Enrich gRPC TLS handshake errors with connection context (no contrib changes)#18
Draft
zinal wants to merge 3 commits into
Draft
Enrich gRPC TLS handshake errors with connection context (no contrib changes)#18zinal wants to merge 3 commits into
zinal wants to merge 3 commits into
Conversation
When TLS handshake fails inside ydbd, the GRPC_LIBRARY log previously contained only the OpenSSL error without connection context. Log the direction (incoming/outgoing), local and peer socket addresses, optional client channel target, and the full error at the security handshaker layer. Demote the duplicate low-level TSI message to DEBUG to avoid two ERROR lines for the same failure. Co-authored-by: Maksim Zinal <zinal@ydb.tech>
This reverts commit 3db26ea.
…rib patches Track recent TCP connect events from gRPC tcp tracer logs inside YDB-owned code and append peer/target details when a handshake failure is logged. Register logical grpcs:// targets when SDK client channels are created. Internal gRPC log verbosity is always DEBUG so connect events can be captured even when GRPC_LIBRARY print level is ERROR; only configured severities are written to stderr. Co-authored-by: Maksim Zinal <zinal@ydb.tech>
cursor
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Improves
:GRPC_LIBRARY ERRORdiagnostics when a TLS handshake fails insideydbd, without patchingcontrib/libs/grpc.Upstream gRPC is vendored and periodically refreshed, so the implementation lives entirely in YDB-owned code.
Approach
ydb/library/grpc/common/log_context.*— global gRPC log hook that:DEBUGso tcp tracer connect events are visible to the hook;SERVER_CONNECT/CLIENT_CONNECTevents from the tcp tracer;Handshake failed ...appends connection context to the ERROR line;GRPC_LIBRARYprint level for all other messages.grpc_common.h— when creating a TLS client channel, registers logicalgrpcs://host:porttarget for correlation with the next outgoing TCP connect.grpc_library_helper.cpp— delegates to the new hook instead of a minimalfprintfwrapper.Example output
Trade-offs vs contrib patch
peeraddresslocaladdresstarget(logical)grpc.server_uri)Testing
./ya make --build relwithdebinfo ydb/library/grpc/common ydb/core/cms/console ydb/public/sdk/cpp/src/library/grpc/client— build succeeded.