Swiftpack.co - Package - apple/swift-nio-ssl

SwiftNIO SSL

SwiftNIO SSL is a Swift package that contains an implementation of TLS based on BoringSSL. This package allows users of SwiftNIO to write protocol clients and servers that use TLS to secure data in flight.

The name is inspired primarily by the names of the library this package uses (BoringSSL), and not because we don't know the name of the protocol. We know the protocol is TLS!

To get started, check out the API docs.

Using SwiftNIO SSL

SwiftNIO SSL provides two ChannelHandlers to use to secure a data stream: the NIOSSLClientHandler and the NIOSSLServerHandler. Each of these can be added to a Channel to secure the communications on that channel.

Additionally, we provide a number of low-level primitives for configuring your TLS connections. These will be shown below.

To secure a server connection, you will need a X.509 certificate chain in a file (either PEM or DER, but PEM is far easier), and the associated private key for the leaf certificate. These objects can then be wrapped up in a TLSConfiguration object that is used to initialize the ChannelHandler.

For example:

let configuration = TLSConfiguration.forServer(certificateChain: try NIOSSLCertificate.fromPEMFile("cert.pem").map { .certificate($0) },
                                               privateKey: .file("key.pem"))
let sslContext = try NIOSSLContext(configuration: configuration)

let server = ServerBootstrap(group: group)
    .childChannelInitializer { channel in
        // important: The handler must be initialized _inside_ the `childChannelInitializer`
        let handler = try NIOSSLServerHandler(context: sslContext)

        [...]
        channel.pipeline.addHandler(handler)
        [...]
    }

For clients, it is a bit simpler as there is no need to have a certificate chain or private key (though clients may have these things). Setup for clients may be done like this:

let configuration = TLSConfiguration.forClient()
let sslContext = try NIOSSLContext(configuration: configuration)

let client = ClientBootstrap(group: group)
    .channelInitializer { channel in}
        // important: The handler must be initialized _inside_ the `channelInitializer`
        let handler = try NIOSSLClientHandler(context: sslContext)

        [...]
        channel.pipeline.addHandler(handler)
        [...]
    }

Github

link
Stars: 211
Help us keep the lights on

Dependencies

Releases

2.4.2 - Oct 11, 2019

Semver Patch

  • Fixed compilation on Linux aarc64. (#141)
  • Improved testing. (#138)
  • Updated BoringSSL. (#142)

2.4.1 - Oct 4, 2019

Semver Patch

  • Fixed the namespacing of a number of BoringSSL functions. (#131)
  • Fix up some inline assembly. (#137)
  • CI and documentation fixes (#132, #133)

2.4.0 - Aug 13, 2019

SemVer Minor

  • Use UInt8 instead of Int8 for buffer types (#127)

SemVer Patch

  • Avoid using a deprecated enum case in the README (#126)
  • Use CInt and CUnsignedInt when calling C APIs (#128)
  • Don't pass read-only bytes as mutable to BoringSSL (#129)

2.3.1 - Aug 10, 2019

Semver Patch

  • Resolved an issue where compilation on 64-bit ARM platforms would fail due to missing compiler defines. (#125)

2.3.0 - Aug 9, 2019

Semver Minor

  • Added support for loading multiple certificates from a single PEM file or buffer, deprecated the old mechanism for doing so. (#123)

Semver Patch

  • Changed the BoringSSL header namespacing strategy to work better with swift package generate-xcodeproj-based Xcode projects. (#122)
  • Fix a crash when attempting to load a private key that is password protected without providing a password. (#119)
  • Clean up documentation. (#120)