You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add configurable server resource isolation - #4541
Add configurable server resource isolation on top of the merged #4522 foundation.
Coordinate connection, handshake, retained-message, session-establishment, queue, execution, request-cost and parked-request limits through one server-scoped provider.
Keep configured startup, continuity/reconnect, control and trusted-owner reservations inside existing totals. Shared capacity remains usable up to explicit owner ceilings.
Use authoritative Session membership for reassembly continuity capacity without granting unrelated resource or rate privileges. Preserve explicit owner mappings and bounded tracking.
Cache immutable classification evidence while retaining current Session and classifier checks.
Support weighted request ordering or FIFO independently of resource accounting. Installed providers enforce decoded-request limits in both modes.
Support custom-handler parking through IRequestParkingPolicy, WithRequestParking(...), and RequestLifetime.ParkSink. Parking releases execution capacity only, keeping retained-data and parked charges until completion. Built-in Publish and the global opt-out remain unchanged.
Provide direct, fluent and DI configuration, public incoming-request parking support, effective startup limit logs and user-facing documentation.
Balanced remains the default. SharedOnly without an explicit provider retains shared behavior for intentionally incompatible/unlimited configurations. Reservations are finite and are not one full-message allowance per Session.
All three previously missed findings in review 5326734718 are addressed in 9e25e4ecc:
A custom FIFO provider receives RequestQueue, RequestQueueBytes, RequestExecution and ParkedRequest accounting. A blocked head cannot be overtaken.
IResourceIsolationReassemblyProvider replaces the sessionless threshold independently of UseFairScheduling. The aggregate byte ceiling remains enforced.
Runtime ReservedReassemblyBytes includes all configured protected stage floors, including ControlReserved.
The review's two already-resolved changes remain intact.
The CI collection race was fixed at its source in e1a994a4b: ArrayOf.ToArrayOf treats a separately read collection count as an initial capacity hint and grows/trims for the actual enumeration. Deterministic tests cover growth, shrinkage and stale-zero counts.
The subsequent recovery-test race was fixed in 05753ce77: fake time advances only after a gated keepalive response has been processed and reset its timer, not merely after request arrival. Recovery-order and timeout assertions remain intact, with additional response-state assertions. Instrumentation reproduced the original failure twice; both fixed variants passed 400 executions per framework.
CodeQL alert 388 was verified and dismissed as a false positive. Startup logs contain aggregate numeric capacities, not credentials or caller identities.
Validation
Scope
Result
Latest automated checks at 05753ce7775a58801b4ba9d8f6d7781b709d0b89
167 successful, one package-publication check skipped, no failures
Remaining external prerequisite
license/cla pending: Contributor License Agreement is not signed yet
FIFO/weighted queues, custom parking and server-channel selection
175 passed on each net10.0/net48
Isolation, configuration and parking-hosting selection
259 passed net10.0; 257 passed net48
ArrayOf conversion tests
73 passed on each net10.0/net48
Recovery-audit and keepalive fixtures
40 passed on each net10.0/net48
NativeAOT smoke from preceding updates
Published and executed successfully
No tests, assertions, coverage thresholds, or required checks were weakened. The remaining CLA prerequisite must be completed through CLA Assistant.
This is not CTT certification or an unconditional network-DDoS, whole-process-memory or fleet-wide guarantee.
Share incomplete-message capacity across server listeners, reserve headroom for activated sessions, and size receive buffers to negotiated chunks. Retain fixed assembly deadlines, prospective quota checks and fault cleanup without changing the default buffer-factory allocation policy.
❌ Patch coverage is 86.48345% with 241 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.86%. Comparing base (46fa7d3) to head (05753ce).
Bound execution wakeups by stage, avoid repeated owner/hash work during revalidation, distinguish live classification changes from missing sessions, correct fixture channel capacity, and clarify the profiles and enforcement contract without weakening configured guarantees.
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. 1 out of 2 committers have signed the CLA.
✅ marcschier ❌ Copilot You have signed the CLA already but the status is still pending? Let us recheck it.
UseFairScheduling is documented as selecting weighted ordering, but this branch also disables every decoded-request admission call when it is false. An injected custom provider that wants FIFO therefore never sees RequestQueue, RequestQueueBytes, RequestExecution, or ParkedRequest, despite being installed as the server resource provider. Preserve FIFO independently from whether these stages are accounted, or expose a separate explicit capability for bypassing decoded-request isolation.
The optional reassembly capability is incorrectly coupled to fair request scheduling here. A custom provider can implement IResourceIsolationReassemblyProvider while returning UseFairScheduling == false; it classifies and charges the chunk, but this expression still applies the legacy sessionless threshold, so its protected pre-session owner cannot use the provider's reserved reassembly capacity. The capability itself should be sufficient to replace that threshold, as documented for custom providers.
Reserved reassembly bytes omit the control-reserved floor
ReservedReassemblyBytes omits the reassembly stage's ControlReserved floor. CreateRuntimePlan permits an explicit nonzero control floor for this stage, while UnreservedReassemblyBytes uses SharedCapacity, which does subtract it; the public totals then no longer add up to MaxReassemblyBytes. Derive the reserved value from the runtime stage when available (or include its control floor explicitly).
Use an available count only as an initial capacity hint, growing and trimming for the actual enumeration. Prevents concurrent queue growth from overrunning the array and shrinkage from emitting trailing defaults. Add deterministic growth, shrinkage and empty-count regressions.
Address all three previously missed findings in review 5326734718: account custom FIFO requests, honor optional reassembly classification without weighted scheduling, and include control reserves in runtime reassembly totals.
Wait for each gated keepalive response to reset its timer before advancing the fake clock. Preserve recovery ordering and progress assertions while removing the proven request-arrival versus response-completion race.
…ssionlessInvocation (#4659)
Marc answered the five design questions (2026-10-05). This update
implements the answers; see "Design decisions" at the end.
# Description
OPC 10000-4 §6.3 lets a client invoke a subset of the services without
CreateSession/ActivateSession. The request then carries either an Access
Token in `RequestHeader.authenticationToken` or no token at all. The
server today only offers the low-level
`ISessionManager.ValidateSessionLessRequest` event. Without a handler,
every request whose token names no session is answered with
`Bad_SessionIdInvalid`, including a request without a token. That is the
code a client of an expired session expects; for a session-less request,
§6.3.1 has a server that does not support the invocation answer
`Bad_ServiceUnsupported`.
This PR adds built-in session-less invocation behind an opt-in and keeps
the existing event as the way to take over completely.
## Changes
### `AddSessionlessInvocation()`
(`src/Opc.Ua.Server/Hosting/OpcUaServerBuilderExtensions.cs`)
```csharp
services.AddOpcUa()
.AddServer(options => { /* … */ })
.AddSessionlessInvocation(o => o.AllowAnonymous = false) // the default
.AddJwtIssuer(/* … */); // validates the Access Tokens
```
- Registers `SessionlessInvocationOptions`.
`DependencyInjectionStandardServer` applies them to the `SessionManager`
in use, including one created by a registered session manager factory,
unless that manager already has options.
- Without dependency injection: `SessionManager.SessionlessInvocation =
new SessionlessInvocationOptions()`.
- Without either, nothing changes apart from the
`Bad_ServiceUnsupported` answer below.
### `SessionlessInvocationOptions` (new, `src/Opc.Ua.Server/Session/`)
- `AcceptAccessTokens` (default `true`): an Access Token in
`RequestHeader.authenticationToken`, carried as a String NodeId, is
handed to the server's identity registry (`IServerIdentityRegistry`, the
one ActivateSession uses) as an issued JWT token (OPC 10000-6
§7.6.5.2.3). The resulting identity runs the request. §6.3.1 requires an
encrypted channel for the token, so it is only accepted over
SignAndEncrypt or HTTPS.
- `AllowAnonymous` (default `false`): a request without a token runs as
an anonymous user. Without it, such a request is rejected with
`Bad_IdentityTokenInvalid`.
- `MaxConcurrentRequests` (default 64) and
`MaxConcurrentRequestsPerChannel` (default 16): the budget for
session-less requests, see below. Zero does not limit; a negative value
is rejected.
### Budget for session-less requests (`SessionlessRequestBudget`, new,
internal)
#4541 bounds channels and incomplete messages. A session-less request
has no Session to be accounted for, but it occupies a worker and keeps
its channel active. It gets a budget of its own:
- **Two limits**, checked and taken together under one
`System.Threading.Lock`: concurrent requests on the server, and on one
channel. A request refused by the channel limit takes no server-wide
place. The channel is the SecureChannel on opc.tcp. The HTTPS bindings
use one SecureChannel id per listener, so their requests are grouped by
peer address (IPv4-mapped IPv6 addresses count as IPv4).
