HTTPDNS:Use HTTPDNS in native iOS scenarios

4.1 Plain HTTP scenarios

Plain HTTP has no TLS handshake or certificate verification. HTTPDNS integration requires only HTTP-layer changes:

1. Replace the Host in the request URL with the IP address from HTTPDNS

   • For example, if the original request URL is http://example.com/api and HTTPDNS resolves it to the IP address 1.2.3.4, change the URL to http://1.2.3.4/api.

2. Explicitly set the Host header to the original domain

   • If you use NSMutableURLRequest, you can add request.allHTTPHeaderFields[@"Host"] = @"example.com"; to the request header. This ensures that the server can identify the correct domain at the application layer.

4.2 HTTPS scenarios without SNI

For HTTPS sites without SNI or with a few fixed certificate domains, integrate HTTPDNS at the NSURLSession layer:

1. Replace the Host in the request URL with the IP address from HTTPDNS

   • For example, if the original request URL is https://example.com/api and HTTPDNS resolves it to the IP address 1.2.3.4, change the URL to https://1.2.3.4/api.

2. Explicitly set the Host header to the original domain

   • Similarly, you can set request.allHTTPHeaderFields[@"Host"] = @"example.com"; in NSMutableURLRequest.

3. Hook the certificate verification process

   • During the TLS handshake, using the IP address for certificate verification causes a domain-certificate mismatch.

   • In the NSURLSessionDelegate callback URLSession:didReceiveChallenge:completionHandler:, replace the IP with the original domain (example.com) when verifying serverTrust to pass certificate verification.

   • Code example:

     - (void)URLSession:(NSURLSession *)session
                   task:(NSURLSessionTask *)task
     didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
       completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition,
                                   NSURLCredential *credential))completionHandler {
         if ([challenge.protectionSpace.authenticationMethod isEqualToString:NSURLAuthenticationMethodServerTrust]) {
             NSString *originalHost = [self getOriginalHostFromRequest:task.originalRequest];
             SecTrustRef serverTrust = challenge.protectionSpace.serverTrust;
             if ([self evaluateServerTrust:serverTrust forDomain:originalHost]) {
                 // The certificate is verified.
                 NSURLCredential *credential = [NSURLCredential credentialForTrust:serverTrust];
                 completionHandler(NSURLSessionAuthChallengeUseCredential, credential);
             } else {
                 // Certificate verification failed. Use the default handler.
                 completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
             }
         } else {
             completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
         }
     }
     
     - (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust forDomain:(NSString *)domain {
         // Create a certificate verification policy.
         NSMutableArray *policies = [NSMutableArray array];
         if (domain) {
             [policies addObject:(__bridge_transfer id) SecPolicyCreateSSL(true, (__bridge CFStringRef) domain)];
         } else {
             [policies addObject:(__bridge_transfer id) SecPolicyCreateBasicX509()];
         }
     
         // Bind the verification policy to the server certificate.
         SecTrustSetPolicies(serverTrust, (__bridge CFArrayRef) policies);
         // Evaluate whether the current serverTrust is trusted. Apple recommends that the serverTrust can be verified if the result is kSecTrustResultUnspecified or kSecTrustResultProceed. For more information, see https://developer.apple.com/library/ios/technotes/tn2232/_index.html.
         // For more information about SecTrustResultType, see SecTrust.h.
         SecTrustResultType result;
         SecTrustEvaluate(serverTrust, &result);
         return (result == kSecTrustResultUnspecified || result == kSecTrustResultProceed);
     }

5.1 Custom NSURLProtocol

Subclass NSURLProtocol to intercept system network requests and implement HTTP/HTTPS logic at a lower level using CFNetwork or NSInputStream/NSOutputStream:

1. Intercept requests

   • In canInitWithRequest:, determine whether to intercept the request.

   • In startLoading, replace the URL domain with the IP address. Retain the original domain for certificate verification and SNI.

2. Set SNI

   • Use CFStream or SecureTransport APIs to set kCFStreamSSLPeerName to the original domain for correct SNI during the SSL handshake.

3. Verify certificates

   • Manually verify that the certificate domain matches the original domain.

Alibaba Cloud EMAS provides a sample implementation in HttpDnsNSURLProtocolImpl.m in the httpdns_ios_demo. Modify or reuse it based on your requirements.

5.2 Using libcurl

libcurl is a cross-platform C network library that supports manual SNI configuration for correct SSL handshake domain resolution when multiple domains share an IP. The integration process:

1. Resolve the domain to get the corresponding IP address

   • Use an HTTPDNS method such as resolveHostSyncNonBlocking: to resolve the target domain.

2. Set the SNI and IP mapping

   • Use CURLOPT_RESOLVE or another API to write the "domain:port:resolved_IP" mapping to curl's internal DNS cache.

   • Keep the original domain in CURLOPT_URL so the TLS handshake includes correct domain information.

3. Verify certificates

   • libcurl enables certificate verification by default. Use callbacks for more fine-grained certificate checks as needed.

HTTPDNS + libcurl integration example (pseudocode):

CURL *curl_handle = curl_easy_init();
if (curl_handle) {
    // For example, get IP = 1.2.3.4 from HTTPDNS, target domain = example.com, and port = 443
    struct curl_slist *dnsResolve = NULL;
    dnsResolve = curl_slist_append(dnsResolve, "example.com:443:1.2.3.4");
    // Set the domain-to-IP mapping
    curl_easy_setopt(curl_handle, CURLOPT_RESOLVE, dnsResolve);

    // Continue to use the original domain as the URL
    curl_easy_setopt(curl_handle, CURLOPT_URL, "https://example.com");

    // Enable SSL verification
    curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 1L);
    curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYHOST, 2L);

    // Initiate the request
    CURLcode res = curl_easy_perform(curl_handle);

    // Check the result
    if (res != CURLE_OK) {
        fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res));
    }

    // Clean up
    curl_easy_cleanup(curl_handle);
    curl_slist_free_all(dnsResolve);
}