summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVu Tran <vu.tran@windriver.com>2014-08-20 10:45:11 -0400
committerBruce Ashfield <bruce.ashfield@windriver.com>2014-08-22 16:27:48 -0400
commit0f225491c7e34a52b1e65b6af2482c9f16472cac (patch)
tree177a6295c300bb3c609f8d042e1ccb5395d403d4
parentbf5bf7c6356c6771b3ff1849bf606bb1c5b18a43 (diff)
downloadmeta-cloud-services-0f225491c7e34a52b1e65b6af2482c9f16472cac.tar.gz
core: update core components to latest havana/stable releases
The patch CVE-2014-0006-swift-1265665.patch is already in the latest Swift havana/stable release, so dropping it. Signed-off-by: Vu Tran <vu.tran@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
-rw-r--r--meta-openstack/recipes-devtools/python/python-cinder_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-glance_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-heat_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-horizon_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-keystone_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-neutron_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-nova_git.bb4
-rw-r--r--meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch59
-rw-r--r--meta-openstack/recipes-devtools/python/python-swift_git.bb5
9 files changed, 16 insertions, 76 deletions
diff --git a/meta-openstack/recipes-devtools/python/python-cinder_git.bb b/meta-openstack/recipes-devtools/python/python-cinder_git.bb
index acabfa0..3124600 100644
--- a/meta-openstack/recipes-devtools/python/python-cinder_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-cinder_git.bb
@@ -20,8 +20,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
20 file://cinder-builtin-tests-config-location.patch \ 20 file://cinder-builtin-tests-config-location.patch \
21 " 21 "
22 22
23SRCREV="81259f36f57e91b31009fbd209ea2a07a2ceb213" 23SRCREV="34179609ed312ba65c8ac7ca78ea8fec39b28987"
24PV="2013.2.3+git${SRCPV}" 24PV="2013.2.4+git${SRCPV}"
25S = "${WORKDIR}/git" 25S = "${WORKDIR}/git"
26 26
27inherit setuptools update-rc.d identity default_configs hosts 27inherit setuptools update-rc.d identity default_configs hosts
diff --git a/meta-openstack/recipes-devtools/python/python-glance_git.bb b/meta-openstack/recipes-devtools/python/python-glance_git.bb
index 1f94939..a59512f 100644
--- a/meta-openstack/recipes-devtools/python/python-glance_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-glance_git.bb
@@ -12,8 +12,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
12 file://glance-change-builtin-tests-config-location.patch \ 12 file://glance-change-builtin-tests-config-location.patch \
13 " 13 "
14 14
15SRCREV="396ca82f7e359b430a6cb0a6162d7bc937367705" 15SRCREV="85584018b27bb08f3f727d4b4dc2a54ba693e375"
16PV="2013.2.3+git${SRCPV}" 16PV="2013.2.4+git${SRCPV}"
17 17
18S = "${WORKDIR}/git" 18S = "${WORKDIR}/git"
19 19
diff --git a/meta-openstack/recipes-devtools/python/python-heat_git.bb b/meta-openstack/recipes-devtools/python/python-heat_git.bb
index 176cfa1..82f179e 100644
--- a/meta-openstack/recipes-devtools/python/python-heat_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-heat_git.bb
@@ -16,8 +16,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
16 file://heat-tests-change-project_dir-path.patch \ 16 file://heat-tests-change-project_dir-path.patch \
17" 17"
18 18
19SRCREV="58de9e6415f5bdabde708c8584b21b59b7e96a88" 19SRCREV="b8ef3e94e4e6d378a59d64e1585ce3360c870b8c"
20PV="2013.2.3+git${SRCPV}" 20PV="2013.2.4+git${SRCPV}"
21S = "${WORKDIR}/git" 21S = "${WORKDIR}/git"
22 22
23SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-templates ${SRCNAME}-cfn" 23SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-templates ${SRCNAME}-cfn"
diff --git a/meta-openstack/recipes-devtools/python/python-horizon_git.bb b/meta-openstack/recipes-devtools/python/python-horizon_git.bb
index fd246db..597f5ab 100644
--- a/meta-openstack/recipes-devtools/python/python-horizon_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-horizon_git.bb
@@ -41,8 +41,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
41 file://horizon-use-full-package-path-to-test-directories.patch \ 41 file://horizon-use-full-package-path-to-test-directories.patch \
42 " 42 "
43 43
44SRCREV="cd1de75ee2a8c246d5564e96ccc48185816c2290" 44SRCREV="df782fc2b51f5e9d2e38e3e33a4ebdc0705a50b4"
45PV="2013.2.3+git${SRCPV}" 45PV="2013.2.4+git${SRCPV}"
46S = "${WORKDIR}/git" 46S = "${WORKDIR}/git"
47 47
48inherit setuptools update-rc.d python-dir default_configs 48inherit setuptools update-rc.d python-dir default_configs
diff --git a/meta-openstack/recipes-devtools/python/python-keystone_git.bb b/meta-openstack/recipes-devtools/python/python-keystone_git.bb
index f242844..09d7849 100644
--- a/meta-openstack/recipes-devtools/python/python-keystone_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-keystone_git.bb
@@ -17,8 +17,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
17 file://convert_keystone_backend.py \ 17 file://convert_keystone_backend.py \
18 " 18 "
19 19
