- Chunk count one compare is incorrect
- Instead of a static configuration calculate the chunk count limits dynamically, as changing buffer size in the negotiation was not taken into account and could lead to reduced message size.
- Remove the static chunk count calculation.
- set `KeepAliveTimeout` default back to 5s, was unintentionally set to 50s in 368 release
- fix a bug that duplicate subscriptions were created after reconnect when transfer succeeds.
- add a property to enable subscription transfer in reconnect, set `Session.TransferSubscriptionsOnReconnect=true` to enable, IOP issues may not allow to use it with some servers.
- add a `SessionReconnectHandler(true)` constructor to support reconnect abort, if the connection recovers before reconnect timer called. If the new constructor is used, its a breaking change: Needs check of `Session` property in Reconnect handler callback, if aborted `Session==null`.
- Reduce warning log output if server timestamp > client time.
- Add handling when subscriptions can not be transferred, e.g. when false user credentials or no security prevent transfer.
- Improve the reconnect timer handling by using `OperationLimit` in reconnect.
- Add sample for `SessionReconnectHandler` in console client.
- Seperate session sample code from `UAClient`.
- Tested on popular demo servers of various SDK vendors.
- Fix Winforms ref client
* Added default values DefaultRequestMaxChunkCount and DefaultResponseMaxChunkCount
* The negotiated Request and Response MaxChunkCount values are checked when building a chunked message.
- Certificates should compare X500DistinguishedName with binary ASN.1 compare
- Other compares should follow ordinal and not resort DN entries
- Fix all related issues to pass tests, e.g. GDS certificates accepted with reversed Subject, cert validation
- Add defensive checks in cert validation
Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@softing.com>
The OPC Foundation Technical Control Board on March 30th decided on the following changes with regard to the license information in the published Nuget packages:
• Replace the “Redistributables” license for OPC UA Nuget packages with the Dual License.
• Change the dual license in the source files so that “members” are replaced with “corporate members”. (see #1763)
Effectively,
- Nuget packages from libraries provided as samples which only build from source code which is covered by a MIT license, are the directly tagged with the MIT license.
- Nuget packages which build from source code where the headers imply the dual license applies, are tagged with the Dual License 'LICENSE.txt' found in the repository root.
Headers incorrectly state that the RCL applies to members, however the OPC Source Deliverables license states RCL is applicable only to corporate members.
The OPC Foundation Technical Control Board on March 30th decided on the following changes with regard of the license headers:
• Change the dual license in the source files so that “members” are replaced with “corporate members”.
Co-authored-by: Suciu Mircea Adrian <Mircea-Adrian.Suciu@softing.com>
- Only an issue if the configuration does not specify the security policy uri for anonymous token
- If the config does not specify the security policy, for anonymous user token the security profile Basic256Sha256 was chosen.
- This setting requires for the client to trust the server certificate if it tries to connect with security None, may cause IOP issues when no security is chosen and encryption is required for the anonymous user token.
* Fixed session recreate TransferSubscriptions bug.
1. When session is recreated and there is no subscription is needed to transfer, it will throw Exception - BadNothingToDo. After adding check the subscriptions count, it won't try to subscribe non-existing subscriptions.
2. When session is recreated and there are subscriptions are needed to transer, it transferred wrong subscriptions. It should transfer old subscriptions in old session, but current code transfer new subscriptions in new session to new session - which will always throw Exception - "A subscription can not be transferred due to missing transfer Id"
* Log update and TransferSubscriptions update.
fixes#1733 and #1734
A new unit test which will currently fail, due to incorrect treatment of node ids with numeric identifier 0 in the namespace with index 0. ( "NodeId nodeId = new NodeId (0,0)." ).
Of course such a node id is invalid. It seems to be present, however, in some PLCs under certain situations. We encountered such node ids in the context of a customer ticket. The node ids were read into instance of type "DataValue" using the read service call. The evaluation of the read result then failed due to comparisons like the ones in the unit test.
fixes#1610
- Doc, docs, docs updates for new 368 support
- fix a missing null pointer check when ConditionRefresh is run
- Ref server: move NodeManager factory API to StandardServer, decoupling the NodeManager implementation from Ref server
- Ref server: add shadow mode flag, to allow to map a docker configuration in a mapped folder.
- Ref server: sample batch files how to run Github CR and local docker images
- Improve some misleading 'delete application certificate' log messages.
* Bump System.Io.Pipelines from 6.0.1 to 6.0.2
* Fix the fast PR build
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Martin Regen <mregen@microsoft.com>
* Bump coverlet.collector from 3.1.0 to 3.1.2
* Add fast path for PR in this repo. Forks still use the long path.
Co-authored-by: Martin Regen <mregen@microsoft.com>
- Fixed issue: After transfer, available sequence numbers were not properly ack/republished.
- Fixed issue: After transfer, race condition could delete subscription before transfer finished.
- Fixed issue: After reload of a subscription, duplicate client handles may have been used.
