romanett
359abe68be
## Proposed changes Fixes #4729 on master378 (1.5.378.x), the branch the issue was reported against. The master counterpart is #4736. If a server is stopped while requests are queued, a request could be completed twice. The second completion landed on a `ServiceResponsePooledValueTaskSource` that had already gone back to the process-wide pool and been rented by another request. That request, possibly on another server in the same process, then received a foreign response, which showed up as `InvalidCastException` or `BadSecurityChecksFailed`. ### Changes - **Leased completion (root defense, same as #4736):** each rental of the pooled source gets a lease number. `EndpointIncomingRequest` captures it at construction and completes through `TrySetResult(lease, response)`, a single CAS on the pending lease. Only the first completion of the current rental is accepted, and a late completion can never reach the next owner. - **`ServerBase.RequestQueue`:** - `Dispose` drains the queue with `TryDequeue` instead of completing a `ToList()` snapshot. Each request is now removed by exactly one party, either a worker or `Dispose`. This replaces the `m_queue.Clear()` that only compiled under `NETSTANDARD2_1_OR_GREATER`. - The stop flag is now an `int`. `Dispose` sets it with `Interlocked.Exchange`, which is a full fence, and is now idempotent. - `ScheduleIncomingRequest` re-checks the stop flag after enqueuing and drains the queue instead of letting `ObjectDisposedException` from `Release()` escape. Previously that exception made `ProcessAsync` complete the already-queued request a second time. - A worker that dequeues a request after stop completes it with `BadServerHalted` instead of running it. Workers also treat a disposed semaphore as shutdown. - Completions from the queue go through a helper that catches and logs exceptions. ## Tests - `RequestQueueShutdownTests.DisposeCompletesQueuedRequestsOnceAsync`: fails on the current master378 (a request is completed twice) and passes with the fix. - `RequestQueueShutdownTests.ScheduleAfterDisposeCompletesOnce`. - `RequestQueueShutdownTests.ConcurrentScheduleAndDisposeCompletesEachRequestOnceAsync`: a stress guard. It did not reproduce the old bug locally. - `ServiceResponsePooledValueTaskSourceTests`: a duplicate completion is ignored, and a stale completion after the source is recycled does not complete the next rental. - Local net10.0 runs: `Opc.Ua.Core.Tests` Stack.* 1496 passed, 0 failed; `Opc.Ua.Server.Tests` 513 passed, 0 failed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
OPC UA .NET Stack
Overview
This OPC UA reference implementation targets .NET Framework, .NET, and .NET Standard 2.1.
.NET allows to develop apps that run on all common platforms available today, including Linux, iOS, Android (via Xamarin) and Windows without requiring platform-specific modifications.
One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).
For a comprehensive list of supported OPC UA Profiles and Facets, see the dedicated documentation.
More samples based on the official Nuget packages can be found in the OPC UA .NET Samples repository. For development there is also a preview Nuget feed available. For local testing a Docker container of the Reference Server is available for preview and release builds.
Features included
Core and Libraries
- Fully ported Core OPC UA Stack and Libraries (Client, Server, Configuration, Complex Types & GDS assemblies).
- Reference sample Server and Client.
- X.509 Certificate support for client and server authentication.
- SHA-2 support (up to SHA512) including security profile Basic256Sha256, Aes128Sha256RsaOaep and Aes256Sha256RsaPss for configurations with high security needs.
- ECC Security policies ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1.
- Anonymous, username and X.509 certificate user authentication.
- UA-TCP & HTTPS transports (client and server).
- Reverse Connect for the UA-TCP transport (client and server).
- Folder & OS-level (X509Store) Certificate Stores with Global Discovery Server and Server Push support.
- Sessions and (durable) Subscriptions.
- A PubSub library with samples.
Key Features and Updates in OPC UA 1.05
- Security Enhancements: Improved encryption and authentication mechanisms.
- CRL Support: Added Certificate Revocation List support for X509Store on Windows.
- Performance Improvements: Faster binary encoding and decoding, reducing memory usage and latency.
- Role-Based Management: Support for WellKnownRoles and RoleBasedUserManagement WellKnownRoles & RoleBasedUserManagement.
