owncloud / owncloud/core

[QA] https connection with invalid SSL-certificate only logs an 'unknown error'

Open
#40,011 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

QA:team
Dominant language
PHP
Stars
8.8k
Forks
2.1k
Avg merge
20h 7m
Merged PRs (30d)
41

Description

Seen with search_elastic 2.1.1-rc1
Probably not specific to search_elastic. sftp, ldaps, ... could also be affected.

  • Use a https enabled connection to the elastic server.
  • When the ssl-certificate is valid, the connection works. OK
  • Make the cert invalid, by e.g.
    a) remove the rootCA from the system
    b) use an expired cert openssl x509 -sha256 -req -days 0 ...
  • Elastic search results stop appearing. Normal search results still work. Okayish
  • No useful diagnosis is given. BAD
    image

owncloud.log has (same for a) and b) ):

{"reqId":"YmNdYqWDrcqPnF34nGInxgAAAAM","level":3,"time":"2022-04-23T01:58:58+00:00","remoteAddr":"2.247.253.233","user":"admin","app":"search_elastic","method":"GET","url":"\/ind
ex.php\/core\/search?query=hello&inApps%5B%5D=files&page=1&size=30","message":"Exception: {\"Exception\":\"Elastica\\\\Exception\\\\Connection\\\\HttpException\",\"Message\":\"Un
known error:60\",\"Code\":0,\"Trace\":\"#0 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Request.php(178): Elastica\\\\T
ransport\\\\Http->exec()\\n#1 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Client.php(513): Elastica\\\\Request->send()
\\n#2 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Search.php(278): Elastica\\\\Client->request()\\n#3 \\\/var\\\/www\\
\/owncloud\\\/apps-external\\\/search_elastic\\\/lib\\\/SearchElasticService.php(205): Elastica\\\\Search->search()\\n#4 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_ela
stic\\\/lib\\\/Search\\\/ElasticSearchProvider.php(198): OCA\\\\Search_Elastic\\\\SearchElasticService->search()\\n#5 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elasti
c\\\/lib\\\/Search\\\/ElasticSearchProvider.php(103): OCA\\\\Search_Elastic\\\\Search\\\\ElasticSearchProvider->fetchResults()\\n#6 \\\/var\\\/www\\\/owncloud\\\/lib\\\/private\\
\/Search.php(67): OCA\\\\Search_Elastic\\\\Search\\\\ElasticSearchProvider->searchPaged()\\n#7 \\\/var\\\/www\\\/owncloud\\\/core\\\/search\\\/ajax\\\/search.php(56): OC\\\\Searc
h->searchPaged()\\n#8 \\\/var\\\/www\\\/owncloud\\\/lib\\\/private\\\/Route\\\/Route.php(155): require_once('\\\/var\\\/www\\\/ownclo...')\\n#9 \\\/var\\\/www\\\/owncloud\\\/lib\
\\/private\\\/Route\\\/Router.php(344): OC\\\\Route\\\\Route->OC\\\\Route\\\\{closure}(*** sensitive parameters replaced ***)\\n#10 \\\/var\\\/www\\\/owncloud\\\/lib\\\/base.php(
927): OC\\\\Route\\\\Router->match()\\n#11 \\\/var\\\/www\\\/owncloud\\\/index.php(54): OC::handleRequest()\\n#12 {main}\",\"File\":\"\\\/var\\\/www\\\/owncloud\\\/apps-external\
\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Transport\\\/Http.php\",\"Line\":186}"}

Expected behaviour:

  • Print something similar as what curl prints in the above situations:
    a)
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

b)

curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html

Note that the error code 60 is seen in both, the curl error message, and the owncloud.log "Unknown error:60"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at vendor/ruflin/elastica/src/Transport/Http.php line 186 and trace the failure through apps-external/search_elastic/lib/SearchElasticService.php line 205 and Search/ElasticSearchProvider.php. Reproduce the invalid-certificate cases described in the issue and compare the resulting log with curl's certificate-specific messages. Done means the log identifies the certificate problem instead of reporting only “Unknown error:60”.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch, php
Domain
backend, search, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.