Problem
Legacy integrity keys expire even while ordinary reads are active. The maintained .NET implementation renews them every 25 minutes by default; python-snap7 has no renewal mechanism, so a long-lived V1 connection will eventually fail.
Renewal must be performed under the existing authenticated session and the new key must not become active until the old-key-protected response is verified.
Scope
- Add configurable legacy SessionKey refresh, enabled by default with a conservative interval.
- Perform the documented ServerSessionRequest / SecurityKey renewal exchange.
- Serialize renewal with application requests.
- Verify the renewal response with the old key before atomically switching to the new key.
- Stop/cancel refresh activity during disconnect and failure cleanup.
- Surface renewal failure predictably rather than silently continuing with an expired key.
Acceptance criteria
- A deterministic short-interval test performs at least one renewal while reads continue.
- No request is encoded partly with the old key and partly with the new key.
- Failed renewal never installs the new key.
- Disconnect leaves no timer/thread/task behind.
- Sync behavior is implemented first; async support is tracked by the async parity issue.
Dependencies
- Correct key descriptor encoding
- Atomic setup/key activation
- Response HMAC verification and request serialization
Problem
Legacy integrity keys expire even while ordinary reads are active. The maintained .NET implementation renews them every 25 minutes by default; python-snap7 has no renewal mechanism, so a long-lived V1 connection will eventually fail.
Renewal must be performed under the existing authenticated session and the new key must not become active until the old-key-protected response is verified.
Scope
Acceptance criteria
Dependencies