Skip to content

Conversation

gjcairo
Copy link
Collaborator

@gjcairo gjcairo commented Aug 28, 2024

Motivation

We currently have a NIOPosix client transport implementation in gRPC v2, but it doesn't support TLS.

Modifications

This PR adds support for TLS in the NIOPosix-backed HTTP/2 implementation of the client transport for gRPC v2.

Result

We now support TLS when using the NIOPosix client transport in gRPC V2.

@gjcairo gjcairo added the version/v2 Relates to v2 label Aug 28, 2024
@gjcairo gjcairo requested a review from glbrntt August 28, 2024 12:28
Copy link
Collaborator

@glbrntt glbrntt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks great so far. I left a few comments but the bigger piece of feedback is that we should now be adding some end-to-end tests for this.

@gjcairo gjcairo requested a review from glbrntt September 5, 2024 13:45
@gjcairo gjcairo force-pushed the ssl-nioposix-client branch from f389a06 to 9590227 Compare September 6, 2024 16:08
Copy link
Collaborator

@glbrntt glbrntt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small thing to shuffle around but looks good otherwise, thanks Gus!

serverHostname = nil
case .tls(let tlsConfig):
do {
nioSSLContext = try NIOSSLContext(configuration: TLSConfiguration(tlsConfig))
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are expensive to create (IIRC it's of the order 20k allocations!) and at the moment we do it per connection. Can we do it in init instead and then reuse it?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While making this change I realised that we're exposing the tls case for TransportSecurity even when NIOSSL cannot be imported. I think this is unsafe, because it means users may be able to add a TLSConfig to their server/client, which then simply will be ignored if the platform the code's being built on doesn't support NIOSSL. If this happens on both the server and the client, it could mean the connection is plaintext and there would be no warnings that the config wasn't used.
I've wrapped the tls case of TransportSecurity in #if canImport(NIOSSL) to avoid this. Let me know if you agree with it or if I'm missing something/think it should be resolved in some other way.

@gjcairo gjcairo force-pushed the ssl-nioposix-client branch from 4f19c21 to 8853b7e Compare September 9, 2024 12:56
@gjcairo gjcairo requested a review from glbrntt September 9, 2024 12:56
Copy link
Collaborator

@glbrntt glbrntt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks Gus!

@glbrntt glbrntt merged commit 62b7f85 into grpc:main Sep 9, 2024
15 of 17 checks passed
@gjcairo gjcairo deleted the ssl-nioposix-client branch September 9, 2024 13:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

version/v2 Relates to v2

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants