{"action":"created","issue":{"url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/4","repository_url":"https://api.github.com/repos/cloudfoundry/silk-release","labels_url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/4/comments","events_url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/4/events","html_url":"https://github.com/cloudfoundry/silk-release/issues/4","id":345380525,"node_id":"MDU6SXNzdWUzNDUzODA1MjU=","number":4,"title":"Feature Request log TCP connection failures (that were allowed)","user":{"login":"youngm","id":438661,"node_id":"MDQ6VXNlcjQzODY2MQ==","avatar_url":"https://avatars2.githubusercontent.com/u/438661?v=4","gravatar_id":"","url":"https://api.github.com/users/youngm","html_url":"https://github.com/youngm","followers_url":"https://api.github.com/users/youngm/followers","following_url":"https://api.github.com/users/youngm/following{/other_user}","gists_url":"https://api.github.com/users/youngm/gists{/gist_id}","starred_url":"https://api.github.com/users/youngm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/youngm/subscriptions","organizations_url":"https://api.github.com/users/youngm/orgs","repos_url":"https://api.github.com/users/youngm/repos","events_url":"https://api.github.com/users/youngm/events{/privacy}","received_events_url":"https://api.github.com/users/youngm/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-27T22:10:38Z","updated_at":"2018-07-27T22:10:40Z","closed_at":null,"author_association":"NONE","body":"## Issue\r\n\r\nAs a CF operator I would like to be able to see something logged when a TCP connection is attempted but never established for any reason.\r\n\r\n## Context\r\n\r\nWe recently moved to container networking and in the process would like to replace our home grown iptables logger with the container networking iptables logger.  It appears for TCP connections the silk iptables logger with either log:\r\n\r\n* SYN Sent (Allowed)\r\n* SYN Sent (Denied)\r\n\r\nThough this is great information, it would also be useful if we could see something logged when a TCP connection is attempted but never established.\r\n\r\n* Cf deployments in organizations often have a layer of network firewalls to deal with in addition to container firewalls.  This is a great way to direct users with connection issues towards places other than CF networking.\r\n* It can also be useful for users and operators to see failed connection attempts to help in the debugging of infrastructure network flakiness and such as well.\r\n\r\nOur previous home grown connection logger was able to log a message when a SYN was sent that never resulted in an established connection, it has been of great value.\r\n\r\n**Though I make mention above about users seeing these logs, that isn't the primary concern of this issue.  We have ways to present this information to our users what we need from container networking is some way to detect that a connection attempt failed.**\r\n\r\n## Steps to Reproduce\r\n\r\n* Connect from an application in a container to a ip address and port that don't work but is NOT blocked by iptables policies.\r\n* Note the connection fails to happen\r\n* Note that in the iptables logger logs several connection attempts with no way to know that a connection was ever even established.\r\n\r\n## Expected result\r\n\r\nSome way to identify that a connection never resulted from an attempted TCP connection.\r\n\r\nAs a side I think it is perfectly acceptable to see a connection attempt logged and later a failure.  My users haven't had any issue getting confused between an attempt and a failure.  Successes and failures tend to have different audiences.  Successes are useful for auditors, security teams, and such.  Failures tend to be more useful for application developers.  So, no need to be too particular about making sure one  and only one log is presented per connection.  Success/Fail.  Seeing an Attempt/success then later a fail is just fine as well.\r\n\r\n## Current result\r\n\r\nDoesn't appear to be possible to identify a connection failure from the iptables logs.\r\n\r\n## Disclaimer\r\n\r\nI'm not a networking guru.  I barely know how our home grown solution works (written by someone who doesn't work with me anymore).  But if you have questions I can do what I can.\r\n\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/comments/408551237","html_url":"https://github.com/cloudfoundry/silk-release/issues/4#issuecomment-408551237","issue_url":"https://api.github.com/repos/cloudfoundry/silk-release/issues/4","id":408551237,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODU1MTIzNw==","user":{"login":"cf-gitbot","id":5589368,"node_id":"MDQ6VXNlcjU1ODkzNjg=","avatar_url":"https://avatars3.githubusercontent.com/u/5589368?v=4","gravatar_id":"","url":"https://api.github.com/users/cf-gitbot","html_url":"https://github.com/cf-gitbot","followers_url":"https://api.github.com/users/cf-gitbot/followers","following_url":"https://api.github.com/users/cf-gitbot/following{/other_user}","gists_url":"https://api.github.com/users/cf-gitbot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-gitbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-gitbot/subscriptions","organizations_url":"https://api.github.com/users/cf-gitbot/orgs","repos_url":"https://api.github.com/users/cf-gitbot/repos","events_url":"https://api.github.com/users/cf-gitbot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-gitbot/received_events","type":"User","site_admin":false},"created_at":"2018-07-27T22:10:40Z","updated_at":"2018-07-27T22:10:40Z","author_association":"NONE","body":"We have created an issue in Pivotal Tracker to manage this: \n\nhttps://www.pivotaltracker.com/story/show/159378152 \n\nThe labels on this github issue will be updated when the story is started."}}
{"actor":{"display_login":"cf-gitbot"}}