fix: mTLS server and client setup and docs #1781

johanandren · 2023-05-02T19:37:47Z

Includes fix for #1728

docs/src/main/paradox/server/mtls.md

plugin-tester-scala/src/main/scala/example/myapp/helloworld/MtlsGreeterServer.scala

docs/src/main/paradox/server/mtls.md

Co-authored-by: Patrik Nordwall <patrik.nordwall@gmail.com>

johanandren · 2023-05-03T13:43:34Z

Caveat: not sure the added SSL context setup doesn't break all kinds of things when not doing mTLS, hoping CI will tell me

johanandren · 2023-05-04T11:32:02Z

Some more testing/digging, the client SSLContext translation only happens when a custom SSLContext is defined, so regular use without that is completely unaffected by this, and I think all such customisation was broken based on what @patriknw noticed when trying to set up a custom context to accept a self-signed cert, which then worked with this patch.

So: ready for final review/merge

johanandren · 2023-05-04T13:29:06Z

I'll add a test covering this as well, so we notice if we break TLS setup again

patriknw · 2023-05-05T07:46:52Z

Caveat: not sure the added SSL context setup doesn't break all kinds of things when not doing mTLS

I tested this with TLS but without mTLS and it works.

johanandren · 2023-05-05T07:59:49Z

We could add an additional test for custom SSL only, but I think what that would catch is already covered by the mTLS test I wrote yesterday.

patriknw

LGTM, after something minor in the samples

patriknw · 2023-05-05T08:15:59Z

plugin-tester-java/src/main/java/example/myapp/helloworld/MtlsGreeterClient.java

+ try {
+ BufferedInputStream in = new BufferedInputStream(MtlsGreeterServer.class.getResourceAsStream(path));
+ ByteArrayOutputStream bao = new ByteArrayOutputStream();
+ for (int result = in.read(); result != -1; result = in.read()) {


Since this is text, shouldn't it use a Reader instead? Random example https://www.baeldung.com/convert-input-stream-to-string

Also, this is missing close() on the in. I think they are Closable so placing in try (...) { should automatically close.

patriknw · 2023-05-05T08:18:34Z

plugin-tester-java/src/main/resources/certs/README.md

+Server cert for localhost signed by rootCA in localhost-server.*, no password for private key
+Client cert for a client to connect in localhost-client.*, no password for private key
+
+Certs used by `MtlsGreeterServer`.


For reference, should we include the commands for how the test certs were created?

patriknw · 2023-05-05T08:23:21Z

project/Dependencies.scala

@@ -19,8 +19,8 @@ object Dependencies {
 // https://doc.akka.io//docs/akka/current/project/downstream-upgrade-strategy.html
 val akka = "2.7.0"
 val akkaBinary = "2.7"
- val akkaHttp = "10.5.0-M1"
- val akkaHttpBinary = "10.4"
+ val akkaHttp = "10.5.0"


make sure the release notes includes this change

ihostage · 2023-12-15T10:37:08Z

@patriknw @johanandren
Hi, friends! 👋
Any chance that this fix will be backported to 2.1.x and released as 2.1.7 with APL 2.0?

Context: Play gRPC stucks on 2.1.5 and can't bump to 2.1.6 by this problem 😞

johanandren · 2023-12-15T11:08:22Z

I'm afraid we have no plans to backport any functionality added in 2.2 and later to the 2.1 branch

ihostage · 2023-12-15T12:37:59Z

I'm afraid we have no plans to backport any functionality added in 2.2 and later to the 2.1 branch

Will release be possible if I will do the small (without docs and samples) backport itself?

ihostage · 2023-12-15T13:20:50Z

I tested locally and it looks as if we need only this piece of changes, nothing more

Subject: [PATCH] Backport #1781
---
Index: runtime/src/main/scala/akka/grpc/internal/NettyClientUtils.scala
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/runtime/src/main/scala/akka/grpc/internal/NettyClientUtils.scala b/runtime/src/main/scala/akka/grpc/internal/NettyClientUtils.scala
--- a/runtime/src/main/scala/akka/grpc/internal/NettyClientUtils.scala	(revision accf37ccc97205d588742ced4bcc7d1ed7499142)
+++ b/runtime/src/main/scala/akka/grpc/internal/NettyClientUtils.scala	(revision 1943f6dc29418f3332203fa3143b959aa60fd512)
@@ -5,7 +5,6 @@
 package akka.grpc.internal
 
 import java.util.concurrent.TimeUnit
-
 import javax.net.ssl.SSLContext
 import akka.{ Done, NotUsed }
 import akka.annotation.InternalApi
@@ -16,7 +15,17 @@
 import io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts
 import io.grpc.netty.shaded.io.grpc.netty.NegotiationType
 import io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder
-import io.grpc.netty.shaded.io.netty.handler.ssl.{ SslContext, SslContextBuilder }
+import io.grpc.netty.shaded.io.netty.handler.ssl.ApplicationProtocolConfig.{
+  Protocol,
+  SelectedListenerFailureBehavior,
+  SelectorFailureBehavior
+}
+import io.grpc.netty.shaded.io.netty.handler.ssl.{
+  ApplicationProtocolConfig,
+  ApplicationProtocolNames,
+  SslContext,
+  SslContextBuilder
+}
 
