Files
Marc Schier f358078b1c [Client] Central channel manager: ref-counted shared channels, coalesced reconnect, IRetryBudget (#3288) (#3852)
# Description

Introduces a central `IClientChannelManager` that owns client-side
transport channels with reference counting, sharing, coalesced
reconnect, and asynchronous participant notification. Sessions,
discovery clients, and registration clients targeting the same
`ConfiguredEndpoint` (with the same reverse-connect identity) now share
a single underlying `ITransportChannel`; reconnect is transparent to
callers; and the previous `AttachChannel`/`DetachChannel` +
`SessionReconnectHandler` patterns are obsoleted.

## What lands

### Core types (`Stack/Opc.Ua.Core/Stack/Client/`)

- `ManagedChannelKey`, `ChannelState`, `ChannelStateChange`,
`ParticipantReconnectResult`
- `IReconnectParticipant`, `IManagedTransportChannel`,
`IClientChannelManager`
- `IChannelReconnectPolicy` + `ExponentialBackoffChannelReconnectPolicy`
(default mirrors historical `SessionReconnectHandler`: 500 ms → 30 s
exponential)
- `IRetryBudget` + `RetryBudget` — shared retry deadline so the
two-level retry no longer compounds multiplicatively
- `ClientChannelManager` — single non-partial sealed class with
SOLID-extracted internal types under
`Stack/Opc.Ua.Core/Stack/Client/Channels/Internal/`: `ChannelEntry`
(behind `IChannelEntryHost`), `ManagedTransportChannelLease`,
`ClientChannel`, `ClientChannelManagerMetrics` (IMeter),
`ClientChannelManagerCertRotation` (auto `ReconnectAllAsync` on
`CertificateManager` rotation), `ClientChannelManagerDiagnostics`
(ActivitySource + EventSource). Refcount, coalesced reconnect, and
transparent faulted-entry recovery via `SwapFaultedEntryAsync` (swaps a
lease's underlying entry on subsequent `ReconnectAsync` when the prior
cycle Faulted/Closed, preserves participant, back-off via policy
`GetDelay(SwapCount)`)

### Three-state lifecycle gate

`Disconnected` → `TransportConnecting` / `TransportReconnecting` →
`TransportConnectedSessionReactivating` → `Ready` (or `Faulted` /
`Closed`). Only `Ready` releases the service-call gate; the manager
bypasses the gate internally for participant `ActivateSession` traffic
during reactivation via an `AsyncLocal` scope.

### Session integration (`Libraries/Opc.Ua.Client/Session/`)

- New `Session.CreateAsync(IClientChannelManager, …)` overload
- `Session` implements `IReconnectParticipant`; reactivation handler
distinguishes `Reactivated` / `RequiresSessionRecreate` /
`TransientFailure` / `FatalForParticipant` / `FatalForChannel`
- `Session.ReconnectAsync(ct)` automatically delegates to the channel
manager when wired
- `Session.RecreateInPlaceAsync` swaps managed-channel leases for
failover-to-different-endpoint via a new atomic
`IClientChannelManager.GetAsync(endpoint, participantFactory, …)`
overload; same-key recreates delegate to manager reconnect;
explicit-channel/connection callers retain legacy behavior
- KA failure routes through
`IClientChannelManager.ReconnectAsync(channel)`

### ManagedSession integration

- `WithChannelManager(...)` builder + ctor param; DI-resolved
automatically
- Two-level retry: channel-mgr handles transparent reconnect; outer
`ConnectionStateMachine` + `IReconnectPolicy` only triggers on terminal
channel `Faulted`. Outer-state churn suppressed during channel-mgr
cycles via `_channelReconnectInProgress` flag wired through
`IManagedTransportChannel.StateChanged`
- New `ManagedSession.ChannelStateChanged` event surfaces transparent
reconnects
- `ConnectionStateChangedEventArgs.UnderlyingChannelState` populated
when outer reconnect was triggered by a channel fault
- Shared `IRetryBudget` propagated so the layers enforce a single
max-total-time

### Discovery / Registration / GDS

Channel-manager-aware `CreateAsync` overloads on `DiscoveryClient`,
`RegistrationClient`, `ServerPushConfigurationClient`,
`LocalDiscoveryServerClient`, `GlobalDiscoveryServerClient`. Each
registers a minimal `IReconnectParticipant`; co-located sessions and
discovery probes targeting the same endpoint share a channel.

