Skip to content

By @lukebakken: Suppress spurious warnings from port scanner connections (backport #15715)#15717

Merged
michaelklishin merged 5 commits intov4.2.xfrom
mergify/bp/v4.2.x/pr-15715
Mar 12, 2026
Merged

By @lukebakken: Suppress spurious warnings from port scanner connections (backport #15715)#15717
michaelklishin merged 5 commits intov4.2.xfrom
mergify/bp/v4.2.x/pr-15715

Conversation

@mergify
Copy link
Copy Markdown

@mergify mergify bot commented Mar 12, 2026

This is #15713 by @lukebakken with one extra test added by me.


This is an automatic backport of pull request #15715 done by Mergify.

lukebakken and others added 4 commits March 12, 2026 02:12
Port scanners and other non-RabbitMQ clients connecting to the stream
port send arbitrary data before any authentication takes place. The
resulting `{unknown, Data}` commands are expected and not actionable,
so logging them at warning level is unnecessarily noisy.

Add a specific clause for `{unknown, _}` in `handle_frame_pre_auth/4`
that logs at debug level. The existing warning-level catch-all remains
for any other genuinely unexpected pre-auth commands.

Also add a specific clause for `{unknown, _}` in
`handle_frame_post_auth/4` with a clearer log message, and extract
`send_close_and_increment/2` to eliminate the resulting duplication.

(cherry picked from commit 3e710d3)
Two sources of noise in the logs when port scanners connect to the
stream port:

1. Unrecognised pre-auth data was logged at warning level. Since this
   is expected from port scanners and other non-RabbitMQ clients, add a
   specific `{unknown, _}` clause in `handle_frame_pre_auth/4` that
   logs at debug level instead. The existing warning-level catch-all
   remains for any other unexpected pre-auth commands.

   Also add a specific `{unknown, _}` clause in
   `handle_frame_post_auth/4` with a clearer log message, and extract
   `send_close_and_increment/2` to eliminate the resulting duplication.

2. When incoming data does not contain a complete frame (e.g. a port
   scanner sends fewer bytes than a full frame header), no commands are
   parsed and `connection_step` remains unchanged. The pre-`open`
   state handlers treated this as an invalid transition and logged a
   warning. Add a guard in each of the five pre-`open` state handlers
   (`tcp_connected`, `peer_properties_exchanged`, `authenticating`,
   `tuning`, `tuned`) that returns `keep_state` when
   `NextConnectionStep` equals the current state, waiting for more
   data. The existing negotiation timeout will still close connections
   that make no progress.

(cherry picked from commit 0fa1e99)
(cherry picked from commit b69c014)
@michaelklishin michaelklishin added this to the 4.2.5 milestone Mar 12, 2026
@michaelklishin michaelklishin merged commit 5b5c6b1 into v4.2.x Mar 12, 2026
854 of 877 checks passed
@michaelklishin michaelklishin deleted the mergify/bp/v4.2.x/pr-15715 branch March 12, 2026 05:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants