node-opcua / node-opcua / 23974043205

/* eslint-disable max-statements */

/**

 * @module node-opcua-server

 */

// tslint:disable:no-console

import { EventEmitter } from "node:events";

import net, { type Server, type Socket } from "node:net";

import chalk from "chalk";

import { assert } from "node-opcua-assert";

import type { OPCUACertificateManager } from "node-opcua-certificate-manager";

import { type ICertificateChainProvider, StaticCertificateChainProvider } from "node-opcua-common";

import { type Certificate, combine_der, makeSHA1Thumbprint, type PrivateKey, split_der } from "node-opcua-crypto/web";

import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";

import { getFullyQualifiedDomainName, resolveFullyQualifiedDomainName } from "node-opcua-hostname";

import {

    fromURI,

    type IServerSessionBase,

    type Message,

    MessageSecurityMode,

    SecurityPolicy,

    ServerSecureChannelLayer,

    type ServerSecureChannelParent,

    toURI

} from "node-opcua-secure-channel";

import { ApplicationDescription, EndpointDescription, UserTokenType } from "node-opcua-service-endpoints";

import type { IHelloAckLimits } from "node-opcua-transport";

import type { UserTokenPolicyOptions } from "node-opcua-types";

import type { IChannelData } from "./i_channel_data";

import type { ISocketData } from "./i_socket_data";

const debugLog = make_debugLog(__filename);

const errorLog = make_errorLog(__filename);

const warningLog = make_warningLog(__filename);

const doDebug = checkDebugFlag(__filename);

const UATCP_UASC_UABINARY = "http://opcfoundation.org/UA-Profile/Transport/uatcp-uasc-uabinary";

function extractSocketData(socket: net.Socket, reason: string): ISocketData {

    const { bytesRead, bytesWritten, remoteAddress, remoteFamily, remotePort, localAddress, localPort } = socket;

    const data: ISocketData = {

        bytesRead,

        bytesWritten,

        localAddress,

        localPort,

        remoteAddress,

        remoteFamily,

        remotePort,

        timestamp: new Date(),

        reason

    };

    return data;

}

function extractChannelData(channel: ServerSecureChannelLayer): IChannelData {

    const { channelId, clientCertificate, securityMode, securityPolicy, timeout, transactionsCount } = channel;

    const channelData: IChannelData = {

        channelId,

        clientCertificate,

        securityMode,

        securityPolicy,

        timeout,

        transactionsCount

    };

    return channelData;

}

function dumpChannelInfo(channels: ServerSecureChannelLayer[]): void {

    function d(s: IServerSessionBase) {

        return `[ status=${s.status} lastSeen=${s.clientLastContactTime.toFixed(0)}ms sessionName=${s.sessionName} timeout=${

            s.sessionTimeout

        } ]`;

    }

    function dumpChannel(channel: ServerSecureChannelLayer): void {

        console.log("------------------------------------------------------");

        console.log("            channelId = ", channel.channelId);

        console.log("             timeout  = ", channel.timeout);

        console.log("        remoteAddress = ", channel.remoteAddress);

        console.log("        remotePort    = ", channel.remotePort);

        console.log("");

        console.log("        bytesWritten  = ", channel.bytesWritten);

        console.log("        bytesRead     = ", channel.bytesRead);

        console.log("        sessions      = ", Object.keys(channel.sessionTokens).length);

        console.log(Object.values(channel.sessionTokens).map(d).join("\n"));

        // biome-ignore lint/suspicious/noExplicitAny: accessing internal transport for debug dump

        const socket = (channel as any).transport?._socket;

        if (!socket) {

            console.log(" SOCKET IS CLOSED");

        }

    }

    for (const channel of channels) {

        dumpChannel(channel);

    }

    console.log("------------------------------------------------------");

}

const emptyCertificateChain: Certificate[] = [];

