[QA] https connection with invalid SSL-certificate only logs an 'unknown error'
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 8.8k
- Forks
- 2.1k
- Avg merge
- 20h 7m
- Merged PRs (30d)
- 41
Description
Seen with search_elastic 2.1.1-rc1
Probably not specific to search_elastic. sftp, ldaps, ... could also be affected.
- Use a https enabled connection to the elastic server.
- When the ssl-certificate is valid, the connection works. OK
- Make the cert invalid, by e.g.
a) remove the rootCA from the system
b) use an expired certopenssl x509 -sha256 -req -days 0 ... - Elastic search results stop appearing. Normal search results still work. Okayish
- No useful diagnosis is given. BAD

owncloud.log has (same for a) and b) ):
{"reqId":"YmNdYqWDrcqPnF34nGInxgAAAAM","level":3,"time":"2022-04-23T01:58:58+00:00","remoteAddr":"2.247.253.233","user":"admin","app":"search_elastic","method":"GET","url":"\/ind
ex.php\/core\/search?query=hello&inApps%5B%5D=files&page=1&size=30","message":"Exception: {\"Exception\":\"Elastica\\\\Exception\\\\Connection\\\\HttpException\",\"Message\":\"Un
known error:60\",\"Code\":0,\"Trace\":\"#0 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Request.php(178): Elastica\\\\T
ransport\\\\Http->exec()\\n#1 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Client.php(513): Elastica\\\\Request->send()
\\n#2 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Search.php(278): Elastica\\\\Client->request()\\n#3 \\\/var\\\/www\\
\/owncloud\\\/apps-external\\\/search_elastic\\\/lib\\\/SearchElasticService.php(205): Elastica\\\\Search->search()\\n#4 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_ela
stic\\\/lib\\\/Search\\\/ElasticSearchProvider.php(198): OCA\\\\Search_Elastic\\\\SearchElasticService->search()\\n#5 \\\/var\\\/www\\\/owncloud\\\/apps-external\\\/search_elasti
c\\\/lib\\\/Search\\\/ElasticSearchProvider.php(103): OCA\\\\Search_Elastic\\\\Search\\\\ElasticSearchProvider->fetchResults()\\n#6 \\\/var\\\/www\\\/owncloud\\\/lib\\\/private\\
\/Search.php(67): OCA\\\\Search_Elastic\\\\Search\\\\ElasticSearchProvider->searchPaged()\\n#7 \\\/var\\\/www\\\/owncloud\\\/core\\\/search\\\/ajax\\\/search.php(56): OC\\\\Searc
h->searchPaged()\\n#8 \\\/var\\\/www\\\/owncloud\\\/lib\\\/private\\\/Route\\\/Route.php(155): require_once('\\\/var\\\/www\\\/ownclo...')\\n#9 \\\/var\\\/www\\\/owncloud\\\/lib\
\\/private\\\/Route\\\/Router.php(344): OC\\\\Route\\\\Route->OC\\\\Route\\\\{closure}(*** sensitive parameters replaced ***)\\n#10 \\\/var\\\/www\\\/owncloud\\\/lib\\\/base.php(
927): OC\\\\Route\\\\Router->match()\\n#11 \\\/var\\\/www\\\/owncloud\\\/index.php(54): OC::handleRequest()\\n#12 {main}\",\"File\":\"\\\/var\\\/www\\\/owncloud\\\/apps-external\
\\/search_elastic\\\/vendor\\\/ruflin\\\/elastica\\\/src\\\/Transport\\\/Http.php\",\"Line\":186}"}
Expected behaviour:
- Print something similar as what curl prints in the above situations:
a)
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
b)
curl: (60) SSL certificate problem: certificate has expired
More details here: https://curl.haxx.se/docs/sslcerts.html
Note that the error code 60 is seen in both, the curl error message, and the owncloud.log "Unknown error:60"
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at vendor/ruflin/elastica/src/Transport/Http.php line 186 and trace the failure through apps-external/search_elastic/lib/SearchElasticService.php line 205 and Search/ElasticSearchProvider.php. Reproduce the invalid-certificate cases described in the issue and compare the resulting log with curl's certificate-specific messages. Done means the log identifies the certificate problem instead of reporting only “Unknown error:60”.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch, php
- Domain
- backend, search, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100