1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
//===----------------------------------------------------------------------===//
//
// This source file is part of the SwiftNIO open source project
//
// Copyright (c) 2017-2018 Apple Inc. and the SwiftNIO project authors
// Licensed under Apache License v2.0
//
// See LICENSE.txt for license information
// See CONTRIBUTORS.txt for the list of SwiftNIO project authors
//
// SPDX-License-Identifier: Apache-2.0
//
//===----------------------------------------------------------------------===//
import NIO
extension String {
private func isIPAddress() -> Bool {
// We need some scratch space to let inet_pton write into.
var ipv4Addr = in_addr()
var ipv6Addr = in6_addr()
return self.withCString { ptr in
return inet_pton(AF_INET, ptr, &ipv4Addr) == 1 ||
inet_pton(AF_INET6, ptr, &ipv6Addr) == 1
}
}
func validateSNIServerName() throws {
guard !self.isIPAddress() else {
throw NIOSSLExtraError.cannotUseIPAddressInSNI(ipAddress: self)
}
// no 0 bytes
guard !self.utf8.contains(0) else {
throw NIOSSLExtraError.invalidSNIHostname
}
guard (1 ... 255).contains(self.utf8.count) else {
throw NIOSSLExtraError.invalidSNIHostname
}
}
}
/// A channel handler that wraps a channel in TLS using NIOSSL.
/// This handler can be used in channels that are acting as the client
/// in the TLS dialog. For server connections, use the `NIOSSLServerHandler`.
public final class NIOSSLClientHandler: NIOSSLHandler {
public convenience init(context: NIOSSLContext, serverHostname: String?) throws {
try self.init(context: context, serverHostname: serverHostname, optionalCustomVerificationCallback: nil)
}
@available(*, deprecated, renamed: "init(context:serverHostname:customVerificationCallback:)")
public init(context: NIOSSLContext, serverHostname: String?, verificationCallback: NIOSSLVerificationCallback? = nil) throws {
guard let connection = context.createConnection() else {
fatalError("Failed to create new connection in NIOSSLContext")
}
connection.setConnectState()
if let serverHostname = serverHostname {
try serverHostname.validateSNIServerName()
// IP addresses must not be provided in the SNI extension, so filter them.
do {
try connection.setServerName(name: serverHostname)
} catch {
preconditionFailure("Bug in NIOSSL (please report): \(Array(serverHostname.utf8)) passed NIOSSL's hostname test but failed in BoringSSL.")
}
}
if let verificationCallback = verificationCallback {
connection.setVerificationCallback(verificationCallback)
}
super.init(connection: connection, shutdownTimeout: context.configuration.shutdownTimeout)
}
public convenience init(context: NIOSSLContext, serverHostname: String?, customVerificationCallback: @escaping NIOSSLCustomVerificationCallback) throws {
try self.init(context: context, serverHostname: serverHostname, optionalCustomVerificationCallback: customVerificationCallback)
}
// This exists to handle the explosion of initializers we got when I tried to deprecate the first one. At least they all pass through one path now.
private init(context: NIOSSLContext, serverHostname: String?, optionalCustomVerificationCallback: NIOSSLCustomVerificationCallback?) throws {
guard let connection = context.createConnection() else {
fatalError("Failed to create new connection in NIOSSLContext")
}
connection.setConnectState()
if let serverHostname = serverHostname {
try serverHostname.validateSNIServerName()
// IP addresses must not be provided in the SNI extension, so filter them.
do {
try connection.setServerName(name: serverHostname)
} catch {
preconditionFailure("Bug in NIOSSL (please report): \(Array(serverHostname.utf8)) passed NIOSSL's hostname test but failed in BoringSSL.")
}
}
if let verificationCallback = optionalCustomVerificationCallback {
connection.setCustomVerificationCallback(CustomVerifyManager(callback: verificationCallback))
}
super.init(connection: connection, shutdownTimeout: context.configuration.shutdownTimeout)
}
}
|
