yahoo-eng-team team mailing list archive

[Matt Riedemann <mriedem.os@xxxxxxxxx>]

** Also affects: nova/rocky
   Importance: Undecided
       Status: New

** Changed in: nova/rocky
       Status: New => In Progress

** Changed in: nova/rocky
   Importance: Undecided => Medium

** Changed in: nova/rocky
     Assignee: (unassigned) => s10 (vlad-esten)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1788180

Title:
  nova-serialproxy should support X-Forwarded-Proto

Status in OpenStack Compute (nova):
  Fix Released
Status in OpenStack Compute (nova) rocky series:
  In Progress

Bug description:
  Setup description
  ------------------
  Multinode deployment with kolla with keepalived and haproxy with SSL
  termination. nova-serialproxy is configured with base_url=wss://
  because I want my users to connect through a secure channel.

  Problem description
  -------------------
  Get a serial-proxy url with token like this (works fine):
    openstack console url show --insecure --serial <uuid>

  Connect to the url (in my case: simple python websocket):
    python serial.py wss://hostname:6083?token=<token>

  Result:
    nova-serialproxy closes the connection
    Log contains "Origin header protocol does not match this host."

  Expected result:
    connection works

  Problem analysis
  ----------------
  haproxy accepts the wss:// connection and forwards the connection to the
  serialproxy process. HAproxy changes the Origin header to 'http' and adds
  a header 'X-Forwarded-Proto: https'.

  'websocketproxy.py' accepts the connection and fails because the URL
  in 'Origin'has not the same scheme/protocol as issued in the
  'console url show' command.

  AFAIK the behaviour of haproxy is ok and the serialproxy should offer a
  possiblity to check the value of 'X-Forwarded-Proto' as source protocol.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1788180/+subscriptions