Skip to content

Conversation

@Lagovas
Copy link
Collaborator

@Lagovas Lagovas commented Feb 4, 2022

When I looked how our component that logs confusing message about failure of decryption, I found some legacy unused code (ErrKeyNotExist, AcraBlock Data Processor), some confusing logs with Warning/Erorr levels that should use Debug.

To avoid logging in deepest level I wrapped error with fmt.Errorf("%w") to save context, avoid logging and handling it as previous on higher level. And found that in go1.15 previous approach of check that FileNotExist suggest to use new package that works okay with wrapped error, but go1.15 doesn't contain this package and needs manual unwrapping before check. So I moved function that uses this API into separate files error_check.go and error_check_go15.go that included/excluded to compilation with build tags. After removing go1.15 support we need just delete error_check_go15.go file.

Additionaly I speeded up our integration tests [T2443] (because I already checked it before and it was fast) by forking ocsp/crl servers on module level. For me it decreases time of tests from 2m+ to 1m+. And made possible to avoid re-compilation binaries for each test run and re-use already compiled binaries that takes a lot of time (especially for tests that generate new configs). And updated CircleCI to build binaries before run any workflow that depends on them (also decreased tests' time on CI to 1-2m).

@vixentael , what do you think about debug log on decryption failure with explanation:
Probably error occurred because: 1. used not appropriate TLS certificate or acra-server configured with inappropriate --client_id=<client_id>; 2. forgot to generate keys for your TLS certificate (or with specified client_id); 3. incorrectly configured keystore: incorrect path to folder or Redis database's number

in crypto/acrablock.go/crypto/acrastruct.go?
Note: it's impossible for now log it as multiline log and one confusing point that it logs before logging with Error level (because it logged on higher level of stack). But it is easy to match that they are related by filepath that wasn't found and mentioned in both log messages.

Checklist

@Lagovas Lagovas requested review from Zhaars and iamnotacake February 4, 2022 14:17
Copy link
Collaborator

@vixentael vixentael left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please see my comments

"client_id": string(accessContext.GetClientID()),
"zone_id": string(accessContext.GetZoneID()),
}).
Debugln("Probably error occurred because: 1. used not appropriate TLS certificate or acra-server configured with inappropriate --client_id=<client_id>; 2. forgot to generate keys for your TLS certificate (or with specified client_id); 3. incorrectly configured keystore: incorrect path to folder or Redis database's number")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Debugln("Probably error occurred because: 1. used not appropriate TLS certificate or acra-server configured with inappropriate --client_id=<client_id>; 2. forgot to generate keys for your TLS certificate (or with specified client_id); 3. incorrectly configured keystore: incorrect path to folder or Redis database's number")
Debugln("The error occurred due to one of the following reasons: 1. The client_id from TLS certificate doesn't match the encryption key: check that you are using the appropriate TLS certificate or configure acra-server with a different --client_id=<client_id>. 2. The encryption key for the client_id from TLS certificate is missing, generate encryption keys using keymaker utility for your TLS certificate (or with specified client_id); 3. The required keys are missing in the `keys_dir`, ensure that `keys_dir` param is pointed to a folder with keys or to the correct Redis database's number")

Take a look @Lagovas , I tried to make messages more friendly and precise

"client_id": string(accessContext.GetClientID()),
"zone_id": string(accessContext.GetZoneID()),
}).
Debugln("Probably error occurred because: 1. used not appropriate TLS certificate or acra-server configured with inappropriate --client_id=<client_id>; 2. forgot to generate keys for your TLS certificate (or with specified client_id); 3. incorrectly configured keystore: incorrect path to folder or Redis database's number")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same

@Lagovas
Copy link
Collaborator Author

Lagovas commented Feb 4, 2022

updated messages discussed with @vixentael in chat and she has approved

@Lagovas Lagovas merged commit 7f3c98f into cossacklabs:master Feb 4, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants