diff --git a/octavia/common/utils.py b/octavia/common/utils.py index f4260d74ef..ec66066721 100644 --- a/octavia/common/utils.py +++ b/octavia/common/utils.py @@ -20,6 +20,7 @@ import base64 import hashlib +import re import socket import netaddr @@ -45,7 +46,9 @@ def base64_sha1_string(string_to_hash): # break backwards compatibility with existing loadbalancers. hash_str = hashlib.sha1(string_to_hash.encode('utf-8')).digest() # nosec b64_str = base64.b64encode(hash_str, str.encode('_-', 'ascii')) - return b64_str.decode('UTF-8') + b64_sha1 = b64_str.decode('UTF-8') + # https://github.com/haproxy/haproxy/issues/644 + return re.sub(r"^-", "x", b64_sha1) def get_network_driver(): diff --git a/octavia/tests/unit/common/test_utils.py b/octavia/tests/unit/common/test_utils.py index 832f6ee6f8..b98e5a321d 100644 --- a/octavia/tests/unit/common/test_utils.py +++ b/octavia/tests/unit/common/test_utils.py @@ -60,3 +60,18 @@ class TestConfig(base.TestCase): utils.ip_netmask_to_cidr('10.0.0.1', '255.255.240.0')) self.assertEqual('10.0.0.0/30', utils.ip_netmask_to_cidr( '10.0.0.1', '255.255.255.252')) + + def test_base64_sha1_string(self): + str_to_sha1 = [ + # no special cases str (no altchars) + ('77e7d60d-e137-4246-8a84-a25db33571cd', + 'iVZVQ5AKmk2Ae0uGLP0Ue4OseRM='), + # backward compat amphorae with - in str[1:] + ('9c6e5f27-a0da-4ceb-afe5-5a81230be42e', + 'NjrNgt3Egl-H5ScbYM5ChtUH3M8='), + # sha1 would start with -, now replaced with x + ('4db4a3cf-9fef-4057-b1fd-b2afbf7a8a0f', + 'xxqntK8jJ_gE3QEmh-D1-XgCW_E=') + ] + for str, sha1 in str_to_sha1: + self.assertEqual(sha1, utils.base64_sha1_string(str)) diff --git a/releasenotes/notes/fix-peer-name-prefix-hypen-e74a87e9a01b4f4c.yaml b/releasenotes/notes/fix-peer-name-prefix-hypen-e74a87e9a01b4f4c.yaml new file mode 100644 index 0000000000..0f883eab8f --- /dev/null +++ b/releasenotes/notes/fix-peer-name-prefix-hypen-e74a87e9a01b4f4c.yaml @@ -0,0 +1,10 @@ +--- +upgrade: + - | + An amphora image update is recommended to pick up a workaround to an + HAProxy issue where it would fail to reload on configuration change should + the local peer name start with "-x". +fixes: + - | + Workaround an HAProxy issue where it would fail to reload on configuration + change should the local peer name start with "-x".