SSL Configuration Fails even EnbleSsl property is set to false #6038

aminchenkov · 2022-07-09T04:19:05Z

Fixes # #3594

Changes

If remote:dot-netty:enablessl property is set false and certificate and a password are not provided, a SslSettings object is still trying to be created.
After this change, SslSettings object will be attempted to create only if enablessl property is set to false.

Aaronontheweb · 2022-07-11T12:33:58Z

Thanks @aminchenkov - I'll review this.

Aaronontheweb · 2022-07-11T13:33:45Z

Looks like this PR broke some of the other tests in the affected file. Looking at that...

Aaronontheweb · 2022-07-11T13:37:49Z

Ah, it's your own test that is failing

Aaronontheweb · 2022-07-11T13:38:48Z

   at Akka.Remote.Tests.Transport.DotNettySslSupportSpec.If_EnableSsl_configuration_is_true_but_not_valid_certificate_password_is_provided_than_WindowsCryptographicException_should_be_thrown() in /home/vsts/work/1/s/src/core/Akka.Remote.Tests/Transport/DotNettySslSupportSpec.cs:line 253
--- End of stack trace from previous location where exception was thrown ---

Assert.Equal() Failure
          ↓ (pos 0)
Expected: The specified network password is not cor···
Actual:   error:23076071:PKCS12 routines:PKCS12_par···
          ↑ (pos 0)

Aaronontheweb · 2022-07-11T14:15:19Z

Disabled the inner assertion around the exact error message. But otherwise, this PR looks good to me.

Aaronontheweb

LGTM

Aaronontheweb · 2022-07-11T14:16:42Z

@Arkatufus we're going to need to backport this change to v1.4 as well.

Aaronontheweb · 2022-07-11T14:42:21Z

Build failed due to a temporary NuGet.org failure. I'll re-run it.

aminchenkov · 2022-07-11T17:00:28Z

@Aaronontheweb , what is next? I see it was approved, but when it will be merged? Can we expect it to release it soon?

Aaronontheweb · 2022-07-11T21:48:13Z

@aminchenkov I'm making sure that those compilation issues (NuGet-related) have been resolved. Once that's done we'll backport this PR into the v1.4 branch and do a release soon. This week probably.

ismaelhamed · 2022-07-12T06:37:39Z

We still need to check for config.HasPath("ssl")

Aaronontheweb · 2022-07-12T12:06:26Z

We still need to check for config.HasPath("ssl")

You're right about that

Aaronontheweb · 2022-07-12T13:52:03Z

src/core/Akka.Remote/Transport/DotNetty/DotNettyTransportSettings.cs

@@ -87,7 +87,7 @@ public static DotNettyTransportSettings Create(Config config)
                serverSocketWorkerPoolSize: ComputeWorkerPoolSize(config.GetConfig("server-socket-worker-pool")),
                clientSocketWorkerPoolSize: ComputeWorkerPoolSize(config.GetConfig("client-socket-worker-pool")),
                maxFrameSize: ToNullableInt(config.GetByteSize("maximum-frame-size", null)) ?? 128000,
-                ssl: config.HasPath("ssl") ? SslSettings.Create(config.GetConfig("ssl")) : SslSettings.Empty,
+                ssl: config.HasPath("ssl") && config.GetBoolean("enable-ssl", false) ? SslSettings.Create(config.GetConfig("ssl")) : SslSettings.Empty,


I think this should address your issue @ismaelhamed

enableSsl && config.HasPath("ssl") can be achieved by moving line #81 outside the return, but otherwise LGTM.

@ismaelhamed , I pushed the change. Please check if it is what you wanted.

Aaronontheweb

LGTM

…t to false (#6043) * SSL Configuration Fails even EnbleSsl property is set to false (#6038) * Respect EnableSsl configuration propert * Update DotNettySslSupportSpec.cs * Update DotNettySslSupportSpec.cs * Update DotNettyTransportSettings.cs * Moved enableSsl variable initialization outside return statement Co-authored-by: Aliaksei Minchankou <[email protected]> Co-authored-by: Aaron Stannard <[email protected]> * SSL * (Parameter 'certificatePath') * TestKit * Fixed up assertion to no longer be whitespace sensitive * [Bug] using FluentAssertions; Co-authored-by: aminchenkov <[email protected]> Co-authored-by: Aliaksei Minchankou <[email protected]> Co-authored-by: Aaron Stannard <[email protected]>

aminchenkov · 2022-07-25T19:24:17Z

@Aaronontheweb, I upgraded our project to use 1.40 and 1.39 and our application is broken. We use Ask/Tell pattern to communicate between nodes and this does not work anymore - message does not send. Any ideas why it might happen?
Working version is "1.4.16".

