OPC UA ReverseConnect Client Implementation

[AndreasHeine]

OPC UA ReverseConnect Client Implementation

Goal

Add client-side support for Server-initiated TCP transport (ReverseConnect) while keeping existing outbound client behavior unchanged.

1. Protocol Layer Changes

• Add ReverseHello message type (RHE) and struct.
• Update UA TCP binary parser/serializer to support ReverseHello.
• Extend transport message dispatch so ReverseHello can be received before Hello/Acknowledge.

Files to touch:

• asyncua/ua/uaprotocol_hand.py
• asyncua/ua/ua_binary.py
• asyncua/common/connection.py

2. Reverse Handshake State Machine

Implement a reverse handshake path:

• Accept inbound socket.
• Require first frame to be ReverseHello.
• Validate ServerUri and optional endpoint policy.
• Send Hello.
• Wait for Acknowledge.
• Proceed to OpenSecureChannel.

Enforce protocol constraints:

• Hello/Acknowledge only once per transport.
• Close connection on repeated/invalid handshake frames.
• Add configurable initial handshake timeout (default <= 120s).

Primary file:

• asyncua/client/ua_client.py

3. Client Listener Mode

Add a listener mode for the client:

• Start inbound TCP listener (asyncio.start_server) for ReverseConnect.
• Track accepted sockets and handshake status.
• Limit pending sockets/resources.
• On overload, return ErrorMessage(BadServerTooBusy) and close.

Likely files:

• asyncua/client/ua_client.py
• asyncua/client/client.py (public configuration/API)

4. High-Level API & Config

Add explicit ReverseConnect configuration:

• Enable/disable reverse mode.
• Client listen URL/host/port.
• Allowed server ApplicationUris.
• Handshake timeout.
• Reconnect delay/backoff parameters for reverse path.

Integrate into existing flows:

• connect()
• connect_sessionless()
• reconnect pipeline (_prepare_reconnect_transport, _reconnect_loop)

Primary file:

• asyncua/client/client.py

5. Reconnect & Lifecycle Integration

Adapt reconnect logic so reverse mode:

• Re-establishes listener if needed.
• Waits for next server-initiated socket.
• Repeats Hello/Acknowledge/OpenSecureChannel.
• Reuses existing session restore/subscription recovery flow.

Primary files:

• asyncua/client/client.py
• asyncua/client/ua_client.py

6. Security & Validation

• Validate ReverseHello.ServerUri against policy/allow-list.
• Keep certificate validation on OpenSecureChannel exactly as current flow.
• Log rejections with reason (URI mismatch, timeout, overload, malformed frame).

7. Testing Plan

Add tests for:

• ReverseHello encode/decode.
• Valid reverse handshake success path.
• Invalid first message after accept (must close).
• Duplicate Hello/Acknowledge handling.
• Handshake timeout behavior.
• BadServerTooBusy response under resource pressure.
• Reverse reconnect after dropped socket/channel.

Likely test files:

• tests/test_connections.py
• new reverse-focused tests (e.g. tests/test_reverse_connect.py)

8. Rollout Strategy

• Phase 1: protocol support (RHE parsing/serialization).
• Phase 2: low-level reverse handshake in UaClient.
• Phase 3: high-level Client API and reconnect wiring.
• Phase 4: test coverage + docs/examples.
• Phase 5: optional hardening (socket pooling, pause/resume behavior from Table 76).

9. Minimum Viable Feature (first merge)

• One reverse listener.
• One accepted socket used immediately for channel/session.
• URI validation + timeout + basic overload handling.
• Full parity with current normal session create/activate path once channel is up.

10. Done Criteria

• Existing outbound client tests still pass unchanged.
• New reverse tests pass.
• Client can complete: ReverseHello -> Hello -> Acknowledge -> OpenSecureChannel -> CreateSession -> ActivateSession.
• Reconnect works in reverse mode after transport drop.