How to help fortify swift-nio against DoS?

hi Franz, undoubtedly this is a massive improvement over writing state machines in channel handlers.

there is a really mundane issue with this solution, which the same as i mentioned before: these API’s aren’t visible in any released version of SwiftNIO! (also, the configureAsyncHTTPServerPipeline you suggested in the other thread seems to have vanished from the main branch too.)

the DocC documentation doesn’t have any record of such a type NIOAsyncChannel. swiftinit only picks it up because i configured it to do so, but it doesn’t know where the symbol comes from, because lib/SymbolGraphGen ignores @_spis.

none of these issues are your fault, of course. this is a lib/SymbolGraphGen problem. it affects many libraries¹ and i raised it a few months ago over at the swift-docc slack, but it seems to have fallen out of the 90-day retention window, so i’ve gone ahead and filed a proper issue in its place.

anyway, this is not a criticism of SwiftNIO, just a remark that these new features are not quite as accessible as one might assume.


[1] this is also an issue when working with raw syntax in SwiftSyntax. it appears that some package authors have also begun working around this problem by just manually labeling things “SPI” without using the attribute.

EDIT:

it looks like the AsyncChannel interfaces were removed three weeks ago in order to patch CVE-2023-44487, but were never put back. so it is not possible to use them even if you want to be an early adopter.

1 Like