- **Answer**: `Bad_ServerTooBusy` ("The Server does not have the
resources to process the request at this time."), the code #4541's
request queue uses when it has no room. `Bad_TooManyOperations` means
too many operations in one request, so it does not fit.
- **Lifetime**: the place is taken before the identity is checked, which
also bounds the validations that run at the same time. The lease is
attached to the `OperationContext` and returned when the context is
disposed, which every service does with `using`, however the request
ends (completed, failed, cancelled). A rejected token, a handler error
or exception, and a cancelled validation return it at once. A lease
releases once, however often it is disposed. Channel entries are removed
with their last request.
- **Scope**: it applies to every session-less request on a manager that
has `SessionlessInvocation` set, including requests a
`ValidateSessionLessRequest` handler decides. A handler without
`AddSessionlessInvocation` runs without a limit, as before. Requests
with a Session token and services outside the §6.3.1 set are not
counted.
- The limits are read for each request, so a change of the options
applies to the next request.
### `SessionManager`
- **Service sets:** a request without a session is limited to the
service sets §6.3.1 allows: View (without
RegisterNodes/UnregisterNodes), Attribute, Method, NodeManagement and
Query. Every other service keeps answering `Bad_SessionIdInvalid`.
`IsSessionlessService(RequestType)` is public.
- **Request without a token:** with session-less invocation not enabled
and no `ValidateSessionLessRequest` handler, it is answered with
`Bad_ServiceUnsupported` (§6.3.1). A token that names no session stays
`Bad_SessionIdInvalid`.
- **Precedence:** a registered `ValidateSessionLessRequest` handler
still decides first, unchanged apart from the service-set limit.
`ValidateSessionlessRequestAsync` is `protected virtual` for servers
that need their own rules.
- **Roles:** the identity of a session-less request goes through the
role resolution ActivateSession applies to the effective identity of a
Session (the `ResolveRoles` part of `AddMandatoryRoles`: the
`MustChangePassword` restriction, `IRoleManager.ResolveGrantedRoles`, so
mapped Access Token claims and the built-in AuthenticatedUser role).
This includes an identity a `ValidateSessionLessRequest` handler sets.
There is no client application certificate without a Session, so no
TrustedApplication role and no application-based mapping.
- **Cancellation:** cancelling an Access Token validation propagates as
`OperationCanceledException` so the endpoint maps it to the status of
the request lifetime (previously it became `Bad_UnexpectedError`). The
budget place is still returned.
- **Log:** a rejected Access Token is logged with a dedicated
`[LoggerMessage]` (`ServerEventIds.SessionManager + 18`, the next free
id after #4632).
### Documentation
- `docs/SessionlessInvocation.md` (new, linked from `docs/README.md`):
which services, enabling it, caller identity, the answers without the
feature, the request limits, the handler, calling the server over
opc.tcp and the REST binding.
- `docs/ResourceIsolation.md`: a short section "Requests without a
Session" pointing to the budget.
- `docs/DependencyInjection.md`: `AddSessionlessInvocation` in the
identity extension tables.
## Tests
- `Opc.Ua.Server.Tests/SessionlessInvocationTests` (mocked server
internals):
- `SessionlessRequestIsUnsupportedUnlessEnabled`,
`AnUnknownSessionTokenStaysBadSessionIdInvalid`,
`ServicesOutsideTheSessionlessSetStillNeedASession` (7 services),
`TheServiceSetLimitAppliesBeforeAValidateSessionLessRequestHandler`,
`AValidateSessionLessRequestHandlerTakesPrecedenceAsync`;
-
`SessionlessRequestWithoutIdentityIsRejectedUnlessAnonymousIsAllowedAsync`,
`SessionlessAccessTokenIsValidatedByTheIdentityRegistryAsync`,
`AnAccessTokenNoAuthenticatorHandlesIsRejected`,
`SessionlessAccessTokenRequiresAnEncryptedChannel` (None, Sign),
`SessionlessAccessTokenIsAcceptedOverSignAndEncryptAsync`,
`AccessTokensCanBeDisabled`,
`IsSessionlessServiceFollowsTheServiceSetsOfPartFour` (21 cases),
`ValidateSessionlessRequestRejectsMissingArguments`;
- wiring: `AddSessionlessInvocationRegistersTheConfiguredOptions`,
`AddSessionlessInvocationRejectsANullBuilder`,
`TheHostedServerAppliesTheOptionsToItsSessionManager`,
`TheHostedServerAppliesTheOptionsToAFactoryCreatedSessionManager`,
`TheHostedServerKeepsOptionsTheSessionManagerAlreadyHas`.
