[SRU]: check_hostname requires server_hostname when using container_infra endpoint with HTTPS

[Piotr Łodej]

Note: Original description below

[Impact]

* On Jammy Caracal, when endpoints are configured with TLS, the Magnum UI does not display any information about deployed resources, although they are created and visible using the command-line client. The dashboard displays errors about connecting to the backend

* This bug is introduced by a patch (d/p/0001-Update-VerifiedHTTPSConnection-for-Python-3.12.patch) [1], which was added to include Python 3.12 support by refactoring ssl context management but did not pass a server_hostname parameter to context.wrap_socket. This merged upstream during the Dalmatian cycle and was not backported to Caracal upstream. Therefore, upstream Caracal doesn't hit this bug, but also doesn't have the fix that properly supports Python 3.12. Nevertheless, the patch [1] is included in the Ubuntu Cloud Archive for Jammy-Caracal and the distro package for Noble, so Ubuntu's Caracal packages are affected (distro and UCA).

* This bug was fixed upstream in [2], which merged during the Epoxy cycle, and was backported to Dalmatian (but not upstream Caracal, since upstream Caracal doesn't have [1] and, therefore, isn't affected by this bug). However, Ubuntu's Dalmatian and Epoxy packages (both distro packages and UCA) don't have this fix.

* Therefore, the affected Ubuntu packages are the python-magnumclient shipped as on Noble, Oracular (EOL) and Plucky, and then for the Ubuntu Cloud Archive (UCA) the affected packages are python-magnumclient for Jammy Caracal, Noble Dalmatian, and Noble-Epoxy.

[1] https://opendev.org/openstack/python-magnumclient/commit/83a10d4d49388fb680b450c728cd1e62d18e8672
[2] https://opendev.org/openstack/python-magnumclient/commit/ecdcc0697cd53592b54078175001755169436761

[Test Plan]

* Deploy Openstack by any method. I will use juju

* Deploy magnum services and setup relations

juju deploy magnum --channel=2024.1/stable magnum
juju relate magnum keystone
juju relate magnum vault
juju relate magnum:ampq rabbitmq-server:ampq
juju relate magnum:shared-db magnum-mysql-router:shared-db

juju deploy magnum-dashboard --channel=2024.1/stable magnum-dashboard
juju relate magnum-dashboard keystone
juju relate magnum-dashboard vault
juju relate magnum-dashboard openstack-dashboard

* Configure magnum
juju run magnum/0 domain-setup

* Open openstack dashboard, and go to the cluster management pane

* See error message and that there's observability of any magnum resources without the patch

* Upgrade to proposed, and see a properly populated dashboard

[What can go wrong]

* While this fixes an issue with SNI in TLS handshakes, in environments where SNI is not configured correctly or TLS certs are not distributed properly, this patch may break the environment and expose those issues.

====================================
Original description:

Openstack: 2024.2
Ubuntu: 22.04
Deployment Tool: Kolla Ansible

Steps to reproduce:
From version 2024.2 of Magnum when using Horizon (navigate to Project->Container Infra->Cluster or Cluster Templates) "/api/container_infra/*" endpoints return 500 Internal Server Error "check_hostname requires server_hostname". Container Infra Endpoint is using HTTPS

Horizon error log:
error invoking apiclient
Traceback (most recent call last):
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/openstack_dashboard/api/rest/utils.py", line 128, in _wrapped
    data = function(self, request, *args, **kw)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnum_ui/api/rest/magnum.py", line 302, in get
    result = magnum.cluster_list(request)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnum_ui/api/magnum.py", line 193, in cluster_list
    return magnumclient(request).clusters.list(limit, marker, sort_key,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnumclient/v1/baseunit.py", line 82, in list
    return self._list(self._path(path), self.__class__.template_name)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnumclient/common/base.py", line 117, in _list
    resp, body = self.api.json_request('GET', url)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnumclient/common/httpclient.py", line 240, in json_request
    resp, body_iter = self._http_request(url, method, **kwargs)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnumclient/common/httpclient.py", line 187, in _http_request
    conn.request(method, conn_url, **kwargs)
  File "/usr/lib/python3.12/http/client.py", line 1336, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/lib/python3.12/http/client.py", line 1382, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.12/http/client.py", line 1331, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.12/http/client.py", line 1091, in _send_output
    self.send(msg)
  File "/usr/lib/python3.12/http/client.py", line 1035, in send
    self.connect()
  File "/var/lib/kolla/venv/lib/python3.12/site-packages/magnumclient/common/httpclient.py", line 310, in connect
    self.sock = context.wrap_socket(sock)
                ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/ssl.py", line 455, in wrap_socket
    return self.sslsocket_class._create(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/ssl.py", line 970, in _create
    raise ValueError("check_hostname requires server_hostname")
ValueError: check_hostname requires server_hostname
Internal Server Error: /api/container_infra/clusters/

After analysis the problem exists in python-magnumclient from version 4.6.0 (https://opendev.org/openstack/python-magnumclient/commit/5d8fd3840052e07418e007f336deb99fd58b7e92)

According to documentation when using check_hostname with CERT_REQUIRED you must also pass server_hostname to wrap_socket
(Python 3.12 doc reference: https://docs.python.org/3.12/library/ssl.html#ssl.SSLContext.check_hostname

[Jake Yip (waipengyip)]

I haven't had the chance to look at this yet. If you are able to fix this, can you send up a patch please?

[Esmerlin Joel Mieses (symph0nic)]

Changes propposed on https://review.opendev.org/c/openstack/python-magnumclient/+/937537

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/python-magnumclient 4.8.1 Epoxy release.

[Lars Erik Pedersen (pedersen-larserik)]

Hi,

We're observing this in Caracal (2024.1) as well. Both on 22.04 and 24.04. python-magnumclient 4.4.0

[Pravin Mohan (pravinm)]

Hi,

Did the fix back ported to Jammy-Caracal release. We are still hitting this bug.

[Nobuto Murata (nobuto)]

> This issue was fixed in the openstack/python-magnumclient 4.8.1 Epoxy release.

Isn't Ubuntu plucky the release that requires the fix first before backporting it to noble-epoxy, noble-dalmatian, noble, jammy-caracal?

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "noble-lp2091103.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Nobuto Murata (nobuto)]

It's fixed in 4.9.0 and 4.8.1 in the upstream.
https://opendev.org/openstack/python-magnumclient/commit/ecdcc0697cd53592b54078175001755169436761

[Bryan Fraschetti (bryanfraschetti)]

Patch for python-magnumclient package in Plucky distro

[Bryan Fraschetti (bryanfraschetti)]

Patch for python-magnumclient in Noble Epoxy in the UCA

[Bryan Fraschetti (bryanfraschetti)]

Patch for python-magnumclient in Noble Dalmatian in the UCA

[Bryan Fraschetti (bryanfraschetti)]

Patch for python-magnumclient for Noble distro

[Bryan Fraschetti (bryanfraschetti)]

Patch for python-magnumclient in Jammy Caracal in the UCA

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.