// biome-ignore lint/suspicious/noExplicitAny: deliberate null→PrivateKey sentinel

const emptyPrivateKey = null as any as PrivateKey;

let OPCUAServerEndPointCounter = 0;

export interface OPCUAServerEndPointOptions {

    /**

     * the tcp port

     */

    port: number;

    /**

     * the tcp host

     */

    host?: string;

    /**

     * the DER certificate chain

     */

    certificateChain: Certificate[];

    /**

     * privateKey

     */

    privateKey: PrivateKey;

    certificateManager: OPCUACertificateManager;

    /**

     *  the default secureToken lifetime @default=60000

     */

    defaultSecureTokenLifetime?: number;

    /**

     * the maximum number of connection allowed on the TCP server socket

     * @default 20

     */

    maxConnections?: number;

    /**

     *  the  timeout for the TCP HEL/ACK transaction (in ms)

     *  @default 30000

     */

    timeout?: number;

    serverInfo: ApplicationDescription;

    objectFactory?: unknown;

    transportSettings?: IServerTransportSettings;

}

export interface IServerTransportSettings {

    adjustTransportLimits: (hello: IHelloAckLimits) => IHelloAckLimits;

}

export interface EndpointDescriptionParams {

    restricted?: boolean;

    allowUnsecurePassword?: boolean;

    resourcePath?: string;

    alternateHostname?: string[];

    hostname: string;

    /**

     * Override the port used in the endpoint URL.

     * When set, the endpoint URL uses this port instead of the

     * server's listen port. The server does NOT listen on this port.

     * Useful for Docker port-mapping, reverse proxies, and NAT.

     */

    advertisedPort?: number;

    securityPolicies: SecurityPolicy[];

    userTokenTypes: UserTokenType[];

}

/**

 * Per-URL security overrides for advertised endpoints.

 *

 * When `advertisedEndpoints` contains a config object, the endpoint

 * descriptions generated for that URL use the overridden security

 * settings instead of inheriting from the main endpoint.

 *

 * Any field that is omitted falls back to the main endpoint's value.

 *

 * @example

 * ```ts

 * advertisedEndpoints: [

 *     // Public: SignAndEncrypt only, no anonymous

 *     {

 *         url: "opc.tcp://public.example.com:4840",

 *         securityModes: [MessageSecurityMode.SignAndEncrypt],

 *         allowAnonymous: false

 *     },

 *     // Internal: inherits everything from main endpoint

 *     "opc.tcp://internal:48480"

 * ]

 * ```

 */

export interface AdvertisedEndpointConfig {

    /** The full endpoint URL, e.g. `"opc.tcp://public.example.com:4840"` */

    url: string;

    /** Override security modes (default: inherit from main endpoint) */

    securityModes?: MessageSecurityMode[];

    /** Override security policies (default: inherit from main endpoint) */

    securityPolicies?: SecurityPolicy[];

    /** Override anonymous access (default: inherit from main endpoint) */

    allowAnonymous?: boolean;

    /** Override user token types (default: inherit from main endpoint) */

    userTokenTypes?: UserTokenType[];

}

/**

 * An advertised endpoint entry — either a plain URL string (inherits

 * all settings from the main endpoint) or a config object with

 * per-URL security overrides.

 */

export type AdvertisedEndpoint = string | AdvertisedEndpointConfig;

/**

 * Normalize any `advertisedEndpoints` input into a uniform

 * `AdvertisedEndpointConfig[]`.

 *

 * This coercion is done early so that all downstream code

 * (endpoint generation, IP/hostname extraction) only deals

 * with one type.

