Releases: OPCFoundation/UA-.NETStandard
OPC UA 1.05 Maintenance Update
Breaking Changes:
Server
- IMonitoredItem Interface extended & used instead of MonitoredItem Class
- New ISession Interface instead of Session Class
- ISesssionManager, ISubscriptionManager, ISubscription & IServerInternal interfaces extended
Core
- ICertificateStore Async Methods now have async suffixes, old names deprecated
- All obsolete Methods removed
Client
- All sync methods are now marked as deprecated
- DataTypeDictionaries moved into the ComplexTypes Package. If the helper methods of the Session were used we recommend to use the complex type system as a replacement that can handle all servers from OPC UA Spec 1.0 - 1.0.05.
- NodeCache now has an async interface (to have access to the ITypeTable interface use the .TypeTree property or AsNodeTable method
ApplicationInstance
- Methods Returning a task have asyny suffixes
GDS Client
- sync apis marked as deprecated
Bug Fixes:
Server
- Fix Subscription Keepalive being sent on first publish
- Handle unsent requests on closed SecureChannel to be sent on new channel of the same session
Client
- Disable Subscription cleanup if subscriptions are being created
- Fix subscription leaking due to not completed PublishResponseMessageWorkerAsync tasks
- Fix subscription leaking due to not completed PublishResponseMessageWorkerAsync tasks
New features:
Server
- Support for async method calls by implementing IAsyncNodeManager interface (see ConfigurationNodeManager for an example usage)
- New Task based Request Queue
- New generated Code with async Method Call handlers & async Service Calls
- New extended CustomNodeManager with support for SamplingGroup Mechanism
GDS Client
- exposes async APIS and marks sync apis as deprecated
Client
- New LRU NodeCache added & used in ComplexType System
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- Update GDS Client to use async Client API and deprecate sync Calls. by @romanett in #3164
- Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3165
- Fix nuget and official build and additional smaller analzyer fixes by @marcschier in #3166
- remove sync client calls from async client tests by @romanett in #3168
- Make GDS Tests use ECC for connection. Update Certificate wait check to use polling mechanism. by @romanett in #3167
- removing strong namer which does not work and fork async add auto and… by @marcschier in #3175
- [Tests] Remove net 462 CI / Add TestContext Logging support for GDS Tests / Fix Tests for netstandard by @romanett in #3170
- Make sync client api obsolete by @marcschier in #3174
- Optimize reflection-based lookups using caches by @marcschier in #3179
- Move newly introduced AsyncNodeTable and AsyncTypeTree interfaces to core by @marcschier in #3182
Full Changelog: 1.5.376.244...1.5.377.21
OPC UA 1.05 Maintenance Update
Breaking Changes:
Server
- IMonitoredItem Interface extended & used instead of MonitoredItem Class
- New ISession Interface instead of Session Class
- ISesssionManager, ISubscriptionManager, ISubscription & IServerInternal interfaces extended
Core
- ICertificateStore Async Methods now have async suffixes, old names deprecated
- All obsolete Methods removed
Client
- All sync methods are now marked as deprecated
- DataTypeDictionaries moved into the ComplexTypes Package. If the helper methods of the Session were used we recommend to use the complex type system as a replacement that can handle all servers from OPC UA Spec 1.0 - 1.0.05.
- NodeCache now has an async interface (to have access to the ITypeTable interface use the .TypeTree property or AsNodeTable method
ApplicationInstance
- Methods Returning a task have asyny suffixes
GDS Client
- sync apis marked as deprecated
Bug Fixes:
Server
- Fix Subscription Keepalive being sent on first publish
- Handle unsent requests on closed SecureChannel to be sent on new channel of the same session
Client
- Disable Subscription cleanup if subscriptions are being created
- Fix subscription leaking due to not completed PublishResponseMessageWorkerAsync tasks
- Fix subscription leaking due to not completed PublishResponseMessageWorkerAsync tasks
New features:
Server
- Support for async method calls by implementing IAsyncNodeManager interface (see ConfigurationNodeManager for an example usage)
- New Task based Request Queue
- New generated Code with async Method Call handlers & async Service Calls
- New extended CustomNodeManager with support for SamplingGroup Mechanism
GDS Client
- exposes async APIS and marks sync apis as deprecated
Client
- New LRU NodeCache added & used in ComplexType System
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- Update GDS Client to use async Client API and deprecate sync Calls. by @romanett in #3164
- Bump actions/checkout from 4 to 5 by @dependabot[bot] in #3165
- Fix nuget and official build and additional smaller analzyer fixes by @marcschier in #3166
- remove sync client calls from async client tests by @romanett in #3168
- Make GDS Tests use ECC for connection. Update Certificate wait check to use polling mechanism. by @romanett in #3167
- removing strong namer which does not work and fork async add auto and… by @marcschier in #3175
- [Tests] Remove net 462 CI / Add TestContext Logging support for GDS Tests / Fix Tests for netstandard by @romanett in #3170
- Make sync client api obsolete by @marcschier in #3174
- Optimize reflection-based lookups using caches by @marcschier in #3179
- Move newly introduced AsyncNodeTable and AsyncTypeTree interfaces to core by @marcschier in #3182
Full Changelog: 1.5.376.244...1.5.377.11-preview
OPC UA 1.05 Maintenance Update
1.05.376 July Release
This release is based on the 1.05.05 Nodeset with generated files from the ModelCompiler.
