Skip to content

Commit 522b419

Browse files
gjcairogjcairo
committed
Formatting
1 parent a3a7cc7 commit 522b419

File tree

2 files changed

+150
-91
lines changed

2 files changed

+150
-91
lines changed

‎Sources/GRPCNIOTransportHTTP2Posix/TLSConfig.swift‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ extension HTTP2ServerTransport.Posix.Config {
171171
///
172172
/// If this is set to `true` but the client does not support ALPN, then the connection will be rejected.
173173
public var requireALPN: Bool
174-
174+
175175
/// Create a new HTTP2 NIO Posix server transport TLS config.
176176
/// - Parameters:
177177
/// - certificateChain: The certificates the server will offer during negotiation.
@@ -284,7 +284,7 @@ extension HTTP2ClientTransport.Posix.Config {
284284

285285
/// An optional server hostname to use when verifying certificates.
286286
public var serverHostname: String?
287-
287+
288288
/// Create a new HTTP2 NIO Posix client transport TLS config.
289289
/// - Parameters:
290290
/// - certificateChain: The certificates the client will offer during negotiation.

‎Tests/GRPCNIOTransportHTTP2Tests/HTTP2TransportTLSEnabledTests.swift‎

Lines changed: 148 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@
1414
* limitations under the License.
1515
*/
1616

17-
import GRPCNIOTransportHTTP2Posix
18-
import Testing
19-
import X509
2017
import Crypto
21-
import SwiftASN1
2218
import Foundation
19+
import GRPCNIOTransportHTTP2Posix
2320
import NIOSSL
21+
import SwiftASN1
22+
import Testing
23+
import X509
2424

2525
@Suite("HTTP/2 transport E2E tests with TLS enabled")
2626
struct HTTP2TransportTLSEnabledTests {
@@ -163,14 +163,22 @@ struct HTTP2TransportTLSEnabledTests {
163163
try await self.executeUnaryRPCForEachTransportPair { security in
164164
[
165165
HTTP2TransportTLSEnabledTests.Transport(
166-
server: .posix(.tls(.defaults(
167-
certificateChain: [.bytes(security.server.certificate, format: .der)],
168-
privateKey: .bytes(security.server.key, format: .der)
169-
))),
170-
client: .posix(.tls(.defaults {
171-
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
172-
$0.serverHostname = "localhost"
173-
}))
166+
server: .posix(
167+
.tls(
168+
.defaults(
169+
certificateChain: [.bytes(security.server.certificate, format: .der)],
170+
privateKey: .bytes(security.server.key, format: .der)
171+
)
172+
)
173+
),
174+
client: .posix(
175+
.tls(
176+
.defaults {
177+
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
178+
$0.serverHostname = "localhost"
179+
}
180+
)
181+
)
174182
)
175183
]
176184
}
@@ -181,17 +189,27 @@ struct HTTP2TransportTLSEnabledTests {
181189
try await self.executeUnaryRPCForEachTransportPair { security in
182190
[
183191
HTTP2TransportTLSEnabledTests.Transport(
184-
server: .posix(.tls(.mTLS(
185-
certificateChain: [.bytes(security.server.certificate, format: .der)],
186-
privateKey: .bytes(security.server.key, format: .der)) {
187-
$0.trustRoots = .certificates([.bytes(security.client.certificate, format: .der)])
188-
})),
189-
client: .posix(.tls(.mTLS(
190-
certificateChain: [.bytes(security.client.certificate, format: .der)],
191-
privateKey: .bytes(security.client.key, format: .der)) {
192-
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
193-
$0.serverHostname = "localhost"
194-
}))
192+
server: .posix(
193+
.tls(
194+
.mTLS(
195+
certificateChain: [.bytes(security.server.certificate, format: .der)],
196+
privateKey: .bytes(security.server.key, format: .der)
197+
) {
198+
$0.trustRoots = .certificates([.bytes(security.client.certificate, format: .der)])
199+
}
200+
)
201+
),
202+
client: .posix(
203+
.tls(
204+
.mTLS(
205+
certificateChain: [.bytes(security.client.certificate, format: .der)],
206+
privateKey: .bytes(security.client.key, format: .der)
207+
) {
208+
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
209+
$0.serverHostname = "localhost"
210+
}
211+
)
212+
)
195213
)
196214
]
197215
}
@@ -200,81 +218,122 @@ struct HTTP2TransportTLSEnabledTests {
200218
@Test("Error is surfaced when client fails server verification")
201219
// Verification should fail because the custom hostname is missing on the client.
202220
func testClientFailsServerValidation() async throws {
203-
await #expect(performing: {
204-
try await self.executeUnaryRPCForEachTransportPair { security in
205-
[
206-
HTTP2TransportTLSEnabledTests.Transport(
207-
server: .posix(.tls(.mTLS(
208-
certificateChain: [.bytes(security.server.certificate, format: .der)],
209-
privateKey: .bytes(security.server.key, format: .der)) {
210-
$0.trustRoots = .certificates([.bytes(security.client.certificate, format: .der)])
211-
})),
212-
client: .posix(.tls(.mTLS(
213-
certificateChain: [.bytes(security.client.certificate, format: .der)],
214-
privateKey: .bytes(security.client.key, format: .der)) {
215-
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
216-
}))
221+
await #expect(
222+
performing: {
223+
try await self.executeUnaryRPCForEachTransportPair { security in
224+
[
225+
HTTP2TransportTLSEnabledTests.Transport(
226+
server: .posix(
227+
.tls(
228+
.mTLS(
229+
certificateChain: [.bytes(security.server.certificate, format: .der)],
230+
privateKey: .bytes(security.server.key, format: .der)
231+
) {
232+
$0.trustRoots = .certificates([
233+
.bytes(security.client.certificate, format: .der)
234+
])
235+
}
236+
)
237+
),
238+
client: .posix(
239+
.tls(
240+
.mTLS(
241+
certificateChain: [.bytes(security.client.certificate, format: .der)],
242+
privateKey: .bytes(security.client.key, format: .der)
243+
) {
244+
$0.trustRoots = .certificates([
245+
.bytes(security.server.certificate, format: .der)
246+
])
247+
}
248+
)
249+
)
250+
)
251+
]
252+
}
253+
},
254+
throws: { error in
255+
guard let rootError = error as? RPCError else {
256+
Issue.record("Should be an RPC error")
257+
return false
258+
}
259+
#expect(rootError.code == .unavailable)
260+
#expect(
261+
rootError.message
262+
== "Channel isn't ready. The server accepted the TCP connection but closed the connection before completing the HTTP/2 connection preface."
263+
)
264+
265+
guard
266+
let sslError = rootError.cause as? NIOSSLExtraError,
267+
case .failedToValidateHostname = sslError
268+
else {
269+
Issue.record(
270+
"Should be a NIOSSLExtraError.failedToValidateHostname error, but was: \(String(describing: rootError.cause))"
217271
)
218-
]
219-
}
220-
}, throws: { error in
221-
guard let rootError = error as? RPCError else {
222-
Issue.record("Should be an RPC error")
223-
return false
224-
}
225-
#expect(rootError.code == .unavailable)
226-
#expect(rootError.message == "Channel isn't ready. The server accepted the TCP connection but closed the connection before completing the HTTP/2 connection preface.")
227-
228-
guard
229-
let sslError = rootError.cause as? NIOSSLExtraError,
230-
case .failedToValidateHostname = sslError
231-
else {
232-
Issue.record("Should be a NIOSSLExtraError.failedToValidateHostname error, but was: \(String(describing: rootError.cause))")
233-
return false
234-
}
272+
return false
273+
}
235274

