Af/optional min tls version

.gitignore

@@ -28,6 +28,9 @@ Package.resolved
 **/xcuserdata
 **/*.xcuserdata
 xcuserdata
+**/xcshareddata
+**/*.xcshareddata
+xcshareddata
 
 # Codegen build products
 build/

Sources/ClientRuntime/Networking/Http/CRT/CRTClientTLSOptions.swift

@@ -7,6 +7,7 @@
 
 import AwsCommonRuntimeKit
 import Smithy
+import SmithyHTTPClientAPI
 
 public struct CRTClientTLSOptions: TLSConfiguration, Sendable {
 
@@ -25,6 +26,9 @@ public struct CRTClientTLSOptions: TLSConfiguration, Sendable {
     /// Optional PKCS#12 password
     public var pkcs12Password: String?
 
+    /// Optional Minimum TLS version
+    public var minimumTLSVersion: SmithyHTTPClientAPI.TLSVersion?
+
     /// Information is provided to use custom trust store
     public var useSelfSignedCertificate: Bool {
         return certificateDir != nil && certificate != nil
@@ -41,13 +45,15 @@ public struct CRTClientTLSOptions: TLSConfiguration, Sendable {
         certificate: String? = nil, // .cer
         pkcs12Path: String? = nil, // .p12 PEM
         pkcs12Password: String? = nil,
-        privateKey: String? = nil
+        privateKey: String? = nil,
+        minimumTLSVersion: SmithyHTTPClientAPI.TLSVersion? = nil
     ) {
         self.certificateDir = certificateDir
         self.certificate = certificate
         self.pkcs12Path = pkcs12Path
         self.pkcs12Password = pkcs12Password
         self.privateKey = privateKey
+        self.minimumTLSVersion = minimumTLSVersion
     }
 }
 
@@ -81,6 +87,19 @@ extension CRTClientTLSOptions {
             if self.useSelfSignedCertificate, let certPath = certificateDir, let certFilename = certificate {
                 try tlsOptions.overrideDefaultTrustStore(caPath: certPath, caFile: certFilename)
             }
+            // Set minimum TLS version if specified
+            if let minVersion = minimumTLSVersion {
+                switch minVersion {
+                case .tls10:
+                    tlsOptions.setMinimumTLSVersion(AwsCommonRuntimeKit.TLSVersion.TLSv1)
+                case .tls11:
+                    tlsOptions.setMinimumTLSVersion(AwsCommonRuntimeKit.TLSVersion.TLSv1_1)
+                case .tls12:
+                    tlsOptions.setMinimumTLSVersion(AwsCommonRuntimeKit.TLSVersion.TLSv1_2)
+                case .tls13:
+                    tlsOptions.setMinimumTLSVersion(AwsCommonRuntimeKit.TLSVersion.TLSv1_3)
+                }
+            }
 
             tlsContext = try TLSContext(options: tlsOptions, mode: .client)
         } catch {

Sources/ClientRuntime/Networking/Http/URLSession/URLSessionHTTPClient.swift

@@ -447,6 +447,21 @@ public final class URLSessionHTTPClient: HTTPClient, @unchecked Sendable {
         self.connectionTimeout = httpClientConfiguration.connectTimeout ?? 60.0
         var urlsessionConfiguration = URLSessionConfiguration.default
         urlsessionConfiguration = URLSessionConfiguration.from(httpClientConfiguration: httpClientConfiguration)
+
+        if let tlsConfig = tlsConfiguration, let minVersion = tlsConfig.minimumTLSVersion {
+            switch minVersion {
+            case .tls10,
+                 .tls11:
+                 // Enforce a secure minimum; do not allow TLS 1.0 or 1.1, they have been deprecated.
+                logger.error("This `minimumTLSVersion` (\(minVersion)) is not supported. Falling back to TLS 1.2.")
+                urlsessionConfiguration.tlsMinimumSupportedProtocolVersion = .TLSv12
+            case .tls12:
+                urlsessionConfiguration.tlsMinimumSupportedProtocolVersion = .TLSv12
+            case .tls13:
+                urlsessionConfiguration.tlsMinimumSupportedProtocolVersion = .TLSv13
+            }
+        }
+
         self.session = SessionType.init(configuration: urlsessionConfiguration, delegate: delegate, delegateQueue: nil)
     }
 