It contains important bug fixes which were found after the last 1.05.376 release, as well as new features.
Enhancements:
- Enhance enum definition handling and validation.
- Use Central Package Management for Nuget Packages.
New Features:
- Implement Support for PEM Public Keys in Directory Certificate Store.
- Allow to modify sensitivity of KeepAliveStopped on Client.
- Add support for Async Service Calls in the generated files.
Fixes:
- Fix Client removing subscription if publish response is received before createSubscriptionResponse.
- Fix Subscription Diagnostics DataChangeNotificationsCount being calcualted incorrectly.
NET6.0 target removed
- The NET6.0 outdated target has been removed since it is superseded by NET8.0.
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- [Server] Fix Subscription Diagnostics DataChangeNotificationsCount being calcualted incorrectly by @romanett in #3119
- [Client] Fix removal of Subscription if PublishResponse is received before CreateSubscriptionResponse by @romanett in #3120
- Remove net6 / Label Pubsub Package as Release / Update Nuget Packages by @romanett in #3121
- Use Central Package Management for Nuget Packages by @romanett in #3122
- Enhance enum definition handling and validation by @marcschier in #3124
- [Client] Allow to modify sensitivity of KeepAliveStopped by @romanett in #3105
- Implement Support for PEM Public Keys in Directory Certificate Store by @romanett in #3088
- Update for 1.5.5 release with Async Service Calls by @opcfoundation-org in #3116
- Remove net6.0 left-overs. by @mrsuciu in #3130
- Merge master to release/1.5.376 by @mrsuciu in #3131
Full Changelog: 1.5.376.235...1.5.376.244
OPC UA 1.05 Maintenance Update
1.05.376 June Release
It contains important bug fixes which were found after the last 1.05.376 release, as well as a couple of new features.
Enhancements:
- Enhance role permission validation on server.
New Features:
- Allow to define a custom StringComparsion for Equals Operator.
- Implement Support for client requested "mul" locale.
Fixes:
- Fix XML Encoding and decoding of Matrix element to conform to specification.
- Fix closing of shared Transport Channel in Recreate Scenario on client.
- Fix Regression - Sampling Group disposing m_shutdownEvent in Shutdown Method on server.
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- Fix XML Encoding and decoding of Matrix Element in Variant to conform to spec by @romanett in #3053
- Bump Microsoft.Extensions.Logging and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3057
- Bump NUnit.Console and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3058
- Bump Microsoft.Extensions.Configuration and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3060
- Add version System.Diagnostics.DiagnosticSource to match Microsoft.Extensions.Logging.Abstractions version by @mrsuciu in #3061
- [Server] Add Back removed Public QueueEvent(EventFieldList fields) Method to MonitoredItem by @romannet in #3064
- Bump Microsoft.Extensions.Configuration, Microsoft.Extensions.Configuration.EnvironmentVariables and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3066
- Bump Serilog, Serilog.Sinks.File and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3067
- Update to latest nuget packages by @mrsuciu in #3069
- Disable strongname warning for net8.0 and net9.0 for MQTTnet latest unsigned assembly by @mrsuciu in #3073
- [Server] Enhance role permission validation by @romanett in #3047
- [Client] Fix closing of shared Transport Channel in Recreate Scenario / Add missing event Handler to Session Constructor / Call RenewUserIdentity on Session.ReCreate by @romanett in #3055
- Fix XML Encoding of Null Variant to conform to spec by @romanett in #3062
- [Server] [Regression] fix Sampling Group disposing m_shutdownEvent in Shutdown Method. Fix double call of Shutdown Method by @romanett in #3070
- Make RelativePath.Parse throw SRE if NamespaceIndexes cannot be found by @romanett in #3071
Full Changelog: 1.5.376.213...1.5.376.235
OPC UA 1.05 Maintenance Update
1.05.376 April Release
This release is based on the 1.05.04 Nodeset with generated files from the ModelCompiler.
