New RPCConnectionManager: Single unified manager, no ringbuffer, OpenSSL-owned sockets

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ### Changed
 
+- TLS is now terminated by OpenSSL directly on the socket, rather than being relayed over the ringbuffer and decrypted through a memory BIO. Session interfaces now exchange plaintext through a `ccf::SessionWriter`, and empty X.509 certificate bundles are rejected by the replacement validation path (#8117).
 - CBOR parsing now rejects composite (array or map) and tagged values used as map keys anywhere in the decoded document, including nested maps in optional COSE headers (#8297).
 
 ### Removed

CMakeLists.txt

@@ -718,10 +718,10 @@ if(BUILD_TESTS)
     )
 
     add_unit_test(
-      rpc_connections_test
-      ${CMAKE_CURRENT_SOURCE_DIR}/src/host/test/rpc_connections.cpp
+      openssl_server_test
+      ${CMAKE_CURRENT_SOURCE_DIR}/src/host/test/openssl_server_test.cpp
     )
-    target_link_libraries(rpc_connections_test PRIVATE uv)
+    target_link_libraries(openssl_server_test PRIVATE ccf_tasks http_parser uv)
 
     add_unit_test(
       node_connections_test
@@ -903,7 +903,10 @@ if(BUILD_TESTS)
       ${CMAKE_CURRENT_SOURCE_DIR}/src/node/test/identity_types.cpp
     )
 
-    add_unit_test(tls_test ${CMAKE_CURRENT_SOURCE_DIR}/src/tls/test/main.cpp)
+    add_unit_test(
+      tls_test
+      ${CMAKE_CURRENT_SOURCE_DIR}/src/clients/tls/test/main.cpp
+    )
     target_link_libraries(tls_test PRIVATE ${CMAKE_THREAD_LIBS_INIT})
 
     add_unit_test(

doc/contribute/onboarding.rst

@@ -63,12 +63,13 @@ Note that this diagram deliberately does not represent host-to-enclave communica
 .. mermaid::
 
     flowchart TB
-        Client[HTTPS/1.1 Client <a href='../build_apps/auth/index.html'>auth</a>] -- TLS 1.2 or 1.3 --> TLSSession
-        TLSSession[TLS Session <a href='https://github.com/microsoft/CCF/blob/main/src/enclave/tls_session.h'>src</a>] -- PlainText --> HTTPSession
+        Client[HTTPS/1.1 Client <a href='../build_apps/auth/index.html'>auth</a>] -- TLS 1.2 or 1.3 --> TLSConnection
+        TLSConnection[TLS Connection <a href='https://github.com/microsoft/CCF/blob/main/src/host/tls/openssl_server.h'>src</a>] -- PlainText --> HTTPSession
+        HTTPSession -- PlainText --> SessionWriter[Session Writer <a href='https://github.com/microsoft/CCF/blob/main/include/ccf/node/session.h'>src</a>]
+        SessionWriter --> TLSConnection
         HTTPSession[HTTP Session <a href='https://github.com/microsoft/CCF/blob/main/src/http/http_session.h'>src</a>] -- Request --> Endpoint[Application Endpoint <a href='../build_apps/api.html#application-endpoint-registration'>doc</a>]
         Endpoint -- Response --> HTTPSession
-        HTTPSession --> TLSSession
-        TLSSession --> Client
+        TLSConnection --> Client
         Endpoint -- WriteSet --> Store[Store <a href='../build_apps/kv/index.html'>doc</a>]
         Store -- LedgerEntry --> Ledger[Ledger <a href='../architecture/ledger.html'>doc</a>]
         Ledger -- LedgerEntry --> Disk

include/ccf/node/session.h

@@ -3,7 +3,7 @@
 #pragma once
 
 #include <cstdint>
-#include <span>
+#include <vector>
 
 namespace ccf
 {
@@ -12,8 +12,55 @@ namespace ccf
   public:
     virtual ~Session() = default;
 