Sources/ClientRuntime/Networking/Http/URLSession/URLSessionTLSOptions.swift

@@ -5,6 +5,8 @@
 // SPDX-License-Identifier: Apache-2.0
 //
 
+import SmithyHTTPClientAPI
+
 public struct URLSessionTLSOptions: TLSConfiguration, Sendable {
 
     /// Filename of the turst certificate file in main bundle (.cer)
@@ -22,6 +24,9 @@ public struct URLSessionTLSOptions: TLSConfiguration, Sendable {
     /// Optional PKCS#12 password
     public var pkcs12Password: String?
 
+    /// Optional Minimum TLS version
+    public var minimumTLSVersion: TLSVersion?
+
     /// Information is provided to use custom trust store
     public var useSelfSignedCertificate: Bool {
         return certificate != nil
@@ -35,10 +40,12 @@ public struct URLSessionTLSOptions: TLSConfiguration, Sendable {
     public init(
         certificate: String? = nil, // .cer
         pkcs12Path: String? = nil, // .p12
-        pkcs12Password: String? = nil
+        pkcs12Password: String? = nil,
+        minimumTLSVersion: TLSVersion? = nil
     ) {
         self.certificate = certificate
         self.pkcs12Path = pkcs12Path
         self.pkcs12Password = pkcs12Password
+        self.minimumTLSVersion = minimumTLSVersion
     }
 }

Sources/SmithyHTTPClientAPI/TLSConfiguration.swift

@@ -26,4 +26,14 @@ public protocol TLSConfiguration: Sendable {
 
     // Optional PKCS#12 password
     var pkcs12Password: String? { get set }
+
+    // Optional Minimum TLS Version
+    var minimumTLSVersion: TLSVersion? { get set }
+}
+
+public enum TLSVersion: String, Sendable {
+    case tls10 = "TLSv1_0"
+    case tls11 = "TLSv1_1"
+    case tls12 = "TLSv1_2"
+    case tls13 = "TLSv1_3"
 }

Sources/SmithySwiftNIO/SwiftNIOHTTPClientTLSOptions.swift

@@ -26,6 +26,9 @@ public struct SwiftNIOHTTPClientTLSOptions: SmithyHTTPClientAPI.TLSConfiguration
     /// Optional PKCS#12 password
     public var pkcs12Password: String?
 
+    /// Optional Minimum TLS version
+    public var minimumTLSVersion: SmithyHTTPClientAPI.TLSVersion?
+
     /// Information is provided to use custom trust store
     public var useSelfSignedCertificate: Bool {
         return certificate != nil || certificateDir != nil
@@ -42,12 +45,14 @@ public struct SwiftNIOHTTPClientTLSOptions: SmithyHTTPClientAPI.TLSConfiguration
         certificateDir: String? = nil,
         privateKey: String? = nil,
         pkcs12Path: String? = nil,
-        pkcs12Password: String? = nil
+        pkcs12Password: String? = nil,
+        minimumTLSVersion: SmithyHTTPClientAPI.TLSVersion? = nil
     ) {
         self.certificate = certificate
         self.certificateDir = certificateDir
         self.privateKey = privateKey
         self.pkcs12Path = pkcs12Path
         self.pkcs12Password = pkcs12Password
+        self.minimumTLSVersion = minimumTLSVersion
     }
 }

Sources/SmithySwiftNIO/SwiftNIOHTTPClientTLSResolverUtils.swift

@@ -44,6 +44,19 @@ extension SwiftNIOHTTPClientTLSOptions {
             }
         }
 
+        if let minVersion = minimumTLSVersion {
+            switch minVersion {
+            case .tls10:
+                tlsConfig.minimumTLSVersion = .tlsv1
+            case .tls11:
+                tlsConfig.minimumTLSVersion = .tlsv11
+            case .tls12:
+                tlsConfig.minimumTLSVersion = .tlsv12
+            case .tls13:
+                tlsConfig.minimumTLSVersion = .tlsv13
+            }
+        }
+
         return tlsConfig
     }
 }

