This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/pekko.git
The following commit(s) were added to refs/heads/main by this push:
new 87d45050f5 warn if pekko-remote is not using tls (#3400)
87d45050f5 is described below
commit 87d45050f5be5c882eff6f1b86c824788eca6e67
Author: PJ Fanning <[email protected]>
AuthorDate: Tue Aug 4 09:57:13 2026 +0100
warn if pekko-remote is not using tls (#3400)
* warn if pekko-remote is not using tls
* Update RemoteActorRefProvider.scala
* Update NonTlsWarningSpec.scala
---
.../pekko/remote/RemoteActorRefProvider.scala | 43 ++++++-
.../apache/pekko/remote/NonTlsWarningSpec.scala | 136 +++++++++++++++++++++
2 files changed, 177 insertions(+), 2 deletions(-)
diff --git
a/remote/src/main/scala/org/apache/pekko/remote/RemoteActorRefProvider.scala
b/remote/src/main/scala/org/apache/pekko/remote/RemoteActorRefProvider.scala
index ddd647925b..098e9ac00e 100644
--- a/remote/src/main/scala/org/apache/pekko/remote/RemoteActorRefProvider.scala
+++ b/remote/src/main/scala/org/apache/pekko/remote/RemoteActorRefProvider.scala
@@ -33,7 +33,8 @@ import pekko.dispatch.sysmsg._
import pekko.event.EventStream
import pekko.event.Logging
import pekko.event.Logging.Error
-import pekko.event.LoggingAdapter
+import pekko.event.LogMarker
+import pekko.event.MarkerLoggingAdapter
import pekko.pattern.pipe
import pekko.remote.artery.ArterySettings
import pekko.remote.artery.ArterySettings.AeronUpd
@@ -194,7 +195,7 @@ private[pekko] class RemoteActorRefProvider(
@volatile
private var _log = local.log
- def log: LoggingAdapter = _log
+ def log: MarkerLoggingAdapter = _log
override def rootPath: ActorPath = local.rootPath
override def deadLetters: InternalActorRef = local.deadLetters
@@ -267,6 +268,7 @@ private[pekko] class RemoteActorRefProvider(
warnIfDirectUse()
warnIfUseUnsafeWithoutCluster()
+ warnIfNoTls()
// this enables reception of remote requests
transport.start()
@@ -351,6 +353,43 @@ private[pekko] class RemoteActorRefProvider(
"Pekko Cluster not in use - Using Pekko Cluster is recommended if
you need remote watch and deploy.")
}
+ // Log on `init` to warn about non-TLS remote transports.
+ private def warnIfNoTls(): Unit = {
+ if (remoteSettings.Artery.Enabled) {
+ remoteSettings.Artery.Transport match {
+ case ArterySettings.Tcp =>
+ log.warning(
+ LogMarker.Security,
+ "Artery remote is configured without TLS (transport = tcp), " +
+ "messages are not encrypted in transit. " +
+ "Use 'tls-tcp' transport to enable TLS. " +
+ "See
https://pekko.apache.org/docs/pekko/current/remoting-artery.html#configuring-ssl-tls-for-artery";)
+ case AeronUpd =>
+ log.warning(
+ LogMarker.Security,
+ "Artery remote is configured without TLS (transport = aeron-udp),
" +
+ "messages are not encrypted in transit. " +
+ "Use 'tls-tcp' transport if encryption is required. " +
+ "See
https://pekko.apache.org/docs/pekko/current/remoting-artery.html#configuring-ssl-tls-for-artery";)
+ case _ => // TlsTcp, no warning needed
+ }
+ } else {
+ remoteSettings.Transports.foreach {
+ case (transportClass, _, transportConfig) =>
+ val enableSsl = transportConfig.hasPath("enable-ssl") &&
transportConfig.getBoolean("enable-ssl")
+ if (!enableSsl) {
+ log.warning(
+ LogMarker.Security,
+ "Classic Netty remote is configured without TLS (enable-ssl =
false for transport [{}]), " +
+ "messages are not encrypted in transit. " +
+ "Enable SSL or use Artery with 'tls-tcp' transport. " +
+ "See https://pekko.apache.org/docs/pekko/current/remoting.html";,
+ transportClass)
+ }
+ }
+ }
+ }
+
protected def warnOnUnsafe(message: String): Unit =
if (warnOnUnsafeRemote) log.warning(message)
else log.debug(message)
diff --git
a/remote/src/test/scala/org/apache/pekko/remote/NonTlsWarningSpec.scala
b/remote/src/test/scala/org/apache/pekko/remote/NonTlsWarningSpec.scala
new file mode 100644
index 0000000000..2a4f49be17
