openstack/devstack
Code Issues Proposed changes

Set specified header size when enabling tls-proxy

Browse Source 
As part of getting swift's functional testing to work properly through
the tls-proxy we need to increase the allowed request header size in
apache. This was a non issue without tls proxy as requests hit the
eventlet webserver directly which was configured via the swift config
which sets this relatively large limit (by default devstack configures
swift to have a header size limit of 16384).

Now we pass in an optional parameter to start_tls_proxy that includes
the desired header size. lib/swift then passes in the value it also
configures in its swift.conf.

If not explicitly set we default to 8190 which is apache2's default.

Change-Id: Ib2811c8d3cbb49cf94b70294788526b15a798edd
This commit is contained in:
Clark Boylan 2017-05-31 13:17:22 -07:00
parent a718b5ea92
commit f4dbd12f78
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/swift
View File

@ -837,7 +837,7 @@ function start_swift {
if is_service_enabled tls-proxy; then
local proxy_port=${SWIFT_DEFAULT_BIND_PORT}
start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT
start_tls_proxy swift '*' $proxy_port $SERVICE_HOST $SWIFT_DEFAULT_BIND_PORT_INT $SWIFT_MAX_HEADER_SIZE
fi
run_process s-proxy "$SWIFT_BIN_DIR/swift-proxy-server ${SWIFT_CONF_DIR}/proxy-server.conf -v"

7
lib/tls
View File

@ -485,6 +485,8 @@ function start_tls_proxy {
local f_port=$3
local b_host=$4
local b_port=$5
# 8190 is the default apache size.
local f_header_size=${6:-8190}
tune_apache_connections
@ -512,6 +514,11 @@ $listen_string
# ('Connection aborted.', BadStatusLine("''",)) error
KeepAlive Off
# This increase in allowed request header sizes is required
# for swift functional testing to work with tls enabled. It is 2 bytes
# larger than the apache default of 8190.
LimitRequestFieldSize $f_header_size
<Location />
ProxyPass http://$b_host:$b_port/ retry=0 nocanon
ProxyPassReverse http://$b_host:$b_port/