More TLS tests

source/Halibut.Tests.DotMemory/Halibut.Tests.DotMemory.csproj

@@ -39,7 +39,7 @@
         <PackageReference Include="Serilog.Sinks.NUnit" Version="1.0.3" />
         <PackageReference Include="System.Diagnostics.PerformanceCounter" Version="6.0.1" />
         <PackageReference Include="TeamCity.VSTest.TestAdapter" Version="1.0.36" />
-        <PackageReference Include="Serilog" Version="2.12.0" />
+        <PackageReference Include="Serilog" Version="4.1.0" />
         <PackageReference Include="Serilog.Sinks.ColoredConsole" Version="3.0.1" />
         <PackageReference Include="Octopus.Shellfish" Version="0.2.1180" />
     </ItemGroup>

source/Halibut.Tests/Halibut.Tests.csproj

@@ -44,10 +44,11 @@
     <PackageReference Include="NUnit3TestAdapter" Version="4.4.2" />
     <PackageReference Include="Serilog.Extensions.Logging" Version="7.0.0" />
     <PackageReference Include="Serilog.Sinks.NUnit" Version="1.0.3" />
+    <PackageReference Include="Serilog.Sinks.TextWriter" Version="3.0.0" />
     <PackageReference Include="System.Diagnostics.PerformanceCounter" Version="6.0.1" />
     <PackageReference Include="System.Interactive.Async" Version="6.0.1" />
     <PackageReference Include="TeamCity.VSTest.TestAdapter" Version="1.0.36" />
-    <PackageReference Include="Serilog" Version="2.12.0" />
+    <PackageReference Include="Serilog" Version="4.1.0" />
     <PackageReference Include="Serilog.Sinks.ColoredConsole" Version="3.0.1" />
   </ItemGroup>
 

source/Halibut.Tests/Support/BackwardsCompatibility/LatestClientAndPreviousServiceVersionBuilder.cs

@@ -1,12 +1,17 @@
 using System;
+using System.Collections.Concurrent;
+using System.IO;
 using System.Threading;
 using System.Threading.Tasks;
+using Halibut.Diagnostics;
 using Halibut.Diagnostics.LogCreators;
 using Halibut.Logging;
 using Halibut.TestProxy;
 using Halibut.Tests.Support.Logging;
 using Halibut.Transport.Proxy;
 using Octopus.TestPortForwarder;
+using Serilog;
+using ILog = Halibut.Diagnostics.ILog;
 
 namespace Halibut.Tests.Support.BackwardsCompatibility
 {
@@ -21,6 +26,7 @@ public class LatestClientAndPreviousServiceVersionBuilder : IClientAndServiceBui
         ProxyFactory? proxyFactory;
         Reference<HttpProxyService>? proxyServiceReference;
         LogLevel halibutLogLevel = LogLevel.Trace;
+        StringWriter? loggerStringWriter;
         readonly OldServiceAvailableServices availableServices = new(false, false);
 
         LatestClientAndPreviousServiceVersionBuilder(ServiceConnectionType serviceConnectionType, CertAndThumbprint serviceCertAndThumbprint)
@@ -59,6 +65,12 @@ public static LatestClientAndPreviousServiceVersionBuilder ForServiceConnectionT
             }
         }
 
+        public LatestClientAndPreviousServiceVersionBuilder RecordingLogs(out StringWriter stringWriter)
+        {
+            loggerStringWriter = stringWriter = new();
+            return this;
+        }
+
         public LatestClientAndPreviousServiceVersionBuilder WithServiceVersion(Version? version)
         {
             this.version = version;
@@ -149,7 +161,11 @@ async Task<IClientAndService> IClientAndServiceBuilder.Build(CancellationToken c
 
         public async Task<ClientAndService> Build(CancellationToken cancellationToken)
         {
-            var logger = new SerilogLoggerBuilder().Build().ForContext<LatestClientAndPreviousServiceVersionBuilder>();
+            var logger = loggerStringWriter == null
+                ? new SerilogLoggerBuilder()
+                    .Build().ForContext<LatestClientAndPreviousServiceVersionBuilder>()
+                : new LoggerConfiguration().WriteTo.TextWriter(loggerStringWriter).CreateLogger();
+
             CancellationTokenSource cancellationTokenSource = new();
             if (version == null)
             {

