Update of TERMINATED_HTTPS Listener allows unsetting of TLS certificates

[notandy]

Problem

A new TERMINATED_HTTPS listener cannot be created without TLS Certificate reference or SNI reference.

But api allows updating an existing one without or with empty TLS references

$ curl -X POST https://loadbalancer-3.qa-de-1.cloud.sap/v2.0/lbaas/listeners -H "Accept: application/json" -H "Content-Type: application/json" -H "X-Auth-Token: $OS_AUTH_TOKEN" -d '{"listener": {"loadbalancer_id": "e5d2f132-7f57-4a17-95f3-b8d7b53936f8", "protocol": "TERMINATED_HTTPS", "protocol_port": 443, "admin_state_up": true, "default_tls_container_ref": null}}'

{"faultcode": "Client", "faultstring": "Validation failure: An SNI or default certificate container reference must be provided for TERMINATED_HTTPS protocol listeners.", "debuginfo": null}

vs.

$ curl -X PUT https://loadbalancer-3.qa-de-1.cloud.sap/v2.0/lbaas/listeners/68e98bcd-6e8d-4f5e-a016-a9967be36f43 -H "Accept: application/json" -H "Content-Type: application/json" -H "User-Agent: openstacksdk/0.58.0 keystoneauth1/4.3.1 python-requests/2.26.0 CPython/3.9.10" -H "X-Auth-Token: $OS_AUTH_TOKEN" -d '{"listener": {"default_tls_container_ref": null}}'

{"listener": {"id": "68e98bcd-6e8d-4f5e-a016-a9967be36f43", "name": "listener_29", "description": "", "provisioning_status": "ERROR", "operating_status": "ONLINE", "admin_state_up": true, "protocol": "TERMINATED_HTTPS", "protocol_port": 29, "connection_limit": -1, "default_tls_container_ref": null, "sni_container_refs": [], "project_id": "e9141fb24eee4b3e9f25ae69cda31132", "default_pool_id": "1c688dfe-de15-4a5d-89e4-7234325fa41d", "l7policies": [], "insert_headers": {}, "created_at": "2021-01-05T13:16:59", "updated_at": "2022-01-28T14:49:19", "loadbalancers": [{"id": "1811c3fc-2c7c-4f29-8ced-f7d085caf52d"}], "timeout_client_data": 50000, "timeout_member_connect": 5000, "timeout_member_data": 50000, "timeout_tcp_inspect": 0, "tags": [], "client_ca_tls_container_ref": null, "client_authentication": "NONE", "client_crl_container_ref": null, "allowed_cidrs": null, "tls_ciphers": null, "tenant_id": "e9141fb24eee4b3e9f25ae69cda31132"}}

Proposed fix

add condition to https://github.com/openstack/octavia/blob/master/octavia/api/v2/controllers/listener.py#L434 that ensures terminated_https listeners always have at least one tls certificat ref or sni ref.

Also consider to create an upstream bug.