Bug 1504299 - VMWare WebMKS consoles do not proxy sessions as VNC sessions do in CloudForms
Summary: VMWare WebMKS consoles do not proxy sessions as VNC sessions do in CloudForms
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: UI - OPS
Version: 5.8.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: GA
: 5.10.0
Assignee: Dávid Halász
QA Contact: Kedar Kulkarni
URL:
Whiteboard:
Depends On:
Blocks: 1520964 1523404
TreeView+ depends on / blocked
 
Reported: 2017-10-19 21:26 UTC by Robb Manes
Modified: 2021-06-10 13:18 UTC (History)
13 users (show)

Fixed In Version: 5.10.0.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1520964 1523404 (view as bug list)
Environment:
Last Closed: 2018-06-21 20:25:20 UTC
Category: Bug
Cloudforms Team: VMware
Target Upstream Version:
Embargoed:
kkulkarn: automate_bug+


Attachments (Terms of Use)

Description Robb Manes 2017-10-19 21:26:51 UTC
Description of problem:
In VMWare environments beyond ESXi 6.X, VNC is no longer supported as a console protocol, in favor of WebMKS.  In a CloudForms environment where the UI appliances are exposed publically with no access to hypervisors, and workers have direct connections to the hypervisors themselves, when using VNC it was easy to proxy the VNC session from a worker appliance which had direct connections to the host to the UI, so that the VM could still be utilized via console.

Using WebMKS, it appears from the UI worker (and from the resulting page it attempts to open) there is no method to proxy these connections currently in CloudForms, which in an environment where only the worker appliances have direct host-access, means console access is effectively removed.

VNC handler methods call SystemConsole.launch_proxy_if_not_local if the session requires proxying.  Noting remote_console_webmks_acquire_ticket and validate_remote_console_webmks_support, as these appear to only work from the context of the local appliance.

If I have missed anything or misunderstood the situation please let me know, thanks.

Version-Release number of selected component (if applicable):
CFME 5.8.1.5

How reproducible:
Every time

Steps to Reproduce:
1. Connect over VNC, and session will proxy from worker to UI
2. Connect over WebMKS, and UI will attempt to direct connect (and fail if it has no access to the subnet that the hypervisor is on or is blocked by a firewall)

Actual results:
WebMKS does not proxy

Expected results:
WebMKS should proxy as VNC does

Comment 1 Adam Grare 2017-10-20 14:15:02 UTC
The web console proxy is handled by the UI team, reassigning.

Comment 5 CFME Bot 2017-12-05 09:13:10 UTC
New commit detected on ManageIQ/manageiq-ui-classic/master:
https://github.com/ManageIQ/manageiq-ui-classic/commit/e901ebea2e6a6c700bdc6c6593ff78ca7ca6bc32

commit e901ebea2e6a6c700bdc6c6593ff78ca7ca6bc32
Author:     Dávid Halász <dhalasz>
AuthorDate: Mon Nov 20 10:37:38 2017 +0100
Commit:     Dávid Halász <dhalasz>
CommitDate: Mon Nov 20 14:34:33 2017 +0100

    Adjust the remote console views/controllers for WebMKS proxying
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1504299

 app/controllers/vm_remote.rb                 | 15 +++++++--------
 app/views/vm_common/console_webmks.html.haml | 11 ++++++++++-
 2 files changed, 17 insertions(+), 9 deletions(-)

Comment 6 CFME Bot 2017-12-05 14:10:34 UTC
New commit detected on ManageIQ/manageiq-providers-vmware/master:
https://github.com/ManageIQ/manageiq-providers-vmware/commit/60cc8bff27e3745001b5ea781ef9fd63ccd9fa79

commit 60cc8bff27e3745001b5ea781ef9fd63ccd9fa79
Author:     Dávid Halász <skateman>
AuthorDate: Fri Nov 17 17:22:58 2017 +0100
Commit:     Dávid Halász <skateman>
CommitDate: Mon Nov 20 10:24:57 2017 +0100

    Proxy WebMKS connections through the WebSocket worker
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1504299

 .../providers/vmware/infra_manager/vm/remote_console.rb | 17 +++++++++++++++--
 .../vmware/infra_manager/vm/remote_console_spec.rb      |  4 ++--
 2 files changed, 17 insertions(+), 4 deletions(-)

Comment 7 CFME Bot 2017-12-05 14:16:48 UTC
New commit detected on ManageIQ/manageiq/master:
https://github.com/ManageIQ/manageiq/commit/0526e5f4e48a52372f6c567827bcf52b168049ed

commit 0526e5f4e48a52372f6c567827bcf52b168049ed
Author:     Dávid Halász <dhalasz>
AuthorDate: Fri Nov 17 12:14:34 2017 +0100
Commit:     Dávid Halász <dhalasz>
CommitDate: Mon Dec 4 13:49:15 2017 +0100

    Wrap the right side of the websocket proxy in classes
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1504299

 lib/websocket_proxy.rb           | 25 ++++++-------------------
 lib/websocket_right.rb           | 14 ++++++++++++++
 lib/websocket_socket.rb          |  9 +++++++++
 lib/websocket_ssl_socket.rb      | 22 ++++++++++++++++++++++
 spec/lib/websocket_proxy_spec.rb | 16 ++++++++--------
 5 files changed, 59 insertions(+), 27 deletions(-)
 create mode 100644 lib/websocket_right.rb
 create mode 100644 lib/websocket_socket.rb
 create mode 100644 lib/websocket_ssl_socket.rb

Comment 8 CFME Bot 2017-12-05 14:16:54 UTC
New commit detected on ManageIQ/manageiq/master:
https://github.com/ManageIQ/manageiq/commit/3edd55f177e78963f9a69ed12aa164aed5b5e41a

commit 3edd55f177e78963f9a69ed12aa164aed5b5e41a
Author:     Dávid Halász <dhalasz>
AuthorDate: Fri Nov 17 13:02:36 2017 +0100
Commit:     Dávid Halász <dhalasz>
CommitDate: Mon Dec 4 13:49:39 2017 +0100

    Add support for proxying WebMKS connections through WebsocketWorker
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1504299

 lib/websocket_proxy.rb  |  9 ++++++++-
 lib/websocket_webmks.rb | 30 ++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 lib/websocket_webmks.rb


Note You need to log in before you can comment on or make changes to this bug.