diff options
author | Vu Tran <vu.tran@windriver.com> | 2014-08-20 10:45:11 -0400 |
---|---|---|
committer | Bruce Ashfield <bruce.ashfield@windriver.com> | 2014-08-22 16:27:48 -0400 |
commit | 0f225491c7e34a52b1e65b6af2482c9f16472cac (patch) | |
tree | 177a6295c300bb3c609f8d042e1ccb5395d403d4 | |
parent | bf5bf7c6356c6771b3ff1849bf606bb1c5b18a43 (diff) | |
download | meta-cloud-services-0f225491c7e34a52b1e65b6af2482c9f16472cac.tar.gz |
core: update core components to latest havana/stable releases
The patch CVE-2014-0006-swift-1265665.patch is already in the
latest Swift havana/stable release, so dropping it.
Signed-off-by: Vu Tran <vu.tran@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com>
9 files changed, 16 insertions, 76 deletions
diff --git a/meta-openstack/recipes-devtools/python/python-cinder_git.bb b/meta-openstack/recipes-devtools/python/python-cinder_git.bb index acabfa0..3124600 100644 --- a/meta-openstack/recipes-devtools/python/python-cinder_git.bb +++ b/meta-openstack/recipes-devtools/python/python-cinder_git.bb | |||
@@ -20,8 +20,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
20 | file://cinder-builtin-tests-config-location.patch \ | 20 | file://cinder-builtin-tests-config-location.patch \ |
21 | " | 21 | " |
22 | 22 | ||
23 | SRCREV="81259f36f57e91b31009fbd209ea2a07a2ceb213" | 23 | SRCREV="34179609ed312ba65c8ac7ca78ea8fec39b28987" |
24 | PV="2013.2.3+git${SRCPV}" | 24 | PV="2013.2.4+git${SRCPV}" |
25 | S = "${WORKDIR}/git" | 25 | S = "${WORKDIR}/git" |
26 | 26 | ||
27 | inherit setuptools update-rc.d identity default_configs hosts | 27 | inherit setuptools update-rc.d identity default_configs hosts |
diff --git a/meta-openstack/recipes-devtools/python/python-glance_git.bb b/meta-openstack/recipes-devtools/python/python-glance_git.bb index 1f94939..a59512f 100644 --- a/meta-openstack/recipes-devtools/python/python-glance_git.bb +++ b/meta-openstack/recipes-devtools/python/python-glance_git.bb | |||
@@ -12,8 +12,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
12 | file://glance-change-builtin-tests-config-location.patch \ | 12 | file://glance-change-builtin-tests-config-location.patch \ |
13 | " | 13 | " |
14 | 14 | ||
15 | SRCREV="396ca82f7e359b430a6cb0a6162d7bc937367705" | 15 | SRCREV="85584018b27bb08f3f727d4b4dc2a54ba693e375" |
16 | PV="2013.2.3+git${SRCPV}" | 16 | PV="2013.2.4+git${SRCPV}" |
17 | 17 | ||
18 | S = "${WORKDIR}/git" | 18 | S = "${WORKDIR}/git" |
19 | 19 | ||
diff --git a/meta-openstack/recipes-devtools/python/python-heat_git.bb b/meta-openstack/recipes-devtools/python/python-heat_git.bb index 176cfa1..82f179e 100644 --- a/meta-openstack/recipes-devtools/python/python-heat_git.bb +++ b/meta-openstack/recipes-devtools/python/python-heat_git.bb | |||
@@ -16,8 +16,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
16 | file://heat-tests-change-project_dir-path.patch \ | 16 | file://heat-tests-change-project_dir-path.patch \ |
17 | " | 17 | " |
18 | 18 | ||
19 | SRCREV="58de9e6415f5bdabde708c8584b21b59b7e96a88" | 19 | SRCREV="b8ef3e94e4e6d378a59d64e1585ce3360c870b8c" |
20 | PV="2013.2.3+git${SRCPV}" | 20 | PV="2013.2.4+git${SRCPV}" |
21 | S = "${WORKDIR}/git" | 21 | S = "${WORKDIR}/git" |
22 | 22 | ||
23 | SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-templates ${SRCNAME}-cfn" | 23 | SERVICECREATE_PACKAGES = "${SRCNAME}-setup ${SRCNAME}-templates ${SRCNAME}-cfn" |
diff --git a/meta-openstack/recipes-devtools/python/python-horizon_git.bb b/meta-openstack/recipes-devtools/python/python-horizon_git.bb index fd246db..597f5ab 100644 --- a/meta-openstack/recipes-devtools/python/python-horizon_git.bb +++ b/meta-openstack/recipes-devtools/python/python-horizon_git.bb | |||