The focus of this release is on the added support for Durable Subscriptions, support for the 1.05.04 Nodeset and bug fixes.
Breaking Changes:
- Updated XML-Encoding / XML-Decoding of Matrix Element in Variant to conform to Specification
- Interface extensions in the Server to support Durable Subscriptions
- A valid CertificateStore Configuration is now enforced on Startup
Potential breaking changes that can affect modelling tools:
- The UANodeSet includes a new optional attribute DesignToolOnly.
New Features:
- 1.05.04 Nodeset Update
- Allow setting a temporary Context for using IEncoders in custom code
- Add Support for Durable Subscriptions by implementing needed persistence code in custom Interfaces. Sample Implementations are present in the console reference Server Docs
Fixes:
- Fix ValueRank for Base Variable State
- UserIdentityToken now uses UTF-8 Encoded byte Array for storing unencrypted PW
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- Bump Microsoft.Extensions.Logging and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3015
- Bump Microsoft.Extensions.Configuration and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3019
- [Server] [Client] Return BadIdentityTokenInvalid if use of anonymous identity token is not allowed by @romanett in #3012
- Enable Durable Subscriptions by @romanett in #2978
- 1.05.04 final release fixes by @opcfoundation-org in #2893
- Bump BouncyCastle.Cryptography and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3034
- Bump Microsoft.Extensions.Logging and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3038
- [Server] Restore durable subscriptions on Server Restart by @romanett in #3025
- Bump Microsoft.Extensions.Configuration and Microsoft.NETFramework.ReferenceAssemblies by @dependabot in #3039
- Enforce Valid Certificate Store configuration by @romanett in #3023
- Make UserIdentityToken internally use byte Array instead of string for storing unencrypted password. by @romanett in #3035
- [Console Reference Server] Implement file based queues for durable Subscriptions by @romanett in #3042
- Set default value for the ValueRank attribute of BaseVariableState and BaseVariableTypeState to ValueRanks.Any as in the specification by @mrsuciu in #3049
- Allow setting the context in a temporary using scope for IEncoder instances by @mrsuciu in #3044
- Update version.json by @mrsuciu in #3050
- Fix XML Encoding and decoding of Matrix Element in Variant to conform… by @romanett in #3054
Full Changelog: 1.5.375.457...1.5.376.213
OPC UA 1.05.375 Maintenance Update
1.05.375 Maintenance Update
This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler.
It contains important bug fixes which were found after the last 1.05.375 ECC release.
Improvements and bug fixes
- Various smaller bug fixes.
- Fix: SecurityToken renewal
- Remove oldest channel if not used by session
- Fix reconnect when ReverseConnection is used
- Add support for SupportsFilteredRetain
- By default set NoDelay and Lingerstate to 5 sec (thanks @sxleixer)
- Fix RegisterWithDiscoveryServer method not using a certificate for the secure channel
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- 733ec5d Merge pull request #3004 from OPCFoundation/master
- 28d2227 Revert "Enable Nullability for important Certificate Handling classes (#2989)" (#3007)
- 38388f1 fix RegisterWithDiscoveryServer method not using a certificate for the secure channel @romanett (#3005)
- ca18c2d Bump System.Diagnostics.DiagnosticSource and Microsoft.NETFramework.ReferenceAssemblies (#3002)
- c75c8a0 By default set NoDelay and Lingerstate to 5 sec @mregen, @sxleixer (#3000) [ #2882 ]
- 37cebe3 [Server] Add support for SupportsFilteredRetain @Archie-Miller (#2913)
- 23d167a Enable Nullability for important Certificate Handling classes @romanett (#2989)
- ba915ac Bump NUnit.Console from 3.19.1 to 3.19.2 (#2980)
- d985747 [Client] Fix reconnect when ReverseConnection is used @JohnJiang26821 (#2985)
- cbf789d Fix a case where NodeId.Null is modified @mregen (#2995)
- 703b52d Make FiniteStateMachine DoTransition virtual @romanett (#2988)
- d540baf Remove oldest channel if not used by session, when number of channels reaches MaxChannelCount - 1 @mrsuciu(#2986)
- 8e408db fix Token renewal @romanett (#2990)
- 1baf420 [Server] Fix Sampling Group creating a new long running task for every Client AddMonitoredItems Method Call @romanett (#2984)
- 7cbeee7 [Test] Add ECC Certificates to various tests @romanett (#2961)
Full Changelog: 1.5.375.443...1.5.375.457
OPC UA 1.05.374 Maintenance Update
1.05.374 Maintenance Release
This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler.
