Skip to content

GitLab

新注册的用户请输入邮箱并保存，随后登录邮箱激活账号。后续可直接使用邮箱登录！

Closed
Opened by zhang yang@zhangyang1 of 19 tasks completed1/19 tasks

nginx p2p流量转发，节点未发送SNI（Server Name Indication）

【问题分类】

  • bug
  • P2P网络相关（包含libp2p,liquid）
  • 链账户身份与权限相关（证书问题、public、多签投票问题）
  • 核心交易引擎相关（交易池、DAG）
  • 共识相关
  • 智能合约相关
  • 存储相关
  • SDK相关
  • 长安链CMC工具
  • 长安链管理台
  • 长安链浏览器
  • 长安链合约IDE
  • 长安链web签名插件
  • 跨链相关
  • 轻节点相关
  • 隐私计算相关
  • 密码学相关
  • 环境依赖
  • 其他补充：

【问题描述】（请对问题进行描述，方便定位问题）

【具体现象】

长安链节点配置nginx进行p2p流量转发，区块链节点建立SSL 连接时没有发送SNI（Server Name Indication），导致nginx map匹配servername为空。

【操作步骤】

  • nginx配置

    user root root;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

error_log  /var/log/nginx/error.log  debug;

stream {
    upstream org1_node1 {
       server 10.0.2.15:12005;
    }

    upstream org2_node2 {
       server 10.0.2.15:12006;
    }

    map $ssl_preread_server_name $targetBackend {
       node1.tls.org1 org1_node1;
       node2.tls.org2 org2_node2;
    }
    
    server
    {
        listen       3004;
        ssl_preread on;
        proxy_pass $targetBackend;
    }
}

  • 证书解析

    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 586131 (0x8f193)
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = cn, ST = beijing, L = beijing, O = org1, OU = root-cert, CN = ca.org1
        Validity
            Not Before: Dec 23 06:58:48 2024 GMT
            Not After : Dec 21 06:58:48 2033 GMT
        Subject: C = cn, ST = beijing, L = beijing, O = org1, OU = consensus, CN = node1.tls.org1
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:bd:64:10:57:97:30:f7:b2:8e:73:08:54:d7:93:
                    69:4a:6f:7b:35:d0:d3:43:01:02:cc:aa:40:b2:73:
                    1b:07:28:9c:46:2e:4f:01:4b:b5:23:f4:34:30:15:
                    cf:9c:ef:86:4b:d7:a8:0d:86:0f:90:90:58:f3:b6:
                    6c:1c:72:9b:0b
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage: 
                Any Extended Key Usage
            X509v3 Subject Key Identifier: 
                B9:8F:DF:21:89:33:A7:D3:84:61:6F:F1:98:72:EF:26:A9:BE:13:E0:D3:B1:BC:82:93:BC:47:7A:C7:EE:1B:A2
            X509v3 Authority Key Identifier: 
                keyid:E3:E3:99:83:BB:AD:28:64:4E:0F:09:72:97:61:29:C9:52:A7:78:FB:47:6B:5A:C1:9D:4F:9A:79:9F:C3:83:19

            X509v3 Subject Alternative Name: 
                DNS:localhost, DNS:chainmaker.org, IP Address:127.0.0.1
    Signature Algorithm: ecdsa-with-SHA256
         30:45:02:21:00:f8:55:24:cc:0f:63:b2:4c:fb:8f:d0:fc:c7:
         4b:f8:ea:2b:66:a1:13:0f:58:2d:87:4b:c9:2b:61:10:cc:19:
         17:02:20:26:fb:8e:8b:8f:58:04:75:03:d7:9d:d6:5c:ae:d8:
         c2:9e:57:d9:8e:e6:1c:ae:0c:f2:65:56:3a:a7:f7:c1:d1

  • chainmaker.yml seed配置

    net:
  provider: LibP2P
  listen_addr: /ip4/0.0.0.0/tcp/12005
  seeds:
  - /ip4/10.0.2.15/tcp/12006/p2p/QmXvyDDUy9adSoDc6rBMCMYnAKhwFVhqLZgj23ehaGgxGJ
  - /dns/node3.tls.org3/tcp/3004/p2p/QmRA3Ldjv5JTFS8UL1Da294HEsU4Z3ik54EkCmZbXtGwDD
  - /dns/node4.tls.org4/tcp/3004/p2p/QmUTisgDPd8W7WjeLfRXE1zyBbMPuWwJZa5bQhZJasifJ7
  - /ip4/10.0.2.15/tcp/12005/p2p/QmU4c2dzhyH2KDDNek8S2rhudCSHHfYxgyaSU2LmFzZ39b
  tls:
    enabled: true
    priv_key_file: ../config/certs/node/node1.tls.key
    cert_file: ../config/certs/node/node1.tls.crt

