New RPCConnectionManager: Single unified manager, no ringbuffer, OpenSSL-owned sockets

[Eddy Ashton (eddyashton)]

Summary

This PR replaces the old split RPC networking path with an OpenSSL-native connection layer. Previously, socket handling lived in host-side libuv code while TLS and protocol sessions were driven through enclave-side ringbuffer messages and memory BIOs. With CCF now running as a single process, that split is no longer useful, so RPC sockets, TLS, protocol session creation, and per-interface policy now live behind a single RPC connection manager.

TLS now terminates at the connection layer. Protocol sessions receive plaintext and write responses through a SessionWriter, so HTTP, HTTP/2, and custom protocols no longer own TLS state directly. This removes the RPC ringbuffer message path, the memory-BIO TLS session layer, and the old libuv RPC connection containers.

The new transport uses non-blocking sockets bound directly to OpenSSL, and splits the work in two. The existing host libuv loop owns the server's own state - accepting connections, uv_poll_t registration, the SSL_CTX, idle connection cleanup via uv_timer_t, and closing file descriptors - and performs no SSL operations itself. Every SSL operation for a connection instead runs on that connection's own OrderedTasks queue, keeping handshakes and bulk encryption off the loop thread. The loop only schedules a pass over a connection, driven either by file descriptor readiness or by a cross-thread request (a queued write, a close, or a certificate update) marshalled through uv_async_t. A connection is serviced by at most one pass at a time. Per-interface behavior such as certificates, session caps, metrics, HTTP parser settings, and custom protocol dispatch is centralized in RPCConnectionManager.

Session caps are applied when a connection is accepted, before any TLS state exists, rather than when its first request arrives. max_open_sessions_hard is documented as a bound on connections, and counting at first-request time missed any client that completed the TCP and TLS handshakes and then went silent while still holding a file descriptor and TLS state.

Node outbound requests are outside this transport and use libcurl.

UDP remains as a small datagram transport driven by uv_poll_t. The temporary QUIC/UDP echo behavior is stateless, so it consumes no session and no interface capacity, while custom UDP protocols are routed to per-peer sessions. Native QUIC is still future work and requires OpenSSL 3.5 or later.

Structural Breakdown

OpenSSLServer is the low-level inbound connection transport. It owns the listening and accepted socket file descriptors, SSL objects, uv_poll_t handles, read/write buffers, handshake state, graceful-close state, certificate reload requests, and idle-timeout sweeping.

OpenSSLSessionManager bridges transport connections to ccf::Session. It lazily creates sessions for inbound connections, forwards plaintext bytes into sessions, implements SessionWriter, and reports connection closure back to the owner.

RPCConnectionManager is the higher-level RPC owner. It replaces the old RPC session container and owns one transport bridge per TCP interface, plus UDP interface state. It applies per-interface admission and caps, certificates, parser settings, application protocol selection, session metrics, custom protocol routing, and UDP peer demultiplexing.

SessionWriter, Session, and PlaintextSession form the new session boundary. Sessions no longer encrypt or decrypt; they parse plaintext and emit plaintext responses to their writer. HTTP/1 and HTTP/2 sessions now use this boundary.

CustomProtocolSubsystemInterface now creates sessions from (ConnID, SessionWriter&) rather than a TLS context. This matches the new layering: custom protocols see plaintext and write through the transport-neutral writer.

DatagramServer is the UDP socket transport. It uses a uv_poll_t handle on the existing libuv loop. RPCConnectionManager echoes datagrams directly for the temporary QUIC behavior, and maps UDP peers to sessions for custom datagram protocols.

Startup wiring moved accordingly. The enclave creates and owns the RPC manager, binds RPC interfaces, resolves actual bound addresses including ephemeral ports, and reports those addresses back through the enclave entry point so the host can write the RPC addresses file.

The removed files are the old RPC transport stack: RPCSessions, TLSSession, host RPC connections, legacy UDP plumbing, the old QUIC session, and the TCP/UDP ringbuffer message types that were specific to the split RPC path. Ledger, consensus, and node-to-node uses of ringbuffer and libuv are not part of this change.

[Amaury Chamayou (achamayou)]

Feels risky on its own, enough not to bundle it with this change I would say, can we keep it as a follow-up performance improvement PR?

[Eddy Ashton (eddyashton)]

Looks like this is a legitimate risk, and somehow causing consistent TSAN failures on this PR that main escapes. Tackling this separately in #8181.

[Amaury Chamayou (achamayou)]

Sharing this SSL_CTX across connections makes OpenSSL's resumption defaults effective for the first time. CCF should explicitly require a fresh authenticated key exchange for every connection:

• TLS 1.2 resumption reuses the prior master secret without a fresh ECDHE exchange, so it does not provide fresh forward secrecy. Disable both stateful session IDs and stateless RFC 5077 tickets.
• TLS 1.3 defaults to issuing two NewSessionTicket messages, enabling PSK resumption. Set the count to zero so every TLS 1.3 connection also performs a full handshake.
• Keep 0-RTT explicitly disabled. Early data is replayable, lacks fresh forward secrecy, and can arrive before current client authentication completes, which is unsafe for state-changing RPC endpoints.

Let's encode this as part of the inbound TLS policy rather than relying on OpenSSL defaults.

Suggested change

	// Disable renegotiation to avoid DoS
	SSL_CTX_set_options(
	c,
	SSL_OP_CIPHER_SERVER_PREFERENCE |
	SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
	SSL_OP_NO_RENEGOTIATION);
	// CCF requires a fresh authenticated key exchange for every connection.
	// Disable stateful session caching, stateless tickets, TLS 1.3 tickets,
	// and early data so resumption cannot weaken forward secrecy or enable
	// replayable pre-authentication requests.
	SSL_CTX_set_session_cache_mode(c, SSL_SESS_CACHE_OFF);
	if (SSL_CTX_set_num_tickets(c, 0) != 1)
	{
	return fail("SSL_CTX_set_num_tickets");
	}
	if (SSL_CTX_set_max_early_data(c, 0) != 1)
	{
	return fail("SSL_CTX_set_max_early_data");
	}
	// Disable renegotiation and stateless session tickets.
	SSL_CTX_set_options(
	c,
	SSL_OP_CIPHER_SERVER_PREFERENCE |
	SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
	SSL_OP_NO_RENEGOTIATION | SSL_OP_NO_TICKET);

[Amaury Chamayou (achamayou)]

This stricter behavior is reasonable, but it is a user-facing compatibility change. The removed tls::CA path treated an empty string as a no-op, so ccf.crypto.isValidX509CertBundle("") returned true; this replacement returns false, which can cause governance proposals that previously passed validation to be rejected. Let's add a CHANGELOG entry describing the intentional behavior change and cover the empty-input case explicitly in the tests.