{"action":"created","issue":{"url":"https://api.github.com/repos/akka/akka/issues/20423","repository_url":"https://api.github.com/repos/akka/akka","labels_url":"https://api.github.com/repos/akka/akka/issues/20423/labels{/name}","comments_url":"https://api.github.com/repos/akka/akka/issues/20423/comments","events_url":"https://api.github.com/repos/akka/akka/issues/20423/events","html_url":"https://github.com/akka/akka/issues/20423","id":152028725,"number":20423,"title":"Make SSLSession available when using TLS flow DLS","user":{"login":"magnusart","id":58892,"avatar_url":"https://avatars.githubusercontent.com/u/58892?v=3","gravatar_id":"","url":"https://api.github.com/users/magnusart","html_url":"https://github.com/magnusart","followers_url":"https://api.github.com/users/magnusart/followers","following_url":"https://api.github.com/users/magnusart/following{/other_user}","gists_url":"https://api.github.com/users/magnusart/gists{/gist_id}","starred_url":"https://api.github.com/users/magnusart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnusart/subscriptions","organizations_url":"https://api.github.com/users/magnusart/orgs","repos_url":"https://api.github.com/users/magnusart/repos","events_url":"https://api.github.com/users/magnusart/events{/privacy}","received_events_url":"https://api.github.com/users/magnusart/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/akka/akka/labels/1%20-%20triaged","name":"1 - triaged","color":"5319e7"},{"url":"https://api.github.com/repos/akka/akka/labels/t:http","name":"t:http","color":"CCCCCC"},{"url":"https://api.github.com/repos/akka/akka/labels/t:http:server","name":"t:http:server","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/akka/akka/milestones/55","html_url":"https://github.com/akka/akka/milestones/2.4.x","labels_url":"https://api.github.com/repos/akka/akka/milestones/55/labels","id":1257017,"number":55,"title":"2.4.x","description":"","creator":{"login":"patriknw","id":336161,"avatar_url":"https://avatars.githubusercontent.com/u/336161?v=3","gravatar_id":"","url":"https://api.github.com/users/patriknw","html_url":"https://github.com/patriknw","followers_url":"https://api.github.com/users/patriknw/followers","following_url":"https://api.github.com/users/patriknw/following{/other_user}","gists_url":"https://api.github.com/users/patriknw/gists{/gist_id}","starred_url":"https://api.github.com/users/patriknw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patriknw/subscriptions","organizations_url":"https://api.github.com/users/patriknw/orgs","repos_url":"https://api.github.com/users/patriknw/repos","events_url":"https://api.github.com/users/patriknw/events{/privacy}","received_events_url":"https://api.github.com/users/patriknw/received_events","type":"User","site_admin":false},"open_issues":267,"closed_issues":0,"state":"open","created_at":"2015-08-16T17:29:51Z","updated_at":"2016-05-02T18:12:26Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2016-04-30T12:47:29Z","updated_at":"2016-05-02T20:36:02Z","closed_at":null,"body":"Based of this forum thread: https://groups.google.com/forum/#!topic/akka-user/zAzELWoDVu0\r\n\r\nMy use case is to identify the connecting client for a SSL connection using the Client certificate chain.\r\n\r\nWhen looking at the Java API my assumption is that I need [SSLSession.getPeerCertificateChain](https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLSession.html#getPeerCertificateChain()), which can be obtained from `SSLSession` which in turn is received when calling [SSLEngine.getSession](https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLEngine.html#getSession()).\r\n\r\n`SSLSession` is used and set at [TLSActor.scala#L446](https://github.com/akka/akka/blob/bd8fcc9d9aeafc2c49745e7519d13b3e0abc18e6/akka-stream/src/main/scala/akka/stream/impl/io/TLSActor.scala#L446).\r\n\r\nLet's discuss how `SSLSession` should be provided to a user of the Flow DSL. Some thoughts:\r\n\r\n**Emit `SSLSession` on separate output port**\r\nOne way would be to make a TLS flow stage that have a `SSLSession` output. The SSLSession would be guaranteed to be emitted before any data is emitted on the data output. The developer could do a priority merge at a later point in the flow where they wish to use the `SSLSession`.\r\n\r\n**Provide a `SSLSession` with each emitted message**\r\nInstead of emitting a `ByteString` a new `TLSMessage` case class is created which in turn contains `SSLSession` as well as the `ByteString`. Since `SSLSession` (to my knowledge) does not change after the handshake is completed it means some overhead. \r\n\r\nI like the first option because it clearly separates how the session is obtained, but I don't like the that the flow stage becomes more complex and requires a `Graph`. Users of `TLS` flow stage today would likely have to rewrite code.  I like the second option because it is very easy to reason about, but I dislike that the same copy of session will be repeated with each message. \r\n\r\nIt would be easy to provide two versions of the `TLS` stage, one with and one without `SSLSessions`. \r\n\r\nThoughts are welcome. I will consider contributing depending on the scope of the change. From my point of view I'd like to keep a rewrite `TLS` flow stage to a `GraphStage` as a separate step.\r\n"},"comment":{"url":"https://api.github.com/repos/akka/akka/issues/comments/216355527","html_url":"https://github.com/akka/akka/issues/20423#issuecomment-216355527","issue_url":"https://api.github.com/repos/akka/akka/issues/20423","id":216355527,"user":{"login":"magnusart","id":58892,"avatar_url":"https://avatars.githubusercontent.com/u/58892?v=3","gravatar_id":"","url":"https://api.github.com/users/magnusart","html_url":"https://github.com/magnusart","followers_url":"https://api.github.com/users/magnusart/followers","following_url":"https://api.github.com/users/magnusart/following{/other_user}","gists_url":"https://api.github.com/users/magnusart/gists{/gist_id}","starred_url":"https://api.github.com/users/magnusart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnusart/subscriptions","organizations_url":"https://api.github.com/users/magnusart/orgs","repos_url":"https://api.github.com/users/magnusart/repos","events_url":"https://api.github.com/users/magnusart/events{/privacy}","received_events_url":"https://api.github.com/users/magnusart/received_events","type":"User","site_admin":false},"created_at":"2016-05-02T20:36:02Z","updated_at":"2016-05-02T20:36:02Z","body":"@ktoso when investigating a bit further I'm actually wondering if I was correct in that the SSLSession was missing. Perhaps it is just that the TLS stage is undocumented and I mistook the ports.\r\n\r\nIf the trait `SslTlsOptions.SslTlsInbound` represents the plain text message then it actually contains the session in `SslTlsOptions.SessionBytes`. I thought this was the chiper text.\r\n\r\nWill see if I can get this up and running and verify it, saw some discussions on the akka users mailing list. Regardless of outcome, high level documentation and examples of the `TLS` stage is missing."}}