Jon Meredith created CASSANDRA-15980:
----------------------------------------
Summary: Improve log messages for socket connection/disconnection
Key: CASSANDRA-15980
URL: https://issues.apache.org/jira/browse/CASSANDRA-15980
Project: Cassandra
Issue Type: Bug
Reporter: Jon Meredith
Assignee: Jon Meredith
Logging for inbound SSL connections can take place before protocol negotiation
has taken place and logs a misleading cipher that could cause problems for
security auditing.
{code:java}
INFO 2020-07-03T13:57:58,380 [Messaging-EventLoop-3-1]
org.apache.cassandra.net.InboundConnectionInitiator:242 - connection from peer
/1.1.1.1:57899 to /2.2.2.2:7000, protocol = TLSv1.2, cipher suite =
SSL_NULL_WITH_NULL_NULL
{code}
Instead Cassandra should log the connection & protocol, then once the cipher
has been negotiated log the agreed upon cipher.
If the inbound SSL connection does not present a client certificate, Cassandra
logs this error, even if the client wasn't required to.
{code:java}
ERROR 2020-07-14T11:58:45,925 [Native-Transport-Requests-1]
org.apache.cassandra.transport.ServerConnection:140 - Failed to get peer
certificates for peer /4.3.2.1:59263
{code}
Logging the absense of verified certificates should be a concern of the
SaslNegotiator if it requires it, and not something worth alerting the operator
for generally. Downgrade to debug message to make investigation possible if
needed.
Finally, to help with logging issues related to disconnection, add a log
statement when an instance decides it no longer needs to keep a gossip
connection open when cleaning up connections in
org.apache.cassandra.net.OutboundConnections.UnusedConnectionMonitor#closeUnusedSinceLastRun
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
