BREACH attack is fixed on horizon side, gzip could be enable when using tls

[Jeffrey Zhang]

breach attack is fixed by https://review.openstack.org/#/c/596549/ on horizon size, gzip cloud be enable when using tls.

* http://breachattack.com/
* https://wiki.openstack.org/wiki/OSSN/OSSN-0037
* https://www.acunetix.com/blog/articles/breach-attack/

[Mark Goddard (mgoddard)]

https://review.opendev.org/#/c/657520/1

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/657520
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=06a8161a18df142be19b5030a970e7e002c68d81
Submitter: Zuul
Branch: master

commit 06a8161a18df142be19b5030a970e7e002c68d81
Author: Jeffrey Zhang <email address hidden>
Date: Tue May 7 11:28:06 2019 +0800

    Enable deflate when using tls for horizon

    deflate is disable because of breach attach[0] issue. But it has be
    fixed on horizon size through[1], so we cloud enable deflate all the
    time.

    compress application/json too in default.

    [0] https://wiki.openstack.org/wiki/OSSN/OSSN-0037
    [1] https://review.openstack.org/#/c/596549/

    Change-Id: I364c8a71633fac846dbaac8eaa0b78191e6d7d0e
    Closes-Bug: #1827976

[Dincer Celik (dincercelik)]

This should be backported to stable/rocky.

[Mark Goddard (mgoddard)]

Dincer, feel free to cherry pick the change to stable branches. The Gerrit
UI allows this.
Mark

On Fri, 28 Jun 2019, 18:21 Dincer Celik, <email address hidden> wrote:

> This should be backported to stable/rocky.
>
> --
> You received this bug notification because you are subscribed to kolla-
> ansible.
> Matching subscriptions: kolla-ansible firehose
> https://bugs.launchpad.net/bugs/1827976
>
> Title:
> BREACH attack is fixed on horizon side, gzip could be enable when
> using tls
>
> Status in kolla-ansible:
> Fix Released
> Status in kolla-ansible stein series:
> Fix Released
>
> Bug description:
> breach attack is fixed by https://review.openstack.org/#/c/596549/
> on horizon size, gzip cloud be enable when using tls.
>
> * http://breachattack.com/
> * https://wiki.openstack.org/wiki/OSSN/OSSN-0037
> * https://www.acunetix.com/blog/articles/breach-attack/
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/kolla-ansible/+bug/1827976/+subscriptions
>

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.opendev.org/668237

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/stein
Review: https://review.opendev.org/668290

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/668290
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=6b77e5a92724af9b627c50d74c4c262ac6f95aa5
Submitter: Zuul
Branch: stable/stein

commit 6b77e5a92724af9b627c50d74c4c262ac6f95aa5
Author: Jeffrey Zhang <email address hidden>
Date: Tue May 7 11:28:06 2019 +0800

    Enable deflate when using tls for horizon

    deflate is disable because of breach attach[0] issue. But it has be
    fixed on horizon size through[1], so we cloud enable deflate all the
    time.

    compress application/json too in default.

    [0] https://wiki.openstack.org/wiki/OSSN/OSSN-0037
    [1] https://review.openstack.org/#/c/596549/

    Change-Id: I364c8a71633fac846dbaac8eaa0b78191e6d7d0e
    Closes-Bug: #1827976
    (cherry picked from commit 06a8161a18df142be19b5030a970e7e002c68d81)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 8.0.0.0rc2 release candidate.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/668237
Committed: https://git.openstack.org/cgit/openstack/kolla-ansible/commit/?id=5ed551c1fdcfba68e6e0ae9458fa7b5540fdc28e
Submitter: Zuul
Branch: stable/rocky

commit 5ed551c1fdcfba68e6e0ae9458fa7b5540fdc28e
Author: Jeffrey Zhang <email address hidden>
Date: Tue May 7 11:28:06 2019 +0800

    Enable deflate when using tls for horizon

    deflate is disable because of breach attach[0] issue. But it has be
    fixed on horizon size through[1], so we cloud enable deflate all the
    time.

    compress application/json too in default.

    [0] https://wiki.openstack.org/wiki/OSSN/OSSN-0037
    [1] https://review.openstack.org/#/c/596549/

    Change-Id: I364c8a71633fac846dbaac8eaa0b78191e6d7d0e
    Closes-Bug: #1827976
    (cherry picked from commit 06a8161a18df142be19b5030a970e7e002c68d81)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 7.1.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla-ansible 9.0.0.0rc1 release candidate.