f6b27025a6
## Proposed changes Fixes #4857. The stack's log messages wrote network addresses (endpoint, discovery and reverse connect URLs, host names, IP addresses, ports), application and user identities, file paths and exception texts as plain parameters. Applications had no reliable way to keep them out of general-purpose logs. This PR replaces the stack's own redaction mechanism with the standard .NET [data classification and redaction](https://learn.microsoft.com/dotnet/core/extensions/data-redaction) packages. Each sensitive `[LoggerMessage]` parameter is classified. The application decides per classification what reaches its logs: erase it, replace it with an HMAC token so entries stay correlatable, or pass it through. ### Taxonomy `Opc.Ua.Redaction.OpcUaDataClassifications` defines the `OpcUa` taxonomy and one attribute per classification: | Classification | Used for | Parameters | |---|---|---| | `[NetworkAddress]` | URLs, host and domain names, IP/MAC addresses, end points, ports | 120 | | `[ApplicationIdentity]` | certificates, subject, issuer, thumbprint, ApplicationUri | 103 | | `[FilePath]` | file, directory and certificate store paths | 67 | | `[SensitiveText]` | exception or remote-supplied text passed as a parameter | 55 | | `[UserIdentity]` | user names, token subjects | 7 | Correlation ids (`ChannelId`, `SessionId`, ...), status codes and NodeIds stay unclassified. ### Pipeline and defaults - Opc.Ua.Core now references `Microsoft.Extensions.Telemetry(.Abstractions)` 10.11.0, so every project above Core uses the `Microsoft.Gen.Logging` generator. Opc.Ua.Client already did, through Http.Resilience. The packages ship net462 and netstandard2.0 builds, so net48 is supported. - **A plain `ILoggerFactory` logs `(null)` in place of classified values.** Classified values are only written by the redaction-aware logger. - The new `ILoggingBuilder.EnableOpcUaRedaction()` turns that logger on. It is `EnableRedaction()` with the discriminator off; otherwise every unredacted value gets `:ParamName` appended. `AddOpcUa().AddLogging(...)` and `DefaultTelemetry.Create(...)` call it, as do the samples, so they log the same information as before until redactors are registered. - `services.AddOpcUa()` alone does not change the host's logging. Generic-host apps call `builder.Logging.EnableOpcUaRedaction()`. This is documented as a behavior-breaking change in `docs/migrate/2.0.x/telemetry.md`. ### Obsolete API `Redact`, `RedactionWrapper<T>`, `IRedactionStrategy`, `RedactionStrategies` and `SimpleRedactionStrategy` are `[Obsolete]`. They still work, but the stack no longer uses them. ### Not classified - The `Exception` passed to a log call. Applications can drop exception messages with `LoggerEnrichmentOptions.IncludeExceptionMessage`. - Exception and `ServiceResult` message texts. - `ServiceResult`/`StatusCode` parameters and logged data values. - The few log calls whose level is decided at run time. - `Opc.Ua.Vision.OpenUsd`, which references only Opc.Ua.Types and cannot see the attributes. ### Generator behavior differences These are visible to log consumers and to tests: - `IFormattable` values such as `NodeId` are stored in the structured state as invariant strings, not as objects. - The generated log state is a thread-local object that is cleared after the call. - Classified values are pooled redactor objects, valid only during the `Log` call. Tests that inspected log state after the fact now capture it during the call. The shared `RecordingLoggerProvider` snapshots classified values. ## Related Issues - Fixes #4857 ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) - [x] Enhancement (non-breaking change which adds functionality) - [ ] Test enhancement (non-breaking change to increase test coverage) - [x] Breaking change (fix or feature that would cause existing functionality to not work as expected; plain logger factories drop classified values) - [x] Documentation Update (if none of the other choices apply) ## Checklist - [x] I have read the CONTRIBUTING doc. - [x] I have signed the CLA. - [x] I ran tests locally with my changes, all passed. - [x] I fixed all failing tests in the CI pipelines. - [x] I fixed all introduced issues with CodeQL and LGTM. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added necessary documentation (if appropriate). - [ ] Any dependent changes have been merged and published in downstream modules. ## Further comments New tests: - `LogClassificationCoverageTests` (Tools.Tests) scans all 104 stack assemblies and fails if an address, identity or path parameter of a `[LoggerMessage]` method is unclassified. - `DataClassificationLoggingTests` (Core.Tests) pins erasing and HMAC redaction, pass-through, the plain-factory drop, and both stack defaults. Local results on net10.0: | Suite | Passed | Failed | |---|---|---| | Core.Tests | 6,489 | 0 | | Client.Tests | 3,231 | 0 | | Tools.Tests | 7,210 | 0 | | PubSub.Tests | 1,536 | 0 | | Core.Diagnostics.Tests | 571 | 0 | | Configuration.Tests | 241 | 0 | - **Server.Tests:** the full run predates the final test fixes and had 12 failures. All 12 were in the fixtures fixed afterwards, which now pass: RoleStateBinding (45/45) and the FileDirectory and compatibility-logging fixtures (74/74 in total). The full Core.Tests and Server.Tests runs were not repeated after those fixes. - **Builds:** `UA.slnx` builds with 0 errors for net10.0 and net48, and the whitespace check passes. - **NativeAOT:** not confirmed locally, because the machine has no C++ linker. A trimmed publish of `Opc.Ua.Aot.Tests` reported no trim or AOT warnings from the stack, the new packages or the generated logging code; its only errors come from the TUnit test framework (`FSharp.Core` not found). The `aot-test` CI job has to confirm the native build. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
GMS sample pair
GmsServer and GmsClient use the public fluent/DI hosting, generated proxies
and bounded GMS clients. These are simulations, not physical measuring
equipment. There are no measurement-start, job-execution, calibration or
machine-correction commands.
