)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"39621ee1e7b083eb7b5388c8e1d61cae77c0b5dd","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":1,"id":"b4fd47b0_e2905084","updated":"2024-05-16 14:25:04.000000000","message":"TODOs:\n- Tests\n- Release Note","commit_id":"53b9190ab1cd155acf0485e9ebb4d5a7940e3242"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"60d6d507b4366d0f2d5bd41cea230c848a7d0889","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5bb80907_b0338bc2","in_reply_to":"b4fd47b0_e2905084","updated":"2024-05-21 18:09:30.000000000","message":"Done","commit_id":"53b9190ab1cd155acf0485e9ebb4d5a7940e3242"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"ea14a9afb957279edabc2fce511ea26d8d5b88ee","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"09698a90_145346a5","in_reply_to":"b4fd47b0_e2905084","updated":"2024-05-21 13:59:06.000000000","message":"Done.","commit_id":"53b9190ab1cd155acf0485e9ebb4d5a7940e3242"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4638a5e80f11846a1684618c81e188a7cc27274b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":18,"id":"85817cc5_0e4df7e9","updated":"2024-06-05 22:06:48.000000000","message":"Just two minor comments","commit_id":"0bea8f4292e557b2dfcd7311a7737cf5684e890f"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"fcdb71f8cb79b4a6b73a39ef7e05f7e38fdc831b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"5547291d_b9b1612a","updated":"2024-08-21 23:45:37.000000000","message":"LGTM","commit_id":"4a5b851607a80ed0ff6fab143637b4e8e5baa245"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"b54f9efd7a237f495097323919e83766067e02a4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":19,"id":"e1eb3eb4_ea15147b","updated":"2024-09-12 08:23:56.000000000","message":"Something is wrong with the logic\n\nI created a pool and a member with\n```\nopenstack loadbalancer pool create --listener listener1 --protocol HTTPS --lb-algorithm ROUND_ROBIN --enable-tls --tls-ciphers TLS_AES_128_CCM_SHA256 --name pool1\nopenstack loadbalancer member create --address 10.0.1.12 --protocol-port 8080 pool1 --name member1\n```\n\nThe generated haproxy.cfg file contains\n```\nserver abc59eef-ba9e-4df2-8ec4-09861e8dd680 10.0.1.12:8080 weight 1 ssl verify none sni ssl_fc_sni ciphers TLS_AES_128_CCM_SHA256 ciphersuites TLS_AES_128_CCM_SHA256 no-sslv3 no-tlsv10 no-tlsv11 alpn h2,http/1.1,http/1.0\n```\n\nhaproxy rejects it with:\n\n```\nSep 12 10:23:58 amphora-052bc3fb-0f35-4978-8e19-c811336cba69 amphora-agent[666]: 2024-09-12 10:23:58.564 666 ERROR octavia.amphorae.backends.agent.api_server.loadbalancer [-] Failed to verify haproxy file: Command \u0027[\u0027haproxy\u0027, \u0027-c\u0027, \u0027-L\u0027, \u0027ZGm0xgnGT4gRkNy7UjMBQxZ2KPk\u0027, \u0027-f\u0027, \u0027/var/lib/octavia/994c48db-c1e2-40a7-8df9-06771944c935/haproxy.cfg.new\u0027, \u0027-f\u0027, \u0027/var/lib/octavia/haproxy-default-user-group.conf\u0027]\u0027 returned non-zero exit status 1. [NOTICE]   (2283) : haproxy version is 2.4.22-f8e3218#012[NOTICE]   (2283) : path to executable is /usr/sbin/haproxy#012[ALERT]    (2283) : Proxy \u00273ddbdc00-de41-460c-96d9-5c24a3589635:54ffb532-6e1d-4309-a98a-4f73eb96bd3c\u0027, server \u0027abc59eef-ba9e-4df2-8ec4-09861e8dd680\u0027 [/var/lib/octavia/994c48db-c1e2-40a7-8df9-06771944c935/haproxy.cfg.new:38] : unable to set SSL cipher list to \u0027TLS_AES_128_CCM_SHA256\u0027.#012[WARNING]  (2283) : Removing incomplete section \u0027peers 994c48dbc1e240a78df906771944c935_peers\u0027 (no peer named \u0027ZGm0xgnGT4gRkNy7UjMBQxZ2KPk\u0027).#012[ALERT]    (2283) : Fatal errors found in configuration.#012: subprocess.CalledProcessError: Command \u0027[\u0027haproxy\u0027, \u0027-c\u0027, \u0027-L\u0027, \u0027ZGm0xgnGT4gRkNy7UjMBQxZ2KPk\u0027, \u0027-f\u0027, \u0027/var/lib/octavia/994c48db-c1e2-40a7-8df9-06771944c935/haproxy.cfg.new\u0027, \u0027-f\u0027, \u0027/var/lib/octavia/haproxy-default-user-group.conf\u0027]\u0027 returned non-zero exit status 1.