mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-24 19:13:02 +08:00
Marc SchierandCopilot
bc4c30034d
# Description Fixes four CTT (OPC UA Compliance Test Tool) conformance gaps that the existing NUnit parity suite was silently passing while the CTT JS scripts kept failing: | Issue | Area | Failing CTT script | |---|---|---| | #3719 | Base Info Core Structure 2 | `001.js` | | #3720 | Base Info FiniteStateMachine + StateMachine Instance | `initialize.js` + `001.js` | | #3723 | Security None | `007.js` (DoS, partially used channels) | | #3841 | Alarms & Conditions | Acknowledge Test_003, Alarm Test_002, Confirm Test_001 / Test_003 / Err_004, Enable Test_002, Non-Exclusive Limit Test_002 | Across all four, the underlying pattern was the same — the NUnit parity tests were checking weaker invariants (DataType attribute instead of encoded Variant BuiltInType; `Assert.Ignore` instead of `Assert.Fail`; stub `GetEndpoints` instead of the real DoS scenario; method-call + Read instead of subscribe-and-validate-event-payload). So the suite gave false confidence on changes that would have failed CTT. Each commit below both **strengthens the NUnit parity test** to encode the same invariant CTT verifies, **and** fixes the server/model defect that the strengthened test surfaces. ## Commits ### `a1db2984c` Fix #3719 (BaseInfoCoreStructure) - **Test**: `BaseInfoServerTests.ReadConformanceUnitsAsync` now reads the **value** of `i=24101` and asserts `WrappedValue.TypeInfo.BuiltInType == BuiltInType.QualifiedName` AND `ValueRank == ValueRanks.OneDimension` — not just the DataType attribute. - **Test**: `BaseInformationTests.BrowseRequiresMandatoryMethodsAsync` now `Assert.Fail`s (not `Assert.Ignore`) when an expected mandatory method is missing on `i=15443` / `i=25440`. - **Server**: `Server_ServerCapabilities_ConformanceUnits` initialised with `Array.Empty<QualifiedName>().ToArrayOf()` so the encoded Variant carries QualifiedName type info even when empty. - **Server**: Added `AddSecurityGroup` / `RemoveSecurityGroup` (on `i=15443`) and `AddPushTarget` / `RemovePushTarget` (on `i=25440`) method nodes with input/output argument metadata and in-memory handlers in `Quickstarts.Servers/ReferenceServerConfigurationNodeManager`. ### `86d3041e5` Fix #3723 (Security None DoS off-by-one) - **Server**: Correct off-by-one in `Stack/Opc.Ua.Core/Stack/Tcp/TcpTransportListener.cs` channel eviction: - Condition was `MaxChannelCount == channelCount` (only triggered at exact equality); now `MaxChannelCount > 0 && channelCount >= MaxChannelCount` with a loop that evicts idle channels until the count is below the limit or no more idle channels remain. - **Server**: `UsedBySession` now properly tracks active sessions and clears on `CloseSession` (`TcpServerChannel`, `TcpListenerChannel`). - **Note**: the NUnit reproducer for this issue (`SecurityNoneDosTests`) stays on the `cttunit` branch (PR #3750) because it depends on the `TestFixture.CloseSharedFixtureSessionAsync` helper that only exists in `Tests/Opc.Ua.Conformance.Tests/`. The server fix on this branch is sufficient to make the CTT JS script pass. ### `2c98390c9` Fix #3720 (BaseInfoStateMachine GeneratesEvent) - **Model**: Add `GeneratesEvent` forward reference on `StateMachineType` (i=2299) and `FiniteStateMachineType` (i=2771) → `AuditUpdateStateEventType` (i=2315) in the design XML (`Tools/Opc.Ua.SourceGeneration.Core/Design/StandardTypes.xml`); regenerated `Stack/Opc.Ua.Core/Schema/Opc.Ua.NodeSet2.xml`. - **Server**: Remove the runtime workaround in `DiagnosticsNodeManager` that previously injected this reference at load time — now redundant because the reference ships in the NodeSet at compile time. - **Test**: New `BaseInfoStateMachineInstanceTests.StateMachineTypeHasGeneratesEventReferenceAsync` walks the type hierarchy looking for `GeneratesEvent` with `IncludeSubtypes=true` and asserts the target resolves to a `BaseEventType` subtype (matches the CTT walk). - Per OPC UA Part 16 §4.4.5 / Part 5 §6.4.2. ### `09f551449` Strengthen A&C conformance event tests (#3841) - **Test fixture**: New `AlarmEventCollector` (476 LOC) — subscribes to events on `i=Server` with a full A&C event filter (`Comment`, `Retain`, transition times, all condition-state Ids); per-condition event log; `WaitForEventAsync(conditionId, predicate, timeout)` for synchronisation. Uses async `IAsyncDisposable` cleanup. - **Tests rewritten** to subscribe to