yahoo-eng-team team mailing list archive
-
yahoo-eng-team team
-
Mailing list archive
-
Message #30291
[Bug 1434611] [NEW] serial console in Horizon is broken by origin header verification
Public bug reported:
Issue
=====
The console tab in Horizon doesn't show the console of the instance
anymore if the "serial console" feature is enabled.
Steps to reproduce
==================
* Enable "serial console" feature in "nova.conf"
[Default]
vnc_enabled=False
[serial_console]
enabled=True
base_url=ws://<host-ip>:6083
* Launch an instance
* Open to the "console" tab of that instance
Expected behavior
=================
The login prompt from the instance is shown via serial console
connection.
Actual behavior
===============
* Black screen + "Status: Closed"
* The traceback shows a validation error [1].
* If "base_url" is NOT set in "nova.conf" the console will still not
connect, but nothing will be logged.
Possible root causes
--------------------
This validation logic was introduced with [2]. The unit seems to be
based on the assumption that the serial console uses "https" [3]. AFAIK
the supposed protocol is "ws".
Logs & Env.
===========
Manually added debug log:
/opt/stack/screen-logs/screen-n-sproxy.log:2015-03-20 14:49:14.081
DEBUG nova.console.websocketproxy
[req-fae1b332-5b8c-4253-a1ec-5306c56c1f3a None None]
origin: http, expected: ws
verify_origin_proto /opt/stack/nova/nova/console/websocketproxy.py:65
Nova version
------------
/opt/stack/nova$ git log --oneline -n5
90ee915 Merge "Add api microvesion unit test case for wsgi.action"
7885b74 Merge "Remove db layer hard-code permission checks for [...]
416f310 Merge "Remove db layer hard-code permission checks for [...]
ecb306b Merge "Remove db layer hard-code permission checks for [...]
6efc8ad Merge "libvirt: don't allow to resize down the default [...]
References
==========
[1] Traceback; nova.console.websocketproxy
http://paste.openstack.org/show/193938/
[2] Gerrit; Websocket Proxy should verify Origin header
https://review.openstack.org/#/c/163033/6
[3] test_websocketproxy.py module; "https" instead of "ws"
https://github.com/openstack/nova/blob/master/nova/tests/unit/console/test_websocketproxy.py#L44
** Affects: horizon
Importance: Undecided
Status: New
** Affects: nova
Importance: Undecided
Status: New
** Tags: console
** Also affects: horizon
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1434611
Title:
serial console in Horizon is broken by origin header verification
Status in OpenStack Dashboard (Horizon):
New
Status in OpenStack Compute (Nova):
New
Bug description:
Issue
=====
The console tab in Horizon doesn't show the console of the instance
anymore if the "serial console" feature is enabled.
Steps to reproduce
==================
* Enable "serial console" feature in "nova.conf"
[Default]
vnc_enabled=False
[serial_console]
enabled=True
base_url=ws://<host-ip>:6083
* Launch an instance
* Open to the "console" tab of that instance
Expected behavior
=================
The login prompt from the instance is shown via serial console
connection.
Actual behavior
===============
* Black screen + "Status: Closed"
* The traceback shows a validation error [1].
* If "base_url" is NOT set in "nova.conf" the console will still not
connect, but nothing will be logged.
Possible root causes
--------------------
This validation logic was introduced with [2]. The unit seems to be
based on the assumption that the serial console uses "https" [3]. AFAIK
the supposed protocol is "ws".
Logs & Env.
===========
Manually added debug log:
/opt/stack/screen-logs/screen-n-sproxy.log:2015-03-20 14:49:14.081
DEBUG nova.console.websocketproxy
[req-fae1b332-5b8c-4253-a1ec-5306c56c1f3a None None]
origin: http, expected: ws
verify_origin_proto /opt/stack/nova/nova/console/websocketproxy.py:65
Nova version
------------
/opt/stack/nova$ git log --oneline -n5
90ee915 Merge "Add api microvesion unit test case for wsgi.action"
7885b74 Merge "Remove db layer hard-code permission checks for [...]
416f310 Merge "Remove db layer hard-code permission checks for [...]
ecb306b Merge "Remove db layer hard-code permission checks for [...]
6efc8ad Merge "libvirt: don't allow to resize down the default [...]
References
==========
[1] Traceback; nova.console.websocketproxy
http://paste.openstack.org/show/193938/
[2] Gerrit; Websocket Proxy should verify Origin header
https://review.openstack.org/#/c/163033/6
[3] test_websocketproxy.py module; "https" instead of "ws"
https://github.com/openstack/nova/blob/master/nova/tests/unit/console/test_websocketproxy.py#L44
To manage notifications about this bug go to:
https://bugs.launchpad.net/horizon/+bug/1434611/+subscriptions
Follow ups
References