request help: Apache APISIX with Secured Websockets #5131
Replies: 13 comments 6 replies
-
|
Would you try to set up some configurations ike this two tests: apisix/t/node/upstream-websocket.t Line 226 in baf216d You can set up the same configuration via Admin API or dashboard (a route with enable_websocket = true, an SSL that provides the certificate to the client, an upstream with https scheme). |
Beta Was this translation helpful? Give feedback.
-
I tried with enable_websocket to true and my upstream is with https scheme. |
Beta Was this translation helpful? Give feedback.
-
see: https://github.com/apache/apisix/blob/master/docs/en/latest/admin-api.md#ssl, you can submit certs by APISIX Dashboard, sidebar with |
Beta Was this translation helpful? Give feedback.
-
I didn't understand what you mean…… |
Beta Was this translation helpful? Give feedback.
-
|
If it is just for testing, you can sign the CA certificate yourself, refer to: https://www.openssl.org/docs/man1.1.1/man1/, or check relevant information through the Internet. |
Beta Was this translation helpful? Give feedback.
-
SSL which provides certificate to the client? Not the engine (service) itself?
I submitted a new SSL with Certificate and private key of the machine the server runs on, but now I cant figure how to connect the route to it.
Have done it, created certificate and private key from openssl, inserted them into APISIx dashboard but now i can't connec tthe route to the SSL. |
Beta Was this translation helpful? Give feedback.
-
here:https://github.com/apache/apisix/blob/master/docs/en/latest/certificate.md#single-sni |
Beta Was this translation helpful? Give feedback.
-
I tried this out already, but it's not working. |
Beta Was this translation helpful? Give feedback.
-
You need to send a request to APISIX using a tool like curl to match the route
Look at the documentation and decide according to your needs. BTW, from your description above, I think you need to do it step by step, from client to APISIX and from APISIX to upstream, and don't rely entirely on dashboard, sometimes you need to use admin-api. |
Beta Was this translation helpful? Give feedback.
-
|
You could give some replication steps and points of blocking, such as adding a route and setting an SSL certificate, sending a request that hits the route, but doesn't hit it. Something like this would allow us to reproduce the problem. |
Beta Was this translation helpful? Give feedback.
-
First of all, thank you for the fast and informative replies, much appreciated. Can't figure out what am I doing wrong, downloaded WireShark and TShark for network observation and tried comparing both networks transactions while on ws and wss, no real value yet. The thing I realy need is a good and working example of simple cmd commands to run some secured ws, all the docs are not that informative imo. |
Beta Was this translation helpful? Give feedback.
-
|
got, I will take the time to try this example in the next few days. |
Beta Was this translation helpful? Give feedback.
-
|
@BoazDr, here's my demo
master_process on;
worker_processes 2;
error_log logs/error.log warn;
pid logs/nginx.pid;
worker_rlimit_nofile 20480;
events {
accept_mutex off;
worker_connections 10620;
}
worker_shutdown_timeout 3;
http {
server {
listen 1983 ssl;
ssl_certificate /usr/local/Cellar/apisix/t/certs/apisix.crt;
ssl_certificate_key /usr/local/Cellar/apisix/t/certs/apisix.key;
lua_ssl_trusted_certificate /usr/local/Cellar/apisix/t/certs/apisix.crt;
server_tokens off;
ssl_certificate_by_lua_block {
local ngx_ssl = require "ngx.ssl"
ngx.log(ngx.WARN, "Receive SNI: ", ngx_ssl.server_name())
}
location /websocket_handshake {
content_by_lua_block {
local websocket = require "resty.websocket.server"
local wb, err = websocket:new()
if not wb then
ngx.log(ngx.ERR, "failed to new websocket: ", err)
return ngx.exit(400)
end
local bytes, err = wb:send_text("hello")
if not bytes then
ngx.log(ngx.ERR, "failed to send text: ", err)
return ngx.exit(444)
end
}
more_clear_headers Date;
}
}
}use websocat test this websocket server: websocat -t --ws-c-uri=wss://127.0.0.1:1983/websocket_handshake - ws-c:cmd:'socat - ssl:127.0.0.1:1983,verify=0,cafile=/usr/local/Cellar/apisix/t/certs/apisix.crt'
hello
curl --location --request PUT 'http://127.0.0.1:9080/apisix/admin/routes/1' \
--header 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
--header 'Content-Type: application/json' \
--data-raw '{
"upstream": {
"scheme": "https",
"nodes": {
"127.0.0.1:1983": 1
},
"type": "roundrobin"
},
"enable_websocket": true,
"uri": "/websocket_handshake"
}'
Note:
websocat -t --tls-domain="127.0.0.1" --ws-c-uri=wss://127.0.0.1:9443/websocket_handshake - ws-c:cmd:'socat - ssl:127.0.0.1:9443,verify=0,cafile=/usr/local/Cellar/apisix/t/certs/apisix.crt'
hello
Wireshake captures the following packet: you can see that the finally, the wss protocol is completed from the client -> APISIX -> upstream |
Beta Was this translation helpful? Give feedback.
-
look like that you do it success?
I don't know, maybe it's a dashboard issue and you need to go there and raise an issue. |
Beta Was this translation helpful? Give feedback.
-
|
succeeds = creates the SSL. What do you mean by dashboard issue? |
Beta Was this translation helpful? Give feedback.
-
|
can you use curl or postman to create SSL? my curl coommond is generated by postman. |
Beta Was this translation helpful? Give feedback.
-
|
As I said, I used curl command to create the SSL, and the result is 'Expiration Time': 'Invalid date'. |
Beta Was this translation helpful? Give feedback.
-
|
I can't reproduce the error, I can't help |
Beta Was this translation helpful? Give feedback.
-
Issue description
I am trying to add an API Gateway to a client-server system, which communicates through secured WebSockets.
The Server is an audio recognition engine that sits in a remote machine, and clients are connecting to it through WebSockets ('wss://...'), sending audio files and receiving their text translate representation. My main goal is to add a free open-source API Gateway in the middle in order to authenticate\authorize\rate limit\etc...
After searching the web, I focused on Apache APISIX gateway. As a test, I managed to connect the APISIX to a client-server which communicates by http/https and it worked fine.
Moreover, I managed to connect the client with the server on regular websocket connection (ws://) and the data transactions were successful, but no matter what I do i cant connect to the secured connection. Are there any special configurations I should edit in the dashboard?
I'm wondering if anyone knows from experience if it's possible to use SecuresWebSockets with Apache APISIX and if yes, how exactly it should be done (a little example would go a long way).
Environment
apisix version): Installed the whole project through docker-compose, all versions are the most recent from official apache APISIX docs.uname -a): Linux Centos 7nginx -Voropenresty -V):curl http://127.0.0.1:9090/v1/server_infoto get the info from server-info API):luarocks --version):The only Web socket reference there is in the dashboard:
Beta Was this translation helpful? Give feedback.
All reactions