[Bug 1790598] Re: metadata service calls to nova-api-metadata with IP based SAN's fails

[Corey Bryant]

The stable/queens fix has been included in neutron 2:12.0.4-0ubuntu1,
currently in the bionic unapproved queue awaiting SRU team review.

** Description changed:

- If the nova-api-metadata service is secured with a certificate that
- makes use of IP based SAN's, under Python 2 certificate validation will
- fail as the ssl module does not support use of IP addresses in cert SAN
- fields (and httplib2 which is used to make the request uses ssl
- directly).
+ [Impact]
+ If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly).
  
  Master branch of neutron has switched (see [0]) to using requests to
  make these calls, supporting use of certs with IP address based SAN's
  (via urllib3 which does support IP address based SAN's under Python 2).
  
  [0]
  https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4
+ 
+ [Test Case]
+ 
+ [Regression Potential]

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1790598

Title:
  metadata service calls to nova-api-metadata with IP based SAN's fails

Status in neutron:
  Fix Committed
Status in neutron package in Ubuntu:
  Fix Released
Status in neutron source package in Xenial:
  Triaged
Status in neutron source package in Bionic:
  Triaged
Status in neutron source package in Cosmic:
  Fix Released

Bug description:
  [Impact]
  If the nova-api-metadata service is secured with a certificate that makes use of IP based SAN's, under Python 2 certificate validation will fail as the ssl module does not support use of IP addresses in cert SAN fields (and httplib2 which is used to make the request uses ssl directly).

  Master branch of neutron has switched (see [0]) to using requests to
  make these calls, supporting use of certs with IP address based SAN's
  (via urllib3 which does support IP address based SAN's under Python
  2).

  [0]
  https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4

  [Test Case]

  [Regression Potential]

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions