Honour certificate verification mode with custom trust roots (TransportServices)

With custom trustRoots, the TransportServices transports installed a
verify block that anchored the custom roots and then evaluated the
SecTrust exactly as Network.framework configured it — with the default
SSL policy, including hostname matching. The configured
CertificateVerification mode was never consulted, so
.noHostnameVerification behaved like full verification (rejecting any
certificate whose SANs don't cover the endpoint, e.g. private-CA
deployments or IP-dialled peers), and .noVerification still evaluated
and could fail the handshake.

The verify block now honours the mode: .noHostnameVerification
re-policies the trust for SSL use with no hostname before evaluating
(chain validation against the custom roots is unchanged), and
.noVerification installs no verify block at all, matching the Posix
transport's NIOSSL semantics for both modes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: dmonagle

Sources/GRPCNIOTransportHTTP2TransportServices/Config+TLS.swift

@@ -324,8 +324,22 @@ extension HTTP2ClientTransport.TransportServices {
 
 @available(gRPCSwiftNIOTransport 2.0, *)
 extension NWProtocolTLS.Options {
-  func setUpVerifyBlock(trustRootsSource: TLSConfig.TrustRootsSource) {
-    if let (verifyQueue, verifyBlock) = trustRootsSource.makeTrustRootsConfig() {
+  func setUpVerifyBlock(
+    trustRootsSource: TLSConfig.TrustRootsSource,
+    verification: TLSConfig.CertificateVerification,
+    evaluatingServerCertificates: Bool
+  ) {
+    // With verification disabled there is nothing to evaluate; installing
+    // the block would evaluate the peer's chain anyway and could fail the
+    // handshake despite verification being explicitly turned off.
+    if verification == .noVerification {
+      return
+    }
+
+    if let (verifyQueue, verifyBlock) = trustRootsSource.makeTrustRootsConfig(
+      verification: verification,
+      evaluatingServerCertificates: evaluatingServerCertificates
+    ) {
       sec_protocol_options_set_verify_block(
         self.securityProtocolOptions,
         verifyBlock,
@@ -337,7 +351,10 @@ extension NWProtocolTLS.Options {
 
 @available(gRPCSwiftNIOTransport 2.0, *)
 extension TLSConfig.TrustRootsSource {
-  internal func makeTrustRootsConfig() -> (DispatchQueue, sec_protocol_verify_t)? {
+  internal func makeTrustRootsConfig(
+    verification: TLSConfig.CertificateVerification,
+    evaluatingServerCertificates: Bool
+  ) -> (DispatchQueue, sec_protocol_verify_t)? {
     switch self.wrapped {
     case .certificates(let certificates):
       let verifyQueue = DispatchQueue(label: "io.grpc.CertificateVerification")
@@ -373,6 +390,16 @@ extension TLSConfig.TrustRootsSource {
           return
         }
 
+        // The trust arrives configured with the platform's default SSL
+        // policy, which includes matching the peer's certificate against the
+        // endpoint's hostname. `.noHostnameVerification` promises chain
+        // validation without the hostname check, so re-policy the trust for
+        // SSL use with no hostname before evaluating.
+        if verification == .noHostnameVerification {
+          let policy = SecPolicyCreateSSL(evaluatingServerCertificates, nil)
+          SecTrustSetPolicies(actualTrust, policy)
+        }
+
         SecTrustSetAnchorCertificates(actualTrust, customAnchors as CFArray)
         SecTrustEvaluateAsyncWithError(actualTrust, verifyQueue) { _, trusted, _ in
           verifyCompleteCallback(trusted)

Sources/GRPCNIOTransportHTTP2TransportServices/HTTP2ClientTransport+TransportServices.swift

@@ -439,7 +439,11 @@ extension NWProtocolTLS.Options {
       )
     }
 
-    self.setUpVerifyBlock(trustRootsSource: tlsConfig.trustRoots)
+    self.setUpVerifyBlock(
+      trustRootsSource: tlsConfig.trustRoots,
+      verification: tlsConfig.serverCertificateVerification,
+      evaluatingServerCertificates: true
+    )
   }
 }
 #endif

Sources/GRPCNIOTransportHTTP2TransportServices/HTTP2ServerTransport+TransportServices.swift

@@ -334,7 +334,11 @@ extension NWProtocolTLS.Options {
       )
     }
 
-    self.setUpVerifyBlock(trustRootsSource: tlsConfig.trustRoots)
+    self.setUpVerifyBlock(
+      trustRootsSource: tlsConfig.trustRoots,
+      verification: tlsConfig.clientCertificateVerification,
+      evaluatingServerCertificates: false
+    )
   }
 }
 #endif

Tests/GRPCNIOTransportHTTP2Tests/HTTP2TransportTLSEnabledTests.swift

@@ -500,6 +500,41 @@ struct HTTP2TransportTLSEnabledTests {
     }
   }
 
+  @Test(
+    "Client using noHostnameVerification connects despite a non-matching hostname",
+    arguments: TransportKind.clientsWithTLS,
+    TransportKind.serversWithTLS
+  )
+  @available(gRPCSwiftNIOTransport 2.0, *)
+  // Like testClientFailsServerValidation, but with hostname verification
+  // disabled the mismatched hostname must be ignored: the certificate chain
+  // still validates against the custom trust roots, so the RPC succeeds.
+  func testClientNoHostnameVerificationIgnoresHostname(
+    clientTransport: TransportKind,
+    serverTransport: TransportKind
+  ) async throws {
+    let certificateKeyPairs = try SelfSignedCertificateKeyPairs()
+    let clientTransportConfig = self.makeDefaultTLSClientConfig(
+      for: clientTransport,
+      certificateKeyPairs: certificateKeyPairs,
+      authority: "wrong-hostname",
+      serverCertificateVerification: .noHostnameVerification
+    )
+    let serverTransportConfig = self.makeDefaultTLSServerConfig(
+      for: serverTransport,
+      certificateKeyPairs: certificateKeyPairs
+    )
+
+    try await self.withClientAndServer(
+      clientConfig: clientTransportConfig,
+      serverConfig: serverTransportConfig
+    ) { control in
+      await #expect(throws: Never.self) {
+        try await self.executeUnaryRPC(control: control)
+      }
+    }
+  }
+
   @Test(
     "Error is surfaced when server fails client verification",
     arguments: TransportKind.clientsWithTLS,
@@ -746,7 +781,8 @@ struct HTTP2TransportTLSEnabledTests {
   private func makeDefaultTLSClientConfig(
     for transportSecurity: TransportKind,
     certificateKeyPairs: SelfSignedCertificateKeyPairs,
-    authority: String? = "localhost"
+    authority: String? = "localhost",
+    serverCertificateVerification: TLSConfig.CertificateVerification = .fullVerification
   ) -> ClientConfig {
     switch transportSecurity {
     case .posix:
@@ -755,6 +791,7 @@ struct HTTP2TransportTLSEnabledTests {
         $0.trustRoots = .certificates([
           .bytes(certificateKeyPairs.server.certificate, format: .der)
         ])
+        $0.serverCertificateVerification = serverCertificateVerification
       }
       config.transport.http2.authority = authority
       return .posix(config)
@@ -766,6 +803,7 @@ struct HTTP2TransportTLSEnabledTests {
         $0.trustRoots = .certificates([
           .bytes(certificateKeyPairs.server.certificate, format: .der)
         ])
+        $0.serverCertificateVerification = serverCertificateVerification
       }
       config.transport.http2.authority = authority
       return .transportServices(config)