Skip to content

TLS on Darwin: Add explainer that MTELG supports all options #367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 13, 2021
Merged

TLS on Darwin: Add explainer that MTELG supports all options #367

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions Sources/AsyncHTTPClient/NIOTransportServices/TLSConfiguration.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,13 @@
func getNWProtocolTLSOptions() -> NWProtocolTLS.Options {
let options = NWProtocolTLS.Options()

let useMTELGExplainer = """
You can still use this configuration option on macOS if you initialize HTTPClient \
with a MultiThreadedEventLoopGroup. Please note that using MultiThreadedEventLoopGroup \
will make AsyncHTTPClient use NIO on BSD Sockets and not Network.framework (which is the preferred \
platform networking stack).
"""

// minimum TLS protocol
if #available(macOS 10.15, iOS 13.0, tvOS 13.0, watchOS 6.0, *) {
sec_protocol_options_set_min_tls_protocol_version(options.securityProtocolOptions, self.minimumTLSVersion.nwTLSProtocolVersion)
Expand All @@ -88,7 +95,7 @@

// the certificate chain
if self.certificateChain.count > 0 {
preconditionFailure("TLSConfiguration.certificateChain is not supported")
preconditionFailure("TLSConfiguration.certificateChain is not supported. \(useMTELGExplainer)")
}

// cipher suites
Expand All @@ -99,20 +106,20 @@

// key log callback
if self.keyLogCallback != nil {
preconditionFailure("TLSConfiguration.keyLogCallback is not supported")
preconditionFailure("TLSConfiguration.keyLogCallback is not supported. \(useMTELGExplainer)")
}

// private key
if self.privateKey != nil {
preconditionFailure("TLSConfiguration.privateKey is not supported")
preconditionFailure("TLSConfiguration.privateKey is not supported. \(useMTELGExplainer)")
}

// renegotiation support key is unsupported

// trust roots
if let trustRoots = self.trustRoots {
guard case .default = trustRoots else {
preconditionFailure("TLSConfiguration.trustRoots != .default is not supported")
preconditionFailure("TLSConfiguration.trustRoots != .default is not supported. \(useMTELGExplainer)")
}
}

Expand All @@ -127,7 +134,8 @@
)

case .noHostnameVerification:
precondition(self.certificateVerification != .noHostnameVerification, "TLSConfiguration.certificateVerification = .noHostnameVerification is not supported")
precondition(self.certificateVerification != .noHostnameVerification,
"TLSConfiguration.certificateVerification = .noHostnameVerification is not supported. \(useMTELGExplainer)")

case .fullVerification:
break
Expand Down