Server side ALPN support for SslStream on Mac

[wfurt]

This is follow-up on #26534

SSL API on OSX/MacOS does not provide sufficient functionality to implement server side ALPN.
That is primarily missing code to parse client hello in SSLProcessClientHelloExtensions() and callback (or some other mechanism) for server to choose from provided list.

[karelz]

Thanks @wfurt. Did you get chance to contact Apple and make them aware of this gap? Is there a link to the case?

[karelz]

@wfurt ping

[LouisStAmour]

It’s possible this is resolved in other networking APIs? https://forums.developer.apple.com/thread/116193

[wfurt]

I could not find any reasonable documentation. From the post, I'm not sure how the negotiation would work.
It would be great if somebody can put together simple C example.

cc: @filipnavara @Tratcher

[LouisStAmour]

Did you try the C nwcat sample referenced at the bottom of that thread? You can download the sample at https://developer.apple.com/documentation/network/implementing_netcat_with_network_framework and tweak it following that post’s instructions?

It’s sparsely documented, but there are C language symbols and searching for these online should reveal other samples on Github, etc. https://developer.apple.com/documentation/network/c-language_symbols

To clarify, given deprecation of other networking stacks it’s extremely unlikely Apple will do anything more than bug fixes to the existing APIs other than Network.framework. I’d suggest a third-party SSL library if you can’t get Network.framework going. :)

There’s a video describing the framework here: https://developer.apple.com/videos/play/wwdc2018/715/

There should also be documented C headers floating around in SDKs or you can find them copied online in places.

[karelz]

There is new API on Mac Catalina that we should explore if it helps.

[daveyostcom]

There is new API on Mac Catalina that we should explore if it helps.

fails on Catalina, final release 10.15 (19A583)
dotnet 3.0.100

0 Thu 14:41:13 /tmp
207 Z% dotnet new grpc -o GrpcGreeter
cd GrpcGreeter
dotnet run
Getting ready...
The template "ASP.NET Core gRPC Service" was created successfully.

Processing post-creation actions...
Running 'dotnet restore' on GrpcGreeter/GrpcGreeter.csproj...
  Restore completed in 2.49 sec for /private/tmp/GrpcGreeter/GrpcGreeter.csproj.

Restore succeeded.

warn: Microsoft.AspNetCore.Server.Kestrel[0]
      Unable to bind to https://localhost:5001 on the IPv4 loopback interface: 'HTTP/2 over TLS is not supported on macOS due to missing ALPN support.'.
warn: Microsoft.AspNetCore.Server.Kestrel[0]
      Unable to bind to https://localhost:5001 on the IPv6 loopback interface: 'HTTP/2 over TLS is not supported on macOS due to missing ALPN support.'.
crit: Microsoft.AspNetCore.Server.Kestrel[0]
      Unable to start Kestrel.
System.IO.IOException: Failed to bind to address https://localhost:5001.
 ---> System.AggregateException: One or more errors occurred. (HTTP/2 over TLS is not supported on macOS due to missing ALPN support.) (HTTP/2 over TLS is not supported on macOS due to missing ALPN support.)
 ---> System.NotSupportedException: HTTP/2 over TLS is not supported on macOS due to missing ALPN support.
   at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware..ctor(ConnectionDelegate next, HttpsConnectionAdapterOptions options, ILoggerFactory loggerFactory)
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.<>c__DisplayClass12_0.<UseHttps>b__0(ConnectionDelegate next)
   at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.Build()
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.<>c__DisplayClass21_0`1.<<StartAsync>g__OnBind|0>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)
   --- End of inner exception stack trace ---
 ---> (Inner Exception dotnet/corefx#1) System.NotSupportedException: HTTP/2 over TLS is not supported on macOS due to missing ALPN support.
   at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware..ctor(ConnectionDelegate next, HttpsConnectionAdapterOptions options, ILoggerFactory loggerFactory)
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.<>c__DisplayClass12_0.<UseHttps>b__0(ConnectionDelegate next)
   at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.Build()
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.<>c__DisplayClass21_0`1.<<StartAsync>g__OnBind|0>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)<---

   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding)
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
Unhandled exception. System.IO.IOException: Failed to bind to address https://localhost:5001.
 ---> System.AggregateException: One or more errors occurred. (HTTP/2 over TLS is not supported on macOS due to missing ALPN support.) (HTTP/2 over TLS is not supported on macOS due to missing ALPN support.)
 ---> System.NotSupportedException: HTTP/2 over TLS is not supported on macOS due to missing ALPN support.
   at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware..ctor(ConnectionDelegate next, HttpsConnectionAdapterOptions options, ILoggerFactory loggerFactory)
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.<>c__DisplayClass12_0.<UseHttps>b__0(ConnectionDelegate next)
   at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.Build()
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.<>c__DisplayClass21_0`1.<<StartAsync>g__OnBind|0>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)
   --- End of inner exception stack trace ---
 ---> (Inner Exception dotnet/corefx#1) System.NotSupportedException: HTTP/2 over TLS is not supported on macOS due to missing ALPN support.
   at Microsoft.AspNetCore.Server.Kestrel.Https.Internal.HttpsConnectionMiddleware..ctor(ConnectionDelegate next, HttpsConnectionAdapterOptions options, ILoggerFactory loggerFactory)
   at Microsoft.AspNetCore.Hosting.ListenOptionsHttpsExtensions.<>c__DisplayClass12_0.<UseHttps>b__0(ConnectionDelegate next)
   at Microsoft.AspNetCore.Server.Kestrel.Core.ListenOptions.Build()
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.<>c__DisplayClass21_0`1.<<StartAsync>g__OnBind|0>d.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindEndpointAsync(ListenOptions endpoint, AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)<---

   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Server.Kestrel.Core.LocalhostListenOptions.BindAsync(AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.AddressesStrategy.BindAsync(AddressBindContext context)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.AddressBinder.BindAsync(IServerAddressesFeature addresses, KestrelServerOptions serverOptions, ILogger logger, Func`2 createBinding)
   at Microsoft.AspNetCore.Server.Kestrel.Core.KestrelServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
   at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.Internal.Host.StartAsync(CancellationToken cancellationToken)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.RunAsync(IHost host, CancellationToken token)
   at Microsoft.Extensions.Hosting.HostingAbstractionsHostExtensions.Run(IHost host)
   at GrpcGreeter.Program.Main(String[] args) in /private/tmp/GrpcGreeter/Program.cs:line 15
134 Thu 14:41:46 /tmp/GrpcGreeter
208 Z% 

[JamesNK]

I believe that is an explicit error designed to provide feedback about the problem. TLS + HTTP/2 + macOS = error. TLS is not being attempted.

To properly test you would need to disable the check.

[Tratcher]

Failure is expected at the moment, SslStream as not been updated yet to call the new macOS API.

[wfurt]

At this point it is not even clear if use of new API would be feasible. as @Tratcher mentioned, there is no change until SslStream (and this issues) is fixed.

[bancek]

Would it be possible to use OpenSSL on MacOS instead of Network.framework? OpenSSL is already used for Linux so the implementation could be reused. Maybe offer an alternative build.

[wfurt]

We used to do that. But that brings another set of issues - like lack of OS integration for certificate management. That seems more important than server ALPN. If this is critical for somebody you can always run it in Linux container with openssl.

[meteatamel]

I also ran into this issue. This means that the gRPC template/sample does not work out of the box on Mac?

[Tratcher]

I also ran into this issue. This means that the gRPC template/sample does not work out of the box on Mac?

Correct, you'll get a specific exception to that effect.