SSL support by viktorasl · Pull Request #427 · httpswift/swifter

viktorasl · 2019-08-02T07:40:57Z

Motivation

To have SSL support and be able to use HTTPS. The use cases of swifter library will be much broader.
Our company use swifter to run mock API server in iOS UI tests (https://github.com/treatwell/twuitests), but currently arbitrary loads have to be enabled in iOS app because iOS enforces using SSL connections.

What's in this PR

This PR introduces SSL support using TLS session on Darwin OS (if everything will turn out fine I'll try adding support for Linux OS as well).

Demo optional localhost (if appears at ~/.swifter/localhost.p12) certificate loading is added to SwifterSampleOSX target.

Closes#111 #395

How did I test it?

Using mkcert tool:

mkcert -install
mkcert -pkcs12 localhost 127.0.0.1 ::1

and then imported generated .p12 file to System keychain.

swifter-bot · 2019-08-02T07:41:31Z

	1 Error
🚫	Please include a CHANGELOG entry. You can find it at CHANGELOG.md.

	2 Warnings
⚠️	It seems like you’ve added new tests to the library. If that’s the case, please update the XCTestManifests.swift file running in your terminal the command `swift test --generate-linuxmain`.
⚠️	If you ran the command `swift test --generate-linuxmain` in your terminal, please remove the line `testCase(IOSafetyTests.__allTests__IOSafetyTests),` from `public func __allTests() -> [XCTestCaseEntry]` in the bottom of the file. For more reference see #366.

	1 Message
📖	Hey, @viktorasl 👋.

Generated by 🚫 Danger

Vkt0r · 2019-08-05T00:53:58Z

Hey, @viktorasl Thanks for taking the time to create this. I'll try to check your PR during this week, can you please in the meantime fix the issues with Danger? Thanks.

Vkt0r · 2019-08-22T20:43:02Z

+ /// - Parameter _data: .p12 certificate file content
+ /// - Parameter password: password used when importing certificate
+ public static func loadP12Certificate(_ _data: Data, _ password: String) throws -> CFArray {
+ let data = _data as NSData


SecPKCS12Import(_:_:_:) is expecting a CFData here, what would be the difference between passing an NSData object instead of a CFData here?

Most of Core Foundation types are toll-free bridged to their Cocoa Foundation counterparts and can be used interchangeably. But I agree, it's better to use actually expected type names here. Will fix that.
/cc https://developer.apple.com/documentation/corefoundation/cfdata-rv9
/cc https://developer.apple.com/library/archive/documentation/General/Conceptual/CocoaEncyclopedia/Toll-FreeBridgin/Toll-FreeBridgin.html

Vkt0r · 2019-08-22T20:44:31Z

+ public static func loadP12Certificate(_ _data: Data, _ password: String) throws -> CFArray {
+ let data = _data as NSData
+ let options = [kSecImportExportPassphrase: password]
+ var items: CFArray!


Can we please make this CFArray optional in order to avoid the force-unwrapping in the next lines?

Vkt0r · 2019-08-22T20:48:44Z

+ /// - Parameter password: password used when importing certificate
+ public static func loadP12Certificate(_ _data: Data, _ password: String) throws -> CFArray {
+ let data = _data as NSData
+ let options = [kSecImportExportPassphrase: password]


In the way Apple does it in the page you referenced they make a cast to String like this:
letoptions=[ kSecImportExportPassphrase asString: password ]
Do we know what difference could generate?

Related to same discussion of String, NSString and CFString I believe they're all the same.

Vkt0r · 2019-08-22T20:54:04Z

+ let data = _data as NSData
+ let options = [kSecImportExportPassphrase: password]
+ var items: CFArray!
+ try ensureNoErr(SecPKCS12Import(data, options as NSDictionary, &items))


SecPKCS12Import(_:_:_:) is expecting a UnsafeMutablePointer<CFArray?>What are differences here between pass a UnsafeMutablePointer<CFArray?> and raw CFArray?. Wouldn't be more type-safe to pass a type like this:
tryensureNoErr(withUnsafeMutablePointer(to:&items){SecPKCS12Import(data, options asCFDictionary, $0)})

Not fully sure what &items generates but I assume it's something like a pointer to CFArray. Used https://developer.apple.com/documentation/security/certificate_key_and_trust_services/identities/importing_an_identity as an example.