It contains important bug fixes which were found after the last 1.05.374 release and backported from the latest ECC release.
Important bug fixes
- Token renewal on the server side was broken in release .158 and .168, hence requiring a reconnect after ServiceTokenLifetime expired.
- According to requirements of a CTT test not the oldest unused channel was released when the number of channels expired.
- NodeId.Null could be overwritten when an ExtensionObject was deserialized.
- A crash could occur in the server nodemanager when no predefined nodes were initialized.
What's Changed
- 0e5781e Merge pull request #2998 from OPCFoundation/develop/main374
- 73d316c Cherrypicks from main for service update in release 374 [ #2953, #2966, #2984, #2990, #2986, #2988 ]
- 20f5159 Make FiniteStateMachine DoTransition virtual (#2988)
- 989ea83 Remove oldest channel if not used by session, when number of channels reaches MaxChannelCount - 1 (#2986)
- 8b81add fix Token renewal (#2990)
- 3465f20 [Server] Fix Sampling Group creating a new long running task for every Client AddMonitoredItems Method Call (#2984)
- 2cadd9e initialize predefined nodes in constructor (#2966)
- d0c8d9e Set initial value of LastActiveTickCount (#2953)
- 930ba09 Fix a case where NodeId.Null is modified (#2994)
Full Changelog: 1.5.374.168...1.5.374.176
OPC UA 1.05 ECC release
1.05.375 January ECC Release
This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler.
The focus in this release was to add the support for Elliptic Curve Cryptography (ECC) and keep backward compatibility with existing configurations.
Improvements and bug fixes
- Various smaller bug fixes.
- Set corresponding security signature hash and validate ECDSA security signature hash algorithm length for ECC certificates
- Fix: Return full CertificateChain after Certificate Update
- Add ECDSA support for importing private key from PEM
- Allow Subject Name Change of Application Certificate in GDS Push scenario
- Extend ServerConfiguration & GDS Server for ECC
- Simplify SetECDsaPublicKey and padd with leading zeros.
ECC support
- Changes to applications configuration
- Configuration permits specifying multiple application certificate types details
- Backward compatibility with existing configurations - meaning no ECC just RSA encryption support
- Further details can be found here
Known Limitations
Not all curves are supported by all OS platforms and not all .NET implementations offer cryptographic API support for all curve types.
Due to these limitations, the support for ECC profiles is available starting with the following target platforms: .NET 4.8, .NET standard 2.1 and .NET 5 and above.
The supported ECC curve types are the following:
NistP256
for ECC certificates with NIST P256 curveNistP384
for ECC certificates with NIST P384 curveBrainpoolP256r1
for ECC certificates with Brainpool P256r1 curveBrainpoolP384r1
for ECC certificates with Brainpool P384r1 curve
Released packages
OPCFoundation.NetStandard.Opc.Ua
OPCFoundation.NetStandard.Opc.Ua.Core
OPCFoundation.NetStandard.Opc.Ua.Security.Certificates
OPCFoundation.NetStandard.Opc.Ua.Configuration
OPCFoundation.NetStandard.Opc.Ua.Server
OPCFoundation.NetStandard.Opc.Ua.Client
OPCFoundation.NetStandard.Opc.Ua.Client.ComplexTypes
OPCFoundation.NetStandard.Opc.Ua.Bindings.Https
OPCFoundation.NetStandard.Opc.Ua.PubSub
What's Changed
- Set initial value of LastActiveTickCount by @mrsuciu in #2953
- Bump Microsoft.Extensions.Configuration from 9.0.0 to 9.0.1 by @dependabot in #2956
- Revert "merge main374 into current branch by @mrsuciu in #2958
- Merge develop/main347 to master by @mrsuciu in #2959
- Update version.json to 1.5.375 by @mrsuciu in #2960
- Simplify SetECDsaPublicKey and padd with leading zeros by @mrsuciu in #2963
- CustomNodeManager2 initialize predefined nodes in constructor by @romanett in #2966
- Cherry-pick initialize predefined nodes in constructor from master by @mrsuciu in #2968
- Set default value for NonceLength to 32 by @mrsuciu in #2971
- Update version.json by @mrsuciu in #2972
- Correct identity token encryption by setting the correct security policy for the user token by @mrsuciu in #2976
- Update version.json by @mrsuciu in #2977
Full Changelog: 1.5.374.168...1.5.375.443
OPC UA 1.05 Maintenance Update
1.05.374 roll up until Jan 22nd.