Tests/ClientRuntimeTests/NetworkingTests/Http/CRTClientTLSOptionsTests.swift

@@ -0,0 +1,76 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import Foundation
+import XCTest
+@testable import ClientRuntime
+import SmithyHTTPClientAPI
+import AwsCommonRuntimeKit
+
+class CRTClientTLSOptionsTests: XCTestCase {
+
+    override func setUp() {
+        super.setUp()
+        CommonRuntimeKit.initialize()
+    }
+
+    func testMinimumTLSVersionInitialization() {
+        let tlsOptions = CRTClientTLSOptions(minimumTLSVersion: .tls12)
+        XCTAssertEqual(tlsOptions.minimumTLSVersion, .tls12)
+    }
+
+    func testMinimumTLSVersionDefaultsToNil() {
+        let tlsOptions = CRTClientTLSOptions()
+        XCTAssertNil(tlsOptions.minimumTLSVersion)
+    }
+
+    func testAllTLSVersionValues() {
+        let tls10 = CRTClientTLSOptions(minimumTLSVersion: .tls10)
+        let tls11 = CRTClientTLSOptions(minimumTLSVersion: .tls11)
+        let tls12 = CRTClientTLSOptions(minimumTLSVersion: .tls12)
+        let tls13 = CRTClientTLSOptions(minimumTLSVersion: .tls13)
+
+        XCTAssertEqual(tls10.minimumTLSVersion, .tls10)
+        XCTAssertEqual(tls11.minimumTLSVersion, .tls11)
+        XCTAssertEqual(tls12.minimumTLSVersion, .tls12)
+        XCTAssertEqual(tls13.minimumTLSVersion, .tls13)
+    }
+
+    func testResolveContextSucceedsWithMinimumTLSVersion() {
+        let tlsOptions = CRTClientTLSOptions(minimumTLSVersion: .tls12)
+
+        // The resolveContext() method should succeed without throwing
+        let context = tlsOptions.resolveContext()
+
+        // Verify a context was created
+        XCTAssertNotNil(context)
+    }
+
+    func testResolveContextSucceedsWithAllTLSVersions() {
+        #if os(Linux)
+        let versions: [SmithyHTTPClientAPI.TLSVersion] = [.tls12]
+        #else
+        let versions: [SmithyHTTPClientAPI.TLSVersion] = [.tls10, .tls11, .tls12, .tls13]
+        #endif
+
+        for version in versions {
+            let tlsOptions = CRTClientTLSOptions(minimumTLSVersion: version)
+            let context = tlsOptions.resolveContext()
+
+            XCTAssertNotNil(context, "Failed to create context for TLS version: \(version)")
+        }
+    }
+
+    func testResolveContextSucceedsWithoutMinimumTLSVersion() {
+        let tlsOptions = CRTClientTLSOptions()
+
+        let context = tlsOptions.resolveContext()
+
+        XCTAssertNotNil(context)
+    }
+
+}

Tests/ClientRuntimeTests/NetworkingTests/URLSession/URLSessionTLSOptionsTests.swift