aminchenkov · 2022-07-25T19:26:42Z

I see in logs (EnableSsl is true):
heartbeat interval is growing too large for address akka.ssl.tcp://RsPlatformServiceSystem@localhost:60841: 2018 millis

aminchenkov · 2022-07-25T19:28:01Z

Custer is formed correctly with all required nodes.

Aaronontheweb · 2022-07-25T20:10:13Z

Glad to hear it

aminchenkov · 2022-07-25T20:13:01Z

Glad to hear it

@Aaronontheweb , it is actually not good for us - we cannot use latest libraries. do you know what might be the root cause of why a message cannot be sent remotely anymore even the cluster is formed? The issue in 1.14.39 as well.

Aaronontheweb · 2022-07-25T20:20:46Z

I missed your earlier comments - no idea. I'm at a conference and can only see messages on my mobile. I recommend filing an issue.

Aaronontheweb · 2022-07-25T20:23:37Z

Also, going to need a lot more information (logs.) Strongly recommend you diff the releases on GitHub and identify where a change could have affected you. We have tons of users running 1.4.39 without issue.

Aaronontheweb · 2022-07-25T20:44:45Z

I upgraded our project to use 1.40 and 1.39 and our application is broken. We use Ask/Tell pattern to communicate between nodes and this does not work anymore - message does not send. Any ideas why it might happen?
Working version is "1.4.16".

There's no reason why Akka.NET wouldn't allow an outbound message to be sent - if Akka.Remote / Akka.Cluster are still functioning normally then the issue isn't remoting / clustering. It's probably your application code and possibly the way we changed how Ask is implemented internally (modernized it to use async Task local functions rather than ContinueWith - should be totally benign unless you are doing weird stuff with async context - diff the release notes.)

aminchenkov · 2022-07-25T21:04:27Z

Thank you. Will try to find the root cause. Will keep you posted.

aminchenkov · 2022-07-26T19:15:21Z

It is release 1.4.24. 23 works fine, Reading release notes. @Aaronontheweb , if you already know what might be the reason - please reply

aminchenkov · 2022-07-27T02:26:11Z

Last logging warning before nothing: "heartbeat interval is growing too large for address"

aminchenkov · 2022-07-27T10:04:53Z

@Aaronontheweb , in 23 the code below returns 1 routee but in 1.24 it returns empty list. Do you have an idea why it might be. We are using deployment.

            var task = RspActorSystem.RsDataValidationActor.Ask<Routees>(GetRoutees.Instance).ContinueWith(tr =>
            {
                var members = tr.Result.Members.ToList();
                return members;
            });

aminchenkov · 2022-07-27T10:40:33Z

@Aaronontheweb , in 23 the code below returns 1 routee but in 1.24 it returns empty list. Do you have an idea why it might be. We are using deployment.
            var task = RspActorSystem.RsDataValidationActor.Ask<Routees>(GetRoutees.Instance).ContinueWith(tr =>
            {
                var members = tr.Result.Members.ToList();
                return members;
            });

Sorry, now it return 1 as well.

Aaronontheweb · 2022-07-27T12:54:03Z

So release v1.4.24 works without any issues now too?

aminchenkov · 2022-07-27T13:20:48Z

No. 1.24 does not work even a routee is resolved.

Aaronontheweb · 2022-07-27T13:24:14Z

Here's everything that occurred in v1.4.24 https://github.com/akkadotnet/akka.net/releases/tag/1.4.24 - the only issue I can think of that would affect you is the transmission of unsafe types in Hyperion was disallowed then. Does that apply to you?

aminchenkov · 2022-07-27T18:34:59Z

@Aaronontheweb , I don't know how I can answer to your question. We send in messages between nodes only integers and strings.