events and validate event payload (`Comment.Text`, `Retain`, `TransitionTime`): - `Acknowledge Test_003` — empty comment + locale propagates to event payload; `Retain=false` afterwards - `Alarm Test_002` — full `ActiveState` cycle Active → Normal with Acknowledge + Confirm; every transition event validated - `Confirm Test_001` — unique comment reaches event payload; `ConfirmedState/Id=true` - `Confirm Test_003` — Acknowledge → wait event → Confirm with empty comment - `Confirm Err_004` — **two concurrent sessions**; second Confirm asserts specifically `BadConditionBranchAlreadyConfirmed` (not a generic `BadInvalidState`) - `Enable Test_002` — Disable + Enable via both type method and discovered instance method; NO events during disabled period; `TransitionTime` within call window; `Retain` flips - `Non-Exclusive Limit Test_002` — mirror for `NonExclusiveLimitAlarmType` - **Server fixes** in `Stack/Opc.Ua.Core.Types/State/AcknowledgeableConditionState.cs`, `Quickstarts.Servers/Alarms/AlarmHolders/*`, and `AlarmNodeManager` for: Comment propagation, Retain clearing, TransitionTime updates, and a dedicated ack-only condition instance (`AcknowledgeableConditionHolder`). ## Verification - `dotnet build UA.slnx` — **0 errors**, 42 pre-existing warnings. - `dotnet test Tests/Opc.Ua.InformationModel.Tests` filtered for the new + master `StateMachineGeneratesEvent` / `BaseInfoServer` / `BaseInformation` tests — **6/6 pass**. - `dotnet test Tests/Opc.Ua.History.Tests --filter AlarmsAndConditions` — **141/144 pass**; the 3 occasional failures in `DisableEnableViaTypeAndInstanceMethodNoEventsDuringDisabledAsync` pass when re-run in isolation, consistent with the known A&C suite CI flakiness pattern. ## Related Issues - Fixes #3719 - Fixes #3720 - Fixes #3723 - Fixes #3841 Related: PR #3750 (`cttunit`) carries the same fixes plus the conformance-test-project versions of the strengthened NUnit tests. Either this PR or that one will land first; the other should be rebased afterwards. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
OPC UA .NET Stack
Overview
This OPC UA reference implementation targets .NET Framework, .NET, and .NET Standard 2.1.
.NET allows to develop apps that run on all common platforms available today, including Linux, iOS, Android (via Xamarin) and Windows without requiring platform-specific modifications.
One of the reference implementations inside this project has been certified for compliance through an OPC Foundation Certification Test Lab to prove its high quality. Fixes and enhancements since the certification process have been tested and verified for compliance using the latest Compliance Test Tool (CTT).
For a comprehensive list of supported OPC UA Profiles and Facets, see the dedicated documentation.
More samples based on the official Nuget packages can be found in the OPC UA .NET Samples repository. For development there is also a preview Nuget feed available. For local testing a Docker container of the Reference Server is available for preview and release builds.
Features included
Core and Libraries
- Fully ported Core OPC UA Stack and Libraries (Client, Server, Configuration, Complex Types & GDS assemblies).
- Reference sample Server and Client.
- X.509 Certificate support for client and server authentication.
- SHA-2 support (up to SHA512) including security profile Basic256Sha256, Aes128Sha256RsaOaep and Aes256Sha256RsaPss for configurations with high security needs.
- ECC Security policies ECC_nistP256, ECC_nistP384, ECC_brainpoolP256r1 and ECC_brainpoolP384r1.
- Anonymous, username and X.509 certificate user authentication.
- UA-TCP & HTTPS transports (client and server).
- Reverse Connect for the UA-TCP transport (client and server).
- Folder & OS-level (X509Store) Certificate Stores with Global Discovery Server and Server Push support.
- Sessions and (durable) Subscriptions.
- A PubSub library with samples.
New in 2.0
- Type safe built in types
- Source generator generated code behind during build
- See MigrationGuide for details.
- New AsyncCustomNodeManager (successor of CustomNodeManager2) with improved Locking Strategy, see Server Async (TAP) Support
- In our Load Test the Server shows at least 2.5x higher throughput under load with 750 subscriptions totaling 450k Monitored items and write times for 600 items below 5 seconds were before > 10 seconds were needed. Also for event at least 3x faster event reporting was observed.