 */

export function normalizeAdvertisedEndpoints(raw?: AdvertisedEndpoint | AdvertisedEndpoint[]): AdvertisedEndpointConfig[] {

    if (!raw) return [];

    const arr = Array.isArray(raw) ? raw : [raw];

    return arr.map((entry) => (typeof entry === "string" ? { url: entry } : entry));

}

export interface AddStandardEndpointDescriptionsParam {

    allowAnonymous?: boolean;

    disableDiscovery?: boolean;

    securityModes?: MessageSecurityMode[];

    restricted?: boolean;

    allowUnsecurePassword?: boolean;

    resourcePath?: string;

    alternateHostname?: string[];

    hostname?: string;

    securityPolicies?: SecurityPolicy[];

    userTokenTypes?: UserTokenType[];

    /**

     * Additional endpoint URL(s) to advertise.

     *

     * Use when the server is behind Docker port-mapping,

     * a reverse proxy, or a NAT gateway.

     *

     * Each entry can be a plain URL string (inherits all security

     * settings from the main endpoint) or an

     * `AdvertisedEndpointConfig` object with per-URL overrides.

     *

     * The server still listens on `port` — these are purely

     * advertised aliases.

     *

     * @example Simple string (inherits main settings)

     * ```ts

     * advertisedEndpoints: "opc.tcp://localhost:48481"

     * ```

     *

     * @example Mixed array with per-URL security overrides

     * ```ts

     * advertisedEndpoints: [

     *     "opc.tcp://internal:48480",

     *     {

     *         url: "opc.tcp://public.example.com:4840",

     *         securityModes: [MessageSecurityMode.SignAndEncrypt],

     *         allowAnonymous: false

     *     }

     * ]

     * ```

     */

    advertisedEndpoints?: AdvertisedEndpoint | AdvertisedEndpoint[];

}

/**

 * Parse an `opc.tcp://hostname:port` URL and extract hostname and port.

 * @internal

 */

export function parseOpcTcpUrl(url: string): { hostname: string; port: number } {

    // URL class doesn't understand opc.tcp://, so swap to http://

    const httpUrl = url.replace(/^opc\.tcp:\/\//i, "http://");

    const parsed = new URL(httpUrl);

    return {

        hostname: parsed.hostname,

        port: parsed.port ? Number.parseInt(parsed.port, 10) : 4840

    };

}

function getUniqueName(name: string, collection: { [key: string]: number }) {

    if (collection[name]) {

        let counter = 0;

        while (collection[`${name}_${counter.toString()}`]) {

            counter++;

        }

        name = `${name}_${counter.toString()}`;

        collection[name] = 1;

        return name;

    } else {

        collection[name] = 1;

        return name;

    }

}

/**

 * Stores the abort listener for channels in the pre-registration phase.

 * Using a WeakMap instead of monkey-patching the channel object keeps

 * this internal state invisible to debuggers and external code.

 */

const preregisterAbortListeners = new WeakMap<ServerSecureChannelLayer, () => void>();

/**

 * OPCUAServerEndPoint a Server EndPoint.

 * A sever end point is listening to one port

 * note:

 *   see OPCUA Release 1.03 part 4 page 108 7.1 ApplicationDescription

 */

export class OPCUAServerEndPoint extends EventEmitter implements ServerSecureChannelParent {

    /**

     * the tcp port

     */

    public port: number;

    public host: string | undefined;

    public certificateManager: OPCUACertificateManager;

    public defaultSecureTokenLifetime: number;

    public maxConnections: number;

    public timeout: number;

    public bytesWrittenInOldChannels: number;

    public bytesReadInOldChannels: number;

    public transactionsCountOldChannels: number;

    public securityTokenCountOldChannels: number;

    public serverInfo: ApplicationDescription;

    public objectFactory: unknown;

    public _on_new_channel?: (channel: ServerSecureChannelLayer) => void;

    public _on_channel_secured?: (channel: ServerSecureChannelLayer) => void;

    public _on_close_channel?: (channel: ServerSecureChannelLayer) => void;

    public _on_connectionRefused?: (socketData: ISocketData) => void;

    public _on_openSecureChannelFailure?: (socketData: ISocketData, channelData: IChannelData) => void;

    /**

     * Certificate chain provider — delegates all cert/key access.

