[Bug 1790598] [NEW] metadata service calls to nova-api-metadata with IP based SAN's fails

[James Page]

Public bug reported:

If the nova-api-metadata service is secured with a certificate that
makes use of IP based SAN's, under Python 2 certificate validation will
fail as the ssl module does not support use of IP addresses in cert SAN
fields (and httplib2 which is used to make the request uses ssl
directly).

Master branch of neutron has switched (see [0]) to using requests to
make these calls, supporting use of certs with IP address based SAN's
(via urllib3 which does support IP address based SAN's under Python 2).

[0]
https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4

** Affects: neutron
     Importance: Undecided
         Status: Fix Committed

** Affects: neutron (Ubuntu)
     Importance: High
         Status: Triaged

** Affects: neutron (Ubuntu Xenial)
     Importance: High
         Status: Triaged

** Affects: neutron (Ubuntu Bionic)
     Importance: High
         Status: Triaged

** Affects: neutron (Ubuntu Cosmic)
     Importance: High
         Status: Triaged

** Also affects: neutron (Ubuntu Cosmic)
   Importance: Undecided
       Status: New

** Also affects: neutron (Ubuntu Bionic)
   Importance: Undecided
       Status: New

** Also affects: neutron (Ubuntu Xenial)
   Importance: Undecided
       Status: New

** Changed in: neutron (Ubuntu Cosmic)
       Status: New => Triaged

** Changed in: neutron (Ubuntu Bionic)
       Status: New => Triaged

** Changed in: neutron (Ubuntu Xenial)
       Status: New => Triaged

** Changed in: neutron (Ubuntu Xenial)
   Importance: Undecided => High

** Changed in: neutron (Ubuntu Bionic)
   Importance: Undecided => High

** Changed in: neutron (Ubuntu Cosmic)
   Importance: Undecided => High

** Description changed:

  If the nova-api-metadata service is secured with a certificate that
  makes use of IP based SAN's, under Python 2 certificate validation will
  fail as the ssl module does not support use of IP addresses in cert SAN
  fields (and httplib2 which is used to make the request uses ssl
  directly).
  
- Master branch of neutron has switched to using requests (via urllib3
- which does support IP address based SAN's under Python 2) to make these
- calls, supporting use of certs with IP address based SAN's.
+ Master branch of neutron has switched to using requests to make these
+ calls, supporting use of certs with IP address based SAN's (via urllib3
+ which does support IP address based SAN's under Python 2).

** Description changed:

  If the nova-api-metadata service is secured with a certificate that
  makes use of IP based SAN's, under Python 2 certificate validation will
  fail as the ssl module does not support use of IP addresses in cert SAN
  fields (and httplib2 which is used to make the request uses ssl
  directly).
  
- Master branch of neutron has switched to using requests to make these
- calls, supporting use of certs with IP address based SAN's (via urllib3
- which does support IP address based SAN's under Python 2).
+ Master branch of neutron has switched (see [0]) to using requests to
+ make these calls, supporting use of certs with IP address based SAN's
+ (via urllib3 which does support IP address based SAN's under Python 2).
+ 
+ [0]
+ https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4

** Also affects: neutron
   Importance: Undecided
       Status: New

** Changed in: neutron
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1790598

Title:
  metadata service calls to nova-api-metadata with IP based SAN's fails

Status in neutron:
  Fix Committed
Status in neutron package in Ubuntu:
  Triaged
Status in neutron source package in Xenial:
  Triaged
Status in neutron source package in Bionic:
  Triaged
Status in neutron source package in Cosmic:
  Triaged

Bug description:
  If the nova-api-metadata service is secured with a certificate that
  makes use of IP based SAN's, under Python 2 certificate validation
  will fail as the ssl module does not support use of IP addresses in
  cert SAN fields (and httplib2 which is used to make the request uses
  ssl directly).

  Master branch of neutron has switched (see [0]) to using requests to
  make these calls, supporting use of certs with IP address based SAN's
  (via urllib3 which does support IP address based SAN's under Python
  2).

  [0]
  https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions