ydb-platform / ydb-platform/ydb-vscode-plugin
Подключается без TLS при использовании аутентификации логин/пароль
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 2
- Avg merge
- 2h
- Merged PRs (30d)
- 1
Description
При попытке подключения к кластеру c использованием static credentials (username/password) идет попытка подключения БЕЗ использования TLS, то есть обычным HTTP/2.0 идем на GRPCS порт, это видно в pcap файле:
а так же в логах сервера:
:GRPC_LIBRARY ERROR: Handshake failed with fatal error SSL_ERROR_SSL: error:1408F10B:SSL routines:ssl3_get_record:wrong version number.
В vscode вот такая ошибка:
[error] [testConnection] FAILED: AbortError: AbortError
at new DOMException (node:internal/per_context/domexception:76:18)
at /Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:60890:20
at new Promise (<anonymous>)
at abortable (/Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:60889:5)
at Driver.ready (/Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:63872:13)
at _ConnectionManager.readyWithCancellation (/Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:66386:22)
at _ConnectionManager.testConnection (/Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:66372:18)
at lp.value (/Users/gene/.vscode/extensions/ydb-tech.ydb-vscode-plugin-0.1.4/out/extension.js:66884:35)
at E._deliver (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3244)
at E.fire (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3562)
at rw.$onMessage (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:530:91239)
at i._doInvokeHandler (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:407:157623)
at i._invokeHandler (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:407:157371)
at i._receiveRequest (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:407:156153)
at i._receiveOneMessage (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:407:155166)
at lp.value (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:407:153066)
at E._deliver (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3244)
at E.fire (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3562)
at ss.fire (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:405:8437)
at lp.value (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:805:9911)
at E._deliver (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3244)
at E.fire (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:403:3562)
at ss.fire (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:405:8437)
at MessagePortMain.<anonymous> (file:///Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/workbench/api/node/extensionHostProcess.js:805:8082)
at MessagePortMain.emit (node:events:519:28)
at MessagePortMain._internalPort.emit (node:electron/js2c/utility_init:2:2959)
Если же попробовать подключиться анонимно то получаем уже нормальное сообщение которое выдается поверх GPRCS:
[testConnection] FAILED: _ClientError: /Ydb.Discovery.V1.DiscoveryService/ListEndpoints UNAUTHENTICATED: unauthenticated, unauthenticated: { <main>: Error: Access denied without user token }
Ситуация воспроизводится на MacOS 26.4.1, vscode 1.120.0
Да, конечно я добавлял custom CA pem file, с которым у меня без проблем подключается YDB-JS SDK
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the connection and Driver.ready/testConnection paths shown in out/extension.js, comparing static username/password authentication with the anonymous attempt. Reproduce the MacOS and VSCode setup described in the issue and inspect the generated traffic and server error; done means static credentials connect through TLS and no longer produce the wrong-version handshake failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript, vscode
- Domain
- authentication, devtools, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100