- Improved Logging: Enhanced logging with
ILoggerandEventSource. - ECC Profiles: Support for NIST & Brainpool Security Profiles.
- Durable Subscriptions: Support for Durable Subscriptions Durable Subscriptions.
Breaking Changes and Heads-Up when upgrading from 1.04 to 1.05
- A few features are still missing to fully comply for 1.05, but certification for V1.04 is still possible with the 1.05 release.
- Thread Safety and Locking: Improved thread safety and reduced locking in secure channel operations.
- Audit and Redaction: New interfaces for auditing and redacting sensitive information.
New in 1.05.378.
- Support for AsyncNodeManagers in the Server Library, see Server Async (TAP) Support
- Reworked Observability via
ITelemetryContextin preparation for better DI support. See documentation for breaking changes.
New in 1.05.376.
- Support for Durable Subscriptions
New in 1.05.375
- Support for ECC Certificates.
New in 1.05.374.70
- CRL Support for the X509Store on Windows
New in 1.05.373
- 1.05 Nodeset
- Support for WellKnownRoles & RoleBasedUserManagement.
New in 1.04.368
- Improved support for Logging with
ILoggerandEventSource. - Support for custom certificate stores with refactored
ICertificateStoreandCertificateStoreTypeinterface. - Client and Server support for TransferSubscriptions.
- How to use Container support with reference server.
Samples and Nuget packages
- OPC UA Console Reference Server for .NET. A Linux Container of the latest builds is available. See also Container support.
- The OPC UA Reference Server has been certified for compliance through an OPC Foundation Certification Test Lab. Fixes and enhancements since the certification process have been tested and verified for compliance using the Compliance Test Tool (CTT). All releases are verified for compliance with the latest official Compliance Test Tool by the maintainers.
- OPC UA Console Reference Publisher and Console Reference Subscriber for .NET and .NET Framework.
- An official OPC UA Nuget package of the core, client, server and configuration libraries is available for integration in .NET projects. Note: The package has been split into Core, Client and Server packages to reduce the dependencies in projects where only client or server is needed. The https binding is now a seperate optional package.
- A preview Nuget feed is available from Azure Devops.
Getting Started
All the tools you need to build .NET libraries and application come with the .NET SDK. You need the .net 10 SDK to build the project. To run applications you need one of the target .NET runtimes installed. See Get started with .NET for what you need.
How to build and run the reference samples in Visual Studio on Windows
- Open the
UA.slnxsolution file using Visual Studio 2026. Ensure you have all target frameworks enabled, including .NET 4.8.x, .NET 8.0, 9.0, and 10.0 (LTS) but Visual Studio will prompt you to install what is missing. - Choose a project in the Solution Explorer and set it with a right click as
Startup Project. - Hit
F5to build and execute the sample.
How to build and run the console samples on Windows, Linux and iOS
This section describes how to run the ConsoleReferenceServer sample application.
Please follow instructions in this article to setup the .NET 10 SDK which provides the dotnet command that allows you to build and run the samples on your platform. Once the dotnet command is available, navigate to the root folder in your local copy of the repository and execute dotnet restore 'UA.slnx'. This command calls into NuGet to restore the tree of dependencies.
Start the server
- Open a command prompt.
- Navigate to the folder Applications/ConsoleReferenceServer.
- To run the server sample type
dotnet run --project ConsoleReferenceServer.csproj -a.- The server is now running and waiting for connections.
Contributing
We strongly encourage community participation and contribution to this project. First, please fork the repository and commit your changes there. Once happy with your changes you can generate a 'pull request'.
You must agree to the contributor license agreement (CLA) before we can accept your changes. The CLA and "I AGREE" button is automatically displayed when you perform the pull request.
Remarks
Self signed certificates for the sample applications
All required application certificates for OPC UA are created at the first start of each application in a directory or OS-level certificate store and remain in use until deleted from the store. Please read Certificates for more information about certificates and stores
Local Discovery Server
By default all sample applications are configured to register with a Local Discovery Server (LDS). A reference implementation of a LDS for Windows can be downloaded here. To setup trust with the LDS the certificates need to be exchanged or registration will fail.