@@ -41,8 +41,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
41 | file://horizon-use-full-package-path-to-test-directories.patch \ | 41 | file://horizon-use-full-package-path-to-test-directories.patch \ |
42 | " | 42 | " |
43 | 43 | ||
44 | SRCREV="cd1de75ee2a8c246d5564e96ccc48185816c2290" | 44 | SRCREV="df782fc2b51f5e9d2e38e3e33a4ebdc0705a50b4" |
45 | PV="2013.2.3+git${SRCPV}" | 45 | PV="2013.2.4+git${SRCPV}" |
46 | S = "${WORKDIR}/git" | 46 | S = "${WORKDIR}/git" |
47 | 47 | ||
48 | inherit setuptools update-rc.d python-dir default_configs | 48 | inherit setuptools update-rc.d python-dir default_configs |
diff --git a/meta-openstack/recipes-devtools/python/python-keystone_git.bb b/meta-openstack/recipes-devtools/python/python-keystone_git.bb index f242844..09d7849 100644 --- a/meta-openstack/recipes-devtools/python/python-keystone_git.bb +++ b/meta-openstack/recipes-devtools/python/python-keystone_git.bb | |||
@@ -17,8 +17,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
17 | file://convert_keystone_backend.py \ | 17 | file://convert_keystone_backend.py \ |
18 | " | 18 | " |
19 | 19 | ||
20 | SRCREV="e7c29874e5a0e43f4f0e9970556c701af508152f" | 20 | SRCREV="7f1feaaf1fa5eca4b1cd541fca4f4203eeaebf8f" |
21 | PV="2013.2.3+git${SRCPV}" | 21 | PV="2013.2.4+git${SRCPV}" |
22 | 22 | ||
23 | S = "${WORKDIR}/git" | 23 | S = "${WORKDIR}/git" |
24 | 24 | ||
diff --git a/meta-openstack/recipes-devtools/python/python-neutron_git.bb b/meta-openstack/recipes-devtools/python/python-neutron_git.bb index f59d111..b3b37f7 100644 --- a/meta-openstack/recipes-devtools/python/python-neutron_git.bb +++ b/meta-openstack/recipes-devtools/python/python-neutron_git.bb | |||
@@ -19,8 +19,8 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
19 | file://uuid_wscheck.patch \ | 19 | file://uuid_wscheck.patch \ |
20 | file://neutron-test-nec-plugin-extensions-location.patch \ | 20 | file://neutron-test-nec-plugin-extensions-location.patch \ |
21 | " | 21 | " |
22 | SRCREV="a8417d78c2675a2ceb5dbfcee70948a88d69e747" | 22 | SRCREV="5499b63215c59150a9095736b9c7b2b79489ebf8" |
23 | PV="2013.2.3+git${SRCPV}" | 23 | PV="2013.2.4+git${SRCPV}" |
24 | 24 | ||
25 | S = "${WORKDIR}/git" | 25 | S = "${WORKDIR}/git" |
26 | 26 | ||
diff --git a/meta-openstack/recipes-devtools/python/python-nova_git.bb b/meta-openstack/recipes-devtools/python/python-nova_git.bb index 9903b94..cfa5caa 100644 --- a/meta-openstack/recipes-devtools/python/python-nova_git.bb +++ b/meta-openstack/recipes-devtools/python/python-nova_git.bb | |||
@@ -26,8 +26,8 @@ SRC_URI += "file://nova-all \ | |||
26 | file://nova.conf \ | 26 | file://nova.conf \ |
27 | file://openrc \ | 27 | file://openrc \ |
28 | " | 28 | " |
29 | SRCREV="a3a955507d9d4b3e2688847fe45f88a26be3e8cc" | 29 | SRCREV="1d9c57a9845ddb3e386d039742184dc1d3d6b136" |
30 | PV="2013.2.3+git${SRCPV}" | 30 | PV="2013.2.4+git${SRCPV}" |
31 | 31 | ||
32 | S = "${WORKDIR}/git" | 32 | S = "${WORKDIR}/git" |
33 | 33 | ||
diff --git a/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch b/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch deleted file mode 100644 index a284b5b..0000000 --- a/meta-openstack/recipes-devtools/python/python-swift/CVE-2014-0006-swift-1265665.patch +++ /dev/null | |||
@@ -1,59 +0,0 @@ | |||
1 | From b2c61375b3255486adb2900922a894dc7dad3c6d Mon Sep 17 00:00:00 2001 | ||
2 | From: Samuel Merritt <sam@swiftstack.com> | ||
