Getting EINVAL error while connecting to MySQL using NodeJS inside Edge

[adevegowda]

We have NodeJS code which connects to MySQL database from within Apigee Edge. We are seeing the following error when we attempt to connect to the database in our private cloud setup:

{"fault":
{"faultstring":"Script execution failed: connect EINVAL: 
at \/organization\/environment\/api\/logindatavalidation.js:16\n 
at domain.js:183\n at \/organization\/environment\/api\/node_modules\/mysql\/lib\/protocol\/sequences\/Sequence.js:96\n 
at \/organization\/environment\/api\/node_modules\/mysql\/lib\/protocol\/Protocol.js:364\n 
at \/organization\/environment\/api\/node_modules\/mysql\/lib\/Connection.js:421\n 
at emit (events.js:95)\n at net.js:440\n 
at _tickDomainCallback (trireme.js:491)\n 
at submitDomainTick (trireme.js:839)\n",
"detail":{"errorcode":"scripts.node.runtime.ScriptExecutionError"}}} 

Have tried the following and it works fine in all the below cases:

1. Executed the same NodeJS script outside of Apigee Edge as a standalone application
2. Executed the same NodeJS script with Trireme
3. Java code connecting to the same database (same parameters - host IP, port#, username, password)

Can you please check what's causing this issue ?

[adevegowda · Accepted solution]

Investigated the issue further and got to know that there’s nodejs.properties file deployed at: /opt/apigee4/conf/apigee/message-processor. It contained the several properties which affects the NodeJS policy behaviour within Edge. Here are some of the properties that were of interest:

#nodejs.enabled=true 

listen.ports.allowed=-1

#connect.ports.allowed=

#connect.ranges.allowed=

connect.ranges.denied=10.0.0.0/8,192.168.0.0/16,127.0.0.1/32

#connect.ranges.denied=

Looking specifically at the value set for the property “connect.ranges.denied”, I noticed that it explicitly denies the connection to hosts with IP addresses starting with “10.", "192.168", and localhost. The property "connect.ranges.allowed" is set to empty which indicates that it allows connections to all IP addresses. However, if the property "connect.ranges.denied" is set, then it overrides anything set in "connect.ranges.allowed".

In our NodeJS code, we were trying to connect to the database with IP address “10.X.X.X”. This was the reason why we were getting EINVAL error while trying to connect to MySQL database using NodeJS code.

I commented out the property connect.ranges.denied in nodejs.properties file and restarted the MPs.

With this change, we were able to connect to MySQL database from within Edge without any issues.

[adevegowda · Accepted solution]

Investigated the issue further and got to know that there’s nodejs.properties file deployed at: /opt/apigee4/conf/apigee/message-processor. It contained the several properties which affects the NodeJS policy behaviour within Edge. Here are some of the properties that were of interest:

#nodejs.enabled=true 

listen.ports.allowed=-1

#connect.ports.allowed=

#connect.ranges.allowed=

connect.ranges.denied=10.0.0.0/8,192.168.0.0/16,127.0.0.1/32

#connect.ranges.denied=

Looking specifically at the value set for the property “connect.ranges.denied”, I noticed that it explicitly denies the connection to hosts with IP addresses starting with “10.", "192.168", and localhost. The property "connect.ranges.allowed" is set to empty which indicates that it allows connections to all IP addresses. However, if the property "connect.ranges.denied" is set, then it overrides anything set in "connect.ranges.allowed".

In our NodeJS code, we were trying to connect to the database with IP address “10.X.X.X”. This was the reason why we were getting EINVAL error while trying to connect to MySQL database using NodeJS code.

I commented out the property connect.ranges.denied in nodejs.properties file and restarted the MPs.

With this change, we were able to connect to MySQL database from within Edge without any issues.

[adevegowda]

Above mentioned changes were done for Private Cloud setup and confirmed that it worked.

[DChiesa]

How would you set that for a later OPDK, which uses CWC (tokenization of config files) ?

[sgilson · Accepted solution]

Dino,

Try:

1. Edit /opt/apigee/customer/application/message-processor.properties,
2. Add this line: conf_nodejs_connect.ranges.denied=IPS
3. Save and restart the message processor.
4. Repeat for each message processor in your setup.

Stephen