First record does not look like a TLS handshake

[tsmjay]

Hi,

This is the process I'm following:

1. Take a recent build of SONiC
2. Run it in GNS3
3. Get a bash shell inside the 'docker-sonic-gnmi' container
4. Run the example gNMI 'get' command

When I do that, I get the following:

root@sonic:/# gnmi_get -insecure -username admin -password YourPaSsWoRd -xpath /openconfig-interfaces:interfaces/interface[name=Ethernet0]/config -target_addr 127.0.0.1:8080 -xpath_target OC-YANG
== getRequest:
prefix: <
  target: "OC-YANG"
>
path: <
  origin: "openconfig-interfaces"
  elem: <
    name: "interfaces"
  >
  elem: <
    name: "interface"
    key: <
      key: "name"
      value: "Ethernet0"
    >
  >
  elem: <
    name: "config"
  >
>
encoding: JSON_IETF

F0719 18:58:12.816922      67 gnmi_get.go:145] Get failed: rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: first record does not look like a TLS handshake"
root@sonic:/#

I have tested the master, 202405, 202311 and 202305 branches.

Am I missing something?

Thanks.

[fishingfly]

try?

gnmi_get -notls -username admin -password YourPaSsWoRd -xpath /openconfig-interfaces:interfaces/interface[name=Ethernet0]/config -target_addr 127.0.0.1:8080 -xpath_target OC-YANG

[puffc]

@fishingfly root@sonic:/# gnmi_get -notls -username admin -password YourPaSsWoRd -xpath /openconfig-interfaces:interfaces/interface[name=Ethernet0]/config -target_addr 127.0.0.1:8080 -xpath_target OC-YANG
F1107 08:22:16.200512 1098 gnmi_get.go:86] Dialing to "127.0.0.1:8080" failed: grpc: the credentials require transport level security (use grpc.WithTransportCredentials() to set)

[slicking]

@sachinholla FYI

[sachinholla]

@puffc, by default the gNMI server runs in no authentication mode. So, you can omit the -username and -password arguments. Looks like go grpc library does not allow credentials in no-TLS mode. gnmi_get -notls -target_addr 127.0.0.1:8080 -xpath ....

About the "first record does not look like a TLS handshake" error -- gNMI server requires certificate configurations to run in TLS mode. You can run following commands from host linux prompt (outside telemetry container) and restart the container.

openssl req -x509 -new -newkey rsa:2048 -nodes -sha256 -days 999 \
    -subj "/CN=[test.sonicfoundation.dev](http://test.sonicfoundation.dev/)" \
    -addext "keyUsage = digitalSignature, keyEncipherment" \
    -addext "extendedKeyUsage = serverAuth, clientAuth" \
    -out /etc/sonic/server_crt.pem -keyout /etc/sonic/server_key.pem
 
sonic-db-cli CONFIG_DB hset 'GNMI|certs' \
    server_crt /etc/sonic/server_crt.pem \
    server_key /etc/sonic/server_key.pem \
    ca_crt ""

Now, the gnmi_get can be used without -notls option; use -insecure to skip certificate validation at the client side. gnmi_get -insecure -target_addr 127.0.0.1:8080 -xpath ....