no rate limiting for incoming requests

[Xav Paice]

Customer has performed a security scan of their deployment, and reported that the Dashboard has no rate limiting in place for the openstack-dashboard application. Their comment:

DESCRIPTION:
The team found that the applications would allow a user to send an unlimited number of requests to
the application without getting blocked or timed out. Allowing unlimited request could be used to
enumerate variables, perform automatic MySQL injection and cross-site scripting attacks or could be
used to perform a denial of service attack on the application. During testing no vulnerability was
found using this issue lowering the risk rating to a low.
EVIDENCE:
The team was able to run multiple scans without getting slowed down or blocked.

Can we go about rate limiting this application via haproxy settings or similar, in a configurable manner?

The URL reported was the standard https port, not the apache port (433).

[Xav Paice (xavpaice)]

Subscribed field-medium as this is a commercial requirement, for a site running Bionic/queens.

[Xav Paice (xavpaice)]

Added charm-hacluster as this could be implemented via haproxy and therefore handle rate limiting for multiple openstack applications.

[James Page (james-page)]

I think this makes a nice security addition to the dashboard charm; it could also apply to API services which also use haproxy as part of their service chain infront of the actual service daemon.

If we do implement this I'd like for it to be disabled by default; enabling should turn on a set of sensible defaults that have been more widely reviewed and we need to make sure sufficient configuration options are exposed to allow tuning.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/850644

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/850644
Committed: https://opendev.org/openstack/charm-openstack-dashboard/commit/c0f87087615e4744e67c2f6dbda3a6b0ed18d3c5
Submitter: "Zuul (22348)"
Branch: master

commit c0f87087615e4744e67c2f6dbda3a6b0ed18d3c5
Author: Mert Kırpıcı <email address hidden>
Date: Wed Jul 20 13:55:38 2022 +0000

    Introduce source IP based rate limiting

    Since we are running haproxy in L4, we are tracking the incoming
    byte rate from client IPs and rejecting TCP connections in a
    sliding window.

    This approach limits the incoming HTTP requests however image uploading
    through the horizon web app is unaffected.

    Change-Id: Ie40d28acb2dc2983fc9edbbeacfd671b380a8f6d
    Closes-Bug: #1836514
    Signed-off-by: Mert Kırpıcı <email address hidden>