Uploaded image for project: 'Cassandra'
  1. Cassandra
  2. CASSANDRA-15980

Improve log messages for socket connection/disconnection

    XMLWordPrintableJSON

Details

    • Code
    • Normal
    • Normal
    • Adhoc Test
    • All
    • None
    • Hide

      I started up a local CCM instance using the guide from Nate on TLP Blog to configure SSL, then checked the messages were sane & formatted.

      Show
      I started up a local CCM instance using the guide from Nate on TLP Blog to configure SSL, then checked the messages were sane & formatted.

    Description

      Logging for inbound SSL connections can take place before protocol negotiation has taken place and logs a misleading cipher that could cause problems for security auditing.
       
       

      INFO  2020-07-03T13:57:58,380 [Messaging-EventLoop-3-1] org.apache.cassandra.net.InboundConnectionInitiator:242 - connection from peer /1.1.1.1:57899 to /2.2.2.2:7000, protocol = TLSv1.2, cipher suite = SSL_NULL_WITH_NULL_NULL
      

       
      Instead Cassandra should log the connection & protocol, then once the cipher has been negotiated log the agreed upon cipher.
       
       
      If the inbound SSL connection does not present a client certificate, Cassandra logs this error, even if the client wasn't required to.

      ERROR 2020-07-14T11:58:45,925 [Native-Transport-Requests-1] org.apache.cassandra.transport.ServerConnection:140 - Failed to get peer certificates for peer /4.3.2.1:59263
      

       
      Logging the absense of verified certificates should be a concern of the SaslNegotiator if it requires it, and not something worth alerting the operator for generally. Downgrade to debug message to make investigation possible if needed.
       
       
      Finally, to help with logging issues related to disconnection, add a log statement when an instance decides it no longer needs to keep a gossip connection open when cleaning up connections in org.apache.cassandra.net.OutboundConnections.UnusedConnectionMonitor#closeUnusedSinceLastRun

      Attachments

        Activity

          People

            jmeredithco Jon Meredith
            jmeredithco Jon Meredith
            Jon Meredith
            Aleksey Yeschenko, David Capwell
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 1h 20m
                1h 20m