tls 证书验证通过一个开关来控制； 默认情况下不强制

Author: 015484

ObjC/NWAsyncSocketObjC/GCDAsyncSocket.m

@@ -180,6 +180,7 @@ - (instancetype)initWithDelegate:(id<GCDAsyncSocketDelegate>)delegate
         _readQueue = [NSMutableArray array];
         _isReadingContinuously = NO;
         _tlsEnabled = NO;
+        _allowInsecureTLS = YES;
         _streamingTextEnabled = NO;
         _IPv4PreferredOverIPv6 = YES;
     }
@@ -580,10 +581,27 @@ - (BOOL)connectToHost:(NSString *)host
     // Create parameters
     nw_parameters_t parameters;
     if (self.tlsEnabled) {
-        parameters = nw_parameters_create_secure_tcp(
-            NW_PARAMETERS_DEFAULT_CONFIGURATION,
-            NW_PARAMETERS_DEFAULT_CONFIGURATION
-        );
+        if (self.allowInsecureTLS) {
+            dispatch_queue_t verifyQueue = self.socketQueue ?: dispatch_get_main_queue();
+            parameters = nw_parameters_create_secure_tcp(
+                ^(nw_protocol_options_t  _Nonnull tlsOptions) {
+                    sec_protocol_options_t secOptions = nw_tls_copy_sec_protocol_options(tlsOptions);
+                    sec_protocol_options_set_verify_block(secOptions, ^(sec_protocol_metadata_t  _Nonnull metadata,
+                                                                         sec_trust_t  _Nonnull trust,
+                                                                         sec_protocol_verify_complete_t  _Nonnull complete) {
+                        (void)metadata;
+                        (void)trust;
+                        complete(true);
+                    }, verifyQueue);
+                },
+                NW_PARAMETERS_DEFAULT_CONFIGURATION
+            );
+        } else {
+            parameters = nw_parameters_create_secure_tcp(
+                NW_PARAMETERS_DEFAULT_CONFIGURATION,
+                NW_PARAMETERS_DEFAULT_CONFIGURATION
+            );
+        }
     } else {
         parameters = nw_parameters_create_secure_tcp(
             NW_PARAMETERS_DISABLE_PROTOCOL,

ObjC/NWAsyncSocketObjC/include/GCDAsyncSocket.h

@@ -52,6 +52,10 @@ typedef NS_ENUM(NSInteger, GCDAsyncSocketError) {
 /// Whether to prefer IPv4 over IPv6 during hostname resolution. Default is YES.
 @property (atomic, assign) BOOL IPv4PreferredOverIPv6;
 
+/// Whether to allow self-signed/invalid certificates when TLS is enabled.
+/// Default is YES (skip validation). Set to NO to enable system certificate validation.
+@property (atomic, assign) BOOL allowInsecureTLS;
+
 /// Whether the socket is currently connected.
 @property (atomic, readonly) BOOL isConnected;