     * Stored in a `#` private field so secrets are not visible

     * in the debugger's property list or JSON serialization.

     */

    #certProvider: ICertificateChainProvider;

    /**

     * Combined DER cache — invalidated whenever the cert provider

     * changes so that `EndpointDescription.serverCertificate`

     * getters don't call `combine_der()` on every access.

     */

    #combinedDerCache: Certificate | undefined;

    private _channels: { [key: string]: ServerSecureChannelLayer };

    private _server?: Server;

    private _endpoints: EndpointDescription[];

    private _listen_callback?: (err?: Error) => void;

    private _started = false;

    private _counter = OPCUAServerEndPointCounter++;

    private _policy_deduplicator: { [key: string]: number } = {};

    private transportSettings?: IServerTransportSettings;

    constructor(options: OPCUAServerEndPointOptions) {

        super();

        assert(!Object.hasOwn(options, "certificate"), "expecting a certificateChain instead");

        assert(Object.hasOwn(options, "certificateChain"), "expecting a certificateChain");

        assert(Object.hasOwn(options, "privateKey"));

        this.certificateManager = options.certificateManager;

        options.port = options.port || 0;

        this.port = parseInt(options.port.toString(), 10);

        this.host = options.host;

        assert(typeof this.port === "number");

        this.#certProvider = new StaticCertificateChainProvider(options.certificateChain, options.privateKey);

        this._channels = {};

        this.defaultSecureTokenLifetime = options.defaultSecureTokenLifetime || 600000;

        this.maxConnections = options.maxConnections || 20;

        this.timeout = options.timeout || 30000;

        this._server = undefined;

        this._setup_server();

        this._endpoints = [];

        this.objectFactory = options.objectFactory;

        this.bytesWrittenInOldChannels = 0;

        this.bytesReadInOldChannels = 0;

        this.transactionsCountOldChannels = 0;

        this.securityTokenCountOldChannels = 0;

        this.serverInfo = options.serverInfo;

        assert(this.serverInfo !== null && typeof this.serverInfo === "object");

        this.transportSettings = options.transportSettings;

    }

    public dispose(): void {

        this.#certProvider = new StaticCertificateChainProvider(emptyCertificateChain, emptyPrivateKey);

        this.#combinedDerCache = undefined;

        assert(Object.keys(this._channels).length === 0, "OPCUAServerEndPoint channels must have been deleted");

        this._channels = {};

        this.serverInfo = new ApplicationDescription({});

        this._endpoints = [];

        assert(this._endpoints.length === 0, "endpoints must have been deleted");

        this._endpoints = [];

        this._server = undefined;

        this._listen_callback = undefined;

        this.removeAllListeners();

    }

    public toString(): string {

        const txt =

            " end point" +

            this._counter +

            " port = " +

            this.port +

            " l = " +

            this._endpoints.length +

            " " +

            makeSHA1Thumbprint(this.getCertificate()).toString("hex");

        return txt;

    }

    public getChannels(): ServerSecureChannelLayer[] {

        return Object.values(this._channels);

    }

    /**

     * Returns the X509 DER form of the server certificate

     */

    public getCertificate(): Certificate {

        return this.getCertificateChain()[0];

    }

    /**

     * Returns the X509 DER form of the server certificate

     */

    public getCertificateChain(): Certificate[] {

        return this.#certProvider.getCertificateChain();

    }

    /**

     * Replace the certificate chain provider for this endpoint.

     *

     * Used by push certificate management to switch from the

     * default static provider to a disk-based one that re-reads

     * certificates on demand.

     *

     * Invalidates the cached `combine_der` result so that

     * `EndpointDescription.serverCertificate` getters pick up

     * the new chain immediately.

     */

    public setCertificateProvider(provider: ICertificateChainProvider): void {

        this.#certProvider = provider;

        this.#combinedDerCache = undefined;

    }

    /**

     * Return the current certificate chain provider.