20SRCREV="e7c29874e5a0e43f4f0e9970556c701af508152f" 20SRCREV="7f1feaaf1fa5eca4b1cd541fca4f4203eeaebf8f"
21PV="2013.2.3+git${SRCPV}" 21PV="2013.2.4+git${SRCPV}"
22 22
23S = "${WORKDIR}/git" 23S = "${WORKDIR}/git"
24 24
diff --git a/meta-openstack/recipes-devtools/python/python-neutron_git.bb b/meta-openstack/recipes-devtools/python/python-neutron_git.bb
index f59d111..b3b37f7 100644
--- a/meta-openstack/recipes-devtools/python/python-neutron_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-neutron_git.bb
@@ -19,8 +19,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
19 file://uuid_wscheck.patch \ 19 file://uuid_wscheck.patch \
20 file://neutron-test-nec-plugin-extensions-location.patch \ 20 file://neutron-test-nec-plugin-extensions-location.patch \
21 " 21 "
22SRCREV="a8417d78c2675a2ceb5dbfcee70948a88d69e747" 22SRCREV="5499b63215c59150a9095736b9c7b2b79489ebf8"
23PV="2013.2.3+git${SRCPV}" 23PV="2013.2.4+git${SRCPV}"
24 24
25S = "${WORKDIR}/git" 25S = "${WORKDIR}/git"
26 26
diff --git a/meta-openstack/recipes-devtools/python/python-nova_git.bb b/meta-openstack/recipes-devtools/python/python-nova_git.bb
index 9903b94..cfa5caa 100644
--- a/meta-openstack/recipes-devtools/python/python-nova_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-nova_git.bb
@@ -26,8 +26,8 @@ SRC_URI += "file://nova-all \
26 file://nova.conf \ 26 file://nova.conf \
27 file://openrc \ 27 file://openrc \
28 " 28 "
29SRCREV="a3a955507d9d4b3e2688847fe45f88a26be3e8cc" 29SRCREV="1d9c57a9845ddb3e386d039742184dc1d3d6b136"
30PV="2013.2.3+git${SRCPV}" 30PV="2013.2.4+git${SRCPV}"
31 31
32S = "${WORKDIR}/git" 32S = "${WORKDIR}/git"
33 33
diff --git a/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch b/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch
deleted file mode 100644
index a284b5b..0000000
--- a/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch
+++ /dev/null
@@ -1,59 +0,0 @@
1From b2c61375b3255486adb2900922a894dc7dad3c6d Mon Sep 17 00:00:00 2001
2From: Samuel Merritt <sam@swiftstack.com>
3Date: Thu, 16 Jan 2014 13:44:23 +0100
4Subject: Use constant time comparison in tempURL
5
6Use constant time comparison when evaluating tempURL to avoid timing
7attacks (CVE-2014-0006). This is the havana backport of the master
8patch.
9
10Fixes bug 1265665
11
12Change-Id: I11e4ad83cc4077e52adf54a0bd0f9749294b2a48
13
14diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py
15index ffc1431..ae2f4a1 100644
16--- a/swift/common/middleware/tempurl.py
17+++ b/swift/common/middleware/tempurl.py
18@@ -98,7 +98,7 @@ from urlparse import parse_qs
19
20 from swift.proxy.controllers.base import get_account_info
21 from swift.common.swob import HeaderKeyDict
22-from swift.common.utils import split_path
23+from swift.common.utils import split_path, streq_const_time
24
25
26 #: Default headers to remove from incoming requests. Simply a whitespace
27@@ -267,17 +267,20 @@ class TempURL(object):
28 if not keys:
29 return self._invalid(env, start_response)
30 if env['REQUEST_METHOD'] == 'HEAD':
31- hmac_vals = self._get_hmacs(env, temp_url_expires, keys,
32- request_method='GET')
33- if temp_url_sig not in hmac_vals:
34- hmac_vals = self._get_hmacs(env, temp_url_expires, keys,
35- request_method='PUT')
36- if temp_url_sig not in hmac_vals:
37- return self._invalid(env, start_response)
38+ hmac_vals = (self._get_hmacs(env, temp_url_expires, keys,
39+ request_method='GET') +
40+ self._get_hmacs(env, temp_url_expires, keys,
41+ request_method='PUT'))
42 else:
43 hmac_vals = self._get_hmacs(env, temp_url_expires, keys)
44- if temp_url_sig not in hmac_vals:
45- return self._invalid(env, start_response)
46+
47+ # While it's true that any() will short-circuit, this doesn't affect
48+ # the timing-attack resistance since the only way this will
49+ # short-circuit is when a valid signature is passed in.
50+ is_valid_hmac = any(streq_const_time(temp_url_sig, h)
51+ for h in hmac_vals)
52+ if not is_valid_hmac:
53+ return self._invalid(env, start_response)
54 self._clean_incoming_headers(env)
55 env['swift.authorize'] = lambda req: None
56 env['swift.authorize_override'] = True
57--
58cgit v0.10.1
59
diff --git a/meta-openstack/recipes-devtools/python/python-swift_git.bb b/meta-openstack/recipes-devtools/python/python-swift_git.bb
index 43ba8dd..fe5fa02 100644
--- a/meta-openstack/recipes-devtools/python/python-swift_git.bb
+++ b/meta-openstack/recipes-devtools/python/python-swift_git.bb
@@ -14,11 +14,10 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \
14 file://swift.init \ 14 file://swift.init \
15 file://swift_setup.sh \ 15 file://swift_setup.sh \
16 file://cluster.conf \ 16 file://cluster.conf \
17 file://CVE-2014-0006-swift-1265665.patch \
18" 17"
19 18
20SRCREV="2f3526c559fe53ce904b735a81dee6de46127176" 19SRCREV="f9c44df6e2d32edf663814670c21ef552bef37db"
21PV="2013.2.2+git${SRCPV}" 20PV="1.10.0+git${SRCPV}"
22S = "${WORKDIR}/git" 21S = "${WORKDIR}/git"
23 22
24inherit setuptools python-dir update-rc.d hosts identity 23inherit setuptools python-dir update-rc.d hosts identity