Support NIO Transport Services - part 2 #184
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| //===----------------------------------------------------------------------===// | ||
| // | ||
| // This source file is part of the AsyncHTTPClient open source project | ||
| // | ||
| // Copyright (c) 2020 Apple Inc. and the AsyncHTTPClient project authors | ||
| // Licensed under Apache License v2.0 | ||
| // | ||
| // See LICENSE.txt for license information | ||
| // See CONTRIBUTORS.txt for the list of AsyncHTTPClient project authors | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| //===----------------------------------------------------------------------===// | ||
|
|
||
| #if canImport(Network) | ||
|
|
||
| import Network | ||
| import NIO | ||
| import NIOHTTP1 | ||
| import NIOTransportServices | ||
|
|
||
| extension HTTPClient { | ||
| public struct NWPOSIXError: Error, CustomStringConvertible { | ||
| /// POSIX error code (enum) | ||
| public let errorCode: POSIXErrorCode | ||
|
|
||
| /// actual reason, in human readable form | ||
| private let reason: String | ||
|
|
||
| /// Initialise a NWPOSIXError | ||
| /// - Parameters: | ||
| /// - errorType: posix error type | ||
| /// - reason: String describing reason for error | ||
| public init(_ errorCode: POSIXErrorCode, reason: String) { | ||
| self.errorCode = errorCode | ||
| self.reason = reason | ||
| } | ||
|
|
||
| public var description: String { return self.reason } | ||
| } | ||
|
|
||
| public struct NWTLSError: Error, CustomStringConvertible { | ||
| /// TLS error status. List of TLS errors can be found in <Security/SecureTransport.h> | ||
| public let status: OSStatus | ||
|
|
||
| /// actual reason, in human readable form | ||
| private let reason: String | ||
|
|
||
| /// initialise a NWTLSError | ||
| /// - Parameters: | ||
| /// - status: TLS status | ||
| /// - reason: String describing reason for error | ||
| public init(_ status: OSStatus, reason: String) { | ||
| self.status = status | ||
| self.reason = reason | ||
| } | ||
|
|
||
| public var description: String { return self.reason } | ||
| } | ||
|
|
||
| @available(macOS 10.14, iOS 12.0, tvOS 12.0, watchOS 6.0, *) | ||
| class NWErrorHandler: ChannelInboundHandler { | ||
| typealias InboundIn = HTTPClientResponsePart | ||
|
|
||
| func errorCaught(context: ChannelHandlerContext, error: Error) { | ||
| context.fireErrorCaught(NWErrorHandler.translateError(error)) | ||
| } | ||
|
|
||
| static func translateError(_ error: Error) -> Error { | ||
| if let error = error as? NWError { | ||
| switch error { | ||
| case .tls(let status): | ||
| return NWTLSError(status, reason: error.localizedDescription) | ||
| case .posix(let errorCode): | ||
| return NWPOSIXError(errorCode, reason: error.localizedDescription) | ||
| default: | ||
| return error | ||
| } | ||
| } | ||
| return error | ||
| } | ||
| } | ||
| } | ||
| #endif |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,140 @@ | ||
| //===----------------------------------------------------------------------===// | ||
| // | ||
| // This source file is part of the AsyncHTTPClient open source project | ||
| // | ||
| // Copyright (c) 2020 Apple Inc. and the AsyncHTTPClient project authors | ||
| // Licensed under Apache License v2.0 | ||
| // | ||
| // See LICENSE.txt for license information | ||
| // See CONTRIBUTORS.txt for the list of AsyncHTTPClient project authors | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| //===----------------------------------------------------------------------===// | ||
|
|
||
| #if canImport(Network) | ||
|
|
||
| import Foundation | ||
| import Network | ||
| import NIOSSL | ||
| import NIOTransportServices | ||
|
|
||
| extension TLSVersion { | ||
| /// return Network framework TLS protocol version | ||
| var nwTLSProtocolVersion: tls_protocol_version_t { | ||
| switch self { | ||
| case .tlsv1: | ||
| return .TLSv10 | ||
| case .tlsv11: | ||
| return .TLSv11 | ||
| case .tlsv12: | ||
| return .TLSv12 | ||
| case .tlsv13: | ||
| return .TLSv13 | ||
| } | ||
| } | ||
| } | ||
|
|
||
| extension TLSVersion { | ||
| /// return as SSL protocol | ||
