Support Swift 4.2

.swift-version

@@ -1 +1 @@
-4.1.2
+4.2

.travis.yml

@@ -11,17 +11,21 @@ matrix:
   - os: linux
     dist: trusty
     sudo: required
+    env: SWIFT_SNAPSHOT=4.1.3
   - os: linux
     dist: trusty
     sudo: required
-    env: SWIFT_SNAPSHOT=swift-4.2-DEVELOPMENT-SNAPSHOT-2018-06-23-a
   - os: osx
     osx_image: xcode9.2
     sudo: required
     env: SWIFT_SNAPSHOT=4.0.3
   - os: osx
     osx_image: xcode9.4
     sudo: required
+    env: SWIFT_SNAPSHOT=4.1.2
+  - os: osx
+    osx_image: xcode10
+    sudo: required
 
 before_install:
 - git clone https://github.com/IBM-Swift/Package-Builder.git

Package.swift

@@ -1,41 +1,57 @@
+// swift-tools-version:4.2
+// The swift-tools-version declares the minimum version of Swift required to build this package.
+
 //
 //  Package.swift
 //  Cryptor
 //
 //  Copyright © 2016 IBM. All rights reserved.
 //
-// 	Licensed under the Apache License, Version 2.0 (the "License");
-// 	you may not use this file except in compliance with the License.
-// 	You may obtain a copy of the License at
+//     Licensed under the Apache License, Version 2.0 (the "License");
+//     you may not use this file except in compliance with the License.
+//     You may obtain a copy of the License at
 //
-// 	http://www.apache.org/licenses/LICENSE-2.0
+//     http://www.apache.org/licenses/LICENSE-2.0
 //
-// 	Unless required by applicable law or agreed to in writing, software
-// 	distributed under the License is distributed on an "AS IS" BASIS,
-// 	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// 	See the License for the specific language governing permissions and
-// 	limitations under the License.
+//     Unless required by applicable law or agreed to in writing, software
+//     distributed under the License is distributed on an "AS IS" BASIS,
+//     WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//     See the License for the specific language governing permissions and
+//     limitations under the License.
 //
 
 import PackageDescription
 
-#if os(macOS) || os(iOS) || os(tvOS) || os(watchOS)
-	let url = "https://github.com/IBM-Swift/CommonCrypto.git"
-	let majorVersion = 1
-	let minorVersion = 0
-#elseif os(Linux)
-	let url = "https://github.com/IBM-Swift/OpenSSL.git"
-	let majorVersion = 1
-	let minorVersion = 0
-#else
-	fatalError("Unsupported OS")
+var targetDependencies: [Target.Dependency] = []
+
+#if os(Linux)
+targetDependencies.append(.target(name: "OpenSSL"))
+#endif
+
+var targets: [Target] = [
+    .target(
+        name: "Cryptor",
+        dependencies: targetDependencies,
+        exclude: ["Cryptor.xcodeproj", "README.md", "Sources/Info.plist"]),
+    .testTarget(
+        name: "CryptorTests",
+        dependencies: ["Cryptor"]),
+]
+
+#if os(Linux)
+targets.append(
+    .systemLibrary(name: "OpenSSL")
+)
 #endif
 
 let package = Package(
-	name: "Cryptor",
-	targets: [Target(name: "Cryptor")],
-	dependencies: [
-		.Package(url: url, majorVersion: majorVersion, minor: minorVersion),
-	],
-	exclude: ["Cryptor.xcodeproj", "README.md", "Sources/Info.plist"]
+    name: "Cryptor",
+    products: [
+        // Products define the executables and libraries produced by a package, and make them visible to other packages.
+        .library(
+            name: "Cryptor",
+            targets: ["Cryptor"]),
+        ],
+    dependencies: [],
+    targets: targets
 )

Sources/Cryptor/KeyDerivation.swift

@@ -86,7 +86,7 @@ public class PBKDF {
 			}
 		#endif
     }
-	
+
     ///
     /// Determines the (approximate) number of iterations of the key derivation algorithm that need
     /// to be run to achieve a particular delay (or calculation time).
@@ -137,7 +137,7 @@ public class PBKDF {
 			if status != 1 {
 				let error = ERR_get_error()
 
-				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(ERR_error_string(error, nil))")
+				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(errToString(ERR_error_string(error, nil)))")
 			}
 		#endif
         return derivedKey
@@ -169,7 +169,7 @@ public class PBKDF {
 			if status != 1 {
 				let error = ERR_get_error()
 
-				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(ERR_error_string(error, nil))")
+				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(errToString(ERR_error_string(error, nil)))")
 			}
 		#endif
         return derivedKey
@@ -203,7 +203,7 @@ public class PBKDF {
 			if status != 1 {
 				let error = ERR_get_error()
 
