hard-coded port in VNC websockify host header when horizon SSL is forced via load balancer

[karena]

We're using haproxy on 3 controllers to load balance and enforce SSL to Openstack APIs, so naturally, Horizon is configured without SSL, and SSL is enforced in HAPROXY via this line:

redirect scheme https if !{ ssl_fc }

When attempting to use the console, error 1006 was received (unable to connect). Using firefox developer tools, it was found that the "websockify" request includes port 80 hard-coded in the response (over https) and therefore, the redirect is bungled.
(see screenshot1).

After disabling the SSL enforcement on HAproxy for VNC
("redirect scheme https if !{ hdr(Host) -m beg vnc.alpha.cloud.ecg.so } !{ ssl_fc }"), the problem is resolved, but VNC continues unencrypted (see screenshot2).

Further details:

root@node-2:/etc/haproxy/conf.d# dpkg -l | grep nova
ii nova-api 1:2014.2-fuel6.0~mira19 OpenStack Compute - API frontend
ii nova-cert 1:2014.2-fuel6.0~mira19 OpenStack Compute - certificate management
ii nova-common 1:2014.2-fuel6.0~mira19 OpenStack Compute - common files
ii nova-conductor 1:2014.2-fuel6.0~mira19 OpenStack Compute - conductor service
ii nova-consoleauth 1:2014.2-fuel6.0~mira19 OpenStack Compute - Console Authenticator
ii nova-novncproxy 1:2014.2-fuel6.0~mira19 OpenStack Compute - NoVNC proxy
ii nova-objectstore 1:2014.2-fuel6.0~mira19 OpenStack Compute - object store
ii nova-scheduler 1:2014.2-fuel6.0~mira19 OpenStack Compute - virtual machine scheduler
ii python-nova 1:2014.2-fuel6.0~mira19 OpenStack Compute Python libraries
ii python-novaclient 1:2.20.0-fuel6.0~mira16 client library for OpenStack Compute API

[Vlad Okhrimenko (vokhrimenko)]

Hi @Karen! Can you please explain me - how I can reproduce this ? (step-by-step)
where I should add string "redirect scheme https if !{ ssl_fc }" (in haproxy.cfg ?)
How I can restart haproxy ?
Thanks!

[Vlad Okhrimenko (vokhrimenko)]

You wrote: "When attempting to use the console, error 1006 was received ...." -- did work another pages ?

[Stanislaw Bogatkin (sbogatkin)]

Hi, Karen. We, actually doesn't support SSL for Fuel 6.0, but in your case you have a problem that your Horizon served by usual Apache and it think that it plain HTTP - and it's actually right. You can try next trick:

In your haproxy set one more option for your horizon config:

reqadd X-Forwarded-Proto:\ https

Then in your Apache set:

setenvif X-Forwarded-Proto https HTTPS=1

for your horizon vhost. Then in Horizon local config set:
OPENSTACK_SSL_NO_VERIFY = True

cause I have not forced Horizon to work with SSL with strict hostname check (there is actually a bug in Horizon master now).

It should help you to work over SSL for pages in Horizon itself.
If you want to get VNC to instances working - you should set nova-nonvncproxy, not Horizon. You should (in case with HAProxy) set your nova-nonvncproxy service on controllers over ssl and then set option in nova.conf to point to right URL for vnc on computes too. After this actions your VNC should work right from Horizon over SSL.

[Timur Sufiev (tsufiev-x)]

Stanislaw, could you please post a link to the bug about Horizon's inability to allow strict SSL hostname check?

I'm closing this one as invalid.