apache / apache/couchdb

Weather report and erlang TLS distribution problem

Open
#4,597 4 comments 0 reactions 0 assignees View on GitHub
bug needs-triage
Dominant language
Erlang
Stars
7k
Forks
1.1k
Avg merge
1d 16h
Merged PRs (30d)
9

Description

## Description

Versions
- COUCHDB
_"couchdb":"Welcome","version":"3.3.1_"
- erl
_Erlang/OTP 25 [erts-13.2.2] [source] [64-bit] [smp:4:4] [ds:4:4:10] [async-threads:1] [jit:ns]_
- Rocky _8.7_

2 node cluster configured and looks like starts well, log output ->
_couch_replicator_clustering : cluster stable -> couch_replicator_clustering : cluster stable_

When I run /weatherreport --etc /opt/couchdb/etc/ without erlang TLS distribution configured, it works ->
xxxx
__Configuration Settings:
[admins] rocky="-pbkdf2-092b2a2214c80a33e720c76cf1b778b23cd95d9d,0d8c8fcd652bc1acc14f291eaead743f,10"
[admins] vagrant="-pbkdf2-6160777f3986cf1c320b01c46e631ecbea8f2910,5a95dcffdfcdc0a9cacfdb7d13a9f392,10"
[chttpd] bind_address="0.0.0.0"
[chttpd] port="5984"
[chttpd_auth] hash_algorithms="sha256, sha"
[chttpd_auth] secret="ed35b213650525d1987c810617000a23"
[couch_httpd_auth] authentication_db="_users"__
xxxx

When I run /weatherreport --etc /opt/couchdb/etc/ with erlang TLS distribution configured, it does not work ->
xxxx
_['couchdb_diag9868@couchdb1.dp.home'] [warning] Could not connect to the local cluster node 'couchdb@couchdb1.dp.home', some checks will not run.
['couchdb_diag9868@couchdb1.dp.home'] [crit] Bad rpc call executing check weatherreport_check_tcp_queues: nodedown
['couchdb_diag9868@couchdb1.dp.home'] [crit] Bad rpc call executing check weatherreport_check_search: nodedown
['couchdb_diag9868@couchdb1.dp.home'] [crit] Bad rpc call executing check weatherreport_check_safe_to_rebuild: nodedown
['couchdb_diag9868@couchdb1.dp.home'] [crit] Bad rpc call executing check weatherreport_check_process_memory: nodedown_
xxxxx

Is it something wrong with the configuration of just weatherport is used somehow wrong?

A test table with new documents gets replicated either when erlang TLS distribution configured or not.
If I try to connect to the port 9100 SSL handshake starts ->
s_client -connect couchdb1.dp.home:9100

## Steps to Reproduce

1. install elrang (this step is needed as otherwise 22 version will be installed and weathereport will not run)
curl -s https://packagecloud.io/install/repositories/rabbitmq/erlang/script.rpm.sh | sudo bash
sudo yum install erlang -y

2. Install couchdb as per https://docs.couchdb.org/en/stable/install/unix.html#enabling-the-apache-couchdb-package-repository
**sudo yum install couchdb-3.3.1-1.el8.x86_64 -y**

3. Prepare the nodes for the cluster -> https://docs.couchdb.org/en/stable/setup/cluster.html
4. Create CA, server1cert.pem / server1key.pem && server2cert.pem / server2key.pem
5. Enable erlang TLS distribution ->https://docs.couchdb.org/en/stable/cluster/tls_erlang_distribution.html
6. The final changes will be

/opt/couchdb/etc/vm.args
xxxxx
_-name couchdb@couchdb1.dp.home
#-name couchdb@couchdb2.dp.home
-setcookie SbFch4ESZSNBAF5ivZn34oKEDAT8H684V4TATER0dCxhGZwjk
-kernel inet_dist_use_interface {0,0,0,0}
-kernel inet_dist_listen_min 9100
-kernel inet_dist_listen_max 9200
-proto_dist inet_tls
-ssl_dist_optfile /etc/couchdb/newcert/couch_ssl_dist.conf_
xxxxx

/etc/couchdb/newcert/couch_ssl_dist.conf (node1)
xxxxx
_[{server,
[{certfile, "/etc/couchdb/newcert/couchdb1withprivate.pem"},
{secure_renegotiate, true}]},
{client,
[{cacertfile, "/etc/couchdb/newcert/CAcert.pem"},
{secure_renegotiate, true}]}]._
xxxxx

/etc/couchdb/newcert/couch_ssl_dist.conf (node2)
xxxxx
_[{server,
[{certfile, "/etc/couchdb/newcert/couchdb2withprivate.pem"},
{secure_renegotiate, true}]},
{client,
[{cacertfile, "/etc/couchdb/newcert/CAcert.pem"},
{secure_renegotiate, true}]}]._
xxxxx

## Expected Behavior
I would like to get the same output as when erlang TLS distribution is not configured.

## Your Environment

https://couchdb1.dp.home:6984
{"couchdb":"Welcome","version":"3.3.1","git_sha":"1fd50b82a","uuid":"ed35b213650525d1987c8106170001fd","features":["access-ready","partitioned","pluggable-storage-engines","reshard","scheduler"],"vendor":{"name":"The Apache Software Foundation"}}

Contributor guide

Open the contributing guide

Research direction

Start with the weatherreport entry point and compare its behavior with and without the Erlang TLS distribution settings in vm.args. Review the node connection configuration in /etc/couchdb/newcert/couch_ssl_dist.conf and the documented TLS distribution setup. Done means weatherreport can connect to the local cluster node and produces the same checks without nodedown errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
databases, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.