-				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(ERR_error_string(error, nil))")
+				throw CryptorError.fail(Int32(error), "ERROR: PKCS5_PBKDF2_HMAC failed, reason: \(errToString(ERR_error_string(error, nil)))")
 			}
 		#endif
 	}

Sources/Cryptor/Status.swift

@@ -207,10 +207,10 @@ public enum Status: Swift.Error, CustomStringConvertible {
 			return "Invalid parameters passed"
 
 		case .fail(let errorCode):
-			return "ERROR: code: \(errorCode), reason: \(ERR_error_string(UInt(errorCode), nil))"
+			return "ERROR: code: \(errorCode), reason: \(errToString(ERR_error_string(UInt(errorCode), nil)))"
 
 		case .rngFailure(let errorCode):
-			return "Random Byte Generator ERROR: code: \(errorCode), reason: \(ERR_error_string(UInt(errorCode), nil))"
+			return "Random Byte Generator ERROR: code: \(errorCode), reason: \(errToString(ERR_error_string(UInt(errorCode), nil)))"
 		}
 	}
 }

Sources/Cryptor/Utilities.swift

@@ -27,6 +27,16 @@ func fatalError(_ message: @autoclosure () -> String = "", file: StaticString =
 	FatalErrorUtil.fatalErrorClosure(message(), file, line)
 }
 
+// Convert an UnsafeMutablePointer<Int8>? to a String, providing a
+// default value of empty string if the pointer is nil.
+func errToString(_ ptr: UnsafeMutablePointer<Int8>?) -> String {
+    if let ptr = ptr {
+        return String(cString: ptr)
+    } else {
+        return ""
+    }
+}
+
 ///
 /// Allows redirection of `fatalError` for Unit Testing or for
 /// library users that want to handle such errors in another way.

Sources/OpenSSL/module.modulemap

@@ -0,0 +1,21 @@
+/**
+ * Copyright IBM Corporation 2016
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+module OpenSSL [system] {
+       header "shim.h" 
+       link "ssl"
+       link "crypto"
+}

Sources/OpenSSL/shim.h

@@ -0,0 +1,81 @@
+/**
+ * Copyright IBM Corporation 2017
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+#ifndef OpenSSLHelper_h
+#define OpenSSLHelper_h
+
+#include <openssl/conf.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#include <openssl/bio.h>
+#include <openssl/ssl.h>
+#include <openssl/md4.h>
+#include <openssl/md5.h>
+#include <openssl/sha.h>
+#include <openssl/hmac.h>
+#include <openssl/rand.h>
+#include <openssl/pkcs12.h>
+#include <openssl/x509v3.h>
+
+// This is a wrapper function to wrap the call to SSL_CTX_set_alpn_select_cb() which is
+// only available from OpenSSL v1.0.2. Calling this function with older version will do
+// nothing.
+static inline SSL_CTX_set_alpn_select_cb_wrapper(SSL_CTX *ctx,
+					  int (*cb) (SSL *ssl,
+								 const unsigned char **out,
+								 unsigned char *outlen,
+								 const unsigned char *in,
+								 unsigned int inlen,
+								 void *arg), void *arg) {
+	#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+		SSL_CTX_set_alpn_select_cb(ctx, cb, arg);
+	#endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
+}
+
+// This is a wrapper function to wrap the call to SSL_get0_alpn_selected() which is
+// only available from OpenSSL v1.0.2. Calling this function with older version will do
+// nothing.
+static inline SSL_get0_alpn_selected_wrapper(const SSL *ssl, const unsigned char **data,
+											 unsigned int *len) {
+	#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+		SSL_get0_alpn_selected(ssl, data, len);
+	#endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
+}
+
+// This is a wrapper function that allows the setting of AUTO ECDH mode when running
+// on OpenSSL v1.0.2. Calling this function on an older version will have no effect.
+static inline SSL_CTX_setAutoECDH(SSL_CTX *ctx) {
+
+	#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL && OPENSSL_VERSION_NUMBER < 0x10100000L)
+		SSL_CTX_ctrl(ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL);
+	#endif
+}
+
+// This is a wrapper function that allows older versions of OpenSSL, that use mutable
+// pointers to work alongside newer versions of it that use an immutable pointer.
+static inline int SSL_EVP_digestVerifyFinal_wrapper(EVP_MD_CTX *ctx, const unsigned char *sig, size_t siglen) {
+
+	//If version higher than 1.0.2 then it needs to use immutable version of sig
+	#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL)
+		return EVP_DigestVerifyFinal(ctx, sig, siglen);
+	#else
+		// Need to make sig immutable for under 1.0.2
+		return EVP_DigestVerifyFinal(ctx, sig, siglen);
+	#endif
+
+}
+
+#endif