dohertj2/lmxopcua
1
0
Fork 0
Code Issues 33 Pull Requests Actions Packages Projects Releases Wiki Activity

docs: remove stale SDK 1 peer and calculator descriptions

Browse Source
This commit is contained in:
Joseph Doherty
2026-11-10 14:02:47 -05:00
parent a7efb39685
commit cd60e469a1
5 changed files with 16 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+7 -6
View File
@@ -301,12 +301,13 @@ guards in front of the store, bound from the same `Security:ApiKeys` section
**Per-client accounting and its limits (#751).** `IOpcUaUserAuthenticator` has an endpoint-carrying
`AuthenticateUserNameAsync(username, password, remoteEndpoint, ct)` overload (default: ignore the endpoint
and delegate), which the server calls and `ApiKeyOpcUaUserAuthenticator` forwards to
`IApiKeyStore.FindAsync(..., remoteAddress, ...)`. The OPC UA SDK (1.5.378) exposes no client address on any
public surface, so `SecureChannelRemoteEndpoint` reads it from the TCP listener's private channel map by
reflection, keyed by the session's secure channel id. It is fail-soft: an unresolvable address (an SDK upgrade
that renamed the members, or a client re-activating over a new channel) is charged to the process-wide bucket
only, which therefore stays as the backstop. `ApiKeyMissBudgetPerEndpointTests` (OpcUaServer.IntegrationTests)
pins the resolution over the wire so such an upgrade fails a test. At most `BoundedApiKeyStore.MaxTrackedEndpoints`
`IApiKeyStore.FindAsync(..., remoteAddress, ...)`. SDK 2.0.1 supplies the public transport-observed
`SecureChannelContext.PeerAddress` on session activation. `OtOpcUaSdkServer` scopes it to the current
asynchronous activation and restores the prior context in `finally`; `OpcUaApplicationHost` adapts it to
the existing IP-budget seam with port zero (no peer port is exposed). The former private-channel-map
reflection helper is removed. An unknown address is charged to the process-wide bucket only, which
therefore stays as the backstop. `ApiKeyMissBudgetPerEndpointTests` (OpcUaServer.IntegrationTests)
pins per-client accounting over the wire; concurrent IPv4/IPv6 activation probes check peer isolation. At most `BoundedApiKeyStore.MaxTrackedEndpoints`
(4096) addresses are tracked; when full, idle (refilled) buckets are pruned and a new address beyond that is
charged process-wide only — never handed a fresh budget. Clients behind one NAT address share a bucket. Neither
guard applies to a driver-only node: its `ArtifactApiKeyStore` is two in-memory dictionary probes and is never