-
Notifications
You must be signed in to change notification settings - Fork 48
Always use system TLS defaults #706
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
rhysparry
wants to merge
12
commits into
main
Choose a base branch
from
rhys/eft-157/os-tls-config
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
ce573b8
Always use system TLS defaults
rhysparry 3d39af8
Add extra tests to confirm SChannel cache is clean
rhysparry e7a052d
Fix test to run on Windows
rhysparry d702851
MemoryFixture workaround
rhysparry bdac208
Generate unique certificates per test to fix SChannel session-cache c…
rhysparry 433d571
Extend unique-cert-per-test fix to backwards compat builders and bad-…
rhysparry 179c0fb
merge main
rhysparry 169329d
merge main
rhysparry 0238b2e
Scope per-test unique certificates to net48
rhysparry 3b12d24
Extend unique-cert-per-test fix to client-only builder
rhysparry fbb2bc4
Trust each polling client's own certificate
rhysparry bec4508
Make listening-client trust thumbprint optional
rhysparry File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
23 changes: 23 additions & 0 deletions
23
....TestUtils.CompatBinary.SchannelProbe/Halibut.TestUtils.CompatBinary.SchannelProbe.csproj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
|
|
||
| <PropertyGroup> | ||
| <OutputType>Exe</OutputType> | ||
| <LangVersion>9.0</LangVersion> | ||
| <RootNamespace>Halibut.TestUtils.SampleProgram.SchannelProbe</RootNamespace> | ||
| <Nullable>enable</Nullable> | ||
| <TreatWarningsAsErrors>true</TreatWarningsAsErrors> | ||
| </PropertyGroup> | ||
|
|
||
| <PropertyGroup Condition="!$([MSBuild]::IsOSUnixLike())"> | ||
| <TargetFrameworks>net48;net8.0</TargetFrameworks> | ||
| </PropertyGroup> | ||
| <PropertyGroup Condition="$([MSBuild]::IsOSUnixLike())"> | ||
| <TargetFramework>net8.0</TargetFramework> | ||
| </PropertyGroup> | ||
|
|
||
| <ItemGroup> | ||
| <ProjectReference Include="..\Halibut\Halibut.csproj" /> | ||
| <ProjectReference Include="..\Halibut.TestUtils.Contracts\Halibut.TestUtils.Contracts.csproj" /> | ||
| </ItemGroup> | ||
|
|
||
| </Project> |
137 changes: 137 additions & 0 deletions
137
source/Halibut.TestUtils.CompatBinary.SchannelProbe/Program.cs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,137 @@ | ||
| using System; | ||
| using System.IO; | ||
| using System.Security.Cryptography.X509Certificates; | ||
| using System.Threading; | ||
| using System.Threading.Tasks; | ||
| using Halibut; | ||
| using Halibut.Diagnostics; | ||
| using Halibut.ServiceModel; | ||
| using Halibut.TestUtils.Contracts; | ||
|
|
||
| namespace Halibut.TestUtils.SampleProgram.SchannelProbe | ||
| { | ||
| public class Program | ||
| { | ||
| public static async Task<int> Main() | ||
| { | ||
| using var cts = new CancellationTokenSource(GetTestTimeout()); | ||
| using var _ = cts.Token.Register(() => Environment.Exit(-10060)); | ||
|
|
||
| var mode = GetSetting("mode"); | ||
| Console.WriteLine($"Mode is: {mode}"); | ||
|
|
||
| if (mode.Equals("serviceonly", StringComparison.OrdinalIgnoreCase)) | ||
| { | ||
| await RunExternalService(cts.Token); | ||
| } | ||
| else | ||
| { | ||
| Console.WriteLine($"Unknown mode: {mode}"); | ||
| throw new Exception($"Unknown mode: {mode}"); | ||
| } | ||
|
|
||
| return 1; | ||
| } | ||
|
|
||
| static async Task RunExternalService(CancellationToken cancellationToken) | ||
| { | ||
| var serviceCert = new X509Certificate2(GetSetting("tentaclecertpath")); | ||
| var octopusThumbprint = GetSetting("octopusthumbprint"); | ||
| var serviceConnectionType = ParseServiceConnectionType(GetSetting("ServiceConnectionType")); | ||
|
|
||
| var services = new DelegateServiceFactory(); | ||
| services.Register<ISayHelloService, IAsyncSayHelloService>(() => new SayHelloServiceImpl()); | ||
|
|
||
| using var tentacle = new HalibutRuntimeBuilder() | ||
| .WithServiceFactory(services) | ||
| .WithServerCertificate(serviceCert) | ||
| .WithLogFactory(new LogFactory()) | ||
| .Build(); | ||
|
|
||
| switch (serviceConnectionType) | ||
| { | ||
| case ServiceConnectionType.Polling: | ||
| var addressToPoll = GetSetting("octopusservercommsport"); | ||
| tentacle.Poll( | ||
| new Uri("poll://SQ-TENTAPOLL"), | ||
| new ServiceEndPoint(new Uri(addressToPoll), octopusThumbprint, null, new HalibutTimeoutsAndLimits()), | ||
