Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[logging] Downgrade hapi connection errors when connecting with the w… #11209

Merged
merged 2 commits into from
Jul 10, 2017

Conversation

jbudz
Copy link
Member

@jbudz jbudz commented Apr 12, 2017

When serving Kibana over http and a request comes in over https, kibana logs a "Parse Error" to the standard application log.

When serving Kibana over https and a request comes in over http, kibana logs a "routines:SSL23_GET_CLIENT_HELLO:http request" to the standard application log. This won't be testable until the http -> https redirect with httpolyglot is removed. See #10930.

This downgrades both log types to debug output.

Copy link
Contributor

@spalger spalger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the answer to my question is "yes, that's our only option" then this LGTM

}

downgradeIfHTTPSWhenHTTP(event) {
return downgradeIfErrorMessage('Parse Error', event);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is error message matching our only option here? Parse Error is pretty vague isn't it? I guess we're still limiting it by the tag list, but I'd really like to use a value that's intended for machines (like errno) rather than one that's intended for humans (and much more likely to change/conflict)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point, I went straight for text because there was no errno. But there is a code for Parse Error sot hat looks like it's the way to go:

{
    event: 'log',
    timestamp: 1492194353021,
    tags: ['connection', 'client', 'error'],
    data: {
        Error: Parse Error at Error(native) bytesParsed: 0,
        code: 'HPE_INVALID_METHOD'
    },
    pid: 73405
}

For the http when https case there isn't more:

{
    event: 'log',
    timestamp: 1492194569892,
    tags: ['connection', 'client', 'error'],
    data: Error: 140736014037952: error: 1407609 C: SSL routines: SSL23_GET_CLIENT_HELLO: http request: ../deps/openssl/openssl/ssl/s23_srvr.c:394:at Error(native),
    pid: 74537
}

@epixa epixa self-requested a review May 17, 2017 18:12
kimjoar pushed a commit that referenced this pull request Jul 7, 2017
- httpolyglot is removed, we no longer automatically redirect from http to https
- server.ssl.redirectHttpFromPort option added to allow for http -> https redirect from one port to another
- We no longer start the dev server with tls by default, it can be turned on with the --ssl flag, npm start -- --ssl, or ./bin/kibana --dev --ssl
- There will currently be error log messages if you connect over the wrong protocol, we have #11209 for downgrading these
@kimjoar
Copy link
Contributor

kimjoar commented Jul 10, 2017

Rebased master, works as expected in my testing.

Below are examples when debug logging is enabled.

ssl.enabled: true + http request:

log   [15:27:52.252] [debug][connection] 140735775310784:error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request:../deps/openssl/openssl/ssl/s23_srvr.c:394:

ssl.enabled: false + https request:

log   [15:30:06.249] [debug][connection][hpe_invalid_method] HPE_INVALID_METHOD: Socket was closed by the client (probably the browser) before it could be read completely

Copy link
Contributor

@epixa epixa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM on green

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants