我正在尝试通过SSL通过libmongoc连接到本地mongodb实例。如果我不使用SSL,则连接可以正常工作,并且可以正常执行CRUD操作,但是当我启用SSL并尝试检索某些数据时,mongoc_cursor_next()
函数会挂起很长时间,然后退出false
。
在服务器端,日志显示,当它卡在函数中时,客户端将连接到服务器,接受连接,断开连接,并重复进行直到几分钟后被卡住:
2019-02-13T15:34:45.792-0300 I NETWORK [listener] connection accepted from 192.168.25.9:55256 #710 (1 connection now open)
2019-02-13T15:34:45.810-0300 I NETWORK [conn710] received client metadata from 192.168.25.9:55256 conn710: { application: { name: "Test Client" }, driver: { name: "mongoc", version: "1.13.1" }, os: { type: "Linux", name: "Ubuntu", version: "18.10", architecture: "x86_64" }, platform: "cfg=0xa15ea0e9 posix=200809 stdc=201710 CC=GCC 8.2.0 CFLAGS="" LDFLAGS=""" }
2019-02-13T15:34:45.810-0300 I NETWORK [conn710] end connection 192.168.25.9:55256 (0 connections now open)
2019-02-13T15:34:46.311-0300 I NETWORK [listener] connection accepted from 192.168.25.9:55258 #711 (1 connection now open)
2019-02-13T15:34:46.328-0300 I NETWORK [conn711] received client metadata from 192.168.25.9:55258 conn711: { application: { name: "Test Client" }, driver: { name: "mongoc", version: "1.13.1" }, os: { type: "Linux", name: "Ubuntu", version: "18.10", architecture: "x86_64" }, platform: "cfg=0xa15ea0e9 posix=200809 stdc=201710 CC=GCC 8.2.0 CFLAGS="" LDFLAGS=""" }
2019-02-13T15:34:46.328-0300 I NETWORK [conn711] end connection 192.168.25.9:55258 (0 connections now open)
2019-02-13T15:34:46.829-0300 I NETWORK [listener] connection accepted from 192.168.25.9:55260 #712 (1 connection now open)
2019-02-13T15:34:46.843-0300 I NETWORK [conn712] received client metadata from 192.168.25.9:55260 conn712: { application: { name: "Test Client" }, driver: { name: "mongoc", version: "1.13.1" }, os: { type: "Linux", name: "Ubuntu", version: "18.10", architecture: "x86_64" }, platform: "cfg=0xa15ea0e9 posix=200809 stdc=201710 CC=GCC 8.2.0 CFLAGS="" LDFLAGS=""" }
2019-02-13T15:34:46.843-0300 I NETWORK [conn712] end connection 192.168.25.9:55260 (0 connections now open)
起初我以为错误出在我的代码中,所以我用-DENABLE_TRACING=1
选项重建了libmongoc库,以查看是否可以找到有帮助的东西。但是,令我惊讶的是,这“解决了”问题:它将不再挂在mongoc_cursor_next()
上,文档将返回正常状态,但是该跟踪将过多的调试信息填充到stdout中,甚至转储已发送的TCP数据包/收到。如果启用跟踪,问题将消失。如果我禁用跟踪,它将返回。
我尝试通过mongoc_client_pool_set_ssl_opts
函数设置SSL选项,但是结果与通过URI传递它们相同。我也尝试在客户端上使用证书,但是也没有运气。唯一有效的方法是要么用-DENABLE_TRACING=1
构建libmongoc,要么不在客户端上使用SSL。
我不知道使用自签名证书是否与我有关,因为我没有受信任的证书。但是我认为sslAllowInvalidCertificates=true
会忽略此要求,因为它只是一个包含模拟数据的开发数据库。
我想念什么吗?
我的环境:
客户:
Ubuntu 18.10 x64,libmongoc 1.13.1 / 1.9.5(均已测试),GCC 8.2.0
Windows 10专业版,libmongoc 1.9.5,MSVC 2015。
服务器:
Ubuntu 18.10 x64
MongoDB 4.0.6(git版本:caa42a1f75a56c7643d0b68d3880444375ec42e3)
OpenSSL版本:OpenSSL 1.1.1 2018年9月11日
我的示例客户端:
int main(int argc, char *argv[])
{
mongoc_init();
mongoc_uri_t *uri = mongoc_uri_new("mongodb://Client:1234@localhost/?authSource=MyDatabase&ssl=true&sslAllowInvalidCertificates=true");
if(!uri)
{
std::cout << "Failed to parse URI";
return 1;
}
mongoc_client_pool_t *pool = mongoc_client_pool_new(uri);
mongoc_client_pool_set_appname(pool, "Test Client");
mongoc_client_pool_set_error_api(pool, MONGOC_ERROR_API_VERSION_2);
mongoc_uri_destroy(uri);
mongoc_client_t *client = mongoc_client_pool_pop(pool);
mongoc_collection_t *col = mongoc_client_get_collection(client, "MyDatabase", "MyCollection");
bson_error_t err;
bson_t *filter = bson_new_from_json(reinterpret_cast<const uint8_t*>("{}"), 2, &err);
bson_t *opts = bson_new_from_json(reinterpret_cast<const uint8_t*>("{}"), 2, &err);
if(!filter || !opts)
return 2;
mongoc_cursor_t *cursor = mongoc_collection_find_with_opts(col, filter, opts, nullptr);
bson_t *bson = nullptr;
while(mongoc_cursor_next(cursor, const_cast<const bson_t **>(&bson)))
std::cout << "Got document!" << std::endl;
mongoc_cursor_destroy(cursor);
mongoc_collection_destroy(col);
mongoc_client_pool_push(pool, client);
mongoc_client_pool_destroy(pool);
mongoc_cleanup();
return 0;
}
我的服务器配置(mongod.conf):
# mongod.conf
# for documentation of all options, see:
# http://docs.mongodb.org/manual/reference/configuration-options/
# Where and how to store data.
storage:
dbPath: /var/lib/mongodb
journal:
enabled: true
# engine:
# mmapv1:
# wiredTiger:
# where to write logging data.
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
# network interfaces
net:
port: 27017
bindIp: 0.0.0.0
ssl:
mode: allowSSL
PEMKeyFile: /home/tyras/mongodb.pem
allowConnectionsWithoutCertificates: true
allowInvalidCertificates: true
# how the process runs
processManagement:
timeZoneInfo: /usr/share/zoneinfo
#security:
security:
authorization: enabled
#operationProfiling:
#replication:
#sharding:
## Enterprise-Only Options:
#auditLog:
#snmp:
编辑:
经过进一步测试,我发现在没有池的情况下进行连接时,它不会卡在mongoc_cursor_next()
上。但失败,并且mongoc_cursor_error()
返回:
Error 13053: No suitable servers found (`serverSelectionTryOnce` set): [Failed to receive length header from server. calling ismaster on 'localhost:27017']
此外,我可以通过SSL与mongo CLI和Compass正常连接。