Aaronontheweb · 2022-07-27T18:36:47Z

That'd be a "no" then - Hyperion doesn't filter out primitives. You should probably just message us in Discord because in order for us to help you you're going to need to share logs / config. Whatever is going on is specific to your application.

aminchenkov · 2022-07-27T19:06:38Z

@Aaronontheweb , do you already have a Discord Server?

Aaronontheweb · 2022-07-27T19:12:56Z

https://discord.gg/GSCfPwhbWP

Respect EnableSsl configuration propert

2b82527

aminchenkov mentioned this pull request Jul 9, 2022

SSL Configuration Fails Unless Fully Configured #3594

Closed

Aaronontheweb added akka-remote configuration labels Jul 11, 2022

Update DotNettySslSupportSpec.cs

151c668

Aaronontheweb approved these changes Jul 11, 2022

View reviewed changes

Update DotNettySslSupportSpec.cs

2b99c67

Aaronontheweb enabled auto-merge (squash) July 11, 2022 14:16

Aaronontheweb disabled auto-merge July 11, 2022 14:16

Aaronontheweb enabled auto-merge (squash) July 11, 2022 14:16

Update DotNettyTransportSettings.cs

2b1d888

Aaronontheweb reviewed Jul 12, 2022

View reviewed changes

Moved enableSsl variable initialization outside return statement

2f249f6

auto-merge was automatically disabled July 12, 2022 15:52
Head branch was pushed to by a user without write access

Aaronontheweb approved these changes Jul 12, 2022

View reviewed changes

Aaronontheweb enabled auto-merge (squash) July 12, 2022 15:55

Aaronontheweb disabled auto-merge July 12, 2022 21:56

Aaronontheweb merged commit b21f5fa into akkadotnet:dev Jul 13, 2022

ismaelhamed mentioned this pull request Jul 21, 2022

Update RELEASE_NOTES.md for 1.4.40 release #6046

Merged

SSL Configuration Fails even EnbleSsl property is set to false #6038

SSL Configuration Fails even EnbleSsl property is set to false #6038

Conversation

aminchenkov commented Jul 9, 2022

Changes

Aaronontheweb commented Jul 11, 2022

Aaronontheweb commented Jul 11, 2022

Aaronontheweb commented Jul 11, 2022

Aaronontheweb commented Jul 11, 2022

Aaronontheweb commented Jul 11, 2022

Aaronontheweb left a comment

Choose a reason for hiding this comment

Aaronontheweb commented Jul 11, 2022

Aaronontheweb commented Jul 11, 2022

aminchenkov commented Jul 11, 2022 • edited Loading

Aaronontheweb commented Jul 11, 2022

ismaelhamed commented Jul 12, 2022

Aaronontheweb commented Jul 12, 2022

Aaronontheweb Jul 12, 2022

Choose a reason for hiding this comment

ismaelhamed Jul 12, 2022 • edited Loading

Choose a reason for hiding this comment

aminchenkov Jul 12, 2022

Choose a reason for hiding this comment

Aaronontheweb left a comment

Choose a reason for hiding this comment

aminchenkov commented Jul 25, 2022

aminchenkov commented Jul 25, 2022

aminchenkov commented Jul 25, 2022

Aaronontheweb commented Jul 25, 2022

aminchenkov commented Jul 25, 2022 • edited Loading

Aaronontheweb commented Jul 25, 2022

Aaronontheweb commented Jul 25, 2022

Aaronontheweb commented Jul 25, 2022

aminchenkov commented Jul 25, 2022

aminchenkov commented Jul 26, 2022

aminchenkov commented Jul 27, 2022

aminchenkov commented Jul 27, 2022 • edited Loading

aminchenkov commented Jul 27, 2022

Aaronontheweb commented Jul 27, 2022

aminchenkov commented Jul 27, 2022

Aaronontheweb commented Jul 27, 2022

aminchenkov commented Jul 27, 2022 • edited Loading

Aaronontheweb commented Jul 27, 2022

aminchenkov commented Jul 27, 2022

Aaronontheweb commented Jul 27, 2022

aminchenkov commented Jul 11, 2022 •

edited

Loading

ismaelhamed Jul 12, 2022 •

edited

Loading

aminchenkov commented Jul 25, 2022 •

edited

Loading

aminchenkov commented Jul 27, 2022 •

edited

Loading

aminchenkov commented Jul 27, 2022 •

edited

Loading