  • /ets/hosts配置

    192.168.100.121 node1.tls.org1
192.168.100.121 node2.tls.org2
192.168.100.121 node3.tls.org3
192.168.100.121 node4.tls.org4

【相关日志文件】（如果有报错日志请贴图，或者上传附件）

  • nginx日志

    2024/12/27 10:59:08 [debug] 1161#1161: *58 event timer del: 9: 4072705
2024/12/27 10:59:08 [debug] 1161#1161: *58 tcp_nodelay
2024/12/27 10:59:08 [debug] 1161#1161: *58 proxy connection handler
2024/12/27 10:59:08 [debug] 1161#1161: *58 malloc: 0000563E65C998B0:448
2024/12/27 10:59:08 [debug] 1161#1161: *58 malloc: 0000563E65D24CB0:16384
2024/12/27 10:59:08 [debug] 1161#1161: *58 stream map started
2024/12/27 10:59:08 [debug] 1161#1161: *58 stream map: "" ""
2024/12/27 10:59:08 [debug] 1161#1161: *58 stream script var: ""
2024/12/27 10:59:08 [error] 1161#1161: *58 no host in upstream "", client: 10.0.2.2, server: 0.0.0.0:3004, bytes from/to client:0/0, bytes from/to upstream:0/0
2024/12/27 10:59:08 [debug] 1161#1161: *58 finalize stream proxy: 500
2024/12/27 10:59:08 [debug] 1161#1161: *58 finalize stream session: 500
2024/12/27 10:59:08 [debug] 1161#1161: *58 stream log handler
2024/12/27 10:59:08 [debug] 1161#1161: *58 close stream connection: 9
2024/12/27 10:59:08 [debug] 1161#1161: *58 reusable connection: 0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65D24CB0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65C998B0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65D20CA0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65C99CA0, unused: 0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65C815F0, unused: 0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65C7CF30, unused: 0
2024/12/27 10:59:08 [debug] 1161#1161: *58 free: 0000563E65C9B1E0, unused: 104
2024/12/27 10:59:08 [debug] 1161#1161: timer delta: 0
2024/12/27 10:59:08 [debug] 1161#1161: worker cycle
2024/12/27 10:59:08 [debug] 1161#1161: epoll timer: -1

  • 节点日志

    2024-12-27 10:19:58.219	[WARN]	[Net]	libp2pnet/libp2p_net.go:412	[Net] send msg failed, node not connected, nodeId: [QmUTisgDPd8W7WjeLfRXE1zyBbMPuWwJZa5bQhZJasifJ7]
2024-12-27 10:19:58.275	[INFO]	[Net]	libp2pnet/libp2p_connection_supervisor.go:186	[ConnSupervisor] try to connect to peer failed(peer: {QmUTisgDPd8W7WjeLfRXE1zyBbMPuWwJZa5bQhZJasifJ7: [/dns/node4.tls.org4/tcp/5004]}, times: 11),failed to dial QmUTisgDPd8W7WjeLfRXE1zyBbMPuWwJZa5bQhZJasifJ7: all dials failed
  * [/ip4/172.16.81.7/tcp/5004] failed to negotiate security protocol: EOF
2024-12-27 10:19:58.275	[INFO]	[Net]	libp2pnet/libp2p_connection_supervisor.go:186	[ConnSupervisor] try to connect to peer failed(peer: {QmRA3Ldjv5JTFS8UL1Da294HEsU4Z3ik54EkCmZbXtGwDD: [/dns/node3.tls.org3/tcp/5004]}, times: 11),failed to dial QmRA3Ldjv5JTFS8UL1Da294HEsU4Z3ik54EkCmZbXtGwDD: all dials failed
  * [/ip4/172.16.81.7/tcp/5004] failed to negotiate security protocol: EOF

【系统信息】（请填写系统信息，方便定位问题）

  • chainmaker-go version * : [v2.3.0]

  • OS & version * : Ubuntu 20.04.6 LTS

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

Copyright © 2021 ChainMaker Org. All Rights Reserved. 长安链 版权所有。