chore(transport): retire the legacy TCP package

Dockerfile

@@ -42,7 +42,6 @@ FROM mcr.microsoft.com/dotnet/sdk:10.0-${CONTAINER_RUNTIME} AS test
 WORKDIR /build
 COPY --from=build ./build/published-tests ./published-tests
 COPY --from=build ./build/ci ./ci
-COPY --from=build ./build/src/EventStore.Core.Tests/Services/Transport/Tcp/test_certificates/ca/ca.crt /usr/local/share/ca-certificates/ca_eventstore_test.crt
 COPY ./scripts/test.sh /build/test.sh
 RUN mkdir ./test-results
 RUN chmod +x /build/test.sh

scripts/test.sh

@@ -3,8 +3,6 @@
 set -o pipefail
 set -o xtrace
 
-update-ca-certificates
-
 core_grpc_security_projects=(
     EventStore.Core.Tests
 )

src/Directory.Packages.props

@@ -10,7 +10,6 @@
     <PackageVersion Include="DotNext.IO" Version="5.26.3" />
     <PackageVersion Include="DotNext.Threading" Version="5.26.3" />
     <PackageVersion Include="DotNext.Unsafe" Version="5.26.2" />
-    <PackageVersion Include="EventStore.Client" Version="21.2.0" />
     <PackageVersion Include="EventStore.Client.Grpc.Streams" Version="23.3.9" />
     <PackageVersion Include="EventStore.Client.Grpc.Operations" Version="23.3.9" />
     <!--Version 8 and beyond are free for open-source projects and non-commercial use, but commercial use requires a paid license-->

src/EventStore.Core.Tests/EventStore.Core.Tests.csproj

@@ -27,11 +27,8 @@
 		<ProjectReference Include="..\EventStore.Core\EventStore.Core.csproj" />
 		<ProjectReference Include="..\EventStore.ClusterNode\EventStore.ClusterNode.csproj" PrivateAssets="all" />
 		<ProjectReference Include="..\EventStore.PluginHosting\EventStore.PluginHosting.csproj" />
-		<ProjectReference Include="..\EventStore.Transport.Tcp\EventStore.Transport.Tcp.csproj" />
 	</ItemGroup>
 	<ItemGroup>
-		<EmbeddedResource Include="Services\Transport\Tcp\test_certificates\**\*.crt" />
-		<EmbeddedResource Include="Services\Transport\Tcp\test_certificates\**\*.key" />
 		<EmbeddedResource Remove="FakePlugin\**" />
 	</ItemGroup>
 	<ItemGroup>

src/EventStore.Core.Tests/Services/Transport/Grpc/Replication/ReplicationMutualTlsTests.cs