source/Halibut.Tests/TlsFixture.cs

@@ -0,0 +1,88 @@
+// Copyright 2012-2013 Octopus Deploy Pty. Ltd.
+// 
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// 
+//   http://www.apache.org/licenses/LICENSE-2.0
+// 
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Security.Authentication;
+using System.Threading.Tasks;
+using FluentAssertions;
+using Halibut.Exceptions;
+using Halibut.Tests.Support;
+using Halibut.Tests.Support.BackwardsCompatibility;
+using Halibut.Tests.Support.TestAttributes;
+using Halibut.Tests.Support.TestCases;
+using Halibut.Tests.TestServices.Async;
+using Halibut.Tests.Util;
+using Halibut.TestUtils.Contracts;
+using NUnit.Framework;
+
+namespace Halibut.Tests
+{
+    public class TlsFixture : BaseTest
+    {
+        [Test]
+        [LatestClientAndLatestServiceTestCases(testNetworkConditions: false)]
+        public async Task LatestClientAndServiceUseBestAvailableSslProtocol(ClientAndServiceTestCase clientAndServiceTestCase)
+        {
+            await using (var clientAndService = await clientAndServiceTestCase.CreateTestCaseBuilder()
+                             .WithStandardServices()
+                             .AsLatestClientAndLatestServiceBuilder()
+                             .RecordingClientLogs(out var clientLogs)
+                             .RecordingServiceLogs(out var serviceLogs)
+                             .Build(CancellationToken))
+            {
+                var echo = clientAndService.CreateAsyncClient<IEchoService, IAsyncClientEchoService>();
+                await echo.SayHelloAsync("World");
+
+                var connectionInitiatorLogs = clientAndServiceTestCase.ServiceConnectionType == ServiceConnectionType.Listening
+                    ? clientLogs
+                    : serviceLogs;
+
+                // .NET does not support TLS 1.3 on Mac OS yet.
+                // https://github.com/dotnet/runtime/issues/1979
+                var expectedSslProtocol = RuntimeInformation.IsOSPlatform(OSPlatform.OSX)
+                    ? SslProtocols.Tls12
+                    : SslProtocols.Tls13;
+
+                connectionInitiatorLogs.Values
+                    .SelectMany(log => log.GetLogs())
+                    .Should().Contain(logEvent => logEvent.FormattedMessage.Contains($"using protocol {expectedSslProtocol}"));
+            }
+        }
+
+        [Test]
+        // [PreviousClientAndLatestServiceVersionsTestCases(testNetworkConditions: false)]
+        [LatestClientAndPreviousServiceVersionsTestCases(testNetworkConditions: false)]
+        public async Task PreviousClientXorServiceUsageMakeSslProtocolFallBackOnTls12(ClientAndServiceTestCase clientAndServiceTestCase)
+        {
+            await using (var clientAndService = await ((LatestClientAndPreviousServiceVersionBuilder)(clientAndServiceTestCase.CreateTestCaseBuilder()
+                             .WithStandardServices()))
+                             .RecordingLogs(out var stringWriter)
+                             .Build(CancellationToken))
+            {
+                var echo = clientAndService.CreateAsyncClient<IEchoService, IAsyncClientEchoService>();
+                await echo.SayHelloAsync("World");
+                const SslProtocols expectedProtocol = SslProtocols.Tls12;
+                var expectedLogFragment = clientAndServiceTestCase.ServiceConnectionType == ServiceConnectionType.Listening
+                    ? $"client connected with {expectedProtocol}"
+                    : $"using protocol {expectedProtocol}";
+                var logs = stringWriter.ToString();
+                logs.Should().Contain(expectedLogFragment);
+            }
+        }
+    }
+}