\n```","commit_id":"4a5b851607a80ed0ff6fab143637b4e8e5baa245"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"50f72684712b4877de194a9130255b0b99ffb9ad","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":19,"id":"8d149ef0_00fb7a8a","in_reply_to":"e1eb3eb4_ea15147b","updated":"2024-09-12 14:31:54.000000000","message":"Thanks for testing this. The logic works because the generated configuration is exactly as I expected it to be.\n\nYou didn\u0027t define the tls_versions, but I can see from the generated config that tlsv1.2 and tlsv1.3 are enabled. If this cipher you defined is supported by both versions it should be added to both the `ciphers` option for tlsv1.2 and `ciphersuites` for tlsv1.3 if I understood the HAProxy documentation correctly.[1]\n\nI have a theory about what\u0027s wrong, but I\u0027ll need to verify.\n`openssl ciphers -tls1_3 -s | grep TLS_AES_128_CCM_SHA256` prints this cipher, while `openssl ciphers -tls1_2 -s | grep TLS_AES_128_CCM_SHA256` does not. So, I think the error here is the assumption that it is supported in both versions, and I definitely checked that TLS_AES_128_CCM_SHA256 is supported in both versions in general when I wrote that patch. Maybe only openssl does not support it in 1.2.\n\n[1]: https://docs.haproxy.org/1.8/configuration.html#ciphersuites%20%28Bind%20options%29","commit_id":"4a5b851607a80ed0ff6fab143637b4e8e5baa245"},{"author":{"_account_id":29244,"name":"Gregory Thiemonge","email":"gthiemon@redhat.com","username":"gthiemonge"},"change_message_id":"7f02aceeaeb8e4ede4891066a483afe2d0aaf453","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":20,"id":"7ec09b9b_7f69f2b1","updated":"2026-03-31 14:35:10.000000000","message":"recheck TrafficOperationsScenarioTest.test_backup_member [374.762775s] ... FAILED","commit_id":"e5296858c45f23e9820250e7b23d34d4537405e7"}],"octavia/common/config.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"ace0dcad972e2dd6fcab15c20cdbe3e0fafe834c","unresolved":true,"context_lines":[{"line_number":137,"context_line":"                help\u003d_(\u0027List of ALPN protocols to use for new TLS-enabled \u0027"},{"line_number":138,"context_line":"                       \u0027pools.\u0027)),"},{"line_number":139,"context_line":"    cfg.ListOpt(\u0027tls1_2_unsupported_ciphers\u0027,"},{"line_number":140,"context_line":"                default\u003d[lib_consts.ALPN_PROTOCOL_HTTP_2,"},{"line_number":141,"context_line":"                         lib_consts.ALPN_PROTOCOL_HTTP_1_1,"},{"line_number":142,"context_line":"                         lib_consts.ALPN_PROTOCOL_HTTP_1_0],"},{"line_number":143,"context_line":"                help\u003d_(\u0027List of ciphersuits that are not supported by TLSv1.2 \u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"e817c105_4ad00c63","line":140,"updated":"2024-05-16 18:48:28.000000000","message":"These aren\u0027t ciphers","commit_id":"068c69ce38e90cf29ae44f8723b3752e61a4774b"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"7bbea1c510a6e049e9800c12334984dd89c99c64","unresolved":false,"context_lines":[{"line_number":137,"context_line":"                help\u003d_(\u0027List of ALPN protocols to use for new TLS-enabled \u0027"},{"line_number":138,"context_line":"                       \u0027pools.