- End to end against the reference server,
`Opc.Ua.Sessions.Tests/SessionlessServiceInvocationTests` (opc.tcp,
`SessionClient` on a channel without CreateSession):
- `ReadWithAnAccessTokenNeedsNoSessionAsync` (SignAndEncrypt),
`AnAccessTokenOnAnUnencryptedChannelIsRejectedAsync`,
`ARequestWithoutAnIdentityIsRejectedAsync`,
`SubscriptionsStillNeedASessionAsync`;
- one sample per service set: `ViewServicesRunWithoutASessionAsync`
(Browse, TranslateBrowsePathsToNodeIds),
`AttributeServicesRunWithoutASessionAsync` (Write, HistoryRead),
`MethodServicesRunWithoutASessionAsync` (Call),
`NodeManagementServicesRunWithoutASessionAsync` (AddNodes). They check
that the service runs and reports its operation result, not a missing
session or an internal error, since #4632 hardened only
Browse/BrowseNext against a missing session. Query is not sampled:
`StandardServer` does not implement QueryFirst/QueryNext.
- REST binding,
`HttpsWebApiIntegrationTests.SessionlessReadOverRestRunsWithAnAccessTokenAsync`
(Compact and Verbose): `POST /read` with the Access Token as String
NodeId (`"AuthenticationToken": "s=<token>"`), and the same request
without a token.
- **Budget**, `Opc.Ua.Server.Tests/SessionlessRequestBudgetTests` (22
tests):
- the budget itself: server limit and release, channel limit that takes
nothing from the server, server limit checked first, zero does not
limit, a lease releases once, HTTPS grouped by peer address (IPv4-mapped
form too), 200 concurrent callers against the limits (exactly the limit
granted, none above the channel limit, parallel release leaves zero and
no tracked channel), 16 callers acquiring and releasing in a loop
(high-water mark never above the limit);
- through `SessionManager.ValidateRequestAsync`: `Bad_ServerTooBusy`
over the server and the channel limit, disposing a context twice
releases once, places returned after a rejected Access Token, an
unencrypted channel, a missing identity, a cancelled validation (while
it waits, the place is taken), a handler error and a handler exception;
the budget also limits requests a handler decides, and a handler-only
server has none; requests outside the service set and requests a
disabled server refuses take no place; changed limits apply to the next
request and new options start a new budget;
- options: finite defaults, negative values rejected.
- **Budget end to end**,
`Opc.Ua.Sessions.Tests/SessionlessServiceInvocationTests.SessionlessRequestsRunInABudgetOfTheirOwnAsync`
(opc.tcp, requests held in the Access Token validation): the third
request over a limit of two gets `Bad_ServerTooBusy`; after release,
five sequential reads and five reads of an unknown node (operation
result bad) all pass; a channel limit of one refuses the second request
on that channel while another channel's request is admitted.
`ARequestWithoutATokenIsUnsupportedWhileTheFeatureIsOffAsync`:
`Bad_ServiceUnsupported` for a request without token on a server without
the feature, `Bad_SessionIdInvalid` for a token that names no Session.
- **Fail without the change**: the places-returned tests fail when the
budget does not release on failure (4 of 22 fail with the release in
`SessionManager` removed; the other budget tests use API this change
adds). `SessionlessRequestIsUnsupportedUnlessEnabled` and
`TheServiceSetLimitAppliesBeforeAValidateSessionLessRequestHandler` are
unchanged from the first version.