### HTTPS transport (`Stack/Opc.Ua.Bindings.Https/`)

- New `IOpcUaHttpClientFactory` abstraction
- HTTPS / OPC-HTTPS channels migrated to `IHttpClientFactory` +
`Microsoft.Extensions.Http.Resilience` (10.6.0; AOT-compatible on net10
via source generators; legacy direct-HTTP path retained for older TFMs /
no-DI consumers)

### DI

`AddOpcUa().AddClient(...)` registers `IClientChannelManager` and the
named HTTPS `HttpClient` + standard resilience handler automatically.
`ManagedSessionBuilder` resolves the manager from DI when present.

### Obsoletions (functional, `[Obsolete]` with guidance)

- `IClientBase.AttachChannel` / `DetachChannel`
- `SessionReconnectHandler`
- `SessionExtensions.ReconnectAsync(connection, ct)` and `(channel, ct)`
legacy overloads

### Tests

- Core: `ClientChannelManagerManagedTests`,
`ClientChannelManagerCertRotationTests`, `RetryBudgetTests`,
`OpcUaHttpClientFactoryTests` — **56 / 56 pass**
- Client: `ManagedSession*Tests` updated; legacy
`SessionReconnectHandlerTests` + `SessionExtensionsTests` preserved with
`#pragma warning disable CS0618` — **129 / 129 pass**
- Sessions integration: `ChannelManagerSharing` / `TransparentReconnect`
/ `SessionLifecycle` / `CertRotation` — **7 pass, 1 skipped**
(`ChannelManagerExhaustionEscalatesAndRecoversWhenServerReturns`
un-`[Ignore]`d and implemented in this PR via `SwapFaultedEntryAsync`;
remaining skip is end-to-end `RequiresSessionRecreate` plumbing —
carry-forward)
- Stress (consolidated `Tests/Opc.Ua.Stress.Tests/Subscriptions/` +
`Channels/`): chaos / contract / soak / lifecycle / leak-accuracy / gap
/ participant-result-aggregation tests merged from the
previously-separate `Opc.Ua.Channels.Stress.Tests` project; nightly run
via `.github/workflows/stress-test.yml`

Builds clean (0 warnings / 0 errors) across all six TFMs: `net472`,
`net48`, `netstandard2.1`, `net8.0`, `net9.0`, `net10.0`.

### Docs

- `Docs/Sessions.md` new § 4 documents the channel manager, three-state
gating, two-level retry with shared `IRetryBudget`, HTTPS resilience
layering
- `Docs/MigrationGuide.md` migration recipes for the four obsoleted API
groups
- `Docs/DependencyInjection.md` channel-manager and HTTPS factory
registration

## Carry-forward (separate PRs)

- End-to-end `ParticipantReconnectResult.RequiresSessionRecreate` →
`Session.RecreateAsync` lifecycle wiring (currently incomplete — flagged
in the 1 remaining skipped integration test)

## Related Issues

- Fixes #3288
- Builds on #3282 (PR that introduced the initial
`ITransportChannelManager` skeleton)

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
*(Channel-manager-specific tests + ManagedSession/client tests verified
across all 6 TFMs; full UA.slnx run is pending CI.)*
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
2026-06-13 16:34:48 +02:00