Vkt0r · 2019-08-22T21:05:19Z

+ let options = [kSecImportExportPassphrase: password]
+ var items: CFArray!
+ try ensureNoErr(SecPKCS12Import(data, options as NSDictionary, &items))
+ let dictionary = (items! as [AnyObject])[0]


The items would be of [[String: Any]], can we please cast it as optional and use firsts instead of the first index directly? Something like this maybe:
guardlet dictionary =(items as?[[String:Any]]).first else{throw SomeError }

Vkt0r · 2019-08-22T21:21:30Z

+ var items: CFArray!
+ try ensureNoErr(SecPKCS12Import(data, options as NSDictionary, &items))
+ let dictionary = (items! as [AnyObject])[0]
+ let secIdentity = dictionary[kSecImportItemIdentity] as! SecIdentity


Same here we can please avoid the force-unwrapping even when Apple does in his examples?

Well, this cannot quite be avoided, because when trying to make it optional compiler produces
Conditional downcast to CoreFoundation type 'SecIdentity' will always succeed error

Vkt0r · 2019-08-22T21:24:03Z

+ let dictionary = (items! as [AnyObject])[0]
+ let secIdentity = dictionary[kSecImportItemIdentity] as! SecIdentity
+ let chain = dictionary[kSecImportItemCertChain] as! [SecCertificate]
+ let certs = [secIdentity] + chain.dropFirst().map { $0 as Any }


Any reason we are dropping the first SecCertificate ?

from SSLSetCertificate:
You must place in certRefs[0] a SecIdentityRef object that identifies the leaf certificate and its corresponding private key
so secIdentity already identifies leaf certificate so that leaf certificate should be dropped from chain otherwise chain becomes invalid due to duplicate certs.

Vkt0r · 2019-08-22T21:48:19Z

I'll be reviewing more soon and I'll try to test it locally with the certificates also.

viktorasl · 2019-08-23T05:56:23Z

I'll probably fix everything after more thorough reviews.

Vkt0r · 2019-08-29T14:52:44Z

Sure, please let me know to continue with the review as it's a little long.

Vkt0r · 2019-09-26T15:02:41Z

@viktorasl Are you still interested in this PR? Please continue with the rest of the changes to be able to continue reviewing it 🙂.

viktorasl · 2019-09-27T06:22:45Z

Hm, miscommunication happened. I was about to apply changes after your full review. But as I understand that I should apply changes now. I'll do that.

Vkt0r · 2019-09-27T14:00:58Z

Ups yes it was sorry about that ☹️. Sounds good please apply the changes in order to continue. Thanks again for your PR!

MartyCatawiki · 2019-10-24T12:10:16Z

Any news around this? It would be really nice when SSL support is added soon.

Vkt0r · 2019-10-24T15:06:30Z

@MartyCatawiki @viktorasl I would be reviewing the latest changes ASAP. Sorry for the delay 😞.

viktorasl · 2019-10-26T10:34:02Z

Sorry it took me so long. Fixed according to comments, please check it out

Vkt0r · 2019-10-29T03:11:40Z

@viktorasl I'll during the week! Thanks for the heads up.

Vkt0r · 2019-11-05T04:48:21Z

+ #if !os(Linux)
+ public class func sslError(from status: OSStatus) -> Error {
+ guard let msg = SecCopyErrorMessageString(status, nil) else {
+ return SocketError.tlsSessionFailed("<\(status): message is not provided>")
+ }
+ return SocketError.tlsSessionFailed(msg as NSString as String)
+ }
+ #endif


SecCopyErrorMessageString is only available for iOS 11.3+ and we're supporting iOS 8+, not sure which is the counterpart here.

Good catch! Very weird that Xcode didn't notify me.
Could not find any counterpart so formed custom message.