- Add tests which emulate the disconnection of a client/server, then transfers
- Add subscription variable to select if missing publish requests are just acknoledged (default) or republished after transfer completes. Set `Subscription.RepublishAfterTransfer` to `true`.
- Improve test framework to allow for testing against external servers using a .runsettings file
- improve publish request logging, by moving calls into `CoreClientUtils.EventLog`
- disable available sequence numbers check, it causes false negatives when many subscriptions are active
- Provide the CTT configuration used for 1.4.9.398: Added tests with arrays except Variant
- Match the Reference server config for CTT run (Console Server was used, others tbd)
- add a few cases in ref server node manager to enable skipped tests
- preset random generators to create deterministic node data
CTT fixes:
- Trigger: fix a regression introduced with the TransferSubscription support, Trigger stopped working, revert change to remove LinkedList in MonitoredItems
- return BadDataEncodingUnsupported creating MonitoredItems
- ensure that MonitoredItem node data reported as required by CTT after initial reading, transfer and SetMonitoring
note: not yet 100% passy, a few uncritical failing tests are still under investigation
Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@softing.com>
- use case: specify the same endpoint protocol with two ports. The returned array contains too many entries, because now the policyId in the UserTokenpolicies was fixed and no more duplicates were detected.
- Implement client and server side of Transfersubscription service calls.
- New Transcription service has been tested with CTT 1.04.9.398
- Unit tests for native service calls and client SDK
- Client implements multiple ways to transfer sessions:
- Client saves subscriptions to xml stream, restarts, loads subscriptions from stream and transfers on server.
- Client creates a new sessions and transfers into new session, while the old session is still active.
- Client closes old session with `DeleteSubscriptionsOnClose = false`, creates new session and transfers subscriptions to new session.
- `SessionReconnectHandler` tries to transfer subscription before recreating the subscriptions.
- breaking change: INodeManager got a new TransferMonitoredItems method
Co-authored-by: Alexander Koepke <alexander.koepke@microsoft.com>
Co-authored-by: Peter Bryntesson <pbrynt@microsoft.com>
* remove the SetDurableSubscription method, to skip the test cases
* DeleteSubscription returns BadSubscriptionIdInvalid
* MethodState return also BadTooManyArguments
* return AttributeIdInvalid for null attributes (fix UA Expert display)
* fix ToString of Variant array of ByteString
* fix Variant decoding 1-dim array of bytestring
Implement a mechanism to create Alarm Branches, store them, allow AddComment, Acknowledge, and Confirm them.
Updates the Retain flag automatically.
Cleans up branches on Ack/Confirm
Allows servers to retrieve branches to clear them all if necessary.
- integrate 'LoadPrivateKey' in the interface to allow to implement cert stores which require a passcode to load/store certificates
Change of behavior:
- Introduce a 'NoPrivateKeys' flag to reduce the risk of leaking a private key to a unsecure store.
- CertificateStoreIdentifier opens 'NoPrivateKey' stores
- CertificateTrustList opens 'NoPrivateKey' stores
- CertificateIdentifier opens store with private keys for application or GDS authority certificates
- CertificateTrustList reuses a store if it is not disposed. A user can just close the store to keep the list of certificates in memory.
- DirectoryStore `Load` does not read private keys anymore, only file names for delete. Reading all private keys caused false errors, e.g. here: #1670
Co-authored-by: mheege-abb <marcus.heege@de.abb.com>
Co-authored-by: mheege-abb <85437567+mheege-abb@users.noreply.github.com>
- In windows container this non deterministic error can occur:
`[WindowsCryptographicException] The specified network password is not correct.`
even if the private key was saved with empty password.
- Fix: After a delayed retry the private key can be loaded successfully.
- fixes#1670
- see also https://github.com/OPCFoundation/UA-.NETStandard/commit/ae9ecac2be6b2f9ed6c639eb60205896c27791e0 for 367 milestone
- The missing fix in https://github.com/OPCFoundation/UA-.NETStandard/commit/6747b471920ce165b59411d37c227e08d49dd047 for the bouncy castle certificate builder which was used in .NET Core 2.1 (eol) and .NET 4.6.2, unnoticed in the tests because windows only uses the keyId to validate the chain.
- AuthorityKeyIdentifier in the SubCA contains the SubjectName of the Issuer instead of the IssuerName. Also an application certificate that is signed by a SubCA would contain the false information.
- The false information has no effect on Windows and macOS, however on linux OpenSSL tests all fields and a chain cannot be fully validated.
* Removed assigning a default value to any variable value in the AddReverseReferences method.
Set the default value of the StatusCode on BaseVariableState to BadWaitingForInitialData.
* Allow initalization from variable states with status code BadWaitingForInitialData
The current SDK supports only Windows and Directory certificate stores. For security reasons, it can be necessary to use custom certificate stores.
* Add support for custom certificate stores
* Certificate Store Type UnitTests
* Start cleanup of ICertificateStore interface in the CRL section (Co-authored-by: Martin Regen <mregen@microsoft.com>)
Martin Regen