- **Review follow-up (`e9a35980b`)**:
`SessionlessAccessTokenReceivesTheRolesMappedFromItsClaimsAsync`,
`SessionlessAccessTokenWithoutTheMappedClaimIsNotGrantedTheRoleAsync`,
`AnAnonymousSessionlessRequestIsGrantedTheAnonymousRoleOnlyAsync`,
`TheIdentityOfAValidateSessionLessRequestHandlerReceivesTheMappedRolesAsync`,
`AValidateSessionLessRequestHandlerThatSetsNoIdentityKeepsNoIdentityAsync`;
end to end
`ARoleMappedNodeIsReadWithTheRolesMappedFromTheAccessTokenAsync` (the
ServerDiagnosticsSummary, readable for SecurityAdmin only, is denied for
a token whose claim is not mapped, readable once the rule maps it,
denied for another token) and
`ACancelledAccessTokenValidationAnswersTheTimeoutAndReturnsItsPlaceAsync`.
The anonymous and no-identity tests guard unchanged behavior. With the
`SessionManager.cs` change removed the three claim-mapping tests, the
end-to-end role test (`Bad_UserAccessDenied`), the end-to-end
cancellation test (`Bad_UnexpectedError` instead of `Bad_Timeout`) and
`ACancelledValidationReturnsItsPlaceAsync` fail. Lines of this commit
were not re-measured for patch coverage; the figure below is for
`496f84fce`.
- **`ClientTest`**: the three assertions that accepted
`Bad_ServiceUnsupported` too are back to master (`Bad_SessionIdInvalid`
only), so the PR no longer touches that file. Since #4646 a closed
`Session` refuses a request without authenticationToken itself; the
server code is not reached. The three tests pass with the single code
(12 cases on net10.0).
- Results on macOS: `Opc.Ua.Server.Tests` full run on net10.0 8076
passed / 9 skipped / 1 failed
(`ACancelledValidationReturnsItsPlaceAsync`, which asserted the old
`Bad_UnexpectedError` mapping; updated to the propagated cancellation
and passing); the session-less, SessionManager and role filters 368
passed / 0 failed on net10.0 and on net8.0, and the session-less
invocation and budget tests 73 passed on net10.0 after the last test was
added. `Opc.Ua.Sessions.Tests` with the
HTTPS/WebApi/WSS/OpenApi/Sessionless/ClientTest filter: 400 passed / 241
skipped / 0 failed on net10.0 and on net8.0 (the earlier host-name
failures were an environment issue of the test machine and are gone).
- Builds: `Opc.Ua.Server`, `Opc.Ua.Server.Tests` and
`Opc.Ua.Sessions.Tests` for net48, net8.0, net9.0 and net10.0 and
`Opc.Ua.Server` in Release net10.0: 0 errors, no new warnings (the
CA2213 in `SamplingGroup.cs` and the CA1861/CA2025 in other test files
are on master too).
- `dotnet format` (whitespace, style, analyzers `--severity info`, one
`--include` per changed file): no finding on a changed line. What
remains is on master lines (`SessionManager.cs` 552, 1374, 2205 and
`DependencyInjectionStandardServer.cs` 228) and the line-ending finding
of a macOS checkout.
- Coverage (`.azurepipelines/check-coverage.ps1` against master, only
the session-less tests of `Opc.Ua.Server.Tests` on net10.0): patch
105/116 changed lines (90.5 %). The 11 uncovered lines are Session-bound
lines of `ValidateRequestAsync` and the lockout logger that moved with
the change; the rest of the suite covers them. The project floor is not
meaningful for this subset.
- Fork CI and CodeQL: previous head `0fba9f21d` (master incl. #4674
merged): [CI run
37307824769](https://github.com/biancode/UA-.NETStandard/actions/runs/37307824769)
green (one net48 timing test, `KeepAliveHandlerV2Async`, failed in the
first attempt and passed on the job rerun; the PR does not touch
subscriptions), [CodeQL run
37307829138](https://github.com/biancode/UA-.NETStandard/actions/runs/37307829138)
green. Current head `e9a35980b`: [CI run
37364178979](https://github.com/biancode/UA-.NETStandard/actions/runs/37364178979),
[CodeQL run
37364182697](https://github.com/biancode/UA-.NETStandard/actions/runs/37364182697)
(results pending).
## Design decisions
Marc's answers (2026-10-05) and what the PR does:
1. **Built in** when `AddSessionlessInvocation` was used. Done.
2. **Service-set limit for all paths**: it applies before a
`ValidateSessionLessRequest` handler too. Done, unchanged.
3. **`Bad_ServiceUnsupported`** for a request without a token on a
server without the feature. Done, unchanged. A token that names no
Session stays `Bad_SessionIdInvalid`.