3 | Date: Thu, 16 Jan 2014 13:44:23 +0100 | ||
4 | Subject: Use constant time comparison in tempURL | ||
5 | |||
6 | Use constant time comparison when evaluating tempURL to avoid timing | ||
7 | attacks (CVE-2014-0006). This is the havana backport of the master | ||
8 | patch. | ||
9 | |||
10 | Fixes bug 1265665 | ||
11 | |||
12 | Change-Id: I11e4ad83cc4077e52adf54a0bd0f9749294b2a48 | ||
13 | |||
14 | diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py | ||
15 | index ffc1431..ae2f4a1 100644 | ||
16 | --- a/swift/common/middleware/tempurl.py | ||
17 | +++ b/swift/common/middleware/tempurl.py | ||
18 | @@ -98,7 +98,7 @@ from urlparse import parse_qs | ||
19 | |||
20 | from swift.proxy.controllers.base import get_account_info | ||
21 | from swift.common.swob import HeaderKeyDict | ||
22 | -from swift.common.utils import split_path | ||
23 | +from swift.common.utils import split_path, streq_const_time | ||
24 | |||
25 | |||
26 | #: Default headers to remove from incoming requests. Simply a whitespace | ||
27 | @@ -267,17 +267,20 @@ class TempURL(object): | ||
28 | if not keys: | ||
29 | return self._invalid(env, start_response) | ||
30 | if env['REQUEST_METHOD'] == 'HEAD': | ||
31 | - hmac_vals = self._get_hmacs(env, temp_url_expires, keys, | ||
32 | - request_method='GET') | ||
33 | - if temp_url_sig not in hmac_vals: | ||
34 | - hmac_vals = self._get_hmacs(env, temp_url_expires, keys, | ||
35 | - request_method='PUT') | ||
36 | - if temp_url_sig not in hmac_vals: | ||
37 | - return self._invalid(env, start_response) | ||
38 | + hmac_vals = (self._get_hmacs(env, temp_url_expires, keys, | ||
39 | + request_method='GET') + | ||
40 | + self._get_hmacs(env, temp_url_expires, keys, | ||
41 | + request_method='PUT')) | ||
42 | else: | ||
43 | hmac_vals = self._get_hmacs(env, temp_url_expires, keys) | ||
44 | - if temp_url_sig not in hmac_vals: | ||
45 | - return self._invalid(env, start_response) | ||
46 | + | ||
47 | + # While it's true that any() will short-circuit, this doesn't affect | ||
48 | + # the timing-attack resistance since the only way this will | ||
49 | + # short-circuit is when a valid signature is passed in. | ||
50 | + is_valid_hmac = any(streq_const_time(temp_url_sig, h) | ||
51 | + for h in hmac_vals) | ||
52 | + if not is_valid_hmac: | ||
53 | + return self._invalid(env, start_response) | ||
54 | self._clean_incoming_headers(env) | ||
55 | env['swift.authorize'] = lambda req: None | ||
56 | env['swift.authorize_override'] = True | ||
57 | -- | ||
58 | cgit v0.10.1 | ||
59 | |||
diff --git a/meta-openstack/recipes-devtools/python/python-swift_git.bb b/meta-openstack/recipes-devtools/python/python-swift_git.bb index 43ba8dd..fe5fa02 100644 --- a/meta-openstack/recipes-devtools/python/python-swift_git.bb +++ b/meta-openstack/recipes-devtools/python/python-swift_git.bb | |||
@@ -14,11 +14,10 @@ SRC_URI = "git://github.com/openstack/${SRCNAME}.git;branch=stable/havana \ | |||
14 | file://swift.init \ | 14 | file://swift.init \ |
15 | file://swift_setup.sh \ | 15 | file://swift_setup.sh \ |
16 | file://cluster.conf \ | 16 | file://cluster.conf \ |
17 | file://CVE-2014-0006-swift-1265665.patch \ | ||
18 | " | 17 | " |
19 | 18 | ||
20 | SRCREV="2f3526c559fe53ce904b735a81dee6de46127176" | 19 | SRCREV="f9c44df6e2d32edf663814670c21ef552bef37db" |
21 | PV="2013.2.2+git${SRCPV}" | 20 | PV="1.10.0+git${SRCPV}" |
22 | S = "${WORKDIR}/git" | 21 | S = "${WORKDIR}/git" |
23 | 22 | ||
24 | inherit setuptools python-dir update-rc.d hosts identity | 23 | inherit setuptools python-dir update-rc.d hosts identity |