Neutron/LBaaS/SSL

Terminating SSL connection on the load balancer and encrypting traffic back to the back end nodes, is a capabilities expected from modern load balancers and incorporated into many applications. This capability enables better certificate management and improved application based load balancing (ex: cookie based persistency, L7 Policies, etc.)

For giving LBaaS SSL termination ability, new extension called SSL will be added.

Rationale

The rational is giving user the ability to use SSL on LBaaS.

User should be able to apply SSL certificates on LBaaS and configure SSL on vip, front-end and back-end. Certificates chain should be supported for the Front-End certificate. Trusted certificates should be supported for the Back-End certificate.

User should be able to create SSL policies, SSL certificates and SSL trusted keys. Vip creation will remain with no change.

User should be able to associate vip with SSL policy and SSL certificates for front-end offload, and SSL trusted keys for back-end encryption.

SSL certificate creation will allow to enter the private key of the certificate if user will check a "remember" check box. In this case private key will be persistent in DB and user will not be required to enter it when associating certificate with a vip. If user chooses not to store private key in OpenStack DB, private key of the certificate will be requested every time when user will associate certificate with a vip.

API change

Vip CRUD API of the LBaaS plugin will not be changed.
New extension named "ssl" will be added, including SSL certificates resources, quota etc.
Vip association API with SSL policy, certificates and SSL trusted keys will be added to the LBaaS plugin

Resources change

vip resource remains the same

SSL policy (new)

*protocols
    List of comma-separated values from a list of allowed values (SSLv3, TLSv1, TLSv1.1, TLSv1.2), default=None
*cipher_suites:
    List of coma-separated values from allowed values list in format 
        <key exchange algorithm>_<bulk encryption algorithm>_<message authentication code>_<pseudorandom function>

SSL certificate (new)

public_key (PEM-formatted)
pass_phrase (not mandatory)
private_key (PEM-formatted, not mandatory)
certificate_chain (List of PEM-formatted public keys, not mandatory)

SSL trusted key (new)

public_key (PEM-formatted)

Data model change

vip database entity remains the same.

ssl_policy

ssl-policy-id
protocols (string 64)
cipher_suites (string 512)

ssl_certificate

ssl-certificate-id
public_key
pass_phrase
certificate_chain
private_key

ssl_trusted_key

ssl-trusted-key-id
key

vip_ssl_policy_assoc (one policy per vip)

vip-id
ssl-policy-id
status
desc

vip_ssl_certificate_assoc (multiple certificates per vip. certificate may be associated with multiple vips)

vip-id
ssl-certificate-id
status
desc.

vip_ssl_trusted_key_assoc (multiple trusted keys per vip. trusted key may be associated with multiple vips)

vip-id
ssl-trusted-key-id
status
desc.

DB Migration

No DB migration is needed

CLI Example

neutron lb-vip-create 
--subnet-id <subnet-id> --protocol <protocol> --protocol-port <tcp port> --name <name> --address <address> <pool-id>
--fe-ssl True --ssl-protocols SSLv3, TLSv1, TLSv1.1 --ciphers DES-CBC-SHA, EXP-DES-CBC-SHA
--public-key PUBLIC-KEY --private-key PRIVATE-KEY --passphrase PASSPHRASE --cert-chain INTERMEDIATE-KEY1, INTERMEDIATE-KEY2
--be-encryption True --be-trusted-keys KEY1,KEY2

Implementation Plan

Modifying LBaaS Vip resources' attribute map with new parameters
Modifying LBaaS Vip DB Model with new parameters
Modifying LBaaS Vip DB Model tests to account new parameters if needed
Modifying LBaaS HA-Proxy driver to support SSL

Update HA-Proxy to version 1.5 {TBD}

Support Matrix

Provider	Protocols	Cipher Suites	Certificate chain	FE client auth.	BE trusted keys	BE client cert.	SNI
HAProxy 1.5	SSLv3, TLSv1	As OpenSSL	Yes	Yes	No	No	Yes
Amazon EC2	SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2	As OpenSSL	Yes	No	Yes	No	No
OpenStack	SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2	As OpenSSL	Yes	No	Yes	No	No