4. **Identity model**: an Access Token in the RequestHeader, validated
as an issued JWT token through the identity registry, anonymous only by
opt-in. Unchanged. The REST authentication is #4674, now in master.
5. **Separate budget** for session-less requests: added, see "Budget for
session-less requests". Open: no limit per identity yet (identities are
claims-defined, so the keys would be unbounded); say if you want one.
## Related Issues
- Fixes#4658
- Relates to #4657 (the REST binding's session-less service set), #4646
(a closed `Session` no longer sends requests without token), #4541
(resource isolation) and #4674 (REST authentication)
## Checklist
- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed. (Affected
suites on net10.0 and net8.0 locally on macOS; .NET Framework is covered
by the fork CI's Windows net48 legs.)
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
---------
Co-authored-by: Marc Schier <marcschier@users.noreply.github.com>
…ed (#4749)
The `[Explicit]` Sessions `LoadTest` fixture has not started since #4541
(also on the 2.0.0 tag): it set `MaxChannelCount = MaxSessionCount =
10100`, and resource isolation refuses to start unless the channel cap
covers the sessions plus the bootstrap and reconnect floors plus one.
Every LoadTest case failed in `OneTimeSetUp`. Running the fixture again,
and profiling it and the `perf/ServerLoadHarness`, found several
bottlenecks that shipped in 2.0.
## Changes
**Test**
- `MaxChannelCount = MaxSessionCount + 3`, the same margin as the
framework defaults (100 / 103).
- Notifications are counted with per-node `Interlocked` counters. The
shared `ConcurrentDictionary<NodeId, int>`, updated by 750
subscriptions, took 13 % of the process CPU in bucket-lock contention.
- After the writer stops, and after the last event, the tests wait until
the received count stops growing instead of a fixed delay, and log the
drain time.
**Server / client**
- **Detached monitored item recovery** (#4094): every node a NodeManager
added (`AddPredefinedNodeAsync`, recursively for children) scanned every
monitored item of every subscription for detached items.
`CreateSubscription` adds ~30 diagnostics nodes, so with 450k monitored
items subscription creation was quadratic: 69 % of CPU, and
`CreateSubscription` timed out. `MonitoredItem` now keeps an exact
process-wide count of live detached or deleted items, and
`MasterNodeManager` skips recovery while it is zero. All flag changes go
through one helper under the item lock; a disposed item does not count,
because it cannot be attached again.
- **Client channel gate** (#4232):
`UaSCUaBinaryClientChannel.SendRequestAsync` entered the gate with a
blocking `Gate.Enter()` inside an async method, and `SemaphoreSlim.Wait`
spun for 19 % of CPU with many requests in flight on one channel. It now
awaits `Gate.EnterAsync(ct)`, like the server side.
- **ResourceManager**
- Status code and symbolic id translation looked up their maps under the
manager lock and translated while holding it. Sessions that request
diagnostics do this for every notification: 83 % of lock contention. The
maps are copy-on-write and read without the lock.
- Translation tables were `SortedDictionary<string, string>` with the
default, culture-sensitive comparer: up to 1 µs per Browse display name,
22 % of Browse server CPU. They now use an ordinal `Dictionary`.
- **Namespace default permissions**: every permission check read
`DefaultAccessRestrictions` / `DefaultRolePermissions` /
`DefaultUserRolePermissions` of the node's namespace through two
server-wide locks and deep-copied the role permission array, per node.
That was 99 % of lock contention for Read/Write of 100 values. The
values are now read once per namespace per service request and
remembered on the `OperationContext`. Contexts that are not a service
request (monitored item and session contexts, which can live long)
remember nothing, so a changed default applies to them at once.
## Results
`perf/ServerLoadHarness`, paired A/B against `master` (3 alternating
rounds, medians, 20 sessions, 24 cores). The harness numbers predate the
recovery, client gate and status code translation commits, which those
scenarios do not exercise:
| Scenario | Throughput | Server CPU / op | Server alloc / op | Lock
contention |
|---|---|---|---|---|
| Read, 100 values | +19 % | −28 % | −18 % | −96 % |
| Read, 100 values, SignAndEncrypt | +27 % | −26 % | −18 % | −98 % |
| Write, 100 values | noise ¹ | −19 % | −17 % | −88 % |
| Browse (Server object) | +3 % | −16 % | −10 % | −2 % ² |
| Read, 1 value | +12 % | −4 % | ±0 | ±0 |
¹ Throughput varied run to run on the shared machine; per-op CPU and
allocation are the reliable signal.
