[Bug 1790598] Re: metadata service calls to nova-api-metadata with IP based SAN's fails
OpenStack Infra
1790598 at bugs.launchpad.net
Tue Sep 18 02:26:49 UTC 2018
Reviewed: https://review.openstack.org/599537
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=c28e4963b75414f093e432c9934f8658a4e56b98
Submitter: Zuul
Branch: stable/rocky
commit c28e4963b75414f093e432c9934f8658a4e56b98
Author: James Page <james.page at ubuntu.com>
Date: Mon Aug 20 15:22:10 2018 +0100
metadata: use requests for comms with nova api
httplib2 makes use of the ssl module provided by Python; under Python 2,
the ssl module does not support IP addresses as subject alternate names
(SAN's) which although an optional part of the associated RFC, is awkward
to work with in environments where certificate management approaches
rely on use of IP addresses in SAN's.
The requests module is more than happy to deal with this scenario; switch
to requests in preference of httplib2 for metadata proxy calls.
httplib2 is retained as its used elsewhere in the codebase.
Closes-Bug: 1790598
Change-Id: Ife4adf09ddbf7116da2f8596c80aed53fb6790df
(cherry picked from commit 7e0dd2f18d4919964655cfce7a282d1c5c131fc4)
** Tags added: in-stable-rocky
--
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to neutron in Ubuntu.
https://bugs.launchpad.net/bugs/1790598
Title:
metadata service calls to nova-api-metadata with IP based SAN's fails
Status in neutron:
Fix Committed
Status in neutron package in Ubuntu:
Fix Released
Status in neutron source package in Xenial:
Triaged
Status in neutron source package in Bionic:
Triaged
Status in neutron source package in Cosmic:
Fix Released
Bug description:
If the nova-api-metadata service is secured with a certificate that
makes use of IP based SAN's, under Python 2 certificate validation
will fail as the ssl module does not support use of IP addresses in
cert SAN fields (and httplib2 which is used to make the request uses
ssl directly).
Master branch of neutron has switched (see [0]) to using requests to
make these calls, supporting use of certs with IP address based SAN's
(via urllib3 which does support IP address based SAN's under Python
2).
[0]
https://github.com/openstack/neutron/commit/7e0dd2f18d4919964655cfce7a282d1c5c131fc4
To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1790598/+subscriptions
More information about the Ubuntu-openstack-bugs
mailing list