236-
return true
237-
})
275+
return true
276+
}
277+
)
238278
}
239279

240280
@Test("Error is surfaced when server fails client verification")
241281
// Verification should fail because the server does not have trust roots containing the client cert.
242282
func testServerFailsClientValidation() async throws {
243-
await #expect(performing: {
244-
try await self.executeUnaryRPCForEachTransportPair { security in
245-
[
246-
HTTP2TransportTLSEnabledTests.Transport(
247-
server: .posix(.tls(.mTLS(
248-
certificateChain: [.bytes(security.server.certificate, format: .der)],
249-
privateKey: .bytes(security.server.key, format: .der)
250-
))),
251-
client: .posix(.tls(.mTLS(
252-
certificateChain: [.bytes(security.client.certificate, format: .der)],
253-
privateKey: .bytes(security.client.key, format: .der)) {
254-
$0.trustRoots = .certificates([.bytes(security.server.certificate, format: .der)])
255-
$0.serverHostname = "localhost"
256-
}))
283+
await #expect(
284+
performing: {
285+
try await self.executeUnaryRPCForEachTransportPair { security in
286+
[
287+
HTTP2TransportTLSEnabledTests.Transport(
288+
server: .posix(
289+
.tls(
290+
.mTLS(
291+
certificateChain: [.bytes(security.server.certificate, format: .der)],
292+
privateKey: .bytes(security.server.key, format: .der)
293+
)
294+
)
295+
),
296+
client: .posix(
297+
.tls(
298+
.mTLS(
299+
certificateChain: [.bytes(security.client.certificate, format: .der)],
300+
privateKey: .bytes(security.client.key, format: .der)
301+
) {
302+
$0.trustRoots = .certificates([
303+
.bytes(security.server.certificate, format: .der)
304+
])
305+
$0.serverHostname = "localhost"
306+
}
307+
)
308+
)
309+
)
310+
]
311+
}
312+
},
313+
throws: { error in
314+
guard let rootError = error as? RPCError else {
315+
Issue.record("Should be an RPC error")
316+
return false
317+
}
318+
#expect(rootError.code == .unavailable)
319+
#expect(
320+
rootError.message
321+
== "Channel isn't ready. The server accepted the TCP connection but closed the connection before completing the HTTP/2 connection preface."
322+
)
323+
324+
guard
325+
let sslError = rootError.cause as? NIOSSL.BoringSSLError,
326+
case .sslError = sslError
327+
else {
328+
Issue.record(
329+
"Should be a NIOSSL.sslError error, but was: \(String(describing: rootError.cause))"
257330
)
258-
]
259-
}
260-
}, throws: { error in
261-
guard let rootError = error as? RPCError else {
262-
Issue.record("Should be an RPC error")
263-
return false
264-
}
265-
#expect(rootError.code == .unavailable)
266-
#expect(rootError.message == "Channel isn't ready. The server accepted the TCP connection but closed the connection before completing the HTTP/2 connection preface.")
267-
268-
guard
269-
let sslError = rootError.cause as? NIOSSL.BoringSSLError,
270-
case .sslError = sslError
271-
else {
272-
Issue.record("Should be a NIOSSL.sslError error, but was: \(String(describing: rootError.cause))")
273-
return false
274-
}
331+
return false
332+
}
275333

276-
return true
277-
})
334+
return true
335+
}
336+
)
278337
}
279338
}
280339

0 commit comments

Comments
 (0)