--- /dev/null
+++ b/remote/src/test/scala/org/apache/pekko/remote/NonTlsWarningSpec.scala
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.pekko.remote
+
+import scala.concurrent.Await
+import scala.concurrent.duration._
+
+import org.apache.pekko
+import pekko.actor.ActorSystem
+import pekko.remote.artery.ArterySettings
+import pekko.testkit.PekkoSpec
+
+import org.scalatest.BeforeAndAfterAll
+import org.scalatest.matchers.should.Matchers
+import org.scalatest.wordspec.AnyWordSpecLike
+
+import com.typesafe.config.ConfigFactory
+
+class NonTlsWarningSpec extends AnyWordSpecLike with Matchers with
BeforeAndAfterAll {
+
+ private var systems: List[ActorSystem] = Nil
+
+ private def createSystem(name: String, config: com.typesafe.config.Config):
ActorSystem = {
+ val sys = ActorSystem(name, config)
+ systems = systems :+ sys
+ sys
+ }
+
+ override def afterAll(): Unit = {
+ systems.foreach { sys =>
+ Await.result(sys.terminate(), 10.seconds)
+ }
+ super.afterAll()
+ }
+
+ "RemoteActorRefProvider" must {
+
+ "detect Artery TCP transport as non-TLS" in {
+ val config = ConfigFactory
+ .parseString("""
+ pekko.remote.artery.transport = tcp
+ """)
+ .withFallback(PekkoSpec.testConf)
+ .withFallback(ConfigFactory.load())
+
+ val system = createSystem("artery-tcp-test", config)
+ val settings = new RemoteSettings(system.settings.config)
+ settings.Artery.Enabled should be(true)
+ settings.Artery.Transport should be(ArterySettings.Tcp)
+ }
+
+ "detect Artery Aeron UDP transport as non-TLS" in {
+ val config = ConfigFactory
+ .parseString("""
+ pekko.remote.artery.transport = aeron-udp
+ """)
+ .withFallback(PekkoSpec.testConf)
+ .withFallback(ConfigFactory.load())
+
+ val system = createSystem("artery-aeron-test", config)
+ val settings = new RemoteSettings(system.settings.config)
+ settings.Artery.Enabled should be(true)
+ settings.Artery.Transport should be(ArterySettings.AeronUpd)
+ }
+
+ "detect Classic Netty transport as non-TLS by default" in {
+ val config = ConfigFactory
+ .parseString("""
+ pekko.remote.artery.enabled = off
+ """)
+ .withFallback(PekkoSpec.testConf)
+ .withFallback(ConfigFactory.load())
+
+ val system = createSystem("classic-netty-test", config)
+ val settings = new RemoteSettings(system.settings.config)
+ settings.Artery.Enabled should be(false)
+ settings.Transports should not be empty
+ // Default classic transport (pekko.remote.classic.netty.tcp) has no
enable-ssl key
+ settings.Transports.foreach {
+ case (_, _, transportConfig) =>
+ val hasSsl = transportConfig.hasPath("enable-ssl") &&
transportConfig.getBoolean("enable-ssl")
+ hasSsl should be(false)
+ }
+ }
+
+ "not warn for Artery TLS-TCP transport" in {
+ val config = ConfigFactory
+ .parseString("""
+ pekko.remote.artery.transport = tls-tcp
+ """)
+ .withFallback(PekkoSpec.testConf)
+ .withFallback(ConfigFactory.load())
+
+ val system = createSystem("artery-tls-tcp-test", config)
+ val settings = new RemoteSettings(system.settings.config)
+ settings.Artery.Enabled should be(true)
+ settings.Artery.Transport should be(ArterySettings.TlsTcp)
+ }
+
+ "detect Classic Netty SSL transport as TLS-enabled" in {
+ val config = ConfigFactory
+ .parseString("""
+ pekko.remote.artery.enabled = off
+ pekko.remote.classic.enabled-transports =
["pekko.remote.classic.netty.ssl"]
+ """)
+ .withFallback(PekkoSpec.testConf)
+ .withFallback(ConfigFactory.load())
+
+ val system = createSystem("classic-netty-ssl-test", config)
+ val settings = new RemoteSettings(system.settings.config)
+ settings.Artery.Enabled should be(false)
+ settings.Transports should not be empty
+ settings.Transports.exists {
+ case (_, _, transportConfig) =>
+ transportConfig.hasPath("enable-ssl") &&
transportConfig.getBoolean("enable-ssl")
+ } should be(true)
+ }
+
+ }
+
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