This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler.
The focus in this release was on perf improvements and bug fixes.
This is also the last official release without ECC support...
Server improvements
- NodeIdDictionary
The underlying dictionary of the commonly used NodeIdDictionary
in node managers is now a ConcurrentDictionary. (see CustomNodeManager2 changes)
Perf comparisons with NodeId hashes showed that the lookup of entries is comparable to the previously used Dictionary, but doesn't require locking in the NodeManager. Now all implementations of GetManagerHandle
can be accessed without locking the node manager, which should reduce contention between service calls. Still, most calls need to be synchronized with locks, but the GetManagerHandle call is decoupled.
Client improvements
- A client fast datachange callback gets now access to the
MoreNotifications
flag, which makes it easier to reshuffle received data changes spread across multiple publish responses. To save the cost of a list translation, the notificationMessage gets a StringCollection for the StringTable instead of a List of strings.
Encoder/Decoder perf improvements
- Taking advantage of stackalloc and Span ins some areas to reduce allocations and JSON escaping.
.NET 9 lib issues fixed
- Linking with .NET 8 LTS caused some issues with referenced .NET9 assemblies, now only .NET 8 flavors are referenced.
Known Issues
- see #2966, a missing null pointer check may cause NullPointerException
- see #2953, channels may not be cleaned up
Other bug fixes as below
What's Changed
- Fix regression in Node AccessRestrictions: change return type from uint32 to ushort by @romanett in #2883
- fix nullreferenceException in NodeState by @romanett in #2894
- Fix server time and move all readerwriter locks outside of try/finally by @mregen in #2903
- Fix errors and warnings building on other Linux distributions by @mregen in #2908
- Add SetHiResClockDisabled & fix Rejected Store Creation in ApplicationConfigurationBuilder by @romanett #2909
- [Server] Improve GetManagerHandle & introduce a threadSafe NodeIdDictionary by @romanett in #2915
- [Client] Fix match endpoints by @romanett in #2925
- Handle status code Uncertain according to the specification by @larws in #2898
- Merge cherrypicks from master in develop branch by @mregen in #2928
- Fix race condition on Nuget build by @mregen in #2930
- Some .NET 9 maintenance and JSON encoder improvements by @mregen in #2922
- Merge develop/main374 in release branch by @mregen in #2944
Full Changelog: 1.5.374.158...1.5.374.168
OPC UA 1.05 Maintenance Update
1.05.374 roll up until Dec 4th.
This release is based on the 1.05.03 Nodeset with generated files from the ModelCompiler.
The focus in this release was on perf improvements and bug fixes.
Breaking change
Based on a recent security review, the Https server endpoints enforce by request TLS mutual authentication and change behavior without.
It is highly recommended to only use mutual TLS authentication. Some clients may not support the new scheme yet.
A new configuration variable
<HttpsMutualTls>true</HttpsMutualTls>
enables or disables the mutual TLS authentication support (default: true).
The behavior of the https TLS endpoint changes according to the following settings:
HttpsMutualTls is true
- The server checks the trust on the certificate which is used by the client for TLS authentication. It must be a valid OPC UA application certificate which is trusted.
- A client can still connect without providing a client certificate, but then it is only able to call discovery services.
- In order to create a session, the client must use the same application certificate that was used for the TLS channel.
HttpsMutualTls is false
- There is no application authentication. The server endpoint uses security None and there is no client application authentication.
- Instead, only user authentication is used to secure the server, anonymous user authentication is disabled.
- Discovery service calls are supported.
Enhancements
- Supports native .NET 9 assemblies. A new X509CertificateLoader was introduced for older .NET versions to keep the code readable without ifdef.
- Server GDS Push CreateSigningRequest supports regeneration of the public/private key pair. by @romanett.
- Callback to notify about channel token renewal.