     * Useful for calling `invalidate()` after certificate rotation.

     */

    public getCertificateProvider(): ICertificateChainProvider {

        return this.#certProvider;

    }

    /**

     * Invalidate the combined DER cache.

     *

     * Called after the underlying provider's chain changes

     * (e.g. after `provider.invalidate()` or `provider.update()`).

     * The next `EndpointDescription.serverCertificate` access

     * will recompute the combined DER from the provider.

     */

    public invalidateCombinedDerCache(): void {

        this.#combinedDerCache = undefined;

    }

    /**

     * Convenience method: invalidate both the provider's cache

     * (so it re-reads from disk) and the combined DER cache

     * (so endpoint descriptions recompute `serverCertificate`).

     *

     * Prefer this over calling `getCertificateProvider().invalidate()`

     * and `invalidateCombinedDerCache()` separately.

     */

    public invalidateCertificates(): void {

        this.#certProvider.invalidate();

        this.#combinedDerCache = undefined;

    }

    /**

     * Get the combined DER certificate (all certs concatenated)

     * for use in EndpointDescription.serverCertificate.

     * Cached internally; invalidated by provider changes.

     * @internal

     */

    public getCombinedCertificate(): Certificate | undefined {

        const chain = this.#certProvider.getCertificateChain();

        if (!this.#combinedDerCache) {

            this.#combinedDerCache = combine_der(chain);

        }

        return this.#combinedDerCache;

    }

    /**

     * the private key

     */

    public getPrivateKey(): PrivateKey {

        return this.#certProvider.getPrivateKey();

    }

    /**

     * The number of active channel on this end point.

     */

    public get currentChannelCount(): number {

        return Object.keys(this._channels).length;

    }

    /**

     */

    public getEndpointDescription(

        securityMode: MessageSecurityMode,

        securityPolicy: SecurityPolicy,

        endpointUrl: string | null

    ): EndpointDescription | null {

        const endpoints = this.endpointDescriptions();

        const arr = endpoints.filter(matching_endpoint.bind(this, securityMode, securityPolicy, endpointUrl));

        return arr.length === 0 ? null : arr[0];

    }

    public addEndpointDescription(

        securityMode: MessageSecurityMode,

        securityPolicy: SecurityPolicy,

        options: EndpointDescriptionParams

    ): void {

        // c8 ignore next

        if (securityMode === MessageSecurityMode.None && securityPolicy !== SecurityPolicy.None) {

            throw new Error(" invalid security ");

        }

        // c8 ignore next

        if (securityMode !== MessageSecurityMode.None && securityPolicy === SecurityPolicy.None) {

            throw new Error(" invalid security ");

        }

        //

        // resource Path is a string added at the end of the url such as "/UA/Server"

        const resourcePath = (options.resourcePath || "").replace(/\\/g, "/");

        assert(resourcePath.length === 0 || resourcePath.charAt(0) === "/", "resourcePath should start with /");

        const effectivePort = options.advertisedPort ?? this.port;

        const endpointUrl = `opc.tcp://${hostname}:${effectivePort}${resourcePath}`;

        const endpoint_desc = this.getEndpointDescription(securityMode, securityPolicy, endpointUrl);

        // c8 ignore next

        if (endpoint_desc) {

            throw new Error(" endpoint already exist");

        }

        const userTokenTypes = options.userTokenTypes;

        // now build endpointUrl

        this._endpoints.push(

            _makeEndpointDescription(

                {

                    collection: this._policy_deduplicator,

                    hostname,

                    server: this.serverInfo,

                    securityMode,

                    securityPolicy,

                    allowUnsecurePassword: options.allowUnsecurePassword,

                    resourcePath: options.resourcePath,

                    restricted: !!options.restricted,

                    advertisedPort: options.advertisedPort,

                    userTokenTypes

                },

                this

            )

        );

