4

我正在尝试配置 AKKA SSL 连接以使用我的密钥库和信任文件，并且我希望它能够在类路径中找到它们。

我试图将 application.conf 设置为：

...
remote.netty.ssl = {
        enable = on
        key-store = "keystore"
        key-store-password = "passwd"
        trust-store = "truststore"
        trust-store-password = "passwd"
        protocol = "TLSv1"
        random-number-generator = "AES128CounterSecureRNG"
        enabled-algorithms = ["TLS_RSA_WITH_AES_128_CBC_SHA"]
    }
...

如果keystore和trustore文件在当前目录中，这可以正常工作。在我的应用程序中，这些文件被打包到 WAR 和 JAR 档案中，因此我想从类路径中读取它们。

我尝试按照此处getResource("keystore")所述在 application.conf 中使用，但没有任何运气。Config 从字面上读取它作为一个字符串。

我还尝试解析 String conf 并强制它读取值：

val conf: Config = ConfigFactory parseString (s"""
...
"${getClass.getClassLoader.getResource("keystore").getPath}" 
...""")

在这种情况下，它会在类路径上找到正确的路径，file://some_dir/target/scala-2.10/server_2.10-1.1-one-jar.jar!/main/server_2.10-1.1.jar!/keystore这正是它所在的位置（在 jar 中）。但是，底层 Netty SSL 传输找不到给定此路径的文件，我得到：

Oct 03, 2013 1:02:48 PM org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink
WARNING: Failed to initialize an accepted socket.
45a13eb9-6cb1-46a7-a789-e48da9997f0fakka.remote.RemoteTransportException: Server SSL connection could not be established because key store could not be loaded
    at akka.remote.netty.NettySSLSupport$.constructServerContext$1(NettySSLSupport.scala:113)
    at akka.remote.netty.NettySSLSupport$.initializeServerSSL(NettySSLSupport.scala:130)
    at akka.remote.netty.NettySSLSupport$.apply(NettySSLSupport.scala:27)
    at akka.remote.netty.NettyRemoteTransport$PipelineFactory$.defaultStack(NettyRemoteSupport.scala:74)
    at akka.remote.netty.NettyRemoteTransport$PipelineFactory$$anon$1.getPipeline(NettyRemoteSupport.scala:67)
    at akka.remote.netty.NettyRemoteTransport$PipelineFactory$$anon$1.getPipeline(NettyRemoteSupport.scala:67)
    at org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink$Boss.registerAcceptedChannel(NioServerSocketPipelineSink.java:277)
    at org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink$Boss.run(NioServerSocketPipelineSink.java:242)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:724)
Caused by: java.io.FileNotFoundException: file:/some_dir/server/target/scala-2.10/server_2.10-1.1-one-jar.jar!/main/server_2.10-1.1.jar!/keystore (No such file or directory)
    at java.io.FileInputStream.open(Native Method)
    at java.io.FileInputStream.<init>(FileInputStream.java:138)
    at java.io.FileInputStream.<init>(FileInputStream.java:97)
    at akka.remote.netty.NettySSLSupport$.constructServerContext$1(NettySSLSupport.scala:118)
    ... 10 more

我想知道是否有任何方法可以在不实现自定义 SSL 传输的情况下在 AKKA 中进行配置。也许我应该在代码中配置 Netty？

显然我可以硬编码路径或从环境变量中读取它，但我更喜欢更灵活的类路径解决方案。

我决定查看akka.remote.netty.NettySSLSupport引发异常的代码，这里是代码：

  def initializeServerSSL(settings: NettySettings, log: LoggingAdapter): SslHandler = {
log.debug("Server SSL is enabled, initialising ...")

def constructServerContext(settings: NettySettings, log: LoggingAdapter, keyStorePath: String, keyStorePassword: String, protocol: String): Option[SSLContext] =
  try {
    val rng = initializeCustomSecureRandom(settings.SSLRandomNumberGenerator, settings.SSLRandomSource, log)
    val factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm)
    factory.init({
      val keyStore = KeyStore.getInstance(KeyStore.getDefaultType)
      val fin = new FileInputStream(keyStorePath)
      try keyStore.load(fin, keyStorePassword.toCharArray) finally fin.close()
      keyStore
    }, keyStorePassword.toCharArray)
    Option(SSLContext.getInstance(protocol)) map { ctx ⇒ ctx.init(factory.getKeyManagers, null, rng); ctx }
  } catch {
    case e: FileNotFoundException    ⇒ throw new RemoteTransportException("Server SSL connection could not be established because key store could not be loaded", e)
    case e: IOException              ⇒ throw new RemoteTransportException("Server SSL connection could not be established because: " + e.getMessage, e)
    case e: GeneralSecurityException ⇒ throw new RemoteTransportException("Server SSL connection could not be established because SSL context could not be constructed", e)
  }

看起来它必须是一个普通的文件名（字符串），因为这就是 FileInputStream 所需要的。

欢迎大家提出意见！

4

2 回答 2

1

我也陷入了类似的问题并且遇到了类似的错误。在我的情况下，我试图使用 akka-http 使用自签名证书访问 https 服务器，使用以下代码我能够通过：

val trustStoreConfig = TrustStoreConfig(None, Some("/etc/Project/keystore/my.cer")).withStoreType("PEM")
val trustManagerConfig = TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))

val badSslConfig = AkkaSSLConfig().mapSettings(s => s.withLoose(s.loose
  .withAcceptAnyCertificate(true)
  .withDisableHostnameVerification(true)
).withTrustManagerConfig(trustManagerConfig))

val badCtx = Http().createClientHttpsContext(badSslConfig)

Http().superPool[RequestTracker](badCtx)(httpMat)
于 2017-11-18T13:13:51.060 回答
0

在写这个问题的时候，AFAIK 没有办法做到这一点。我正在结束这个问题，但如果新版本提供此类功能或有其他方法可以做到这一点，我欢迎更新。

于 2014-01-05T16:01:29.867 回答