Jira (PDB-2267) puppetdb-access.log does not log access requests to a hostname/IP it is not listening to

[Rob Nelson (JIRA)]

Title: Message Title

Rob Nelson commented on PDB-2267   Re: puppetdb-access.log does not log access requests to a hostname/IP it is not listening to Further testing shows similar logging issues with curls against the right URL but invalid certificate options. Here is a working query and tcpdump: # curl https://10.0.0.134:8081/pdb/query/v4/nodes/testbox.nelson.va/facts -k --cacert /etc/puppetlabs/puppet/ssl/certs/ca.pem --cert /etc/puppetlabs/puppet/ssl/certs/testbox.nelson.va.pem --key /etc/puppetlabs/puppet/ssl/private_keys/testbox.nelson.va.pem <lots of JSON output>   # tcpdump -nni lo port 8081 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes 16:16:34.901740 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [S], seq 659415533, win 43690, options [mss 65495,sackOK,TS val 92807965 ecr 0,nop,wscale 7], length 0 12:12:57.372566 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [S.], seq 2605542896, ack 659415534, win 43690, options [mss 65495,sackOK,TS val 92807965 ecr 92807965,nop,wscale 7], length 0 16:16:34.901766 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [.], ack 1, win 342, options [nop,nop,TS val 92807965 ecr 92807965], length 0 16:16:34.962334 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [P.], seq 1:154, ack 1, win 342, options [nop,nop,TS val 92808025 ecr 92807965], length 153 16:16:34.962356 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [.], ack 154, win 350, options [nop,nop,TS val 92808025 ecr 92808025], length 0 16:16:34.963757 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [P.], seq 1:1619, ack 154, win 350, options [nop,nop,TS val 92808027 ecr 92808025], length 1618 16:16:34.963765 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [.], ack 1619, win 1365, options [nop,nop,TS val 92808027 ecr 92808027], length 0 16:16:34.979799 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [P.], seq 154:2721, ack 1619, win 1365, options [nop,nop,TS val 92808043 ecr 92808027], length 2567 16:16:34.979997 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [.], ack 2721, win 1373, options [nop,nop,TS val 92808043 ecr 92808043], length 0 16:16:35.034319 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [P.], seq 1619:1625, ack 2721, win 1373, options [nop,nop,TS val 92808097 ecr 92808043], length 6 16:16:35.034364 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [P.], seq 1625:1694, ack 2721, win 1373, options [nop,nop,TS val 92808097 ecr 92808043], length 69 16:16:35.034767 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [.], ack 1694, win 1365, options [nop,nop,TS val 92808098 ecr 92808097], length 0 16:16:35.034907 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [P.], seq 2721:2886, ack 1694, win 1365, options [nop,nop,TS val 92808098 ecr 92808097], length 165 16:16:35.058612 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [P.], seq 1694:18131, ack 2886, win 1413, options [nop,nop,TS val 92808122 ecr 92808098], length 16437 16:16:35.058862 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [P.], seq 18131:27368, ack 2886, win 1413, options [nop,nop,TS val 92808122 ecr 92808098], length 9237 16:16:35.058869 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [.], ack 27368, win 3411, options [nop,nop,TS val 92808122 ecr 92808122], length 0 16:16:35.060217 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [P.], seq 2886:2939, ack 27368, win 3411, options [nop,nop,TS val 92808123 ecr 92808122], length 53 16:16:35.060232 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [F.], seq 2939, ack 27368, win 3411, options [nop,nop,TS val 92808123 ecr 92808122], length 0 16:16:35.061584 IP 10.0.0.134.8081 > 10.0.0.134.45961: Flags [F.], seq 27368, ack 2940, win 1413, options [nop,nop,TS val 92808125 ecr 92808123], length 0 16:16:35.061592 IP 10.0.0.134.45961 > 10.0.0.134.8081: Flags [.], ack 27369, win 3411, options [nop,nop,TS val 92808125 ecr 92808125], length 0   # tail -f puppetdb-access.log 10.0.0.134 - - [21/Dec/2015:16:20:17 +0000] "GET /pdb/query/v4/nodes/testbox.nelson.va/facts HTTP/1.1" 200 25414 "-" "curl/7.29.0" By comparison, here is what happens when the cert options are left off. Obviously this fails as it should, but it does open a socket and is not logged. # curl https://10.0.0.134:8081/pdb/query/v4/nodes/testbox.nelson.va/facts -k curl: (35) NSS: client certificate not found (nickname not specified)   # tcpdump -nni lo port 8081 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes 16:21:21.630685 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [S], seq 1085702087, win 43690, options [mss 65495,sackOK,TS val 93094694 ecr 0,nop,wscale 7], length 0 18:17:49.337034 IP 10.0.0.134.8081 > 10.0.0.134.45970: Flags [S.], seq 3570655584, ack 1085702088, win 43690, options [mss 65495,sackOK,TS val 93094694 ecr 93094694,nop,wscale 7], length 0 16:21:21.630714 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [.], ack 1, win 342, options [nop,nop,TS val 93094694 ecr 93094694], length 0 16:21:21.698859 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [P.], seq 1:154, ack 1, win 342, options [nop,nop,TS val 93094762 ecr 93094694], length 153 16:21:21.698878 IP 10.0.0.134.8081 > 10.0.0.134.45970: Flags [.], ack 154, win 350, options [nop,nop,TS val 93094762 ecr 93094762], length 0 16:21:21.700959 IP 10.0.0.134.8081 > 10.0.0.134.45970: Flags [P.], seq 1:1619, ack 154, win 350, options [nop,nop,TS val 93094764 ecr 93094762], length 1618 16:21:21.700968 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [.], ack 1619, win 1365, options [nop,nop,TS val 93094764 ecr 93094764], length 0 16:21:21.702722 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [P.], seq 154:759, ack 1619, win 1365, options [nop,nop,TS val 93094766 ecr 93094764], length 605 16:21:21.703996 IP 10.0.0.134.8081 > 10.0.0.134.45970: Flags [F.], seq 1619, ack 759, win 360, options [nop,nop,TS val 93094767 ecr 93094766], length 0 16:21:21.704050 IP 10.0.0.134.45970 > 10.0.0.134.8081: Flags [F.], seq 759, ack 1620, win 1365, options [nop,nop,TS val 93094767 ecr 93094767], length 0 16:21:21.704059 IP 10.0.0.134.8081 > 10.0.0.134.45970: Flags [.], ack 760, win 360, options [nop,nop,TS val 93094767 ecr 93094767], length 0   # tail -f puppetdb-access.log <no new statements> Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.