SSL/TLS configuration not handled correctly

Bug #1637962 reported by Mathias Ewald
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
kolla
Won't Fix
Critical
Unassigned
Newton
Won't Fix
Critical
Unassigned

Bug Description

I found out that setting kolla_external_vip_address = kolla_internal_vip_address sets haproxy_enable_external_vip to "no" which disables the creation of external listeners in HAproxy. This means tls_bind_info in haproxy.cfg is never used, so we don't get any SSL termination. This essentially disables SSL all together.

Horizons local_settings file states

{% if kolla_enable_tls_external | bool %}
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
{% endif %}

The kolla_enable_tls_external is completely independent of the kolla_external_vip_address or kolla_internal_vip_address variable. As a result, when disabling SSL by setting internal and external VIP to the same value, Horizon is still configured for HTTPS. Connecting to Port 80 works, but we are redirected to "https://" which fails.

Tags: horizon https ssl
Mathias Ewald (mewald)
summary: - SSL/TLS configuration not handlet correctly
+ SSL/TLS configuration not handled correctly
Changed in kolla:
milestone: none → ocata-1
importance: Undecided → Medium
Steven Dake (sdake)
Changed in kolla:
status: New → Triaged
importance: Medium → Critical
Changed in kolla:
milestone: ocata-1 → ocata-2
Changed in kolla:
milestone: ocata-2 → ocata-3
Changed in kolla:
milestone: ocata-3 → ocata-rc1
Changed in kolla:
milestone: ocata-rc1 → pike-1
Changed in kolla:
milestone: pike-2 → pike-3
Changed in kolla:
milestone: pike-3 → pike-rc1
Changed in kolla:
milestone: pike-rc1 → queens-1
Mathias Ewald (mewald)
information type: Public → Public Security
information type: Public Security → Public
Revision history for this message
Dave McCowan (dave-mccowan) wrote :

This is "working" (or breaking) as designed, perhaps it needs to be documented better?
Or, is the ask for Kolla to fail to deploy with this configuration?
TLS is not supported on the internal network, so the case where the all API requests with TLS go to the internal VIP is not a valid configuration.

A wish list item should be to add TLS support to the internal network.

Changed in kolla:
milestone: queens-2 → queens-3
Revision history for this message
Jeffrey Zhang (jeffrey4l) wrote :

This is not expected to work. Before SSL is terminated by haproxy.

If this issue should be resolved, better start from a new design.

Changed in kolla:
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.