如何为Erlang 24添加TLS_PSK_WITH_AES_128_CBC_SHA_256到默认加密套件列表

Erlang SSL模块默认不会启用PSK类加密套件，不需要修改Erlang源码，只需手动拼接自定义套件列表传入配置即可，不同场景的配置方法如下：

1 通用Erlang SSL服务启用自定义套件 #

• 先获取当前tlsv1.2默认加密套件列表，将目标套件拼接至列表的对应优先级位置，启动SSL服务时传入自定义列表即可
• 示例代码：

% 1. 转换目标套件为Erlang识别的map格式
TargetSuite = ssl:str_to_suite("TLS_PSK_WITH_AES_128_CBC_SHA_256"),
% 2. 获取tlsv1.2默认加密套件列表
DefaultSuites = ssl:cipher_suites(default, 'tlsv1.2'),
% 3. 拼接自定义套件列表，此处目标套件设为最高优先级
CustomSuites = [TargetSuite | DefaultSuites],
% 4. 启动SSL服务/客户端时传入配置，同时补充PSK相关参数
SslOpts = [
    {ciphers, CustomSuites},
    {versions, ['tlsv1.2']},
    {psk_identity, "自定义PSK身份标识"},
    {user_lookup_fun, fun(_PSKIdentity, _UserState) -> {ok, <<"PSK密钥二进制内容">>} end}
]

2 搭载MQTT插件的RabbitMQ启用该套件 #

无需修改Erlang代码，直接修改RabbitMQ配置即可：

方法一：通过rabbitmq.conf配置 #

配置文件默认路径为/etc/rabbitmq/rabbitmq.conf，添加以下内容：

# 启用TLS1.2
listeners.ssl.default = 5671
ssl.versions = tlsv1.2
# 配置加密套件，目标套件放在最前，后续拼接默认套件即可
ssl.ciphers = TLS_PSK_WITH_AES_128_CBC_SHA_256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-CCM,ECDHE-ECDSA-AES256-CCM-8,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-CCM,ECDHE-ECDSA-AES128-CCM-8,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-RSA-AES256-GCM-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-RSA-AES256-SHA256,DHE-DSS-AES256-SHA256,DHE-RSA-AES128-GCM-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-RSA-CHACHA20-POLY1305,DHE-RSA-AES128-SHA256,DHE-DSS-AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,DHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,DHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA

如果需要配置PSK身份校验函数，使用方法二。

方法二：通过advanced.config配置 #

配置文件默认路径为/etc/rabbitmq/advanced.config，添加以下内容：

[
    {rabbit, [
        {ssl_options, [
            {ciphers, [ssl:str_to_suite("TLS_PSK_WITH_AES_128_CBC_SHA_256") | ssl:cipher_suites(default, 'tlsv1.2')]},
            {versions, ['tlsv1.2']},
            {user_lookup_fun, {fun(PSKIdentity, _State) -> {ok, <<"你的PSK密钥内容">>} end, []}}
        ]}
    ]}
].

配置完成后执行systemctl restart rabbitmq-server重启服务生效。

验证配置是否生效 #

可在Erlang shell执行以下命令测试：

% 返回{ok, Socket}则代表配置生效
ssl:connect("你的RabbitMQ服务地址", 5671, [{ciphers, [ssl:str_to_suite("TLS_PSK_WITH_AES_128_CBC_SHA_256")]}, {versions, ['tlsv1.2']}, {psk_identity, "你的PSK身份标识"}, {psk, <<"你的PSK密钥内容">>}], 5000).

内容的提问来源于stack exchange，提问作者Der edle weiße Ritter