\u0027)),"},{"line_number":139,"context_line":"    cfg.ListOpt(\u0027tls1_2_unsupported_ciphers\u0027,"},{"line_number":140,"context_line":"                default\u003d[lib_consts.ALPN_PROTOCOL_HTTP_2,"},{"line_number":141,"context_line":"                         lib_consts.ALPN_PROTOCOL_HTTP_1_1,"},{"line_number":142,"context_line":"                         lib_consts.ALPN_PROTOCOL_HTTP_1_0],"},{"line_number":143,"context_line":"                help\u003d_(\u0027List of ciphersuits that are not supported by TLSv1.2 \u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"9c954e1a_74ac7819","line":140,"in_reply_to":"e817c105_4ad00c63","updated":"2024-05-16 18:57:21.000000000","message":"Classic copy-paste mistake and forgot to update.","commit_id":"068c69ce38e90cf29ae44f8723b3752e61a4774b"}],"octavia/common/jinja/haproxy/combined_listeners/jinja_cfg.py":[{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4d899c241aac9a09b3f5ba3791470b46f5c71592","unresolved":true,"context_lines":[{"line_number":363,"context_line":"            tls_enabled \u003d True"},{"line_number":364,"context_line":"            if listener.tls_ciphers is not None:"},{"line_number":365,"context_line":"                # Cipher combinations that only TLSv1.3 supports"},{"line_number":366,"context_line":"                tlsv1_3_only_ciphers \u003d {"},{"line_number":367,"context_line":"                    \"TLS_AES_128_GCM_SHA256\","},{"line_number":368,"context_line":"                    \"TLS_AES_256_GCM_SHA384\","},{"line_number":369,"context_line":"                    \"TLS_CHACHA20_POLY1305_SHA256\","}],"source_content_type":"text/x-python","patch_set":4,"id":"4d776be1_21239474","line":366,"updated":"2024-05-16 14:52:45.000000000","message":"I think we should centralize these in the constants or maybe even pull them out to the config file so operators can update the list without an Octavia release. What do you think?","commit_id":"a0051c1097d550b0f99bf618cb8b8d02e2a6586b"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"aa77f67e74fed496a21679a3ff0e850361a52012","unresolved":true,"context_lines":[{"line_number":363,"context_line":"            tls_enabled \u003d True"},{"line_number":364,"context_line":"            if listener.tls_ciphers is not None:"},{"line_number":365,"context_line":"                # Cipher combinations that only TLSv1.3 supports"},{"line_number":366,"context_line":"                tlsv1_3_only_ciphers \u003d {"},{"line_number":367,"context_line":"                    \"TLS_AES_128_GCM_SHA256\","},{"line_number":368,"context_line":"                    \"TLS_AES_256_GCM_SHA384\","},{"line_number":369,"context_line":"                    \"TLS_CHACHA20_POLY1305_SHA256\","}],"source_content_type":"text/x-python","patch_set":4,"id":"d59dea72_8de786e2","line":366,"in_reply_to":"4d776be1_21239474","updated":"2024-05-16 17:41:23.000000000","message":"Yes, I was thinking about moving them to octavia-lib constants. On the other hand, they are only used here, so an octavia-lib change seems like an overkill just for this.\n\nI also thought about separating cipher configs for TLS\u003c1.3 and TLS\u003e\u003d1.3. I assume HAProxy devs had a good reason to introduce the new option, although it is not obvious to me. Honestly, I think HAProxy made a bad choice calling that new option ciphersuites and keeping the ciphers option for pre TLS1.3 only. These similar names create confusion IMO as they require documentation text to understand the difference.\n\nThe Octavia listener API currently has a `tls_ciphers` option. How would we name a new TLS1.3+ option? `tlsv1.3_ciphers`? Or maybe `tls_ciphersuites` to be consistent with HAProxy but repeat their naming mistake (IMO)?