SSL setup for multiple projects is broken

[Dr. Jens Harbott]

When running a devstack environment with "enable_plugin tls-proxy", the unversioned cinder endpoint is returning incorrect links. E.g. when we have the cinder v1 endpoint https://192.168.1.4/volume/v1, a curl at https://192.168.1.4/volume/ instead shows https://192.168.1.4/v1/.

[Dr. Jens Harbott (j-harbott)]

This also affects other projects:

Neutron https://192.168.1.4:9696/ links to http://192.168.1.4:19696/v2.0/
Nova https://192.168.0.30/compute/ links to http://192.168.0.30/compute/v2/

[Dr. Jens Harbott (j-harbott)]

There are also failing tempest tests associated with the neutron issue:

neutron.tests.tempest.api.test_networks.NetworksSearchCriteriaTest.test_list_pagination_with_href_links
and a couple of similar ones:

neutron.tests.tempest.api.test_routers.RoutersSearchCriteriaTest.test_list_pagination_with_href_links[id-40804af8-c25d-45f8-b8a8-b4c70345215d]
----------------------------------------------------------------------------------------------------------------------------------------------

Captured traceback:
~~~~~~~~~~~~~~~~~~~
    Traceback (most recent call last):
      File "/opt/stack/neutron/neutron/tests/tempest/api/test_routers.py", line 310, in test_list_pagination_with_href_links
        self._test_list_pagination_with_href_links()
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 548, in inner
        return f(self, *args, **kwargs)
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 539, in inner
        return f(self, *args, **kwargs)
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 726, in _test_list_pagination_with_href_links
        self._test_list_pagination_iteratively(self._list_all_with_hrefs)
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 655, in _test_list_pagination_iteratively
        len(expected_resources), sort_args
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 689, in _list_all_with_hrefs
        uri = self.get_bare_url(prev_links['next'])
      File "/opt/stack/neutron/neutron/tests/tempest/api/base.py", line 595, in get_bare_url
        self.assertTrue(url.startswith(base_url))
      File "/usr/local/lib/python2.7/dist-packages/unittest2/case.py", line 702, in assertTrue
        raise self.failureException(msg)
    AssertionError: False is not true

In order to fix these, I need to:

- a2enmod headers
- add 'RequestHeader set X-Forwarded-Proto "https"' in /etc/apache2/sites-available/neutron-tls-proxy.conf
- add "[oslo_middleware] enable_proxy_headers_parsing = true" in /etc/neutron/neutron.conf
- add "[oslo_middleware] enable_proxy_headers_parsing = true" in /etc/neutron/nova.conf

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/498828

[Sean Dague (sdague)]

This is really only a devstack fix

[Dr. Jens Harbott (j-harbott)]

@Sean: IMO this bug is also about these projects not having functional tests that verify the correctness of the versioned links returned by their unversioned endpoint, which is why I wanted to let them at least see this issue.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/498828
Committed: https://git.openstack.org/cgit/openstack-dev/devstack/commit/?id=411c34da69f423059a04431a542be2b1b7a65f38
Submitter: Jenkins
Branch: master

commit 411c34da69f423059a04431a542be2b1b7a65f38
Author: Jens Harbott <email address hidden>
Date: Tue Aug 29 14:40:26 2017 +0000

    Fix URLs when running with tls-proxy enabled

    Various services are returning broken links when running behind
    tls-proxy. These issues can be fixed by setting the X-Forwarded-Proto
    header in the apache config and letting oslo_middleware parse it.

    Change-Id: Ibe5dbdc4644ec812f0435f59319666fc336c195a
    Partial-Bug: 1713731