sandstorm-io/sandstorm

Suppress noisy OpenSSL errors in system log?

Open

#3596 opened on Dec 13, 2021

View on GitHub
 (2 comments) (0 reactions) (0 assignees)JavaScript (6,583 stars) (737 forks)batch import
enhancementgood first issue

Description

A large portion of my system log contains the below exceptions from the gateway. I am not sure these should be logged on a production server. I get the impression they represent failed connection attempts from browsers (or likely bots) which do not support a new enough TLS version. Public servers are often subjected to a deluge of random connection attempts: If we're confident these aren't "Sandstorm errors", I think it might make sense to stop logging them.

sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:1000009c:SSL routines:OPENSSL_internal:HTTP_REQUEST
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000b8:SSL routines:OPENSSL_internal:NO_SHARED_CIPHER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f0:SSL routines:OPENSSL_internal:UNSUPPORTED_PROTOCOL
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000b8:SSL routines:OPENSSL_internal:NO_SHARED_CIPHER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0
sandstorm/gateway.c++:1072: error: exception = kj/compat/tls.c++:66: failed: OpenSSL error; message = error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER
stack: 58f2a4 596986 596fd5 544fa1 597a60 591de0 5fe0c0

Contributor guide

Tech stack
cppjavascript
Domain
backendobservability
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
basic C++understanding of logging in kj framework
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70
Research direction
The issue requests suppression of noisy OpenSSL errors in the system log. The relevant code is in sandstorm/gateway.c++ around line 1072, where exceptions from OpenSSL are being logged. To resolve, one should inspect the logging mechanism in the gateway, possibly using a conditional check to skip logging errors like WRONG VERSION NUMBER or HTTP REQUEST. The maintainers have not commented on the specific errors to suppress; a good approach would be to introduce a configuration option or a whitelist of errors to ignore, or simply lower the log level for these expected errors. The linked comments may provide additional context.