@@ -0,0 +1,144 @@
+using System;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
+using System.Threading.Tasks;
+using EventStore.ClusterNode;
+using EventStore.Common.Utils;
+using EventStore.Core.Authorization;
+using EventStore.Core.Bus;
+using EventStore.Core.Messages;
+using EventStore.Core.Messaging;
+using EventStore.Core.Services.Replication;
+using EventStore.Core.Services.Transport.Grpc.Replication;
+using EventStore.Core.Services.Transport.Http.NodeHttpClientFactory;
+using EventStore.Core.Tests.Helpers;
+using Grpc.Core;
+using Grpc.Net.Client;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.AspNetCore.Server.Kestrel.Core;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using NUnit.Framework;
+using Proto = EventStore.Replication;
+
+namespace EventStore.Core.Tests.Services.Transport.Grpc.Replication;
+
+[TestFixture]
+public class ReplicationMutualTlsTests
+{
+	[Test]
+	public async Task trusted_client_certificate_reaches_replication_with_certificate_identity()
+	{
+		using var root = TestCertificates.GetRootCertificate();
+		using var serverCertificate = TestCertificates.GetServerCertificate();
+		using var clientCertificate = TestCertificates.GetOtherServerCertificate();
+		var publisher = new CapturingPublisher();
+		using var host = StartServer(serverCertificate, new X509Certificate2Collection(root), publisher);
+		using var channel = CreateChannel(host, clientCertificate, new X509Certificate2Collection(root));
+		var client = new Proto.Replication.ReplicationClient(channel);
+		using var call = client.Replicate(deadline: DateTime.UtcNow.AddSeconds(10));
+
+		await call.RequestStream.WriteAsync(SubscribeFrame());
+		await call.RequestStream.CompleteAsync();
+		Assert.That(await call.ResponseStream.MoveNext(), Is.False);
+		Assert.That(publisher.Messages.OfType<ReplicationMessage.ReplicaSubscriptionRequest>().Count(), Is.EqualTo(1));
+		Assert.That(publisher.Messages.OfType<ReplicationMessage.ReplicaSubscriptionRequest>().Single()
+			.Session.Identity.TransportIdentityKind,
+			Is.EqualTo(ReplicationTransportIdentityKind.ClientCertificateSha256));
+	}
+
+	[Test]
+	public async Task secure_replication_without_client_certificate_is_rejected_by_application_identity()
+	{
+		using var root = TestCertificates.GetRootCertificate();
+		using var serverCertificate = TestCertificates.GetServerCertificate();
+		var publisher = new CapturingPublisher();
+		using var host = StartServer(serverCertificate, new X509Certificate2Collection(root), publisher);
+		using var channel = CreateChannel(host, null, new X509Certificate2Collection(root));
+		var client = new Proto.Replication.ReplicationClient(channel);
+		using var call = client.Replicate(deadline: DateTime.UtcNow.AddSeconds(10));
+
+		await call.RequestStream.WriteAsync(SubscribeFrame());
+		await call.RequestStream.CompleteAsync();
+		var exception = Assert.ThrowsAsync<RpcException>(async () => await call.ResponseStream.MoveNext());
+		Assert.That(exception!.StatusCode, Is.EqualTo(StatusCode.Unauthenticated));
+		Assert.That(publisher.Messages, Is.Empty);
+	}
+
+	private static IHost StartServer(
+		X509Certificate2 serverCertificate,
+		X509Certificate2Collection trustedRoots,
+		IPublisher publisher)
+	{
+		var host = new HostBuilder()
+			.ConfigureWebHost(webHost => webHost
+				.UseKestrel(server => server.Listen(IPAddress.Loopback, 0, options =>
+				{
+					options.Protocols = HttpProtocols.Http2;
+					options.UseHttps(Program.CreateServerOptionsSelectionCallback(
+						() => serverCertificate,
+						() => null,
+						(certificate, chain, errors) => ClusterVNode<string>.ValidateClientCertificate(
+							certificate, chain, errors, () => null, () => trustedRoots)), null);
+				}))
+				.ConfigureServices(services =>
+				{
+					services.AddGrpc();
+					services.AddSingleton(new ReplicationService(
+						publisher, new PassthroughAuthorizationProvider()));
+				})
+				.Configure(app =>
+				{
+					app.UseRouting();
+					app.UseEndpoints(endpoints => endpoints.MapGrpcService<ReplicationService>());
+				}))
+			.Build();
+		host.Start();
+		return host;
+	}
+
+	private static GrpcChannel CreateChannel(
+		IHost host,
+		X509Certificate2 clientCertificate,
+		X509Certificate2Collection trustedRoots)
+	{
+		var factory = new NodeHttpClientFactory(
+			Uri.UriSchemeHttps,
+			(certificate, chain, errors, names) => ClusterVNode<string>.ValidateServerCertificate(
+				certificate, chain, errors, () => null, () => trustedRoots, names),
+			() => clientCertificate);
+		var httpClient = factory.CreateHttpClient(["localhost"]);
+		var address = host.Services.GetRequiredService<IServer>()
+			.Features.Get<IServerAddressesFeature>()!.Addresses.Single();
+		return GrpcChannel.ForAddress(address, new GrpcChannelOptions
+		{
+			HttpClient = httpClient,
+			DisposeHttpClient = true
+		});
+	}
+
+	private static Proto.ReplicaFrame SubscribeFrame() => ReplicationGrpcCodec.ToGrpc(
+		new ReplicationMessage.SubscribeReplica(
+			ReplicationSubscriptionVersions.V_CURRENT,
+			0,
+			Guid.NewGuid(),
+			[],
+			new DnsEndPoint("replica.internal", 1112),
+			Guid.NewGuid(),
+			Guid.NewGuid(),
+			true,
+			Guid.NewGuid()));
+
+	private sealed class CapturingPublisher : IPublisher
+	{
+		public ConcurrentQueue<Message> Messages { get; } = new();
+
+		public void Publish(Message message) => Messages.Enqueue(message);
+	}
+}

