mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-21 17:16:16 +08:00
87f253bb47
# Description
Adds **unbounded monitored items per subscription** to the V2
`ManagedSession` subscription engine via automatic, transparent
partitioning. Top-level public API and runtime semantics for callers
that stay under the server's `MaxMonitoredItemsPerSubscription` cap are
unchanged; callers that exceed the cap continue to succeed instead of
failing with `BadTooManyMonitoredItems`.
## Approach (OPC UA Part 4 1.05.07 conformant)
- The public `ISubscription` is now a `LogicalSubscription` that owns
one **primary** and zero-or-more **secondary** `Subscription`
partitions, each a real server-side subscription.
- `CompositeMonitoredItemCollection` aggregates the per-partition
`MonitoredItemCollection` views so `Items`, indexer access, and
enumeration look unsharded to the caller.
- `PartitionPlacementPolicy` decides the target partition at
`TryAddMonitoredItem` time:
- **`StrictAffinity`** — keep items tagged with the same `Affinity`
co-located until the partition fills, then split with a one-time
warning.
- **`BestEffortAffinity`** (default) — prefer co-location but spill
silently when the partition is full.
- No affinity → fall back to the least-loaded partition (or the
primary).
- `PartitionForwardingHandler` proxies notifications from secondary
partitions to the caller's handler with the **primary partition's**
`ISubscription` identity, so handler code never observes the split.
- **Durable subscriptions (Part 4 §5.13.9):** when `SetAsDurableAsync`
runs before any items are added, the wrapper records the intent and
installs an `OnAfterCreateAsync` hook on every existing partition. Each
newly-minted secondary inherits the hook so `SetSubscriptionDurable` is
invoked between `CreateSubscription` and `CreateMonitoredItems` — the
only order the standard allows.
- **Snapshot/restore** preserves the partition layout so reconnect and
failover restore items into the same partition they were created in,
with affinity tags intact.
- Secondary partitions that go idle (no items, no pending
`CreateMonitoredItems`) are deleted to release server resources.
## Performance
Hot-path dispatch goes through the primary partition unchanged for the
unsharded case (single-partition fast path); the forwarding handler only
allocates on the multi-partition path. The performance smoke test in
`Tests/Opc.Ua.Stress.Tests` shows no regression.
## New configuration
```csharp
session.AddSubscription(handler, new SubscriptionOptions
{
MaxMonitoredItemsPerPartition = 5000, // optional cap per server-side subscription
PartitionPlacementPolicy = // optional placement policy
PartitionPlacementPolicy.StrictAffinity
});
sub.TryAddMonitoredItem(
name,
nodeId,
o => o with { Affinity = "machine-A" }, // optional co-location hint
out _);
```
Defaults preserve pre-change behaviour (`MaxMonitoredItemsPerPartition =
uint.MaxValue`, `BestEffortAffinity`).
## New types (Libraries/Opc.Ua.Client/Subscription)
| File | Purpose |
| --- | --- |
| `CompositeMonitoredItemCollection.cs` | Aggregate collection view |
| `ILogicalSubscription.cs` / `IPartitionedSubscription.cs` | Internal
contracts used by tests and infrastructure |
| `LogicalSubscription.cs` | Wrapper that owns the partitions |
| `PartitionForwardingHandler.cs` | Notification proxy |
| `PartitionPlacementPolicy.cs` | Affinity-aware item placement |
Modified: `ISubscriptionNotificationHandler`, `MonitoredItemManager`,
`MonitoredItemOptions` (adds `Affinity`), `Subscription`,
`SubscriptionManager`, `SubscriptionOptions` (adds
`MaxMonitoredItemsPerPartition`, `PartitionPlacementPolicy`),
`SubscriptionManagerSerializer`, `MonitoredItemStateSnapshot`,
`SubscriptionStateSnapshot`, `ManagedSessionExtensions`.
## Documentation
- New: `Docs/UnboundedSubscriptions.md` — feature overview, affinity
semantics, snapshot/durable interaction.
- Cross-links added in `Docs/Sessions.md`, `Docs/MigrationGuide.md`,
`Docs/README.md`.
## Validation
| Suite | Result |
| --- | --- |
| Unit tests for new types — `Opc.Ua.Client.Tests.Subscription.*`
(net10.0 + net48) | **39 / 39** |
| All `Opc.Ua.Client.Subscriptions.*` unit tests (net48) | **152 / 152**
|
| Integration — `Opc.Ua.Subscriptions.Tests.UnboundedSubscriptionTests`
(net10.0 + net48) | **3 / 3** (1 durable-only skipped) |
| Integration — `Opc.Ua.Subscriptions.Durable.Tests.*V2Async` (net10.0)
| **6 / 6** (incl. new `DurableLifetimeAppliesToAllPartitionsV2Async`) |
| Adjacent — `Opc.Ua.Sessions.Tests` (net10.0) | **690 / 690** |
| Adjacent — `Opc.Ua.Subscriptions.Classic.Tests` (net10.0) | **32 /
32** |
| Adjacent — `Opc.Ua.Features.Tests` (net10.0) | **128 / 128** |
| Adjacent — `Opc.Ua.Stress.Tests` (net10.0) | **159 / 159** |
| NativeAOT smoke — `Opc.Ua.Aot.Tests.SubscriptionAotTests` (win-x64) |
**5 / 5** (incl. new `UnboundedSubscriptionWithCapAotAsync`) |
## Compatibility
- **No public type removed**, **no obsoletions added**.
- Public surface on `ISubscription` / `ManagedSession` unchanged.
- New options non-breaking by default (`MaxMonitoredItemsPerPartition =
uint.MaxValue` preserves prior behaviour; `BestEffortAffinity` matches
the closest analogue to the prior single-partition semantics).
- Classic V1 subscription engine unchanged.
## Related Issues
- _No tracking issue filed — please reference the appropriate one if any
exists._
## Security review
Scoped against Microsoft Service Tree
``59eec07a-6f20-42b9-b41b-d20e0a6322da`` (Azure Industrial IoT) using a
combination of the security-agent MCP (code-integrity, secrets-usage,
tls, policy-governance, ai-chat) and the ``security-review`` SAST
sub-agent on the PR diff. Bar: SDL secure-coding for a client library +
OPC UA Part 2 / Part 4 §5.5 / §5.13 spec.
Fixed in commit ``c6997689``:
| # | Sev | Title | Fix |
| --- | --- | --- | --- |
| 1 | CRITICAL | Unbounded partition fan-out under hostile server
(CWE-400/770) | Added ``SubscriptionOptions.MaxPartitionCount`` (default
``32``), enforced in ``PartitionPlacementPolicy``, surfaced as
``PlacementDecision.RejectMaxPartitionCountReached`` |
| 2 | HIGH | Snapshot ``LogicalGroupId`` option-consistency not
validated (CWE-502) | ``ValidateAndSortGroup`` now asserts all snapshots
in a group agree on every subscription-wide option |
| 3 | MEDIUM | Restore-path secondaries bypassed
``PartitionForwardingHandler`` (CWE-362) |
``AttachSecondaryPartitionAsync`` now reuses the wrapper's forwarding
handler when present |
Findings explicitly assessed and dismissed (sub-agent confirmed):
* Affinity-index growth — uses ``StringComparer.Ordinal`` (no
CVE-2022-29117 class); growth is application-controlled, not
attacker-controlled.
* Idle-timer race vs ``DisposeAsync`` — race exists; worst case is a
swallowed ``ObjectDisposedException``. No attacker trigger.
* Cross-wrapper notification routing — each ``Add`` allocates its own
forwarding handler; ``BindLogical`` rejects re-binding; no structural
path for crosstalk.
* OPC UA Part 4 §5.13.6 (``SetTriggering`` cross-partition) — enforced
by ``LogicalSubscription.SetTriggeringAsync``.
* OPC UA Part 4 §5.13.9 (durable hook ordering) — installed uniformly on
every minted partition.
Validation: ``Opc.Ua.Client`` builds clean on net10.0; 43 V2 unit tests
+ 3 unbounded integration tests + 6 V2 durable integration tests all
pass.
## Checklist
- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
210 lines
9.4 KiB
C#
210 lines
9.4 KiB
C#
/* ========================================================================
|
|
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
|
|
*
|
|
* OPC Foundation MIT License 1.00
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person
|
|
* obtaining a copy of this software and associated documentation
|
|
* files (the "Software"), to deal in the Software without
|
|
* restriction, including without limitation the rights to use,
|
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
* copies of the Software, and to permit persons to whom the
|
|
* Software is furnished to do so, subject to the following
|
|
* conditions:
|
|
*
|
|
* The above copyright notice and this permission notice shall be
|
|
* included in all copies or substantial portions of the Software.
