How to help fortify swift-nio against DoS?

hi Franz, undoubtedly this is a massive improvement over writing state machines in channel handlers.

there is a really mundane issue with this solution, which the same as i mentioned before: these API’s aren’t visible in any released version of SwiftNIO! (also, the configureAsyncHTTPServerPipeline you suggested in the other thread seems to have vanished from the main branch too.)

the DocC documentation doesn’t have any record of such a type NIOAsyncChannel. swiftinit only picks it up because i configured it to do so, but it doesn’t know where the symbol comes from, because lib/SymbolGraphGen ignores @_spis.

none of these issues are your fault, of course. this is a lib/SymbolGraphGen problem. it affects many libraries¹ and i raised it a few months ago over at the swift-docc slack, but it seems to have fallen out of the 90-day retention window, so i’ve gone ahead and filed a proper issue in its place.

anyway, this is not a criticism of SwiftNIO, just a remark that these new features are not quite as accessible as one might assume.

[1] this is also an issue when working with raw syntax in SwiftSyntax. it appears that some package authors have also begun working around this problem by just manually labeling things “SPI” without using the attribute.


it looks like the AsyncChannel interfaces were removed three weeks ago in order to patch CVE-2023-44487, but were never put back. so it is not possible to use them even if you want to be an early adopter.

1 Like

I know they aren't but I want to recommend them anyway because they are the future. We are working on making them stable API currently. We already have everything landed in NIO and are preparing a release. The rest of the packages will follow shortly afterwards.


in the meantime, could you at least revert 2140160e95f7d27e8b6a90c11e8cfbc7f69ff4f0 from swift-nio-http2, so we do not need to downgrade to an insecure version of swift-nio-http2 to get these APIs from the main branch? :slight_smile:

The revert is unlikely to be needed due to the freshly tagged new releases: New SwiftNIO async APIs.


@Max_Desiatov thanks for sharing it here. You beat me to it ;)


fyi, doc generation for swift-nio is now hitting the same 5.9.1 compiler crash that was breaking swift-certificates last month. i could only fix the issue by manually blacklisting the _NIODataStructures module; no clue what changed in the module to trigger the compiler crash.

again, not NIO’s fault. unsurprisingly, it is (yet another!) lib/SymbolGraphGen bug. please, if anyone has any influence at Apple, this part of the compiler badly needs some attention.

1 Like