524 lines
20 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
using Opc.Ua;
using Opc.Ua.Client;
using Opc.Ua.Identity;
using Opc.Ua.Security.Certificates;
namespace Quickstarts
{
/// <summary>
/// OPC UA Client with examples of basic functionality.
/// </summary>
public class UAClient : IUAClient, IDisposable
{
/// <summary>
/// Initializes a new instance of the UAClient class.
/// </summary>
public UAClient(
ApplicationConfiguration configuration,
ITelemetryContext telemetry,
Action<Array, Array>? validateResponse)
: this(
configuration,
null,
telemetry,
validateResponse)
{
}
/// <summary>
/// Initializes a new instance of the UAClient class for reverse connections.
/// </summary>
public UAClient(
ApplicationConfiguration configuration,
ReverseConnectManager? reverseConnectManager,
ITelemetryContext telemetry,
Action<Array, Array>? validateResponse)
{
ValidateResponse = validateResponse;
m_logger = telemetry.CreateLogger<UAClient>();
m_telemetry = telemetry;
m_configuration = configuration;
// Modern global accept hook on ICertificateManager — fires for
// every certificate validation done via this manager.
m_configuration.CertificateManager.AcceptError = AcceptCertificate;
m_reverseConnectManager = reverseConnectManager;
}
/// <inheritdoc/>
public void Dispose()
{
Dispose(true);
GC.SuppressFinalize(this);
}
/// <summary>
/// Overridable Dispose pattern implementation.
/// </summary>
/// <param name="disposing"></param>
protected virtual void Dispose(bool disposing)
{
if (m_disposed)
{
return;
}
if (disposing)
{
m_reconnectHandler?.Dispose();
Session?.Dispose();
m_configuration.CertificateManager.AcceptError = null;
}
m_disposed = true;
}
/// <summary>
/// Action used
/// </summary>
internal Action<Array, Array>? ValidateResponse { get; }
/// <summary>
/// Gets the client session.
/// </summary>
/// <remarks>
/// Initialized to <c>null!</c> as late-init: the value is assigned by
/// <see cref="ConnectAsync"/> before any caller observes it, and is
/// transiently set to <c>null!</c> during reconnect/dispose. The
/// non-nullable type matches the <see cref="IUAClient"/> contract.
/// </remarks>
public ISession Session { get; private set; } = null!;
/// <summary>
/// The session keepalive interval to be used in ms.
/// </summary>
public int KeepAliveInterval { get; set; } = 5000;
/// <summary>
/// The reconnect period to be used in ms.
/// </summary>
public int ReconnectPeriod { get; set; } = 1000;
/// <summary>
/// The reconnect period exponential backoff to be used in ms.
/// </summary>
public int ReconnectPeriodExponentialBackoff { get; set; } = 15000;
/// <summary>
/// The session lifetime.
/// </summary>
public uint SessionLifeTime { get; set; } = 60 * 1000;
/// <summary>
/// The user identity provider to use to connect to the server.
/// </summary>
public IClientIdentityProvider IdentityProvider { get; set; } = new AnonymousIdentityProvider();
/// <summary>
/// Auto accept untrusted certificates.
/// </summary>
public bool AutoAccept { get; set; }
/// <summary>
/// The file to use for log output.
/// </summary>
public string? LogFile { get; set; }
/// <summary>
/// Do a Durable Subscription Transfer
/// </summary>
public async Task<bool> DurableSubscriptionTransferAsync(
string serverUrl,
bool useSecurity = true,
CancellationToken ct = default)
{
bool success = false;
SubscriptionCollection subscriptions = [.. Session.Subscriptions];
// Transiently null between sessions; ConnectAsync rehydrates.
Session = null!;
if (await ConnectAsync(serverUrl, useSecurity, ct).ConfigureAwait(false) &&
subscriptions != null &&
Session != null)
{
Console.WriteLine($"Transferring {subscriptions.Count} subscriptions from old session to new session...");
success = await Session.TransferSubscriptionsAsync(
subscriptions,
true,
ct).ConfigureAwait(false);
if (success)
{
Console.WriteLine("Subscriptions transferred.");
}
}
return success;
}
/// <summary>
/// Creates a session with the UA server
