grpc / grpc/grpc-node

ChannelOptions doesn't work well in client tls connection

Open
#1,974 15 comments 0 reactions 0 assignees View on GitHub
package: @grpc/grpc-js
Dominant language
TypeScript
Stars
4.8k
Forks
716
Avg merge
2d 3h
Merged PRs (30d)
10

Description

### Problem description
In TLS connection scenaio, the client implemented by nodejs(which depends on grpc-js) cannot connect to server.
I got the error messages from c++ server `ssl_transport_security.cc:1847] No match found for server name: localhost.`, and no error message from nodejs server.

The certs is signed with a special dns name, and the client uses `localhost` to connect. So, I use `ChannelOptions` in node/`ChannelArguments` in c++ to define the `grpc.default_authority`. In this way, the c++ client(actually, including java/kotlin/csharp/python/rust/go) works well.

I'm not sure if it's an issue or my mistake. Please help to check:

[my nodejs client node](https://github.com/feuyeux/hello-grpc/blob/87a6c20efa2210abe7253ce336784e86c1fec860/grpc/hello-grpc-nodejs/common/connection.js#L47)
```javascript
let address = connectTo + ":" + port
let secure = process.env.GRPC_HELLO_SECURE
if (typeof secure !== 'undefined' && secure !== null) {
logger.info("Connect With TLS(%s)", port)
let rootCertContent = fs.readFileSync(certChain);
let privateKeyContent = fs.readFileSync(certKey);
let certChainContent = fs.readFileSync(certChain);
const credentials = grpc.credentials.createSsl(rootCertContent, privateKeyContent, certChainContent);
//https://grpc.github.io/grpc/core/group__grpc__arg__keys.html
const channelOptions = {
'grpc.default_authority': serverName
}
return new services.LandingServiceClient(address, credentials, channelOptions)
} else {
logger.info("Connect With InSecure(%s)", port)
return new services.LandingServiceClient(address, grpc.credentials.createInsecure())
}
```
[my c++ client code](https://github.com/feuyeux/hello-grpc/blob/87a6c20efa2210abe7253ce336784e86c1fec860/grpc/hello-grpc-cpp/common/connection.cpp#L27)
```c++
const string &port = Utils::getBackendPort();
const basic_string, allocator> &target = Utils::getBackend() + ":" + port;
const string &secure = Utils::getSecure();
if (!secure.empty() && secure == "Y") {
grpc::SslCredentialsOptions ssl_opts;
ssl_opts.pem_root_certs = Connection::getFileContent(certChain);
ssl_opts.pem_private_key = Connection::getFileContent(certKey);
ssl_opts.pem_cert_chain = Connection::getFileContent(certChain);
grpc::ChannelArguments channel_args;
channel_args.SetString("grpc.default_authority", serverName);
LOG(INFO) << "Connect with TLS(" << port << ")";
return grpc::CreateCustomChannel(target, grpc::SslCredentials(ssl_opts), channel_args);
} else {
LOG(INFO) << "Connect with InSecure(" << port << ")";
return grpc::CreateChannel(target, grpc::InsecureChannelCredentials());
}
```

### Reproduction steps
Clone and go to this folder:
https://github.com/feuyeux/hello-grpc/tree/main/grpc/hello-grpc-nodejs

Run the below scripts on two terminals:
```bash
export GRPC_HELLO_SECURE="Y"
sh server_start.sh
```

```bash
export GRPC_HELLO_SECURE="Y"
sh client_start.sh
```

### Environment
- OS name, version and architecture: macOS 11.6
- Node version: v16.13.0 and v17.0.1(need to remove sleep lib)
- Node installation method: brew
- Package name and version: [package.json](https://github.com/feuyeux/hello-grpc/blob/main/grpc/hello-grpc-nodejs/package.json)

### Additional context
https://github.com/feuyeux/hello-grpc

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.