The released model is 1.0.0; its reference document is 1.0.1. The upstream
undefined GMS_ProductionStatisticsType remains an explicit conformance
exception: Annex A.1 makes the released NodeSet normative. Neither sample
claims the complete Production facet.
Run
From the repository root, use separate terminals:
dotnet run --project samples\GMS\GmsServer\GmsServer.csproj -f net10.0 -- `
--advanced --instances 2 --seconds 60 --demo-trust
dotnet run --project samples\GMS\GmsClient\GmsClient.csproj -f net10.0 -- `
--events --characteristic Bore --download --demo-trust
Omit --advanced for mandatory structure and inline results. Optional
equipment, corrections and file-transfer absence are reported explicitly.
The server prints READY only after OPC UA initialization; --port 0 selects
a free port and prints its actual URL. Pass that URL with the client's
--endpoint option.
Certificate trust is required by default. The separate server/client stores
under artifacts\gms-pki are retained for administration; trust each peer's
application certificate in the other application's trusted peer store.
--demo-trust is an explicit acceptance-only exception: the server actually
binds the numeric IPv4 loopback address, the client rejects remote endpoints,
and both retain encryption. The client requires Basic256Sha256
SignAndEncrypt and certificate-domain checks. No credentials are embedded.
The default client is passive. To acknowledge one result only, specify its exact system and result and confirm the state change:
dotnet run --project samples\GMS\GmsClient\GmsClient.csproj -f net10.0 -- `
--system Gms1 --acknowledge Gms1-F-0000 --confirm-acknowledgement --seconds 0 --demo-trust
Acknowledgement does not run a job or change a correction. Sensor warnings are observed, never implicitly acknowledged. Their inputs are actual additional environmental measurements, not primary-probe qualification.
Bounds and cleanup
--help lists every bound. The server runs for at most 120 seconds and owns
one or two independent providers/stores, each limited to 256 results and
8 MiB. Each instance permits one metadata handle and one file transfer.
The client queries at most 16 IDs per instance, preserves raw DataValue
quality/timestamps, bounds every observation by time/count/bytes and releases
its subscriptions. Use --count 32 to capture changing advanced measurements
beyond the initial inventory (the notification cap is 64). Downloads return
bounded ByteString values in memory; no result file is written to disk.
With an advanced local server, add
--system Gms1 --download --verify-cleanup --demo-trust to demonstrate a
missing-result error, file-byte-limit refusal, cancellation after a remote
file read and cancellation after monitored-item creation. A subsequent
download and metadata read verify reuse of the single-handle capacity
without waiting for expiration. Other failures return a nonzero exit code;
the client does not silently retry acknowledgement. Ctrl+C awaits cleanup.
Both projects use AppTargetFrameworks and are nonpackable. NativeAOT is
selected inside each application project only, conditionally for net10:
dotnet publish samples\GMS\GmsServer\GmsServer.csproj -c Release -f net10.0 -r win-x64
dotnet publish samples\GMS\GmsClient\GmsClient.csproj -c Release -f net10.0 -r win-x64
Do not pass a graph-wide PublishAot property. Execute the published
applications with the same options to exercise the real transport.
On Windows, the PowerShell 7 GmsClient\Test-GmsSamplePair.ps1 acceptance harness takes
-ServerExecutable, -ClientExecutable and -EvidenceDirectory.
Use -Advanced -AllChecks for positive, refusal and cancellation checks;
add -AssertNative for published NativeAOT binaries. It verifies the actual
loopback listener, natural exits, subscription/handle reuse and owned PKI
cleanup, and records exact commands, output logs and summary.json.