/// </summary>
/// <exception cref="ObjectDisposedException"></exception>
/// <exception cref="ArgumentNullException"><paramref name="serverUrl"/> is <c>null</c>.</exception>
/// <exception cref="ServiceResultException"></exception>
public async Task<bool> ConnectAsync(
string serverUrl,
bool useSecurity = true,
CancellationToken ct = default)
{
if (m_disposed)
{
throw new ObjectDisposedException(nameof(UAClient));
}
if (serverUrl == null)
{
throw new ArgumentNullException(nameof(serverUrl));
}
try
{
if (Session != null && Session.Connected)
{
Console.WriteLine("Session already connected!");
}
else
{
ITransportWaitingConnection? connection = null;
EndpointDescription? endpointDescription = null;
if (m_reverseConnectManager != null)
{
Console.WriteLine($"Waiting for reverse connection to.... {serverUrl}");
do
{
using var cts = new CancellationTokenSource(30_000);
using var linkedCTS = CancellationTokenSource.CreateLinkedTokenSource(
ct,
cts.Token);
connection = await m_reverseConnectManager
.WaitForConnectionAsync(new Uri(serverUrl), null, linkedCTS.Token)
.ConfigureAwait(false) ??
throw new ServiceResultException(
StatusCodes.BadTimeout,
"Waiting for a reverse connection timed out.");
if (endpointDescription == null)
{
Console.WriteLine("Discover reverse connection endpoints....");
endpointDescription = await CoreClientUtils.SelectEndpointAsync(
m_configuration,
connection,
useSecurity,
m_telemetry,
ct
).ConfigureAwait(false);
connection = null;
}
} while (connection == null);
}
else
{
Console.WriteLine($"Connecting to... {serverUrl}");
endpointDescription = await CoreClientUtils.SelectEndpointAsync(
m_configuration,
serverUrl,
useSecurity,
m_telemetry,
ct).ConfigureAwait(false);
}
// Get the endpoint by connecting to server's discovery endpoint.
// Try to find the first endopint with security.
var endpointConfiguration = EndpointConfiguration.Create(m_configuration);
var endpoint = new ConfiguredEndpoint(
null,
endpointDescription!,
endpointConfiguration);
IUserIdentity userIdentity = await CreateUserIdentityAsync(
endpointDescription!,
ct).ConfigureAwait(false);
// Create the session factory. - we could take it as parameter or as member
var sessionFactory = new DefaultSessionFactory(m_telemetry);
// Create the session
ISession session = await sessionFactory
.CreateAsync(
m_configuration,
connection!,
endpoint,
connection == null,
false,
m_configuration.ApplicationName!,
SessionLifeTime,
userIdentity,
default,
ct)
.ConfigureAwait(false);
// Assign the created session
if (session != null && session.Connected)
{
Session = session;
// override keep alive interval
Session.KeepAliveInterval = KeepAliveInterval;
// support transfer
Session.DeleteSubscriptionsOnClose = false;
Session.TransferSubscriptionsOnReconnect = true;
// set up keep alive callback.
Session.KeepAlive += Session_KeepAlive;
// prepare a reconnect handler
m_reconnectHandler = new SessionReconnectHandler(
m_telemetry,
true,
ReconnectPeriodExponentialBackoff);
// Session created successfully.
Console.WriteLine($"New Session Created with SessionName = {Session.SessionName}");
}
}
return true;
}
catch (Exception ex)
{
// Log Error
Console.WriteLine($"Create Session Error : {ex.Message}");
return false;
}
}
private ValueTask<IUserIdentity> CreateUserIdentityAsync(
EndpointDescription endpointDescription,
CancellationToken ct)
{
return IdentityProvider.AcquireIdentityAsync(
endpointDescription,
m_configuration.CreateMessageContext(),
ct);
}
/// <summary>
/// Disconnects the session.
/// </summary>
/// <param name="leaveChannelOpen">Leaves the channel open.</param>
public async Task DisconnectAsync(bool leaveChannelOpen = false, CancellationToken ct = default)
{
try
{
if (Session != null)
{
Console.WriteLine("Disconnecting...");
lock (m_lock)
{
Session.KeepAlive -= Session_KeepAlive;
m_reconnectHandler?.Dispose();
m_reconnectHandler = null;
}
await Session.CloseAsync(!leaveChannelOpen, ct).ConfigureAwait(false);