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
|
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
|
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
|
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
|
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
|
* OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
* The complete license agreement can be found here:
|
|
* http://opcfoundation.org/License/MIT/1.00/
|
|
* ======================================================================*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Threading;
|
|
using System.Threading.Tasks;
|
|
using Opc.Ua.Client.Subscriptions.MonitoredItems;
|
|
|
|
namespace Opc.Ua.Client.Subscriptions
|
|
{
|
|
/// <summary>
|
|
/// <para>
|
|
/// Data value change observed on a monitored item during the V2
|
|
/// publish dispatch.
|
|
/// </para>
|
|
/// <para>
|
|
/// Lifetime note (pooled notifications): when the V2 subscription
|
|
/// manager has <see cref="ISubscriptionManager.PoolNotifications"/>
|
|
/// enabled, the underlying <c>MonitoredItemNotification</c> that
|
|
/// supplied this struct's fields is recycled back to its
|
|
/// activator pool after the handler returns. This struct's
|
|
/// references (<see cref="Value"/>, <see cref="DiagnosticInfo"/>)
|
|
/// project the inner <c>DataValue</c> / <c>DiagnosticInfo</c>
|
|
/// instances directly — those are not themselves pooled (out of
|
|
/// scope), so a handler may safely copy this struct by value and
|
|
/// continue using <see cref="Value"/> after the call. Pool-aware
|
|
/// projection audit: confirmed safe — no reference to a pooled
|
|
/// instance is surfaced.
|
|
/// </para>
|
|
/// </summary>
|
|
/// <param name="MonitoredItem"></param>
|
|
/// <param name="Value"></param>
|
|
/// <param name="DiagnosticInfo"></param>
|
|
public record struct DataValueChange(IMonitoredItem? MonitoredItem,
|
|
DataValue Value, DiagnosticInfo? DiagnosticInfo)
|
|
{
|
|
/// <summary>
|
|
/// <para>
|
|
/// Server-assigned subscription identifier of the partition
|
|
/// that delivered this notification. For single-partition
|
|
/// logical subscriptions (the default) this matches
|
|
/// <c>ISubscription.ServerId</c> of the subscription the
|
|
/// caller registered. For multi-partition subscriptions —
|
|
/// where the V2 engine has transparently split monitored
|
|
/// items across multiple server-side subscriptions — this
|
|
/// disambiguates the source partition so callers that key
|
|
/// off <c>sequenceNumber</c> in their handler can use the
|
|
/// tuple <c>(PartitionServerId, sequenceNumber)</c> to
|
|
/// correlate across publish responses.
|
|
/// </para>
|
|
/// <para>
|
|
/// <c>0</c> on records minted without partition context (e.g.
|
|
/// test fixtures); production publish dispatch always
|
|
/// populates this with the partition's server id.
|
|
/// </para>
|
|
/// </summary>
|
|
public uint PartitionServerId { get; init; }
|
|
}
|
|
|
|
/// <summary>
|
|
/// <para>
|
|
/// Event notification observed during the V2 publish dispatch.
|
|
/// </para>
|
|
/// <para>
|
|
/// Lifetime note (pooled notifications): when the V2 subscription
|
|
/// manager has <see cref="ISubscriptionManager.PoolNotifications"/>
|
|
/// enabled, the underlying <c>EventFieldList</c> is recycled back
|
|
/// to its activator pool after the handler returns. The
|
|
/// <see cref="Fields"/> property is captured by value as an
|
|
/// <see cref="ArrayOf{T}"/> wrapping the original event-fields
|
|
/// array. Arrays are not pooled in this design (out of scope), so
|
|
/// the captured backing array survives the recycle. Pool-aware
|
|
/// projection audit: confirmed safe — no reference to a pooled
|
|
/// instance is surfaced.
|
|
/// </para>
|
|
/// </summary>
|
|
/// <param name="MonitoredItem"></param>
|
|
/// <param name="Fields"></param>
|
|
public record struct EventNotification(IMonitoredItem? MonitoredItem,
|
|
ArrayOf<Variant> Fields)
|
|
{
|
|
/// <summary>
|
|
/// Server-assigned subscription identifier of the partition
|
|
/// that delivered this notification. See
|
|
/// <see cref="DataValueChange.PartitionServerId"/> for full
|
|
/// semantics — the same disambiguation rules apply to event
|
|
/// notifications.
