[jira] [Created] (CASSANDRA-15980) Improve log messages for socket connection/disconnection

["Jon Meredith (Jira)" <ji...@apache.org>]

Jon Meredith created CASSANDRA-15980:
----------------------------------------

             Summary: Improve log messages for socket connection/disconnection
                 Key: CASSANDRA-15980
                 URL: https://issues.apache.org/jira/browse/CASSANDRA-15980
             Project: Cassandra
          Issue Type: Bug
            Reporter: Jon Meredith
            Assignee: Jon Meredith


Logging for inbound SSL connections can take place before protocol negotiation has taken place and logs a misleading cipher that could cause problems for security auditing.
  
  
{code:java}
INFO  2020-07-03T13:57:58,380 [Messaging-EventLoop-3-1] org.apache.cassandra.net.InboundConnectionInitiator:242 - connection from peer /1.1.1.1:57899 to /2.2.2.2:7000, protocol = TLSv1.2, cipher suite = SSL_NULL_WITH_NULL_NULL
{code}
 
 Instead Cassandra should log the connection & protocol, then once the cipher has been negotiated log the agreed upon cipher.
  
  
 If the inbound SSL connection does not present a client certificate, Cassandra logs this error, even if the client wasn't required to.
{code:java}
ERROR 2020-07-14T11:58:45,925 [Native-Transport-Requests-1] org.apache.cassandra.transport.ServerConnection:140 - Failed to get peer certificates for peer /4.3.2.1:59263
{code}
 
 Logging the absense of verified certificates should be a concern of the SaslNegotiator if it requires it, and not something worth alerting the operator for generally. Downgrade to debug message to make investigation possible if needed.
  
  
 Finally, to help with logging issues related to disconnection, add a log statement when an instance decides it no longer needs to keep a gossip connection open when cleaning up connections in org.apache.cassandra.net.OutboundConnections.UnusedConnectionMonitor#closeUnusedSinceLastRun



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org