@@ -0,0 +1,73 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import Foundation
+import XCTest
+@testable import ClientRuntime
+import SmithyHTTPClientAPI
+
+class URLSessionTLSOptionsTests: XCTestCase {
+
+    func testMinimumTLSVersionInitialization() {
+        let tlsOptions = URLSessionTLSOptions(minimumTLSVersion: .tls12)
+        XCTAssertEqual(tlsOptions.minimumTLSVersion, .tls12)
+    }
+
+    func testMinimumTLSVersionDefaultsToNil() {
+        let tlsOptions = URLSessionTLSOptions()
+        XCTAssertNil(tlsOptions.minimumTLSVersion)
+    }
+
+    func testAllTLSVersionValues() {
+        let tls10 = URLSessionTLSOptions(minimumTLSVersion: .tls10)
+        let tls11 = URLSessionTLSOptions(minimumTLSVersion: .tls11)
+        let tls12 = URLSessionTLSOptions(minimumTLSVersion: .tls12)
+        let tls13 = URLSessionTLSOptions(minimumTLSVersion: .tls13)
+
+        XCTAssertEqual(tls10.minimumTLSVersion, .tls10)
+        XCTAssertEqual(tls11.minimumTLSVersion, .tls11)
+        XCTAssertEqual(tls12.minimumTLSVersion, .tls12)
+        XCTAssertEqual(tls13.minimumTLSVersion, .tls13)
+    }
+
+    #if os(iOS) || os(macOS) || os(watchOS) || os(tvOS) || os(visionOS)
+
+    func testMinimumTLSVersionAppliedToURLSessionConfiguration() {
+        let tlsOptions = URLSessionTLSOptions(minimumTLSVersion: .tls12)
+        let httpConfig = HttpClientConfiguration(tlsConfiguration: tlsOptions)
+        let client = URLSessionHTTPClient(httpClientConfiguration: httpConfig)
+
+        // Access the URLSession's configuration to verify TLS version was set
+        XCTAssertEqual(
+            client.session.configuration.tlsMinimumSupportedProtocolVersion,
+            .TLSv12
+        )
+    }
+
+    func testMinimumTLSVersionTLS13AppliedToURLSessionConfiguration() {
+        let tlsOptions = URLSessionTLSOptions(minimumTLSVersion: .tls13)
+        let httpConfig = HttpClientConfiguration(tlsConfiguration: tlsOptions)
+        let client = URLSessionHTTPClient(httpClientConfiguration: httpConfig)
+
+        XCTAssertEqual(
+            client.session.configuration.tlsMinimumSupportedProtocolVersion,
+            .TLSv13
+        )
+    }
+
+    func testNoMinimumTLSVersionUsesDefault() {
+        let tlsOptions = URLSessionTLSOptions()
+        let httpConfig = HttpClientConfiguration(tlsConfiguration: tlsOptions)
+        let client = URLSessionHTTPClient(httpClientConfiguration: httpConfig)
+
+        // When not set, should use system default (typically .TLSv12)
+        XCTAssertNotNil(client.session.configuration.tlsMinimumSupportedProtocolVersion)
+    }
+
+    #endif
+
+}

Tests/SmithySwiftNIOTests/SwiftNIOHTTPClientTLSOptionsTests.swift

@@ -62,4 +62,47 @@ class SwiftNIOHTTPClientTLSOptionsTests: XCTestCase {
         XCTAssertTrue(tlsOptions.useSelfSignedCertificate)
         XCTAssertTrue(tlsOptions.useProvidedKeystore)
     }
+
+    func testMinimumTLSVersionInitialization() {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions(minimumTLSVersion: .tls12)
+        XCTAssertEqual(tlsOptions.minimumTLSVersion, .tls12)
+    }
+
+    func testMinimumTLSVersionDefaultsToNil() {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions()
+        XCTAssertNil(tlsOptions.minimumTLSVersion)
+    }
+
+    func testMinimumTLSVersionTLS10AppliedToConfiguration() throws {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions(minimumTLSVersion: .tls10)
+        let config = try tlsOptions.makeNIOSSLConfiguration()
+        XCTAssertEqual(config.minimumTLSVersion, .tlsv1)
+    }
+
+    func testMinimumTLSVersionTLS11AppliedToConfiguration() throws {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions(minimumTLSVersion: .tls11)
+        let config = try tlsOptions.makeNIOSSLConfiguration()
+        XCTAssertEqual(config.minimumTLSVersion, .tlsv11)
+    }
+
+    func testMinimumTLSVersionTLS12AppliedToConfiguration() throws {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions(minimumTLSVersion: .tls12)
+        let config = try tlsOptions.makeNIOSSLConfiguration()
+        XCTAssertEqual(config.minimumTLSVersion, .tlsv12)
+    }
+
+    func testMinimumTLSVersionTLS13AppliedToConfiguration() throws {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions(minimumTLSVersion: .tls13)
+        let config = try tlsOptions.makeNIOSSLConfiguration()
+        XCTAssertEqual(config.minimumTLSVersion, .tlsv13)
+    }
+
+    func testMinimumTLSVersionNotSetWhenNil() throws {
+        let tlsOptions = SwiftNIOHTTPClientTLSOptions()
+        let config = try tlsOptions.makeNIOSSLConfiguration()
+        // When nil, it should use the default from makeClientConfiguration()
+        // The default is typically TLS 1.2, but we just verify it doesn't crash
+        XCTAssertNotNil(config.minimumTLSVersion)
+    }
+
 }