\n\nAlso, I found that octavia.conf has options `default_listener_ciphers` and `default_pool_ciphers`. I guess we would then have a TLS1.3 ciphers default option there as well?","commit_id":"a0051c1097d550b0f99bf618cb8b8d02e2a6586b"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"ea14a9afb957279edabc2fce511ea26d8d5b88ee","unresolved":false,"context_lines":[{"line_number":363,"context_line":"            tls_enabled \u003d True"},{"line_number":364,"context_line":"            if listener.tls_ciphers is not None:"},{"line_number":365,"context_line":"                # Cipher combinations that only TLSv1.3 supports"},{"line_number":366,"context_line":"                tlsv1_3_only_ciphers \u003d {"},{"line_number":367,"context_line":"                    \"TLS_AES_128_GCM_SHA256\","},{"line_number":368,"context_line":"                    \"TLS_AES_256_GCM_SHA384\","},{"line_number":369,"context_line":"                    \"TLS_CHACHA20_POLY1305_SHA256\","}],"source_content_type":"text/x-python","patch_set":4,"id":"19269169_df32367a","line":366,"in_reply_to":"a845304c_c1c938fe","updated":"2024-05-21 13:59:06.000000000","message":"Done","commit_id":"a0051c1097d550b0f99bf618cb8b8d02e2a6586b"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"60d6d507b4366d0f2d5bd41cea230c848a7d0889","unresolved":false,"context_lines":[{"line_number":363,"context_line":"            tls_enabled \u003d True"},{"line_number":364,"context_line":"            if listener.tls_ciphers is not None:"},{"line_number":365,"context_line":"                # Cipher combinations that only TLSv1.3 supports"},{"line_number":366,"context_line":"                tlsv1_3_only_ciphers \u003d {"},{"line_number":367,"context_line":"                    \"TLS_AES_128_GCM_SHA256\","},{"line_number":368,"context_line":"                    \"TLS_AES_256_GCM_SHA384\","},{"line_number":369,"context_line":"                    \"TLS_CHACHA20_POLY1305_SHA256\","}],"source_content_type":"text/x-python","patch_set":4,"id":"d3b0f201_9f97922e","line":366,"in_reply_to":"a845304c_c1c938fe","updated":"2024-05-21 18:09:30.000000000","message":"Done","commit_id":"a0051c1097d550b0f99bf618cb8b8d02e2a6586b"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"554c77bc2ccdcfe8171f2805c6807d8d88a81f38","unresolved":true,"context_lines":[{"line_number":363,"context_line":"            tls_enabled \u003d True"},{"line_number":364,"context_line":"            if listener.tls_ciphers is not None:"},{"line_number":365,"context_line":"                # Cipher combinations that only TLSv1.3 supports"},{"line_number":366,"context_line":"                tlsv1_3_only_ciphers \u003d {"},{"line_number":367,"context_line":"                    \"TLS_AES_128_GCM_SHA256\","},{"line_number":368,"context_line":"                    \"TLS_AES_256_GCM_SHA384\","},{"line_number":369,"context_line":"                    \"TLS_CHACHA20_POLY1305_SHA256\","}],"source_content_type":"text/x-python","patch_set":4,"id":"a845304c_c1c938fe","line":366,"in_reply_to":"d59dea72_8de786e2","updated":"2024-05-16 17:55:59.000000000","message":"Sorry, I misunderstood your comment. You meant adding user configuration for the constants only. Yes, that sounds like a good idea to me.","commit_id":"a0051c1097d550b0f99bf618cb8b8d02e2a6586b"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4638a5e80f11846a1684618c81e188a7cc27274b","unresolved":true,"context_lines":[{"line_number":90,"context_line":"            CONF.api_settings.tls1_2_unsupported_ciphers.split(\":\"))"},{"line_number":91,"context_line":"        # All combinations TLSv1.3 supports"},{"line_number":92,"context_line":"        self._tlsv1_3_ciphers \u003d self._tlsv1_3_only_ciphers | {"},{"line_number":93,"context_line":"            \"TLS_AES_128_CCM_SHA256\","},{"line_number":94,"context_line":"            \"TLS_AES_128_CCM_8_SHA256\","},{"line_number":95,"context_line":"        }"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"a31f69d2_07a10364","line":93,"updated":"2024-06-05 22:06:48.000000000","message":"It would be nice to have all of these cipher lists in the constants file so they are easy to find.","commit_id":"0bea8f4292e557b2dfcd7311a7737cf5684e890f"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"60179c5a4e735d6858d5346a23bc6b670fbbfc79","unresolved":false,"context_lines":[{"line_number":90,"context_line":"            