ECONNRESET

[dotmilk]

I have two laptops that i switch between development work on, they are both running the latest osx and have the same version of node and this library.

However on one i get this when trying to connect to a amqps://

{ [Error: read ECONNRESET] code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' }

I was wondering if you could provide any insight, or a way i could maybe get a little more information out of the client, the server logs aren't very helpful

[dotmilk]

Actually this problem seems to be related to at least iojs 2.0.0 I haven't tested farther back and node 4.0.0, but is fine on node < v0.12.x

[squaremo]

Do your laptops have the same version of RabbitMQ server as well?

[dotmilk]

It is on a remote rabbit, i haven't gone through the trouble of messing with ssl on local rabbit just yet, cause i realized my other laptop had been switch to node 0.12.4 for previous work, so i was mistaken they were on the same version of node. I just narrowed the breaking change to iojs 1.8.4 anything >= to that or the latest nodejs version will duplicate.

Error: read ECONNRESET
    at exports._errnoException (util.js:749:11)
    at TLSWrap.onread (net.js:529:26)

[dotmilk]

What I am actually curious about now, is if there are other services (not rabbit) that i can duplicate this on.

[squaremo]

if there are other services (not rabbit) that i can duplicate this on

As in, just creating an TLS connection at all? Yes, that would be good to know.

[dotmilk]

Yes, but i'm not sure how to quickly test such a thing, before I go tromping off to the node repo itself. Do you have any suggestions?

[dotmilk]

So i just used the request library to hit https://www.howsmyssl.com/a/check and it reported back using tls 1.2 etc etc, so i'm not sure though if this ends up going through the same spot in the core code or not.

[squaremo]

Just to check, does the server log say anything like

Error on AMQP connection <0.522.0>:
{ssl_upgrade_failure,
    {{notsup,
         [{crypto,sha256_mac,3,[{file,"crypto.erl"},{line,1030}]},
...

? (That's what my local one does when I try the SSL example in examples/ssl.js)

[dotmilk]

Error on AMQP connection <0.8504.0>:
{ssl_upgrade_failure,
    {{function_clause,
         [{tls_v1,enum_to_oid,[28],[{file,"tls_v1.erl"},{line,404}]},
          {ssl_handshake,'-dec_hello_extensions/2-blc$^1/1-0-',1,
              [{file,"ssl_handshake.erl"},{line,1657}]},
          {ssl_handshake,'-dec_hello_extensions/2-blc$^1/1-0-',1,
              [{file,"ssl_handshake.erl"},{line,1657}]},
          {ssl_handshake,dec_hello_extensions,2,
              [{file,"ssl_handshake.erl"},{line,1657}]},
          {tls_handshake,decode_handshake,3,
              [{file,"tls_handshake.erl"},{line,182}]},
          {tls_handshake,get_tls_handshake_aux,3,
              [{file,"tls_handshake.erl"},{line,153}]},
          {tls_connection,next_state,4,
              [{file,"tls_connection.erl"},{line,454}]},
          {gen_fsm,handle_msg,7,[{file,"gen_fsm.erl"},{line,505}]}]},
     {gen_fsm,sync_send_all_state_event,[<0.8505.0>,{start,5000},infinity]}}}

[squaremo]

It's worth going through https://www.rabbitmq.com/troubleshooting-ssl.html (from the troublesome laptop), if you've not already; especially the "Check keys and certificates with OpenSSL" section.

[dotmilk]

Well we have previously checked that too:

openssl s_client -connect rabbit-1.hotelquickly.com:5671 -cert hotelquickly.com.crt -key hotelquickly.key
CONNECTED(00000003)
depth=3 C = US, O = "The Go Daddy Group, Inc.", OU = Go Daddy Class 2 Certification Authority
verify return:1
depth=2 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", CN = Go Daddy Root Certificate Authority - G2
verify return:1
depth=1 C = US, ST = Arizona, L = Scottsdale, O = "GoDaddy.com, Inc.", OU = http://certs.godaddy.com/repository/, CN = Go Daddy Secure Certificate Authority - G2
verify return:1
depth=0 OU = Domain Control Validated, CN = *.hotelquickly.com
verify return:1
---
etc

The thing is, this server config works with php / python (pika) with zero problems, it is only somehow connected with the previous mentioned iojs and latest nodejs, but i am unsure how to really test if this is just rabbit related or a deeper issue.

[squaremo]

Ah good, OK so we know that RabbitMQ doesn't have a problem with the certs in general.

Hmm. Can you connect using those certificates and just tls.connect? (https://nodejs.org/api/tls.html#tls_tls_connect_port_host_options_callback)

(it won't do the AMQP handshake, but you should see at least in the logs whether RabbitMQ accepts the TLS connection)

[dotmilk]

var tls = require('tls')
tls.connect(5671,'muh host',function(){console.log('here')})

Same error ECONNRESET on all expected iojs, nodejs latest. works fine on the 0.12.X family

[michaelklishin]

@cheshirecatalyst make sure you run Erlang 17 or 18, this function_clause failure certainly looks familiar and from the pre-17.0 days.

[dotmilk]

@michaelklishin You sir are a gentleman and a scholar, that was %100 it. Was running 16 for some reason. Now on 18 everything is fine. Still odd to me that the combination of (iojs || latest node) + old erlang = fail, when all the other scripting languages i tried had no problem.

[ecoruh]

4 months on, I have node 5.5.0, RMQ 3.6.0 Erlang 18:2 on Ubuntu. Sanity test "openssl s_client -connect localhost:5671" works. However I have the same problem:
{ [Error: read ECONNRESET] code: 'ECONNRESET', errno: 'ECONNRESET', syscall: 'read' }

Upgrading to Erlang 18.2 didn't solve the issue. Any help is appreciated. I couldn't get amqps/TLS work with amqplib. amqp works.

var amqp = require('amqplib');
var fs = require('fs');

var opts = {
  cert: fs.readFileSync('/root/client/cert.pem'),
  key: fs.readFileSync('/root/client/key.pem'),
  passphrase: 'password',
  ca: [fs.readFileSync('/root/testca/cacert.pem')]
};
// var opts = {};

var open = amqp.connect('amqps://localhost', opts);

open.then(function(conn) {
  process.on('SIGINT', conn.close.bind(conn));
  return conn.createChannel().then(function(ch) {
    ch.sendToQueue('foo', new Buffer('Hello World!'));
  });
}).then(null, console.warn);

[michaelklishin]

@ecoruh I'm afraid nobody can help you without seeing full server logs.

[squaremo]

@ecoruh Can you connect via SSL using any other kind of client? (ideally one of the official ones).
It's not clear to me whether this is something to do with RabbitMQ, Erlang's implementation of SSL, Node.JS's implementation of SSL, or amqplib, and ruling some of those out would help.

[michaelklishin]

@squaremo I suspect the issue was reported separately as #227, and it is a known issue in the Erlang ssl app prior to 17.0.

[squaremo]

Ah I see -- ignore my comment!

[ecoruh]

Yep, @squaremo sorry for the late response, yes the issue is resolved now, and I closed #227.