    }

    public addRestrictedEndpointDescription(options: EndpointDescriptionParams): void {

        options = { ...options };

        options.restricted = true;

        this.addEndpointDescription(MessageSecurityMode.None, SecurityPolicy.None, options);

    }

    public addStandardEndpointDescriptions(options?: AddStandardEndpointDescriptionsParam): void {

        options = options || {};

        options.securityModes = options.securityModes || defaultSecurityModes;

        options.securityPolicies = options.securityPolicies || defaultSecurityPolicies;

        options.userTokenTypes = options.userTokenTypes || defaultUserTokenTypes;

        options.allowAnonymous = options.allowAnonymous === undefined ? true : options.allowAnonymous;

        // make sure we do not have anonymous

        if (!options.allowAnonymous) {

            options.userTokenTypes = options.userTokenTypes.filter((r) => r !== UserTokenType.Anonymous);

        }

        const defaultHostname = options.hostname || getFullyQualifiedDomainName();

        let hostnames: string[] = [defaultHostname];

        options.alternateHostname = options.alternateHostname || [];

        // remove duplicates if any (uniq)

        hostnames = [...new Set(hostnames.concat(options.alternateHostname))];

        for (const alternateHostname of hostnames) {

            const optionsE: EndpointDescriptionParams = {

                hostname: alternateHostname,

                securityPolicies: options.securityPolicies,

                userTokenTypes: options.userTokenTypes,

                allowUnsecurePassword: options.allowUnsecurePassword,

                alternateHostname: options.alternateHostname,

                resourcePath: options.resourcePath

            };

            if (options.securityModes.indexOf(MessageSecurityMode.None) >= 0) {

                this.addEndpointDescription(MessageSecurityMode.None, SecurityPolicy.None, optionsE);

            } else {

                if (!options.disableDiscovery) {

                    this.addRestrictedEndpointDescription(optionsE);

                }

            }

            for (const securityMode of options.securityModes) {

                if (securityMode === MessageSecurityMode.None) {

                    continue;

                }

                for (const securityPolicy of options.securityPolicies) {

                    if (securityPolicy === SecurityPolicy.None) {

                        continue;

                    }

                    this.addEndpointDescription(securityMode, securityPolicy, optionsE);

                }

            }

        }

        // ── Advertised endpoints (virtual — no TCP listener) ──────

        // Normalize to AdvertisedEndpointConfig[] so downstream code

        // only deals with one type.

        const advertisedList = normalizeAdvertisedEndpoints(options.advertisedEndpoints);

        // Main endpoint defaults (guaranteed non-null — assigned above)

        for (const config of advertisedList) {

            const { hostname: advHostname, port: advPort } = parseOpcTcpUrl(config.url);

            // Skip if this hostname+port combo was already covered

            // by the regular hostname loop (same hostname, same port)

            if (hostnames.some((h) => h.toLowerCase() === advHostname.toLowerCase()) && advPort === this.port) {

                continue;

            }

            // Per-URL security overrides — fall back to main settings

            const entrySecurityModes = config.securityModes ?? mainSecurityModes;

            const entrySecurityPolicies = config.securityPolicies ?? mainSecurityPolicies;

            let entryUserTokenTypes = config.userTokenTypes ?? mainUserTokenTypes;

            // Handle allowAnonymous override: if explicitly false,

            // filter out Anonymous even if the main config allows it

            if (config.allowAnonymous === false) {

                entryUserTokenTypes = entryUserTokenTypes.filter((t) => t !== UserTokenType.Anonymous);

            }

            const optionsE: EndpointDescriptionParams = {

                hostname: advHostname,

                advertisedPort: advPort,

                securityPolicies: entrySecurityPolicies,

                userTokenTypes: entryUserTokenTypes,

                allowUnsecurePassword: options.allowUnsecurePassword,

                alternateHostname: options.alternateHostname,

                resourcePath: options.resourcePath

            };

            if (entrySecurityModes.indexOf(MessageSecurityMode.None) >= 0) {

                this.addEndpointDescription(MessageSecurityMode.None, SecurityPolicy.None, optionsE);

