Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1693821

Summary: [OSP 16] nova-novncproxy does not handle TCP RST cleanly when using SSL
Product: Red Hat OpenStack Reporter: melanie witt <mwitt>
Component: openstack-novaAssignee: melanie witt <mwitt>
Status: CLOSED ERRATA QA Contact: OSP DFG:Compute <osp-dfg-compute>
Severity: medium Docs Contact:
Priority: medium    
Version: 16.0 (Train)CC: jhakimra, jpadman, kchamart, lyarwood, mbooth, mwitt, nova-maint, sbauza, sgordon, vromanso
Target Milestone: Upstream M2Keywords: Triaged
Target Release: 16.0 (Train on RHEL 8.1)   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openstack-nova-20.0.1-0.20191025043858.390db63.el8ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1691580 Environment:
Last Closed: 2020-02-06 14:39:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1691580    
Bug Blocks: 1691581, 1691584, 1691585    

Description melanie witt 2019-03-28 17:30:57 UTC 
+++ This bug was initially created as a clone of Bug #1691580 +++

The following is paraphrased from the upstream bug report.
https://bugs.launchpad.net/nova/+bug/1816727/

This should be considered a security hardening bug as it could lead to a denial of service situation. It has been determined the same upstream.

Description of problem (nova-novncproxy):
With haproxy acting as a load balancer, but not terminating SSL. 

With that health check enabled, it was found the nova-novncproxy process CPU spiking and eventually causing the node to hang. 

It seems that the haproxy health checks initiate an SSL connection but then immediately send a TCP RST.

For most services this does not seem to be an issue, but for nova-novncproxy it repeatedly initializes NovaProxyRequestHandler which creates a full nova.compute.rpcapi.ComputeAPI instance which very quickly starts to consume significant CPU and overtake the host.
Comment 1 melanie witt 2019-04-03 17:34:32 UTC 
Change merged upstream.
Comment 6 errata-xmlrpc 2020-02-06 14:39:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:0283