src/EventStore.Core.Tests/Services/Transport/Http/ssl_connections_mutual_auth.cs

@@ -0,0 +1,168 @@
+using System;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
+using System.Threading.Tasks;
+using EventStore.ClusterNode;
+using EventStore.Common.Utils;
+using EventStore.Core.Services.Transport.Http.NodeHttpClientFactory;
+using EventStore.Core.Tests.Helpers;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Hosting.Server;
+using Microsoft.AspNetCore.Hosting.Server.Features;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Services.Transport.Http;
+
+[TestFixture]
+public class ssl_connections_mutual_auth
+{
+	[TestCase(true, true, true, true, true)]
+	[TestCase(true, false, true, true, false)]
+	[TestCase(false, true, true, true, false)]
+	[TestCase(false, false, true, true, false)]
+	[TestCase(true, true, true, false, true)]
+	[TestCase(true, false, true, false, true)]
+	[TestCase(false, true, true, false, false)]
+	[TestCase(false, false, true, false, false)]
+	[TestCase(true, true, false, true, true)]
+	[TestCase(true, false, false, true, false)]
+	[TestCase(false, true, false, true, true)]
+	[TestCase(false, false, false, true, false)]
+	[TestCase(true, true, false, false, true)]
+	[TestCase(true, false, false, false, true)]
+	[TestCase(false, true, false, false, true)]
+	[TestCase(false, false, false, false, true)]
+	public async Task connection_outcome_follows_server_and_client_certificate_policy(
+		bool useTrustedServerCertificate,
+		bool useTrustedClientCertificate,
+		bool validateServerCertificate,
+		bool validateClientCertificate,
+		bool shouldConnectSuccessfully)
+	{
+		using var rootCertificate = TestCertificates.GetRootCertificate();
+		using var serverCertificate = useTrustedServerCertificate
+			? TestCertificates.GetServerCertificate()
+			: TestCertificates.GetUntrustedCertificate();
+		using var clientCertificate = useTrustedClientCertificate
+			? TestCertificates.GetOtherServerCertificate()
+			: TestCertificates.GetUntrustedCertificate();
+		var trustedRoots = new X509Certificate2Collection(rootCertificate);
+		CertificateDelegates.ClientCertificateValidator clientValidator = validateClientCertificate
+			? (certificate, chain, errors) => ClusterVNode<string>.ValidateClientCertificate(
+				certificate,
+				chain,
+				errors,
+				() => null,
+				() => trustedRoots)
+			: (_, _, _) => (true, null);
+
+		using var host = StartServer(serverCertificate, clientValidator);
+		var connected = await TryConnect(
+			host,
+			clientCertificate,
+			validateServerCertificate,
+			trustedRoots);
+
+		Assert.That(connected, Is.EqualTo(shouldConnectSuccessfully));
+	}
+
+	[TestCase(true)]
+	[TestCase(false)]
+	public async Task client_certificate_is_optional_at_the_transport_boundary(bool validateServerCertificate)
+	{
+		using var rootCertificate = TestCertificates.GetRootCertificate();
+		using var serverCertificate = TestCertificates.GetServerCertificate();
+		var trustedRoots = new X509Certificate2Collection(rootCertificate);
+		using var host = StartServer(
+			serverCertificate,
+			(_, _, _) => throw new AssertionException("Missing client certificates bypass node validation."));
+
+		var connected = await TryConnect(
+			host,
+			clientCertificate: null,
+			validateServerCertificate,
+			trustedRoots);
+
+		Assert.That(connected, Is.True);
+	}
+
+	[Test]
+	public async Task server_certificate_is_required()
+	{
+		using var rootCertificate = TestCertificates.GetRootCertificate();
+		var trustedRoots = new X509Certificate2Collection(rootCertificate);
+		using var host = StartServer(
+			serverCertificate: null,
+			(_, _, _) => (true, null));
+
+		var connected = await TryConnect(
+			host,
+			clientCertificate: null,
+			validateServerCertificate: false,
+			trustedRoots);
+
+		Assert.That(connected, Is.False);
+	}
+
+	private static IHost StartServer(
+		X509Certificate2 serverCertificate,
+		CertificateDelegates.ClientCertificateValidator clientCertificateValidator)
+	{
+		var host = new HostBuilder()
+			.ConfigureWebHost(webHost => webHost
+				.UseKestrel(server => server.Listen(IPAddress.Loopback, 0, listenOptions =>
+					listenOptions.UseHttps(Program.CreateServerOptionsSelectionCallback(
+						() => serverCertificate,
+						() => null,
+						clientCertificateValidator), null)))
+				.Configure(app => app.Run(context => context.Response.CompleteAsync())))
+			.Build();
+		host.Start();
+		return host;
+	}
+
+	private static async Task<bool> TryConnect(
+		IHost host,
+		X509Certificate2 clientCertificate,
+		bool validateServerCertificate,
+		X509Certificate2Collection trustedRoots)
+	{
+		CertificateDelegates.ServerCertificateValidator serverValidator = validateServerCertificate
+			? (certificate, chain, errors, otherNames) => ClusterVNode<string>.ValidateServerCertificate(
+				certificate,
+				chain,
+				errors,
+				() => null,
+				() => trustedRoots,
+				otherNames)
+			: (_, _, _, _) => (true, null);
+		var clientFactory = new NodeHttpClientFactory(
+			Uri.UriSchemeHttps,
+			serverValidator,
+			() => clientCertificate);
+		using var client = clientFactory.CreateHttpClient(["localhost"]);
+		client.Timeout = TimeSpan.FromSeconds(5);
+		var address = host.Services.GetRequiredService<IServer>()
+			.Features.Get<IServerAddressesFeature>()!.Addresses.Single();
+		using var request = new HttpRequestMessage(HttpMethod.Get, address)
+		{
+			Version = HttpVersion.Version20,
+			VersionPolicy = HttpVersionPolicy.RequestVersionExact,
+		};
+
+		try
+		{
+			using var response = await client.SendAsync(request);
+			return response.IsSuccessStatusCode;
+		}
+		catch (HttpRequestException)
+		{
+			return false;
+		}
+	}
+}