diff --git a/sys-cluster/nova/Manifest b/sys-cluster/nova/Manifest index a3b3ba70..833af68e 100644 --- a/sys-cluster/nova/Manifest +++ b/sys-cluster/nova/Manifest @@ -1,2 +1,3 @@ DIST nova-2013.1.3.tar.gz 5780115 SHA256 f7c25186920daccb16867c5fd272318beb8cc076e5a55f79b5906618ef2724f4 SHA512 3de29f1cf0789285c7600796588058f056d4196138584bb5ec13a0ea034bbc0569d116a668db67022e302b29995af5960093af1103996269d73dccd62a5dd238 WHIRLPOOL ebb06733a710764004f99da2a69d5479cdd50e35da6d0992233ab9ca0a7a5854a678c5d184d40f97a66fa3abd052b1e6de4629963dd58292f677707997e56239 DIST nova-2013.2.tar.gz 8909222 SHA256 55a51f8d8b6c7b0ba6f8ff9c48604bb82a90bdc3f21460ed325d1cee2dfea95a SHA512 655d6f5a4ab9ddfb741a920417061808bf22521c967d324f0fa1856c801795969df6f4982362bce26836975c09e7f41e25575309cde5c6788ed32e69304381ea WHIRLPOOL d88272c8101426ed4930a924b254d045a5c965f867573039b72b51f7aa5ba2daa47f54332f63e09e781dd22ca55c142acdb432dc92ad366e13b56138ff8f3186 +DIST nova-2014.1.tar.gz 7951303 SHA256 c8fc0e03a826b2b659c77e24737b267588f2c71e3bea9527c71e55a2c76a54d9 SHA512 0893d1ebbf91798cc737e8df97dd2d44fffe4a6163c99f5e63d0f3f6a9ba1c3d1c9ef38e217b74e8da62dd8d5cd91f3be32da2ec062c642d192e32fd96cdf650 WHIRLPOOL c5fcc88912e5eb21aaa9908759324dd37c3670e37edca8562ba1301431fdf8cc40699152fe3ee3a48a495922f4b11846a804ee990d13d3d037726aa520cc0af0 diff --git a/sys-cluster/nova/files/2014.1-CVE-2014-2573-1.patch b/sys-cluster/nova/files/2014.1-CVE-2014-2573-1.patch new file mode 100644 index 00000000..8fc53fa9 --- /dev/null +++ b/sys-cluster/nova/files/2014.1-CVE-2014-2573-1.patch @@ -0,0 +1,103 @@ +From fb030283bed9e41a0343581fa21b81b2ebb07f15 Mon Sep 17 00:00:00 2001 +From: Xiaoyan Ding +Date: Mon, 24 Feb 2014 16:17:46 +0800 +Subject: [PATCH] VMWare: add power off vm before detach disk during unrescue + +Non Hot Plug type disk like IDE can only be detached when the VM is power off. + +Change-Id: Ib1f387a41abe2b52357854e90c2535ebb7b43f18 +Close-bug: #1279199 +(cherry picked from commit 1e1915aaaca38b5691794e0e052a42b9d95dd3c2) +--- + nova/tests/virt/vmwareapi/test_driver_api.py | 27 ++++++++++++++++++++++----- + nova/virt/vmwareapi/vmops.py | 21 ++++++++++++++++----- + 2 files changed, 38 insertions(+), 10 deletions(-) + +diff --git a/nova/tests/virt/vmwareapi/test_driver_api.py b/nova/tests/virt/vmwareapi/test_driver_api.py +index fb60335..c1481aa 100644 +--- a/nova/tests/virt/vmwareapi/test_driver_api.py ++++ b/nova/tests/virt/vmwareapi/test_driver_api.py +@@ -1273,14 +1273,31 @@ def test_rescue_with_config_drive(self): + + def test_unrescue(self): + self._rescue() ++ self.test_vm_ref = None ++ self.test_device_name = None + +- def fake_detach_disk_from_vm(*args, **kwargs): +- pass ++ def fake_power_off_vm_ref(vm_ref): ++ self.test_vm_ref = vm_ref ++ self.assertIsNotNone(vm_ref) + +- self.stubs.Set(self.conn._volumeops, "detach_disk_from_vm", +- fake_detach_disk_from_vm) ++ def fake_detach_disk_from_vm(vm_ref, instance, ++ device_name, destroy_disk=False): ++ self.test_device_name = device_name ++ info = self.conn.get_info(instance) ++ self._check_vm_info(info, power_state.SHUTDOWN) + +- self.conn.unrescue(self.instance, None) ++ with contextlib.nested( ++ mock.patch.object(self.conn._vmops, "_power_off_vm_ref", ++ side_effect=fake_power_off_vm_ref), ++ mock.patch.object(self.conn._volumeops, "detach_disk_from_vm", ++ side_effect=fake_detach_disk_from_vm), ++ ) as (poweroff, detach): ++ self.conn.unrescue(self.instance, None) ++ poweroff.assert_called_once_with(self.test_vm_ref) ++ detach.assert_called_once_with(self.test_vm_ref, mock.ANY, ++ self.test_device_name) ++ self.test_vm_ref = None ++ self.test_device_name = None + info = self.conn.get_info({'name': 1, 'uuid': self.uuid, + 'node': self.instance_node}) + self._check_vm_info(info, power_state.RUNNING) +diff --git a/nova/virt/vmwareapi/vmops.py b/nova/virt/vmwareapi/vmops.py +index 0c28a29..30f8373 100644 +--- a/nova/virt/vmwareapi/vmops.py ++++ b/nova/virt/vmwareapi/vmops.py +@@ -1159,12 +1159,26 @@ def unrescue(self, instance): + "get_dynamic_property", vm_rescue_ref, + "VirtualMachine", "config.hardware.device") + device = vm_util.get_vmdk_volume_disk(hardware_devices, path=vmdk_path) ++ self._power_off_vm_ref(vm_rescue_ref) + self._volumeops.detach_disk_from_vm(vm_rescue_ref, r_instance, device) + self.destroy(r_instance, None, instance_name=instance_name) + self._power_on(instance) + ++ def _power_off_vm_ref(self, vm_ref): ++ """Power off the specifed vm. ++ ++ :param vm_ref: a reference object to the VM. ++ """ ++ poweroff_task = self._session._call_method( ++ self._session._get_vim(), ++ "PowerOffVM_Task", vm_ref) ++ self._session._wait_for_task(poweroff_task) ++ + def power_off(self, instance): +- """Power off the specified instance.""" ++ """Power off the specified instance. ++ ++ :param instance: nova.objects.instance.Instance ++ """ + vm_ref = vm_util.get_vm_ref(self._session, instance) + + pwr_state = self._session._call_method(vim_util, +@@ -1173,10 +1187,7 @@ def power_off(self, instance): + # Only PoweredOn VMs can be powered off. + if pwr_state == "poweredOn": + LOG.debug(_("Powering off the VM"), instance=instance) +- poweroff_task = self._session._call_method( +- self._session._get_vim(), +- "PowerOffVM_Task", vm_ref) +- self._session._wait_for_task(poweroff_task) ++ self._power_off_vm_ref(vm_ref) + LOG.debug(_("Powered off the VM"), instance=instance) + # Raise Exception if VM is suspended + elif pwr_state == "suspended": +-- +1.9.3 + diff --git a/sys-cluster/nova/files/2014.1-CVE-2014-2573-2.patch b/sys-cluster/nova/files/2014.1-CVE-2014-2573-2.patch new file mode 100644 index 00000000..990b6a88 --- /dev/null +++ b/sys-cluster/nova/files/2014.1-CVE-2014-2573-2.patch @@ -0,0 +1,182 @@ +From ffcb17678c7e5409a1f12a09945b18e8879a677d Mon Sep 17 00:00:00 2001 +From: Gary Kotton +Date: Thu, 13 Mar 2014 06:53:58 -0700 +Subject: [PATCH] VMware: ensure rescue instance is deleted when instance is + deleted + +If the user creates a rescue instance and then proceeded to delete +the original instance then the rescue instance would still be up +and running on the backend. + +This patch ensures that the rescue instance is cleaned up if +necessary. + +The vmops unrescue method has a new parameter indicating if +the original VM should be powered on. + +Closes-bug: 1269418 +(cherry picked from commit efb66531bc37ee416778a70d46c657608ca767af) + +Conflicts: + + nova/virt/vmwareapi/vmops.py + +Change-Id: I3c1d0b1d003392b306094b80ea1ac99377441fbf +--- + nova/tests/virt/vmwareapi/test_driver_api.py | 26 +++++++++++++ + nova/virt/vmwareapi/vmops.py | 55 ++++++++++++++++++++-------- + 2 files changed, 65 insertions(+), 16 deletions(-) + +diff --git a/nova/tests/virt/vmwareapi/test_driver_api.py b/nova/tests/virt/vmwareapi/test_driver_api.py +index c1481aa..63f0c59 100644 +--- a/nova/tests/virt/vmwareapi/test_driver_api.py ++++ b/nova/tests/virt/vmwareapi/test_driver_api.py +@@ -34,6 +34,7 @@ + from nova.compute import api as compute_api + from nova.compute import power_state + from nova.compute import task_states ++from nova.compute import vm_states + from nova import context + from nova import exception + from nova.openstack.common import jsonutils +@@ -1191,6 +1192,31 @@ def test_get_info(self): + 'node': self.instance_node}) + self._check_vm_info(info, power_state.RUNNING) + ++ def destroy_rescued(self, fake_method): ++ self._rescue() ++ with ( ++ mock.patch.object(self.conn._volumeops, "detach_disk_from_vm", ++ fake_method) ++ ): ++ self.instance['vm_state'] = vm_states.RESCUED ++ self.conn.destroy(self.context, self.instance, self.network_info) ++ inst_path = '[%s] %s/%s.vmdk' % (self.ds, self.uuid, self.uuid) ++ self.assertFalse(vmwareapi_fake.get_file(inst_path)) ++ rescue_file_path = '[%s] %s-rescue/%s-rescue.vmdk' % (self.ds, ++ self.uuid, ++ self.uuid) ++ self.assertFalse(vmwareapi_fake.get_file(rescue_file_path)) ++ ++ def test_destroy_rescued(self): ++ def fake_detach_disk_from_vm(*args, **kwargs): ++ pass ++ self.destroy_rescued(fake_detach_disk_from_vm) ++ ++ def test_destroy_rescued_with_exception(self): ++ def fake_detach_disk_from_vm(*args, **kwargs): ++ raise exception.NovaException('Here is my fake exception') ++ self.destroy_rescued(fake_detach_disk_from_vm) ++ + def test_destroy(self): + self._create_vm() + info = self.conn.get_info({'uuid': self.uuid, +diff --git a/nova/virt/vmwareapi/vmops.py b/nova/virt/vmwareapi/vmops.py +index 30f8373..831da48 100644 +--- a/nova/virt/vmwareapi/vmops.py ++++ b/nova/virt/vmwareapi/vmops.py +@@ -29,6 +29,7 @@ + from nova import compute + from nova.compute import power_state + from nova.compute import task_states ++from nova.compute import vm_states + from nova import context as nova_context + from nova import exception + from nova.openstack.common import excutils +@@ -985,13 +986,9 @@ def _delete(self, instance, network_info): + except Exception as exc: + LOG.exception(exc, instance=instance) + +- def destroy(self, instance, network_info, destroy_disks=True, +- instance_name=None): +- """Destroy a VM instance. Steps followed are: +- 1. Power off the VM, if it is in poweredOn state. +- 2. Un-register a VM. +- 3. Delete the contents of the folder holding the VM related data. +- """ ++ def _destroy_instance(self, instance, network_info, destroy_disks=True, ++ instance_name=None): ++ # Destroy a VM instance + # Get the instance name. In some cases this may differ from the 'uuid', + # for example when the spawn of a rescue instance takes place. + if not instance_name: +@@ -1029,8 +1026,9 @@ def destroy(self, instance, network_info, destroy_disks=True, + "UnregisterVM", vm_ref) + LOG.debug(_("Unregistered the VM"), instance=instance) + except Exception as excep: +- LOG.warn(_("In vmwareapi:vmops:destroy, got this exception" +- " while un-registering the VM: %s") % str(excep)) ++ LOG.warn(_("In vmwareapi:vmops:_destroy_instance, got this " ++ "exception while un-registering the VM: %s"), ++ excep) + # Delete the folder holding the VM related content on + # the datastore. + if destroy_disks and datastore_name: +@@ -1053,15 +1051,39 @@ def destroy(self, instance, network_info, destroy_disks=True, + {'datastore_name': datastore_name}, + instance=instance) + except Exception as excep: +- LOG.warn(_("In vmwareapi:vmops:destroy, " +- "got this exception while deleting" +- " the VM contents from the disk: %s") +- % str(excep)) ++ LOG.warn(_("In vmwareapi:vmops:_destroy_instance, " ++ "got this exception while deleting " ++ "the VM contents from the disk: %s"), ++ excep) + except Exception as exc: + LOG.exception(exc, instance=instance) + finally: + vm_util.vm_ref_cache_delete(instance_name) + ++ def destroy(self, instance, network_info, destroy_disks=True): ++ """Destroy a VM instance. ++ ++ Steps followed for each VM are: ++ 1. Power off, if it is in poweredOn state. ++ 2. Un-register. ++ 3. Delete the contents of the folder holding the VM related data. ++ """ ++ # If there is a rescue VM then we need to destroy that one