-    virtual void handle_incoming_data(std::span<const uint8_t> data) = 0;
+    // Inbound bytes for this session. Ownership is transferred, so that the
+    // buffer the transport has already built is moved through the session
+    // rather than copied again.
+    virtual void handle_incoming_data(std::vector<uint8_t>&& data) = 0;
     virtual void send_data(std::vector<uint8_t>&& data) = 0;
     virtual void close_session() = 0;
   };
+
+  // Abstract output sink injected into Sessions: a Session hands its outbound
+  // bytes (and connection-teardown requests) to a SessionWriter, which is
+  // implemented by the RPC transport.
+  //
+  // IMPORTANT: Sessions may invoke these methods from worker threads, so
+  // implementations MUST be thread-safe and must marshal any socket operations
+  // onto their I/O thread if required.
+  class SessionWriter
+  {
+  public:
+    virtual ~SessionWriter() = default;
+
+    // `id` throughout is the connection identifier the session was created
+    // with (ccf::tls::ConnID).
+
+    // Queue bytes to be written to the socket associated with `id`. Ownership
+    // is transferred, so that a response which may be arbitrarily large is
+    // moved through to the transport rather than copied again.
+    //
+    // Fire-and-forget: there is currently no backpressure signal.
+    //
+    // FUTURE: to surface genuine TCP-layer backpressure, an implementation
+    // should report when a connection's pending-write queue exceeds a watermark
+    // (tracking per-connection queued bytes) and return a writable/would-block
+    // status here.
+    virtual void write_outbound(int64_t id, std::vector<uint8_t>&& data) = 0;
+
+    // Tear down the connection: stop the underlying socket and drop the
+    // session.
+    virtual void close_socket(int64_t id) = 0;
+
+    // Report that `bytes` of previously delivered inbound data have now been
+    // processed. The transport uses this to decide when it may read more: it
+    // stops reading once the node is holding more unprocessed inbound data
+    // than it is willing to, and resumes as sessions catch up. Without it a
+    // client could make the node queue work faster than it retires it, for as
+    // long as it liked.
+    //
+    // A session which does not report is not penalised beyond its own
+    // connection - the transport releases whatever is still outstanding when
+    // the connection closes - so this defaults to a no-op.
+    virtual void inbound_consumed(int64_t /*id*/, size_t /*bytes*/) {}
+  };
 }

include/ccf/node/startup_config.h

@@ -29,6 +29,12 @@ namespace ccf
 
     ccf::ds::SizeString historical_cache_soft_limit = {"512MB"};
 
+    // How long an idle RPC (client TLS) connection is kept before it is closed.
+    // std::nullopt disables idle closure (connections are never closed for
+    // being idle).
+    std::optional<ccf::ds::TimeString> idle_connection_timeout =
+      ccf::ds::TimeString("60s");
+
     ccf::consensus::Configuration consensus = {};
     ccf::NodeInfoNetwork network;
 

include/ccf/research/custom_protocol_subsystem_interface.h

@@ -16,15 +16,14 @@ namespace ccf
 {
   namespace tls
   {
-    class Context;
     using ConnID = int64_t;
   }
 
   class CustomProtocolSubsystemInterface : public AbstractNodeSubSystem
   {
   public:
     using CreateSessionFn = std::function<std::shared_ptr<Session>(
-      ccf::tls::ConnID, const std::unique_ptr<tls::Context>&&)>;
+      ccf::tls::ConnID, ccf::SessionWriter&)>;
 
     ~CustomProtocolSubsystemInterface() override = default;
 
@@ -41,7 +40,7 @@ namespace ccf
     virtual std::shared_ptr<Session> create_session(
       const std::string& protocol_name,
       ccf::tls::ConnID conn_id,
-      const std::unique_ptr<tls::Context>&& ctx) = 0;
+      ccf::SessionWriter& writer) = 0;
 
     struct Essentials
     {

scripts/source-dependencies.json

@@ -31,8 +31,6 @@
     "tasks": ["ds"],
     "tcp": ["ds"],
     "threading": [],
-    "tls": ["crypto", "ds"],
-    "udp": ["ds"],
     "uv": [],
     "http": ["ccf-api", "crypto", "ds"],
     "http_client": ["ccf-api", "ds", "uv"]