if (leaveChannelOpen)
{
// detach the channel, so it doesn't get
// closed when the session is disposed.
#pragma warning disable CS0618 // sample legacy path
Session.DetachChannel();
#pragma warning restore CS0618
}
Session.Dispose();
// Transiently null after dispose; matches pre-NRT behavior.
Session = null!;
// Log Session Disconnected event
Console.WriteLine("Session Disconnected.");
}
else
{
Console.WriteLine("Session not created!");
}
}
catch (Exception ex)
{
// Log Error
m_logger.LogError(ex, "Disconnect Error");
}
}
/// <summary>
/// Handles a keep alive event from a session and triggers a reconnect if necessary.
/// </summary>
private void Session_KeepAlive(ISession session, KeepAliveEventArgs e)
{
try
{
// check for events from discarded sessions.
if (Session == null || !Session.Equals(session))
{
return;
}
// start reconnect sequence on communication error.
if (ServiceResult.IsBad(e.Status))
{
if (ReconnectPeriod <= 0)
{
m_logger.LogWarning(
"KeepAlive status {StatusCode}, but reconnect is disabled.",
e.Status);
return;
}
SessionReconnectHandler.ReconnectState state = m_reconnectHandler!
.BeginReconnect(
Session,
m_reverseConnectManager,
ReconnectPeriod,
Client_ReconnectComplete
);
if (state == SessionReconnectHandler.ReconnectState.Triggered)
{
m_logger.LogInformation(
"KeepAlive status {StatusCode}, reconnect status {State}, reconnect period {ReconnectPeriod}ms.",
e.Status,
state,
ReconnectPeriod
);
}
else
{
m_logger.LogInformation(
"KeepAlive status {StatusCode}, reconnect status {State}.",
e.Status,
state);
}
// cancel sending a new keep alive request, because reconnect is triggered.
e.CancelKeepAlive = true;
}
}
catch (Exception exception)
{
m_logger.LogError(exception, "Error in OnKeepAlive.");
}
}
/// <summary>
/// Called when the reconnect attempt was successful.
/// </summary>
private void Client_ReconnectComplete(object? sender, EventArgs e)
{
// ignore callbacks from discarded objects.
if (!ReferenceEquals(sender, m_reconnectHandler))
{
return;
}
lock (m_lock)
{
// if session recovered, Session property is null
if (m_reconnectHandler!.Session != null)
{
// ensure only a new instance is disposed
// after reactivate, the same session instance may be returned
if (!ReferenceEquals(Session, m_reconnectHandler.Session))
{
m_logger.LogInformation(
"--- RECONNECTED TO NEW SESSION --- {SessionId}",
m_reconnectHandler.Session.SessionId
);
ISession session = Session;
Session = m_reconnectHandler.Session;
session?.Dispose();
}
else
{
m_logger.LogInformation(
"--- REACTIVATED SESSION --- {SessionId}",
m_reconnectHandler.Session.SessionId);
}
}
else
{
m_logger.LogInformation("--- RECONNECT KeepAlive recovered ---");
}
}
}
/// <summary>
/// Per-error accept callback invoked by the new
/// <see cref="ICertificateValidatorEx.AcceptError"/> hook every time
/// an untrusted certificate is received from the server. Returns
/// <see langword="true"/> to accept the error, <see langword="false"/>
/// to reject it.
/// </summary>
protected virtual bool AcceptCertificate(Certificate certificate, ServiceResult error)
{
// ****
// Implement a custom logic to decide if the certificate should be
// accepted or not. Return true to accept, false to reject.
// ***
m_logger.LogInformation("{Error}", error);
bool certificateAccepted =
error.StatusCode == StatusCodes.BadCertificateUntrusted && AutoAccept;
if (certificateAccepted)
{
m_logger.LogInformation(
"Untrusted Certificate accepted. Subject = {Subject}",
certificate.Subject);
}
else
{
m_logger.LogInformation(
"Untrusted Certificate rejected. Subject = {Subject}",
certificate.Subject);
}
return certificateAccepted;
}
private readonly Lock m_lock = new();
private readonly ReverseConnectManager? m_reverseConnectManager;
private readonly ApplicationConfiguration m_configuration;
private SessionReconnectHandler? m_reconnectHandler;
private readonly ILogger m_logger;
private readonly ITelemetryContext m_telemetry;
private bool m_disposed;
}
}