too. ++ LOG.debug(_("Destroying instance"), instance=instance) ++ if instance['vm_state'] == vm_states.RESCUED: ++ LOG.debug(_("Rescue VM configured"), instance=instance) ++ try: ++ self.unrescue(instance, power_on=False) ++ LOG.debug(_("Rescue VM destroyed"), instance=instance) ++ except Exception: ++ rescue_name = instance['uuid'] + self._rescue_suffix ++ self._destroy_instance(instance, network_info, ++ destroy_disks=destroy_disks, ++ instance_name=rescue_name) ++ self._destroy_instance(instance, network_info, ++ destroy_disks=destroy_disks) ++ LOG.debug(_("Instance destroyed"), instance=instance) ++ + def pause(self, instance): + msg = _("pause not supported for vmwareapi") + raise NotImplementedError(msg) +@@ -1139,7 +1161,7 @@ def rescue(self, context, instance, network_info, image_meta): + adapter_type, disk_type, vmdk_path) + self._power_on(instance, vm_ref=rescue_vm_ref) + +- def unrescue(self, instance): ++ def unrescue(self, instance, power_on=True): + """Unrescue the specified instance.""" + # Get the original vmdk_path + vm_ref = vm_util.get_vm_ref(self._session, instance) +@@ -1161,8 +1183,9 @@ def unrescue(self, instance): + device = vm_util.get_vmdk_volume_disk(hardware_devices, path=vmdk_path) + self._power_off_vm_ref(vm_rescue_ref) + self._volumeops.detach_disk_from_vm(vm_rescue_ref, r_instance, device) +- self.destroy(r_instance, None, instance_name=instance_name) +- self._power_on(instance) ++ self._destroy_instance(r_instance, None, instance_name=instance_name) ++ if power_on: ++ self._power_on(instance) + + def _power_off_vm_ref(self, vm_ref): + """Power off the specifed vm. +-- +1.9.3 + diff --git a/sys-cluster/nova/files/nova.initd b/sys-cluster/nova/files/nova.initd new file mode 100644 index 00000000..14fae14d --- /dev/null +++ b/sys-cluster/nova/files/nova.initd @@ -0,0 +1,20 @@ +#!/sbin/runscript +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +description="Starts ${SVCNAME} service for OpenStack" + +command=/usr/bin/${SVCNAME} +command_background=yes +pidfile=/var/run/nova/${SVCNAME}.pid +required_files=/etc/nova/nova.conf +start_stop_daemon_args="--quiet --user ${NOVA_USER:-nova}" + +depend() { + need net +} + +start_pre() { + checkpath --directory --owner ${NOVA_USER:-nova}:${NOVA_GROUP:-nova} --mode 0775 ${NOVA_RUN:-/var/run/nova} + checkpath --directory --owner ${NOVA_USER:-nova}:${NOVA_GROUP:-nova} --mode 0775 ${NOVA_RUN:-/var/lock/nova} +} diff --git a/sys-cluster/nova/files/nova.sudoersd b/sys-cluster/nova/files/nova.sudoersd new file mode 100644 index 00000000..f15b3285 --- /dev/null +++ b/sys-cluster/nova/files/nova.sudoersd @@ -0,0 +1,3 @@ +Defaults:nova !requiretty + +nova ALL = (root) NOPASSWD: /usr/bin/nova-rootwrap diff --git a/sys-cluster/nova/nova-2014.1-r2.ebuild b/sys-cluster/nova/nova-2014.1-r2.ebuild new file mode 100644 index 00000000..172a4bc1 --- /dev/null +++ b/sys-cluster/nova/nova-2014.1-r2.ebuild @@ -0,0 +1,127 @@ +# Copyright 1999-2014 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.1-r2.ebuild,v 1.3 2014/06/09 04:56:40 prometheanfire Exp $ + +EAPI=5 +PYTHON_COMPAT=( python2_7 ) + +inherit distutils-r1 eutils multilib user + +DESCRIPTION="A cloud computing fabric controller (main part of an IaaS system) written in Python." +HOMEPAGE="https://launchpad.net/nova" +SRC_URI="http://launchpad.net/${PN}/icehouse/${PV}/+download/${P}.tar.gz" + +LICENSE="Apache-2.0" +SLOT="0" +KEYWORDS="~amd64 ~x86" +IUSE="+compute +kvm +network +novncproxy sqlite mysql postgres xen" +REQUIRED_USE="|| ( mysql postgres sqlite ) + compute? ( || ( kvm xen ) )" + +DEPEND="dev-python/setuptools[${PYTHON_USEDEP}] + >=dev-python/pbr-0.6[${PYTHON_USEDEP}] +