² Browse contention is the Server node's browse lock in
`NodeState.CreateBrowser` (all sessions browse the same node); not
changed here.
`LoadTest` (opc.tcp, Release, in-process client and server):
| Case | master | this PR |
|---|---|---|
| `ServerReadLoadTestAsync` | setup failure | passes (50M value reads, 0
errors) |
| `ServerManySessionsLoadTestAsync(500)` | setup failure | passes |
| `ServerSubscribeLoadTest_Classic` | setup failure; on 2026-09-26
(before #4541): `CreateSubscription` `BadRequestTimeout` | 76–85 %
received, **fails** (needs 99 %) |
| `ServerSubscribeLoadTest_ManagedSessionV2` | setup failure;
2026-09-26: 1,885 notifications received | 35–45 M notifications, 77–85
% received, **fails** |
| `ServerEventSubscribeLoadTestAsync` | setup failure; 2026-09-26: 34.6
% | passes: 100 % delivered, drained ~40 s after the last event |
The subscribe cases now lose notifications rather than deliver them
late: delivery stops ~2 s after the last write. Every monitored item has
queue size 1 and the writer is not paced by delivery, so whatever
exceeds the publish rate (~585k notifications/s here, SignAndEncrypt
with the client in the same process) is overwritten.
The event test lost nothing either: it waited a fixed 2 s after the last
event and counted the backlog as lost. It now waits until delivery
stops. Its throughput is bound by garbage collection: the event consumer
of the Server node spends ~90 % of its wall time suspended for
workstation GCs of the shared test process. With `DOTNET_gcServer=1` it
generates 702 instead of ~210 events/s and drains in 7 s instead of ~40
s, and the subscribe cases reach 87 % (Classic) and 93 %
(ManagedSessionV2) at 78–106 M notifications.
## Testing
- `Opc.Ua.Server.Tests` 8468 passed / 5 skipped, `Opc.Ua.Client.Tests`
2788 passed, `Opc.Ua.Sessions.Tests` 851 passed / 379 skipped,
`Opc.Ua.Core.Tests` Tcp/Channel 797 passed (net10.0).
- New `OperationContextDefaultPermissionsCacheTests`.
- `Opc.Ua.Server` builds for net48; `dotnet format whitespace` clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
marcschier
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Description
Add configurable server resource isolation on top of the merged #4522 foundation.
IRequestParkingPolicy,WithRequestParking(...), andRequestLifetime.ParkSink. Parking releases execution capacity only, keeping retained-data and parked charges until completion. Built-in Publish and the global opt-out remain unchanged.Balanced remains the default. SharedOnly without an explicit provider retains shared behavior for intentionally incompatible/unlimited configurations. Reservations are finite and are not one full-message allowance per Session.
Related Issues
Builds on merged #4522. Fixes #4554.
Review and CI corrections
All three previously missed findings in review 5326734718 are addressed in
9e25e4ecc:IResourceIsolationReassemblyProviderreplaces the sessionless threshold independently ofUseFairScheduling. The aggregate byte ceiling remains enforced.ReservedReassemblyBytesincludes all configured protected stage floors, including ControlReserved.The review's two already-resolved changes remain intact.
The CI collection race was fixed at its source in
e1a994a4b:ArrayOf.ToArrayOftreats a separately read collection count as an initial capacity hint and grows/trims for the actual enumeration. Deterministic tests cover growth, shrinkage and stale-zero counts.The subsequent recovery-test race was fixed in
05753ce77: fake time advances only after a gated keepalive response has been processed and reset its timer, not merely after request arrival. Recovery-order and timeout assertions remain intact, with additional response-state assertions. Instrumentation reproduced the original failure twice; both fixed variants passed 400 executions per framework.CodeQL alert 388 was verified and dismissed as a false positive. Startup logs contain aggregate numeric capacities, not credentials or caller identities.
Validation
05753ce7775a58801b4ba9d8f6d7781b709d0b89license/clapending: Contributor License Agreement is not signed yetNo tests, assertions, coverage thresholds, or required checks were weakened. The remaining CLA prerequisite must be completed through CLA Assistant.
This is not CTT certification or an unconditional network-DDoS, whole-process-memory or fleet-wide guarantee.
Checklist