Enable X-Forward-For header for better Keystone access logging

[Adam Heczko]

Observed on Fuel master node:
release: "8.0"
  openstack_version: "2015.1.0-8.0"
  api: "1.0"
  build_number: "217"
  build_id: "217"

Problem description:
It was observed that HAProxy doesn't pass http header "X-Forward-For" for keystone preventing placing into keystone access log IP addresses initiating connection, and rather placing there HAPorxy IP address .
This has security implications, as one would like to analyze Keystone access logs to discover failed login attempts and discover their IP source address (source of requests) will be unable to get real source of incoming to Keystone requests.

Solution proposal:
- add to Keystone haproxy config file option 'option forwardfor'
- add to Keystone apache2 config file option to appropriate log 'X-Forward-for' (substitute %h with %X-Forward-For IP header), like for example:

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
CustomLog "logs/access.log_with_X-Forward-For" #added here for example purposes only

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/257517

[Bogdan Dobrelya (bogdando)]

Raised to high as it has security impact, which is tracing sources of keystone requests

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/257517
Committed: https://git.openstack.org/cgit/openstack/fuel-library/commit/?id=755d845e5d56569312eb838fa0397328913bcf3b
Submitter: Jenkins
Branch: master

commit 755d845e5d56569312eb838fa0397328913bcf3b
Author: Alexey Deryugin <email address hidden>
Date: Mon Dec 14 21:08:52 2015 +0300

    Enable X-Forward-For header for better Keystone access logging

    It was observed that HAProxy doesn't pass http header "X-Forward-For"
    for keystone preventing placing into keystone access log IP addresses
    initiating connection, and rather placing there HAPorxy IP address.
    This has security implications, as one would like to analyze Keystone
    access logs to discover failed login attempts and discover their IP
    source address (source of requests) will be unable to get real source
    of incoming to Keystone requests.

    Change-Id: I4139919e10d50abcb77b0521efa0037345f9582f
    Closes-Bug: #1521228

[Timur Nurlygayanov (tnurlygayanov)]

I can see new option in haproxy configuration file but can't see any errors about incorrect login attepts on my environment with MOS 8.0 RC1. Steps to verify are not clear, fix is applied, status changed to Fix Released.