|
|
/// </summary>
|
|
public uint PartitionServerId { get; init; }
|
|
}
|
|
|
|
/// <summary>
|
|
/// Notification handler
|
|
/// </summary>
|
|
public interface ISubscriptionNotificationHandler
|
|
{
|
|
/// <summary>
|
|
/// Process data change notification
|
|
/// </summary>
|
|
/// <param name="subscription"></param>
|
|
/// <param name="sequenceNumber"></param>
|
|
/// <param name="publishTime"></param>
|
|
/// <param name="notification"></param>
|
|
/// <param name="publishStateMask"></param>
|
|
/// <param name="stringTable"></param>
|
|
/// <returns></returns>
|
|
ValueTask OnDataChangeNotificationAsync(ISubscription subscription,
|
|
uint sequenceNumber, DateTime publishTime,
|
|
ReadOnlyMemory<DataValueChange> notification,
|
|
PublishState publishStateMask, IReadOnlyList<string> stringTable);
|
|
|
|
/// <summary>
|
|
/// Process event notification
|
|
/// </summary>
|
|
/// <param name="subscription"></param>
|
|
/// <param name="sequenceNumber"></param>
|
|
/// <param name="publishTime"></param>
|
|
/// <param name="notification"></param>
|
|
/// <param name="publishStateMask"></param>
|
|
/// <param name="stringTable"></param>
|
|
/// <returns></returns>
|
|
ValueTask OnEventDataNotificationAsync(ISubscription subscription,
|
|
uint sequenceNumber, DateTime publishTime,
|
|
ReadOnlyMemory<EventNotification> notification,
|
|
PublishState publishStateMask, IReadOnlyList<string> stringTable);
|
|
|
|
/// <summary>
|
|
/// Process keep alive notification
|
|
/// </summary>
|
|
/// <param name="subscription"></param>
|
|
/// <param name="sequenceNumber"></param>
|
|
/// <param name="publishTime"></param>
|
|
/// <param name="publishStateMask"></param>
|
|
/// <returns></returns>
|
|
ValueTask OnKeepAliveNotificationAsync(ISubscription subscription,
|
|
uint sequenceNumber, DateTime publishTime,
|
|
PublishState publishStateMask);
|
|
|
|
/// <summary>
|
|
/// Surface a transition in the subscription's lifecycle
|
|
/// (<paramref name="state"/>) or publish-side status
|
|
/// (<paramref name="publishStateMask"/>). Fires from the V2
|
|
/// engine on:
|
|
/// <list type="bullet">
|
|
/// <item><description>Lifecycle transitions —
|
|
/// <see cref="SubscriptionState.Opened"/>,
|
|
/// <see cref="SubscriptionState.Created"/>,
|
|
/// <see cref="SubscriptionState.Modified"/>,
|
|
/// <see cref="SubscriptionState.Deleted"/>.</description></item>
|
|
/// <item><description>Publish-side transitions —
|
|
/// <see cref="PublishState.Republish"/> (a gap was detected and
|
|
/// a republish was issued), <see cref="PublishState.Recovered"/>
|
|
/// (a missing message arrived or publishing resumed after a
|
|
/// stop), <see cref="PublishState.Transferred"/> (the
|
|
/// subscription was taken over on a different session via
|
|
/// <c>TransferSubscriptions</c>).</description></item>
|
|
/// </list>
|
|
/// <para>
|
|
/// Handlers that need derived state (publishing stopped, last
|
|
/// keep-alive, republish-pending, etc.) maintain it themselves
|
|
/// by responding to this callback — V2 is handler-centric and
|
|
/// the engine deliberately does not expose those as polled
|
|
/// properties on <see cref="ISubscription"/>.
|
|
/// </para>
|
|
/// <para>
|
|
/// Per-subscription delivery ordering is guaranteed by the V2
|
|
/// prioritized publish-ack channel: data / event / keep-alive
|
|
/// callbacks for a given subscription always fire in
|
|
/// publish-sequence order. State-change callbacks interleave
|
|
/// with the notification stream at the moment the transition
|
|
/// is observed.
|
|
/// </para>
|
|
/// </summary>
|
|
/// <param name="subscription"></param>
|
|
/// <param name="state"></param>
|
|
/// <param name="publishStateMask"></param>
|
|
/// <param name="ct"></param>
|
|
ValueTask OnSubscriptionStateChangedAsync(ISubscription subscription,
|
|
SubscriptionState state, PublishState publishStateMask,
|
|
CancellationToken ct = default);
|
|
}
|
|
}
|