具有非HTTP TCP服务器的Lightbend ssl-config

Question

I've found several resources that provide details on configuring ssl-config options within the application.conf file and I've identified how to access these configurations using AkkaSSLConfig.get(). I've seen that an https context can be created using a AkkaSSLConfig object as a parameter to ConnectionContext.https().

Is it possible to use this for non-http servers? Is the context returned somehow specific to http? I'm trying to take advantage of ssl-config but it isn't clear to me that it provides any advantages for non-http servers and I don't see any convenient way of building a context from the ssl-config definition, in which case it seems I may as well define the context manually.

Lastly, any examples of building the context for non-http servers are difficult to find. It seems the process may be the same as for http servers, but I'm finding that examples often include the use of classes/methods that have 'http' in the name. If anyone knows of a good example I'd be very appreciative.

Answer 1

import java.io.{File, FileInputStream}
import java.security.{KeyStore, SecureRandom}
import akka.actor.ActorSystem
import akka.http.scaladsl.Http.ServerBinding
import akka.http.scaladsl.model.{HttpResponse, StatusCodes}
import akka.http.scaladsl.server.Directives._
import akka.http.scaladsl.server.Route
import akka.http.scaladsl.server.Directives.pathSingleSlash
import akka.http.scaladsl.{ConnectionContext, Http}
import akka.stream.{ActorMaterializer, TLSClientAuth}
import com.typesafe.sslconfig.akka.AkkaSSLConfig
import com.typesafe.sslconfig.ssl.{KeyManagerConfig, KeyManagerFactoryWrapper, KeyStoreConfig, SSLConfigFactory, SSLConfigSettings}
import javax.net.ssl.{SSLContext, TrustManagerFactory}

import scala.concurrent.{ExecutionContext, Future}

object Test extends App{

  implicit val actorSystem: ActorSystem = ActorSystem("test")
  implicit val materializer: ActorMaterializer = ActorMaterializer()
  implicit val executionContext: ExecutionContext = actorSystem.dispatcher

  val ksConfig: KeyStoreConfig = KeyStoreConfig.apply(data = None,
    filePath = Some("/Users/mshaik/testApp/src/main/resources/keystore/localhost.p12")
  ).withPassword(Some("test"))

  val kmConfig: KeyManagerConfig = KeyManagerConfig().withKeyStoreConfigs(List(ksConfig))

  val sslConfigSettings: SSLConfigSettings = SSLConfigFactory.defaultConfig.withKeyManagerConfig(kmConfig)

  val akkaSSLConfig: AkkaSSLConfig = AkkaSSLConfig.get(actorSystem).withSettings(sslConfigSettings)

  val ks: KeyStore = KeyStore.getInstance("PKCS12")
  ks.load(new FileInputStream(new File(ksConfig.filePath.get)), ksConfig.password.get.toCharArray)

  val kmf: KeyManagerFactoryWrapper = akkaSSLConfig.buildKeyManagerFactory(sslConfigSettings)
  kmf.init(ks, ksConfig.password.get.toCharArray)

  val tmf: TrustManagerFactory = TrustManagerFactory.getInstance("SunX509")
  tmf.init(ks)

  val sslContext: SSLContext = SSLContext.getInstance("TLS")
  sslContext.init(kmf.getKeyManagers, tmf.getTrustManagers, new SecureRandom)

  val ctx: ConnectionContext = ConnectionContext.https(sslContext,
    sslConfig = Some(akkaSSLConfig),
    clientAuth = Some(TLSClientAuth.Want)
  )

  var bindingFuture: Future[ServerBinding] = _

  Http().setDefaultServerHttpContext(ctx)

  val route: Route = pathSingleSlash {
    get {
      complete(HttpResponse(StatusCodes.OK, entity = "Welcome to base path!"))
    }
  }

  try{
    bindingFuture = Http().bindAndHandle(route,  "localhost", 8085, connectionContext = ctx)
    println( s"Server online at https://localhost:8085/")
  } catch {
    case ex: Exception =>
      println(this.getClass, ex.getMessage, ex)
      materializer.shutdown()
      actorSystem.terminate()
  }
}

Answer 2

I believe the answer to my question is that there isn't much use in thoroughly configuring TLS options within ssl-config when creating a non-HTTP TLS connection.

Not a single example I found shows how to define keystore and truststore parameters within the config and then use those configurations to create the SSLContext object (all examples configure the keystore/truststore parameters manually, within the code). Ultimately I found it wasn't useful to use ssl-config for storing configurations. The only place I found it useful is to obtain the list of default ciphers and default protocols (and hence I still use it in my code).

For reference, below is what I ended up doing to configure the context and initial session structure and create the TCP server. This is very similar to other examples found within documentation as well as some responses here on SO. Some differences in this response: 1) This requires client certificates, 2) This is for a server (as opposed to a client), 3) This code shows how to use factory methods to create the TLS BidiFlow (note the Tcp().bindTls call) 4) This allows you to pass in the Flow that will handle the incoming communications.

object TcpServerBindTls extends StrictLogging {
  def apply(hostInterface: String, tcpPort: Int, handler: Flow[ByteString, ByteString, NotUsed])(implicit system: ActorSystem, materializer: ActorMaterializer) = {
    val sslContext = buildSSLContext
    val firstSession = prepareFirstSession(sslContext)
    val connections: Source[Tcp.IncomingConnection, Future[Tcp.ServerBinding]] = Tcp().bindTls(hostInterface, tcpPort, sslContext, firstSession)

    connections runForeach { connection =>
      logger.info(s"New connection: ${connection}")
      connection.handleWith(handler)
    }
  }

  def prepareFirstSession(sslContext: SSLContext)(implicit system: ActorSystem) = {
    val sslConfig = AkkaSSLConfig.get(system);
    val config = sslConfig.config;
    val defaultParams = sslContext.getDefaultSSLParameters();
    val defaultProtocols = defaultParams.getProtocols();
    val defaultCiphers = defaultParams.getCipherSuites();
    val clientAuth = TLSClientAuth.need

    defaultParams.setProtocols(defaultProtocols)
    defaultParams.setCipherSuites(defaultCiphers)

    val firstSession = new TLSProtocol.NegotiateNewSession(None, None, None, None)
       .withCipherSuites(defaultCiphers: _*)
       .withProtocols(defaultProtocols: _*)
       .withParameters(defaultParams)

    firstSession
  }

  def buildSSLContext: SSLContext = {
    val bufferedSource = io.Source.fromFile("/path/to/password/file")
    val keyStorePassword = bufferedSource.getLines.mkString
    bufferedSource.close

    val keyStore = KeyStore.getInstance("PKCS12");
    val keyStoreLocation = "/path/to/keystore/file/server.p12"
    val keyStoreFIS = new FileInputStream(keyStoreLocation)
    keyStore.load(keyStoreFIS, keyStorePassword.toCharArray())

    val trustStore = KeyStore.getInstance("PKCS12");
    val trustStoreLocation = settings.tls.keyStoreLocation;
    val trustStoreFIS = new FileInputStream(keyStoreLocation)
    trustStore.load(trustStoreFIS, keyStorePassword.toCharArray())

    val kmf = KeyManagerFactory.getInstance("SunX509")
    kmf.init(keyStore, keyStorePassword.toCharArray())

    val tmf = TrustManagerFactory.getInstance("SunX509")
    tmf.init(trustStore)

    val sslContext = SSLContext.getInstance("TLS")
    sslContext.init(kmf.getKeyManagers, tmf.getTrustManagers, new SecureRandom())
    sslContext
  }
}