| var sslProtocol: SSLProtocol { | ||
| switch self { | ||
| case .tlsv1: | ||
| return .tlsProtocol1 | ||
| case .tlsv11: | ||
| return .tlsProtocol11 | ||
| case .tlsv12: | ||
| return .tlsProtocol12 | ||
| case .tlsv13: | ||
| return .tlsProtocol13 | ||
| } | ||
| } | ||
| } | ||
|
|
||
| @available(macOS 10.14, iOS 12.0, tvOS 12.0, watchOS 6.0, *) | ||
| extension TLSConfiguration { | ||
| /// Dispatch queue used by Network framework TLS to control certificate verification | ||
| static var tlsDispatchQueue = DispatchQueue(label: "TLSDispatch") | ||
|
|
||
| /// create NWProtocolTLS.Options for use with NIOTransportServices from the NIOSSL TLSConfiguration | ||
| /// | ||
| /// - Parameter queue: Dispatch queue to run `sec_protocol_options_set_verify_block` on. | ||
| /// - Returns: Equivalent NWProtocolTLS Options | ||
| func getNWProtocolTLSOptions() -> NWProtocolTLS.Options { | ||
| let options = NWProtocolTLS.Options() | ||
|
|
||
| // minimum TLS protocol | ||
| if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) { | ||
| sec_protocol_options_set_min_tls_protocol_version(options.securityProtocolOptions, self.minimumTLSVersion.nwTLSProtocolVersion) | ||
| } else { | ||
| sec_protocol_options_set_tls_min_version(options.securityProtocolOptions, self.minimumTLSVersion.sslProtocol) | ||
| } | ||
|
|
||
| // maximum TLS protocol | ||
| if let maximumTLSVersion = self.maximumTLSVersion { | ||
| if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) { | ||
| sec_protocol_options_set_max_tls_protocol_version(options.securityProtocolOptions, maximumTLSVersion.nwTLSProtocolVersion) | ||
| } else { | ||
| sec_protocol_options_set_tls_max_version(options.securityProtocolOptions, maximumTLSVersion.sslProtocol) | ||
| } | ||
| } | ||
|
|
||
| // application protocols | ||
| for applicationProtocol in self.applicationProtocols { | ||
| applicationProtocol.withCString { buffer in | ||
| sec_protocol_options_add_tls_application_protocol(options.securityProtocolOptions, buffer) | ||
| } | ||
| } | ||
|
There was a problem hiding this comment. This one is also reasonably do-able, if we configure a custom trust challenge. For now, though, let's leave it as-is. There was a problem hiding this comment. I assume this would be done with There was a problem hiding this comment. That's correct. You start out with a trust that's appropriately configured (it's passed in, I believe) and you can modify it as needed. |
||
|
|
||
| // the certificate chain | ||
| if self.certificateChain.count > 0 { | ||
| preconditionFailure("TLSConfiguration.certificateChain is not supported") | ||
| } | ||
|
|
||
| // cipher suites | ||
| if self.cipherSuites.count > 0 { | ||
| // TODO: Requires NIOSSL to provide list of cipher values before we can continue | ||
| // https://github.com/apple/swift-nio-ssl/issues/207 | ||
| } | ||
|
|
||
| // key log callback | ||
| if self.keyLogCallback != nil { | ||
| preconditionFailure("TLSConfiguration.keyLogCallback is not supported") | ||
| } | ||
|
|
||
| // private key | ||
| if self.privateKey != nil { | ||
| preconditionFailure("TLSConfiguration.privateKey is not supported") | ||
| } | ||
|
|
||
| // renegotiation support key is unsupported | ||
|
|
||
| // trust roots | ||
| if let trustRoots = self.trustRoots { | ||
| guard case .default = trustRoots else { | ||
| preconditionFailure("TLSConfiguration.trustRoots != .default is not supported") | ||
| } | ||
| } | ||
|
|
||
| switch self.certificateVerification { | ||
| case .none: | ||
| // add verify block to control certificate verification | ||
| sec_protocol_options_set_verify_block( | ||
| options.securityProtocolOptions, | ||
| { _, _, sec_protocol_verify_complete in | ||
| sec_protocol_verify_complete(true) | ||
| }, TLSConfiguration.tlsDispatchQueue | ||
| ) | ||
|
|
||
| case .noHostnameVerification: | ||
| precondition(self.certificateVerification != .noHostnameVerification, "TLSConfiguration.certificateVerification = .noHostnameVerification is not supported") | ||
|
|
||
| case .fullVerification: | ||
| break | ||
| } | ||
|
|
||
| return options | ||
| } | ||
| } | ||
|
|
||
| #endif | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.