Vkt0r · 2019-11-05T04:54:10Z

@viktorasl Can you please compile your PR with Xcode 11.1. I'm getting errors trying to compile it in order to continue the review. Thanks.

viktorasl · 2019-11-05T11:31:27Z

@viktorasl Can you please compile your PR with Xcode 11.1. I'm getting errors trying to compile it in order to continue the review. Thanks.

Found the issue regarding force cast and added swiftlint rule ignore for that one particular line. Hope it solves the problem.

ismetanin · 2019-12-22T14:29:23Z

@viktorasl Hi! Could we use this functionality on iOS? Maybe you can add some examples and instructions to the SwifterSampleiOS?
Hope to see this pull request merged :)

viktorasl · 2019-12-23T07:07:00Z

@viktorasl Hi! Could we use this functionality on iOS? Maybe you can add some examples and instructions to the SwifterSampleiOS?
Hope to see this pull request merged :)

I can look into that 👍 not sure if all APIs are supported on iOS.

ismetanin · 2020-01-15T09:33:42Z

Hey @viktorasl
Have you had time to take a look at that? I tried to run it on iOS but I had some problems with certificates probably or not - anyway I couldn't make it work on iOS

alinmuntean · 2021-07-06T08:35:08Z

Hi guys, any update on this feature?

linhaosunny · 2024-06-14T07:53:43Z

hei, it's that any update for this?

linhaosunny · 2024-06-19T10:34:31Z

@viktorasl this fork commit use ssl can't send data over 16384 bytes,

viktorasl added 8 commits August 1, 2019 17:18

Provide initial API for socket TLS session
8265d2c

Introduce SSL .p12 certificate import API
c3923e3

Load demo SSL localhost certificate
2f394db

Setup TLS session connection
ff4257a

Perform SSL handshake
756716d

Perform reading & writing using TLS session
c5caed9

Add brief docs about SSL/TLS to Readme
5d64270

Document .p12 certificate loading method
d128cbf

Vkt0r requested review from Vkt0r, adamkaplan and pvzig August 5, 2019 00:54

Vkt0r reviewed Aug 22, 2019
View reviewed changes

Make p12 SSL cert load more type safe
88c4578

Vkt0r reviewed Nov 5, 2019
View reviewed changes

Form custom SSL error message if API not available
bfce850

Vkt0r force-pushed the stable branch from 046604e to 9483a5dCompare September 26, 2020 17:56

Uh oh!

Conversation

viktorasl commented Aug 2, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

What's in this PR

How did I test it?

Uh oh!

swifter-bot commented Aug 2, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Vkt0r commented Aug 5, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Vkt0rAug 22, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

viktoraslAug 23, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Vkt0r commented Aug 22, 2019

Uh oh!

viktorasl commented Aug 23, 2019

Uh oh!

Vkt0r commented Aug 29, 2019

Uh oh!

Vkt0r commented Sep 26, 2019

Uh oh!

viktorasl commented Sep 27, 2019

Uh oh!

Vkt0r commented Sep 27, 2019

Uh oh!

MartyCatawiki commented Oct 24, 2019

Uh oh!

Vkt0r commented Oct 24, 2019

Uh oh!

viktorasl commented Oct 26, 2019

Uh oh!

Vkt0r commented Oct 29, 2019

Uh oh!

Vkt0rNov 5, 2019• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Vkt0r commented Nov 5, 2019

Uh oh!

viktorasl commented Nov 5, 2019

Uh oh!

ismetanin commented Dec 22, 2019

Uh oh!

viktorasl commented Dec 23, 2019

Uh oh!

ismetanin commented Jan 15, 2020• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alinmuntean commented Jul 6, 2021

Uh oh!

viktorasl commented Aug 2, 2019•
edited
Loading

swifter-bot commented Aug 2, 2019•
edited
Loading

Vkt0rAug 22, 2019•
edited
Loading

viktoraslAug 23, 2019•
edited
Loading

Vkt0rNov 5, 2019•
edited
Loading

ismetanin commented Jan 15, 2020•
edited
Loading