- Unified Dependency Injection surface —
services.AddOpcUa()with fluentAddServer()/AddClient()/AddComplexTypes()/AddAlarms()/AddGdsServer()/AddLdsServer()/AddWotConServer()extensions forMicrosoft.Extensions.DependencyInjectionand the .NET Generic Host (AOT compatible via theAction<TOptions>overloads).
New in 1.05.378
- Support for AsyncNodeManagers in the Server Library, see Server Async (TAP) Support
- Reworked Observability via
ITelemetryContextin preparation for better DI support. See documentation for breaking changes. - Fully async APIs. Deprecated all sync and APM API.
New in 1.05.376
- Support for Durable Subscriptions
New in 1.05.375
- Support for ECC Certificates.
New in 1.05.374
- CRL Support for the X509Store on Windows
New in 1.05.373
- 1.05 Nodeset
- Support for WellKnownRoles & RoleBasedUserManagement.
Key Features and Updates in OPC UA 1.05
- Thread Safety and Locking: Improved thread safety and reduced locking in secure channel operations.
- Audit and Redaction: New interfaces for auditing and redacting sensitive information.
- Security Enhancements: Improved encryption and authentication mechanisms.
- CRL Support: Added Certificate Revocation List support for X509Store on Windows.
- Performance Improvements: Faster binary encoding and decoding, reducing memory usage and latency.
- Role-Based Management: Support for WellKnownRoles and RoleBasedUserManagement WellKnownRoles & RoleBasedUserManagement.
- Improved Logging: Enhanced logging with
ILoggerandEventSource. - ECC Profiles: Support for NIST & Brainpool Security Profiles.
- Durable Subscriptions: Support for Durable Subscriptions Durable Subscriptions.
New in 1.04.368
- Improved support for Logging with
ILoggerandEventSource. - Support for custom certificate stores with refactored
ICertificateStoreandCertificateStoreTypeinterface. - Client and Server support for TransferSubscriptions.
- How to use Container support with reference server.
Samples and Nuget packages
- OPC UA Console Reference Server for .NET. A Linux Container of the latest builds is available. See also Container support.
- The OPC UA Reference Server has been certified for compliance through an OPC Foundation Certification Test Lab. Fixes and enhancements since the certification process have been tested and verified for compliance using the Compliance Test Tool (CTT). All releases are verified for compliance with the latest official Compliance Test Tool by the maintainers.
- OPC UA Console Reference Publisher and Console Reference Subscriber for .NET and .NET Framework.
- An official OPC UA Nuget package of the core, client, server and configuration libraries is available for integration in .NET projects. Note: The package has been split into Core, Client and Server packages to reduce the dependencies in projects where only client or server is needed. The https binding is now a seperate optional package.
- A preview Nuget feed is available from Azure Devops.
Getting Started
All the tools you need to build .NET libraries and application come with the .NET SDK. You need the .net 10 SDK to build the project. To run applications you need one of the target .NET runtimes installed. See Get started with .NET for what you need.
How to build and run the reference samples in Visual Studio on Windows
- Open the
UA.slnxsolution file using Visual Studio 2026. Ensure you have all target frameworks enabled, including .NET 4.8.x, .NET 8.0, 9.0, and 10.0 (LTS) but Visual Studio will prompt you to install what is missing. - Choose a project in the Solution Explorer and set it with a right click as
Startup Project. - Hit
F5to build and execute the sample.
How to build and run the console samples on Windows, Linux and iOS
This section describes how to run the ConsoleReferenceServer sample application.
Please follow instructions in this article to setup the .NET 10 SDK which provides the dotnet command that allows you to build and run the samples on your platform. Once the dotnet command is available, navigate to the root folder in your local copy of the repository and execute dotnet restore 'UA.slnx'. This command calls into NuGet to restore the tree of dependencies.
Start the server
- Open a command prompt.
- Navigate to the folder Applications/ConsoleReferenceServer.
- To run the server sample type
dotnet run --project ConsoleReferenceServer.csproj -a.- The server is now running and waiting for connections.
Contributing
We strongly encourage community participation and contribution to this project. First, please fork the repository and commit your changes there. Once happy with your changes you can generate a 'pull request'.
You must agree to the contributor license agreement (CLA) before we can accept your changes. The CLA and "I AGREE" button is automatically displayed when you perform the pull request.
Remarks
Self signed certificates for the sample applications
All required application certificates for OPC UA are created at the first start of each application in a directory or OS-level certificate store and remain in use until deleted from the store. Please read Certificates for more information about certificates and stores
Local Discovery Server
By default all sample applications are configured to register with a Local Discovery Server (LDS). A reference implementation of a LDS for Windows can be downloaded here. To setup trust with the LDS the certificates need to be exchanged or registration will fail.