| cancellationToken); | ||
| break; | ||
| case ServiceConnectionType.Listening: | ||
| var port = tentacle.Listen(); | ||
| Console.WriteLine($"Listening on port: {port}"); | ||
| tentacle.Trust(octopusThumbprint); | ||
| break; | ||
| default: | ||
| throw new ArgumentOutOfRangeException(nameof(serviceConnectionType)); | ||
| } | ||
|
|
||
| Console.WriteLine("RunningAndReady"); | ||
| await Console.Out.FlushAsync(); | ||
| await WaitUntilSignaledToDie(); | ||
| } | ||
|
|
||
| static async Task WaitUntilSignaledToDie() | ||
| { | ||
| var stayAliveFile = GetSetting("CompatBinaryStayAliveFilePath"); | ||
| while (true) | ||
| { | ||
| try | ||
| { | ||
| using (new FileStream(stayAliveFile, FileMode.Open, FileAccess.Read, FileShare.None)) | ||
| { | ||
| } | ||
|
|
||
| try | ||
| { | ||
| File.Delete(stayAliveFile); | ||
| } | ||
| finally | ||
| { | ||
| Environment.Exit(0); | ||
| } | ||
| } | ||
| catch (Exception) | ||
| { | ||
| } | ||
|
|
||
| if (!File.Exists(stayAliveFile)) | ||
| { | ||
| Environment.Exit(0); | ||
| } | ||
|
|
||
| await Task.Delay(2000); | ||
| } | ||
| } | ||
|
|
||
| static ServiceConnectionType ParseServiceConnectionType(string s) | ||
| { | ||
| if (Enum.TryParse(s, out ServiceConnectionType result)) | ||
| return result; | ||
| throw new Exception($"Unknown service connection type '{s}'"); | ||
| } | ||
|
|
||
| static TimeSpan GetTestTimeout() | ||
| { | ||
| var timeoutString = GetSetting("TestTimeout"); | ||
| return string.IsNullOrWhiteSpace(timeoutString) ? TimeSpan.FromMinutes(15) : TimeSpan.Parse(timeoutString); | ||
| } | ||
|
|
||
| static string GetSetting(string name) => Environment.GetEnvironmentVariable(name) ?? string.Empty; | ||
| } | ||
|
|
||
| enum ServiceConnectionType | ||
| { | ||
| Polling, | ||
| Listening | ||
| } | ||
|
|
||
| class SayHelloServiceImpl : IAsyncSayHelloService | ||
| { | ||
| public async Task<string> SayHelloAsync(string name, CancellationToken cancellationToken) | ||
| { | ||
| await Task.CompletedTask; | ||
| return name + "..."; | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| using System.Threading; | ||
| using System.Threading.Tasks; | ||
|
|
||
| namespace Halibut.TestUtils.Contracts | ||
| { | ||
| public interface ISayHelloService | ||
| { | ||
| string SayHello(string name); | ||
| } | ||
|
|
||
| public interface IAsyncSayHelloService | ||
| { | ||
| Task<string> SayHelloAsync(string name, CancellationToken cancellationToken); | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -59,11 +59,26 @@ public void TcpClientsAreDisposedCorrectly() | |
| .WriteTo.NUnitOutput() | ||
| .CreateLogger(); | ||
|
|
||
| // Two separate HalibutRuntime instances are used to avoid an SChannel session cache | ||
| // collision on Windows (.NET Framework / SslProtocols.None). SChannel's TLS session | ||
| // cache is per-process and keyed on certificate + host. If a single runtime acts as | ||
| // both a TLS server (accepting inbound connections) and a TLS client (making outbound | ||
| // polling connections) using the same certificate, SChannel can incorrectly reuse a | ||
| // server-side session for a client-side handshake, causing SSPI/TLS failures. | ||
| // | ||
| // - server: pure TLS server — accepts inbound connections from listening tentacles. | ||
| // Uses Certificates.Octopus. | ||
| // - pollingServer: pure TLS client — only makes outbound polling connections to tentacles. | ||
| // Must use a DIFFERENT certificate (Certificates.TentacleListening) so | ||
| // that SChannel never sees the same cert in both server and client roles | ||
| // within this process. | ||
| HalibutRuntime? server = null; | ||
| HalibutRuntime? pollingServer = null; | ||
|
|
||
| try | ||
| { | ||
| server = RunServer(Certificates.Octopus, out var port); | ||
| pollingServer = RunPollingServer(Certificates.TentacleListening); | ||
|
|
||
| var expectedTcpClientCount = 1; //server listen = 1 tcpclient | ||
| //valid requests | ||
|
|
@@ -75,13 +90,15 @@ public void TcpClientsAreDisposedCorrectly() | |
| for (var i = 0; i < NumberOfClients; i++) | ||
| { | ||
| expectedTcpClientCount++; // each time the server polls, it keeps a tcpclient (as we dont have support to say StopPolling) | ||
| RunPollingClient(server, Certificates.TentaclePolling, Certificates.TentaclePollingPublicThumbprint).GetAwaiter().GetResult(); | ||