            } else {

                if (!options.disableDiscovery) {

                    this.addRestrictedEndpointDescription(optionsE);

                }

            }

            for (const securityMode of entrySecurityModes) {

                if (securityMode === MessageSecurityMode.None) {

                    continue;

                }

                for (const securityPolicy of entrySecurityPolicies) {

                    if (securityPolicy === SecurityPolicy.None) {

                        continue;

                    }

                    this.addEndpointDescription(securityMode, securityPolicy, optionsE);

                }

            }

        }

    }

    /**

     * returns the list of end point descriptions.

     */

    public endpointDescriptions(): EndpointDescription[] {

        return this._endpoints;

    }

    /**

     */

    public listen(callback: (err?: Error) => void): void {

        assert(typeof callback === "function");

        assert(!this._started, "OPCUAServerEndPoint is already listening");

        this._listen_callback = callback;

        this._server.on("error", (err: Error) => {

            debugLog(`${chalk.red.bold(" error")} port = ${this.port}`, err);

            this._started = false;

            this._end_listen(err);

        });

        this._server.on("listening", () => {

            debugLog("server is listening");

        });

        const listenOptions: net.ListenOptions = {

            port: this.port,

            host: this.host

        };

        this._server.listen(

            listenOptions,

            /*"::",*/ (err?: Error) => {

                // 'listening' listener

                debugLog(chalk.green.bold("LISTENING TO PORT "), this.port, "err  ", err);

                assert(!err, " cannot listen to port ");

                this._started = true;

                if (!this.port) {

                    const add = this._server?.address();

                }

                this._end_listen();

            }

        );

    }

    public killClientSockets(callback: (err?: Error) => void): void {

    public suspendConnection(callback: (err?: Error) => void): void {

        // Stops the server from accepting new connections and keeps existing connections.

        // (note from nodejs doc: This function is asynchronous, the server is finally closed

        // when all connections are ended and the server emits a 'close' event.

        // The optional callback will be called once the 'close' event occurs.

        // Unlike that event, it will be called with an Error as its only argument

        // if the server was not open when it was closed.

        this._server.close(() => {

            this._started = false;

            debugLog(`Connection has been closed !${this.port}`);

        });

        this._started = false;

        callback();

    }

    public restoreConnection(callback: (err?: Error) => void): void {

        this.listen(callback);

    }

    public abruptlyInterruptChannels(): void {

        for (const channel of Object.values(this._channels)) {

            channel.abruptlyInterrupt();

        }

    }

    /**

     */

    public shutdown(callback: (err?: Error) => void): void {

        debugLog("OPCUAServerEndPoint#shutdown ");

        if (this._started) {

            // make sure we don't accept new connection any more ...

            this.suspendConnection(() => {

                // shutdown all opened channels ...

                const _channels = Object.values(this._channels);

                const promises = _channels.map(

                    (channel) =>

                        new Promise<void>((resolve, reject) => {

                            this.shutdown_channel(channel, (err?: Error) => {

                                if (err) {

                                } else {

                                    resolve();

                                }

                            });

                        })

                );

                Promise.all(promises)

                    .then(() => {

                        /* c8 ignore next */

                        if (!(Object.keys(this._channels).length === 0)) {

                        assert(Object.keys(this._channels).length === 0, "channel must have unregistered themselves");

                        callback();

                    })

                    .catch((err) => {

                    });

            });

        } else {

            callback();

        }

    }

    /**

     */

    public start(callback: (err?: Error) => void): void {

        assert(typeof callback === "function");

        this.listen(callback);

    }

    public get bytesWritten(): number {

        const channels = Object.values(this._channels);

        return (

            this.bytesWrittenInOldChannels +

            channels.reduce((accumulated: number, channel: ServerSecureChannelLayer) => {