- Server detection algorithm for clients which try to exploit the known Basic128Rsa15 vulnerability.
Bug fixes
- Client ReadNodes throws an BadInvalidType if a value type returns null.
- Client reading of large dictionaries is split in chunks. by @ThomasNehring.
- Mixed opc.https and https endpoint prevent a server from starting up .
- Server endpoint certificates were not updated after GDS Push UpdateCertificate. by @romanett.
- Event reports ignore session context. by @Filippo-Oliva-ABB.
- Accept namespace Uri which are not well formed. Stricter handling was added in previous release, but for IOP is again relaxed.
- Reading complex types from a server could cause a null pointer exception in BinaryDecoder. by @marcschier.
- Reading operation limits could cause an exception (thus operation limits were ignored).
- CRL with invalid content could cause exception when reading property with lazy decoding, decode CRL always when constructore is called to catch issues early.
- Channel token HMAC references were not disposed after a channel renew.
- Allow decoding of extension objects which set the length to -1.
- Fix for CauseMappings and bug in ConditionRefresh/2 by @Archie-Miller
What's Changed
- Bump Serilog and System.Diagnostics.DiagnosticSource by @dependabot in #2780
- Update CauseMappings to support transitions correctly by @Archie-Miller #2877
- ConditionRefreshAsync always results in BadNodeIdUnknown by @Archie-Miller #2876
- [Server] GDS Push: Enable regeneratePrivatekey for CreateSigningRequest method of Server by @romanett in #2778
- Client ReadNodes, throw BadInvalidType if a value type returned by an attribute is null by @mregen in #2746
- [Client] Read large dictionaries by @ThomasNehring in #2782
- Server doesn't start up with mixed https endpoints by @mregen in #2789
- #2777 Fix for - MonitoredItem2.OnReportEvent Ignores Session in ISystemContext During Notification Process by @Filippo-Oliva-ABB in #2779
- [Server] update endpoint descriptions after certificate update by @romanett in #2735
- Moved the modified reference server from the unit test to its own file by @ThomasNehring in #2725
- #2656 Fix for - Session is not provided by ClearChangeMasks when a change is notified by @Filippo-Oliva-ABB in #2772
- Revert "#2656 Fix for - Session is not provided by ClearChangeMasks w… by @mregen in #2792
- Fix ExpandedNodeId.Format output for not well formed uri and JSON Verbose WriteStatusCode by @mregen in #2794
- Null pointer exception when reading a complex type from umati server.… by @marcschier in #2798
- Add ReturnDiagnostics to Session Constructor by @romanett in #2810
- IOP: Fix FetchOperationLimits for some use cases by @mregen in #2807
- Update version.json to allow preview builds from develop by @mregen in #2813
- Fix bugs in JSON decoder by @mregen in #2828
- Update brokerHostName before MqttClientOptionsBuilder uses it's value by @mrsuciu in #2830
- Improve crl handling in certificate stores by @romanett in #2829
- Using Uri.TryCreate causes regression with namespace uri that use mixed lower/uppercase letters in the of the Uri. by @KircMax in #2837
- ChannelToken: Dispose HMAC and improve lifetime calculations. by @mregen in #2846
- Added a minimal rogue client detection mechanism at the transport level by @mrsuciu in #2850
- ValidateRolePermissions for MIs montioring the Value of a Node by @romanett in #2809
- [Server] ValidateRolePermissions of MonitoredItems based of the saved user identity to allow validation when no session is present by @romanett in #2832
- Support .NET 9.0 build by @mregen in #2865
- Client perf and memory improvements for JSON encoding and subscriptions by @mregen in #2864
- Register callback to notify about new channel token activation (#2872) by @marcschier in #2873
- [Client] Fix: KeepAliveInterval was not updated on ModifySubscription by @romanett in #2871
- Merge fixes from master in stable branch by @mregen in #2878
- Bump BouncyCastle.Cryptography from 2.4.0 to 2.5.0 by @mregen in #2875
- Allow decoding of extension objects for legacy devices which do not set the length by @mregen in #2869
- Enable mutual tls on server https endpoints by @mrsuciu in #2849
- fix serialization of ApplicationConfiguration /CertificateTrustList by @romanett in #2879
- Merge develop/main374 into release/1.5.374 by @mregen in #2881
New Contributors
- @Filippo-Oliva-ABB made their first contribution in #2779
Full Changelog: 1.5.374.126...1.5.374.158