CONF.api_settings.tls1_2_unsupported_ciphers.split(\":\"))"},{"line_number":91,"context_line":"        # All combinations TLSv1.3 supports"},{"line_number":92,"context_line":"        self._tlsv1_3_ciphers \u003d self._tlsv1_3_only_ciphers | {"},{"line_number":93,"context_line":"            \"TLS_AES_128_CCM_SHA256\","},{"line_number":94,"context_line":"            \"TLS_AES_128_CCM_8_SHA256\","},{"line_number":95,"context_line":"        }"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"f9b15ef9_9a43f086","line":93,"in_reply_to":"a31f69d2_07a10364","updated":"2024-06-11 07:27:09.000000000","message":"Done","commit_id":"0bea8f4292e557b2dfcd7311a7737cf5684e890f"}],"octavia/tests/unit/common/jinja/haproxy/combined_listeners/test_jinja_cfg.py":[{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"ea14a9afb957279edabc2fce511ea26d8d5b88ee","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":9,"id":"573f38ad_5f272906","updated":"2024-05-21 13:59:06.000000000","message":"If you wonder why this file contains lots of unrelated f-string changes: It\u0027s in order to prevent merge conflicts with the f-string conversion patch (but there might be conflicts anyway).","commit_id":"85dbc868f4c305052e36dbc5c205f25d198eaa1e"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"20e73217f03e1ccc98ae2e959098a056eb058f0e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"1a88a01e_b686db94","in_reply_to":"573f38ad_5f272906","updated":"2024-06-03 16:31:37.000000000","message":"Done","commit_id":"85dbc868f4c305052e36dbc5c205f25d198eaa1e"},{"author":{"_account_id":11628,"name":"Michael Johnson","email":"johnsomor@gmail.com","username":"johnsom"},"change_message_id":"4638a5e80f11846a1684618c81e188a7cc27274b","unresolved":true,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"CONF \u003d cfg.CONF"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DEFAULT_TLS_CIPHERS \u003d \u0027:\u0027.join("},{"line_number":32,"context_line":"    sorted(set(constants.CIPHERS_OWASP_SUITE_B.split(\u0027:\u0027)) -"},{"line_number":33,"context_line":"           set(constants.DEFAULT_TLS1_2_UNSUPPORTED_CIPHERS.split(\u0027:\u0027))))"},{"line_number":34,"context_line":"DEFAULT_TLS_CIPHERSUITES \u003d \u0027:\u0027.join("}],"source_content_type":"text/x-python","patch_set":18,"id":"eeadce1f_c169c978","line":31,"updated":"2024-06-05 22:06:48.000000000","message":"Do these need to be globals? I only see one class here.","commit_id":"0bea8f4292e557b2dfcd7311a7737cf5684e890f"},{"author":{"_account_id":34429,"name":"Tom Weininger","email":"dienste@weinimo.de","username":"tweining"},"change_message_id":"60179c5a4e735d6858d5346a23bc6b670fbbfc79","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"CONF \u003d cfg.CONF"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"DEFAULT_TLS_CIPHERS \u003d \u0027:\u0027.join("},{"line_number":32,"context_line":"    sorted(set(constants.CIPHERS_OWASP_SUITE_B.split(\u0027:\u0027)) -"},{"line_number":33,"context_line":"           set(constants.DEFAULT_TLS1_2_UNSUPPORTED_CIPHERS.split(\u0027:\u0027))))"},{"line_number":34,"context_line":"DEFAULT_TLS_CIPHERSUITES \u003d \u0027:\u0027.join("}],"source_content_type":"text/x-python","patch_set":18,"id":"fe5bdb24_a5525737","line":31,"in_reply_to":"eeadce1f_c169c978","updated":"2024-06-11 07:27:09.000000000","message":"They don\u0027t need to be globals. I guess the only reason I\u0027ve put them here was to save a bit of typing, and as you say this module consists of a only a single class only so there shouldn\u0027t be confusion about where it is used. I moved them inside the class now. It makes it clearer that they are only relevant inside the class.","commit_id":"0bea8f4292e557b2dfcd7311a7737cf5684e890f"}]}