| RunPollingClient(pollingServer, Certificates.TentaclePolling, Certificates.TentaclePollingPublicThumbprint).GetAwaiter().GetResult(); | ||
| } | ||
|
|
||
| #if SUPPORTS_WEB_SOCKET_CLIENT | ||
| //setup polling websocket | ||
| AddSslCertToLocalStoreAndRegisterFor("0.0.0.0:8434"); | ||
| for (var i = 0; i < NumberOfClients; i++) | ||
| { | ||
| RunWebSocketPollingClient(server, Certificates.TentaclePolling, Certificates.TentaclePollingPublicThumbprint, Certificates.OctopusPublicThumbprint).GetAwaiter().GetResult(); | ||
| RunWebSocketPollingClient(pollingServer, Certificates.TentaclePolling, Certificates.TentaclePollingPublicThumbprint, Certificates.TentacleListeningPublicThumbprint).GetAwaiter().GetResult(); | ||
| } | ||
| #endif | ||
|
|
||
|
|
@@ -106,6 +123,7 @@ public void TcpClientsAreDisposedCorrectly() | |
| finally | ||
| { | ||
| server?.DisposeAsync().GetAwaiter().GetResult(); | ||
| pollingServer?.DisposeAsync().GetAwaiter().GetResult(); | ||
| } | ||
| } | ||
|
|
||
|
|
@@ -142,16 +160,33 @@ static HalibutRuntime RunServer(X509Certificate2 serverCertificate, out int port | |
| .WithLogFactory(new TestContextLogFactory("client", LogLevel.Info)) | ||
| .Build(); | ||
|
|
||
| //set up listening | ||
| // Trust the listening tentacle certificate for inbound connections. | ||
| // This runtime only accepts connections — it never makes outbound polling connections — | ||
| // keeping it in a pure TLS server role (see declaration comment above). | ||
| server.Trust(Certificates.TentacleListeningPublicThumbprint); | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Comment here probs doesn't help |
||
| port = server.Listen(); | ||
|
|
||
| //setup polling websocket | ||
| AddSslCertToLocalStoreAndRegisterFor("0.0.0.0:8434"); | ||
|
|
||
| return server; | ||
| } | ||
|
|
||
| // pollingServer intentionally uses Certificates.TentacleListening rather than | ||
| // Certificates.Octopus (which server uses). This keeps the two certificates in distinct | ||
| // TLS roles within this process: Octopus is used only as a TLS server cert (by server), | ||
| // and TentacleListening is used only as a TLS client cert (here, and in RunListeningClient). | ||
| // Using the same cert in both roles would trigger an SChannel session-cache collision on | ||
| // Windows with SslProtocols.None (see declaration comment above). | ||
|
Comment on lines
+172
to
+177
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove this comment it is explained above. |
||
| static HalibutRuntime RunPollingServer(X509Certificate2 serverCertificate) | ||
| { | ||
| var services = new DelegateServiceFactory(); | ||
| services.Register<ICalculatorService, IAsyncCalculatorService>(() => new AsyncCalculatorService()); | ||
|
|
||
| return new HalibutRuntimeBuilder() | ||
| .WithServerCertificate(serverCertificate) | ||
| .WithServiceFactory(services) | ||
| .WithLogFactory(new TestContextLogFactory("polling-server", LogLevel.Info)) | ||
| .Build(); | ||
| } | ||
|
|
||
| static async Task RunListeningClient(X509Certificate2 clientCertificate, int port, string remoteThumbprint, bool expectSuccess = true) | ||
| { | ||
| await using (var runtime = new HalibutRuntimeBuilder().WithServerCertificate(clientCertificate).Build()) | ||
|
|
@@ -169,9 +204,13 @@ static async Task RunPollingClient(HalibutRuntime server, X509Certificate2 clien | |
| .Build()) | ||
| { | ||
| runtime.Listen(new IPEndPoint(IPAddress.IPv6Any, 8433)); | ||
| runtime.Trust(Certificates.OctopusPublicThumbprint); | ||
| // Trust the thumbprint of pollingServer's certificate (TentacleListening), which is | ||
| // the cert pollingServer presents when it dials in to establish the polling connection. | ||
| runtime.Trust(Certificates.TentacleListeningPublicThumbprint); | ||
|
|
||
| //setup polling | ||
| // The remote thumbprint here is this runtime's own certificate (TentaclePolling), | ||
| // which pollingServer verifies when it connects to port 8433. | ||
| var serverEndpoint = new ServiceEndPoint(new Uri("https://localhost:8433"), Certificates.TentaclePollingPublicThumbprint, runtime.TimeoutsAndLimits) | ||
| { | ||
| TcpClientConnectTimeout = TimeSpan.FromSeconds(5) | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why don't the existing compat bins that run halibut work for the test?