Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suppress noisy SSL exceptions #61359

Merged
merged 1 commit into from
Aug 27, 2020
Merged

Suppress noisy SSL exceptions #61359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions ...ore/src/main/java/org/elasticsearch/xpack/core/security/transport/SSLExceptionHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,10 @@

import io.netty.handler.codec.DecoderException;
import io.netty.handler.ssl.NotSslRecordException;
import org.elasticsearch.common.regex.Regex;

import javax.net.ssl.SSLException;
import javax.net.ssl.SSLHandshakeException;

public class SSLExceptionHelper {

Expand All @@ -22,6 +24,11 @@ public static boolean isNotSslRecordException(Throwable e) {
}

public static boolean isCloseDuringHandshakeException(Throwable e) {
return isCloseDuringHandshakeSSLException(e)
|| isCloseDuringHandshakeSSLException(e.getCause());
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We were already checking for Received close_notify during handshake, just not within a DecoderException. Not sure whether this was a mistake or whether we do sometimes see this exception unwrapped too.

Also not sure what the implications for the nio transport since the DecoderException wrapper is Netty-specific.

}

private static boolean isCloseDuringHandshakeSSLException(Throwable e) {
return e instanceof SSLException
&& e.getCause() == null
&& "Received close_notify during handshake".equals(e.getMessage());
Expand All @@ -32,4 +39,10 @@ public static boolean isReceivedCertificateUnknownException(Throwable e) {
&& e.getCause() instanceof SSLException
&& "Received fatal alert: certificate_unknown".equals(e.getCause().getMessage());
}

public static boolean isInsufficientBufferRemainingException(Throwable e) {
return e instanceof DecoderException
&& e.getCause() instanceof SSLHandshakeException
&& Regex.simpleMatch("Insufficient buffer remaining for AEAD cipher fragment*", e.getCause().getMessage());
}
}
3 changes: 3 additions & 0 deletions ...va/org/elasticsearch/xpack/core/security/transport/SecurityTransportExceptionHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ public void accept(TcpChannel channel, Exception e) {
} else if (SSLExceptionHelper.isCloseDuringHandshakeException(e)) {
logger.debug("connection {} closed during handshake", channel);
CloseableChannel.closeChannel(channel);
} else if (SSLExceptionHelper.isInsufficientBufferRemainingException(e)) {
logger.debug("connection {} closed abruptly", channel);
CloseableChannel.closeChannel(channel);
} else if (SSLExceptionHelper.isReceivedCertificateUnknownException(e)) {
logger.warn("client did not trust this server's certificate, closing connection {}", channel);
CloseableChannel.closeChannel(channel);
Expand Down
4 changes: 4 additions & 0 deletions ...rc/main/java/org/elasticsearch/xpack/security/transport/SecurityHttpExceptionHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import java.util.function.BiConsumer;

import static org.elasticsearch.xpack.core.security.transport.SSLExceptionHelper.isCloseDuringHandshakeException;
import static org.elasticsearch.xpack.core.security.transport.SSLExceptionHelper.isInsufficientBufferRemainingException;
import static org.elasticsearch.xpack.core.security.transport.SSLExceptionHelper.isNotSslRecordException;
import static org.elasticsearch.xpack.core.security.transport.SSLExceptionHelper.isReceivedCertificateUnknownException;

Expand All @@ -39,6 +40,9 @@ public void accept(HttpChannel channel, Exception e) {
} else if (isCloseDuringHandshakeException(e)) {
logger.debug("connection {} closed during ssl handshake", channel);
CloseableChannel.closeChannel(channel);
} else if (isInsufficientBufferRemainingException(e)) {
logger.debug("connection {} closed abruptly", channel);
CloseableChannel.closeChannel(channel);
} else if (isReceivedCertificateUnknownException(e)) {
logger.warn("http client did not trust this server's certificate, closing connection {}", channel);
CloseableChannel.closeChannel(channel);
Expand Down