 import scala.annotation.nowarn
 import scala.concurrent.duration.FiniteDuration
@@ -172,23 +181,24 @@
    */
   @InternalApi
   private def createNettySslContext(javaSslContext: SSLContext): SslContext = {
-    import io.grpc.netty.shaded.io.netty.handler.ssl.{
-      ApplicationProtocolConfig,
-      ClientAuth,
-      IdentityCipherSuiteFilter,
-      JdkSslContext
-    }
+    import io.grpc.netty.shaded.io.netty.handler.ssl.{ ClientAuth, IdentityCipherSuiteFilter, JdkSslContext }
     // See
     // https://github.com/netty/netty/blob/4.1/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java#L229-L309
-    new JdkSslContext(
+    val apn = new ApplicationProtocolConfig(
+      Protocol.ALPN,
+      SelectorFailureBehavior.NO_ADVERTISE,
+      SelectedListenerFailureBehavior.ACCEPT,
+      ApplicationProtocolNames.HTTP_2)
+    val context = new JdkSslContext(
       javaSslContext,
       /* boolean isClient */ true,
       /* Iterable<String> ciphers */ null, // use JDK defaults (null is accepted as indicated in constructor Javadoc)
       IdentityCipherSuiteFilter.INSTANCE,
-      /* ApplicationProtocolConfig apn */ ApplicationProtocolConfig.DISABLED, // use JDK default (null would also be acceptable, DISABLED config will select the NONE protocol and thus the JdkDefaultApplicationProtocolNegotiator)
-      ClientAuth.NONE, // server-only option, which is ignored as isClient=true (as indicated in constructor Javadoc)
+      /* ApplicationProtocolConfig apn */ apn,
+      ClientAuth.OPTIONAL, // server-only option, which is ignored as isClient=true (as indicated in constructor Javadoc)
       /* String[] protocols */ null, // use JDK defaults (null is accepted as indicated in constructor Javadoc)
       /* boolean startTls */ false)
+    context
   }
 
   /**

doc: WIP mTLS server setup in Scala and certs prepared

a4763fb

probot-autolabeler bot added the update label May 2, 2023

patriknw reviewed May 3, 2023

View reviewed changes

docs/src/main/paradox/server/mtls.md Outdated Show resolved Hide resolved

plugin-tester-scala/src/main/scala/example/myapp/helloworld/MtlsGreeterServer.scala Outdated Show resolved Hide resolved

docs/src/main/paradox/server/mtls.md Outdated Show resolved Hide resolved

johanandren and others added 2 commits May 3, 2023 11:14

Update docs/src/main/paradox/server/mtls.md

94559fb

Co-authored-by: Patrik Nordwall <patrik.nordwall@gmail.com>

Working, including fix for #1728

58b9e2e

johanandren added 3 commits May 3, 2023 15:44

Missing headers

57146d5

wrong scope, moved mtls page to top index

526bace

doc page

e13bd71

johanandren marked this pull request as ready for review May 3, 2023 15:36

One more wrong scope for akka-pki

33b3c84

johanandren changed the title ~~doc: WIP mTLS server setup in Scala and certs prepared~~ doc: mTLS server and client setup May 4, 2023

johanandren changed the title ~~doc: mTLS server and client setup~~ fix: mTLS server and client setup and docs May 4, 2023

johanandren added 3 commits May 4, 2023 15:37

test coverage

a50a0c0

headers and formatting

4f725e4

testkit also for gradle

67579e3

patriknw approved these changes May 5, 2023

View reviewed changes

johanandren added 2 commits May 5, 2023 10:53

more proper input stream handling

92ee92d

cert generation instructions

16c640a

johanandren merged commit 6133650 into main May 5, 2023

johanandren deleted the wip-document-mtls branch May 5, 2023 09:37

ihostage mentioned this pull request Dec 15, 2023

[0.11.x] akka-grpc-codegen, ... 2.1.6 (was 2.1.5) playframework/play-grpc#407

Closed

mkurz mentioned this pull request Dec 21, 2023

Switch to Play 3 and Pekko playframework/play-grpc#490

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: mTLS server and client setup and docs #1781

fix: mTLS server and client setup and docs #1781

johanandren commented May 2, 2023 •

edited

Loading

johanandren commented May 3, 2023

johanandren commented May 4, 2023

johanandren commented May 4, 2023

patriknw commented May 5, 2023

johanandren commented May 5, 2023

patriknw left a comment

patriknw May 5, 2023

johanandren May 5, 2023

patriknw May 5, 2023

johanandren May 5, 2023

patriknw May 5, 2023

ihostage commented Dec 15, 2023

johanandren commented Dec 15, 2023

ihostage commented Dec 15, 2023

ihostage commented Dec 15, 2023

fix: mTLS server and client setup and docs #1781

fix: mTLS server and client setup and docs #1781

Conversation

johanandren commented May 2, 2023 • edited Loading

johanandren commented May 3, 2023

johanandren commented May 4, 2023

johanandren commented May 4, 2023

patriknw commented May 5, 2023

johanandren commented May 5, 2023

patriknw left a comment

Choose a reason for hiding this comment

patriknw May 5, 2023

Choose a reason for hiding this comment

johanandren May 5, 2023

Choose a reason for hiding this comment

patriknw May 5, 2023

Choose a reason for hiding this comment

johanandren May 5, 2023

Choose a reason for hiding this comment

patriknw May 5, 2023

Choose a reason for hiding this comment

ihostage commented Dec 15, 2023

johanandren commented Dec 15, 2023

ihostage commented Dec 15, 2023

ihostage commented Dec 15, 2023

johanandren commented May 2, 2023 •

edited

Loading