source/Halibut/Transport/DiscoveryClient.cs

@@ -42,7 +42,11 @@ public async Task<ServiceEndPoint> DiscoverAsync(ServiceEndPoint serviceEndpoint
 #if NETFRAMEWORK
                             // TODO: ASYNC ME UP!
                             // AuthenticateAsClientAsync in .NET 4.8 does not support cancellation tokens. So `cancellationToken` is not respected here.
-                            await ssl.AuthenticateAsClientAsync(serviceEndpoint.BaseUri.Host, new X509Certificate2Collection(), SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false);
+                            await ssl.AuthenticateAsClientAsync(
+                                serviceEndpoint.BaseUri.Host,
+                                new X509Certificate2Collection(),
+                                SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13,
+                                false);
 #else
                             await ssl.AuthenticateAsClientEnforcingTimeout(serviceEndpoint, new X509Certificate2Collection(), cancellationToken);
 #endif

source/Halibut/Transport/SecureListener.cs

@@ -298,11 +298,17 @@ async Task ExecuteRequest(TcpClient client)
                 {
                     log.Write(EventType.SecurityNegotiation, "Performing TLS server handshake");
 
+                    await ssl
+                        .AuthenticateAsServerAsync(
+                            serverCertificate,
+                            true,
 #pragma warning disable SYSLIB0039
-                    // See https://learn.microsoft.com/en-us/dotnet/fundamentals/syslib-diagnostics/syslib0039
-                    // TLS 1.0 and 1.1 are obsolete from .NET 7
-                    await ssl.AuthenticateAsServerAsync(serverCertificate, true, SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false).ConfigureAwait(false);
+                            // See https://learn.microsoft.com/en-us/dotnet/fundamentals/syslib-diagnostics/syslib0039
+                            // TLS 1.0 and 1.1 are obsolete from .NET 7
+                            SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13,
 #pragma warning restore SYSLIB0039
+                            false)
+                        .ConfigureAwait(false);
 
                     log.Write(EventType.SecurityNegotiation, "Secure connection established, client is not yet authenticated, client connected with {0}", ssl.SslProtocol.ToString());
 

source/Halibut/Transport/Streams/SslStreamExtensionMethods.cs

@@ -26,7 +26,7 @@ internal static async Task AuthenticateAsClientEnforcingTimeout(
 #pragma warning disable SYSLIB0039
                 // See https://learn.microsoft.com/en-us/dotnet/fundamentals/syslib-diagnostics/syslib0039
                 // TLS 1.0 and 1.1 are obsolete from .NET 7
-                EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12,
+                EnabledSslProtocols = SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13,
 #pragma warning restore SYSLIB0039
                 CertificateRevocationCheckMode = X509RevocationMode.NoCheck
             };

source/Halibut/Transport/TcpConnectionFactory.cs

@@ -47,7 +47,11 @@ public async Task<IConnection> EstablishNewConnectionAsync(ExchangeProtocolBuild
 #if NETFRAMEWORK
         // TODO: ASYNC ME UP!
         // AuthenticateAsClientAsync in .NET 4.8 does not support cancellation tokens. So `cancellationToken` is not respected here.
-        await ssl.AuthenticateAsClientAsync(serviceEndpoint.BaseUri.Host, new X509Certificate2Collection(clientCertificate), SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12, false);
+        await ssl.AuthenticateAsClientAsync(
+            serviceEndpoint.BaseUri.Host,
+            new X509Certificate2Collection(clientCertificate),
+            SslProtocols.Tls | SslProtocols.Tls11 | SslProtocols.Tls12 | SslProtocols.Tls13,
+            false);
 #else
             await ssl.AuthenticateAsClientEnforcingTimeout(serviceEndpoint, new X509Certificate2Collection(clientCertificate), cancellationToken);
 #endif

source/Octopus.TestPortForwarder/Octopus.TestPortForwarder.csproj

@@ -14,7 +14,7 @@
         <TargetFramework>net8.0</TargetFramework>
     </PropertyGroup>
     <ItemGroup>
-        <PackageReference Include="Serilog" Version="2.12.0" />
+        <PackageReference Include="Serilog" Version="4.1.0" />
     </ItemGroup>
 
     <PropertyGroup Condition=" '$(TargetFramework)' == 'net48' ">