| 1 |
commit: 13c07b3b3a2769ef42a7fb73a2d0e43ccc2cb37b |
| 2 |
Author: Matthew Thode <prometheanfire <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Wed Sep 2 03:18:09 2015 +0000 |
| 4 |
Commit: Matt Thode <prometheanfire <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Wed Sep 2 03:18:09 2015 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=13c07b3b |
| 7 |
|
| 8 |
sys-cluster/nova: fixing cve-2015-3280 |
| 9 |
|
| 10 |
Package-Manager: portage-2.2.20.1 |
| 11 |
|
| 12 |
.../nova/files/CVE-2015-3280_2015.1.1.patch.patch | 210 +++++++++++++++++ |
| 13 |
sys-cluster/nova/nova-2015.1.1-r3.ebuild | 254 +++++++++++++++++++++ |
| 14 |
2 files changed, 464 insertions(+) |
| 15 |
|
| 16 |
diff --git a/sys-cluster/nova/files/CVE-2015-3280_2015.1.1.patch.patch b/sys-cluster/nova/files/CVE-2015-3280_2015.1.1.patch.patch |
| 17 |
new file mode 100644 |
| 18 |
index 0000000..ff3b3ee |
| 19 |
--- /dev/null |
| 20 |
+++ b/sys-cluster/nova/files/CVE-2015-3280_2015.1.1.patch.patch |
| 21 |
@@ -0,0 +1,210 @@ |
| 22 |
+From 690c05ca495f1d55a469724c94e1551cbfa836f2 Mon Sep 17 00:00:00 2001 |
| 23 |
+From: Rajesh Tailor <rajesh.tailor@×××××××.com> |
| 24 |
+Date: Wed, 4 Mar 2015 05:05:19 -0800 |
| 25 |
+Subject: [PATCH] Delete orphaned instance files from compute nodes |
| 26 |
+ |
| 27 |
+While resizing/revert-resizing instance, if instance gets deleted |
| 28 |
+in between, then instance files remains either on the source or |
| 29 |
+destination compute node. |
| 30 |
+ |
| 31 |
+To address this issue, added a new periodic task |
| 32 |
+'_cleanup_incomplete_migrations' which takes care of deleting |
| 33 |
+instance files from source/destination compute nodes and then |
| 34 |
+mark migration record as failed so that it doesn't appear again |
| 35 |
+in the next periodic task run. |
| 36 |
+ |
| 37 |
+SecurityImpact |
| 38 |
+ |
| 39 |
+Closes-Bug: 1392527 |
| 40 |
+Change-Id: I9866d8e32e99b9f907921f4b226edf7b62bd83a7 |
| 41 |
+(cherry picked from commit 4655751cdd97a4b527a25c7c0a96044ba212cd19) |
| 42 |
+--- |
| 43 |
+ nova/compute/manager.py | 61 ++++++++++++++++++++++-- |
| 44 |
+ nova/tests/unit/compute/test_compute_mgr.py | 72 +++++++++++++++++++++++++++++ |
| 45 |
+ 2 files changed, 129 insertions(+), 4 deletions(-) |
| 46 |
+ |
| 47 |
+diff --git a/nova/compute/manager.py b/nova/compute/manager.py |
| 48 |
+index bf5585e..24a5811 100644 |
| 49 |
+--- a/nova/compute/manager.py |
| 50 |
++++ b/nova/compute/manager.py |
| 51 |
+@@ -267,15 +267,21 @@ def errors_out_migration(function): |
| 52 |
+ def decorated_function(self, context, *args, **kwargs): |
| 53 |
+ try: |
| 54 |
+ return function(self, context, *args, **kwargs) |
| 55 |
+- except Exception: |
| 56 |
++ except Exception as ex: |
| 57 |
+ with excutils.save_and_reraise_exception(): |
| 58 |
+ wrapped_func = utils.get_wrapped_function(function) |
| 59 |
+ keyed_args = safe_utils.getcallargs(wrapped_func, context, |
| 60 |
+ *args, **kwargs) |
| 61 |
+ migration = keyed_args['migration'] |
| 62 |
+- status = migration.status |
| 63 |
+- if status not in ['migrating', 'post-migrating']: |
| 64 |
+- return |
| 65 |
++ |
| 66 |
++ # NOTE(rajesht): If InstanceNotFound error is thrown from |
| 67 |
++ # decorated function, migration status should be set to |
| 68 |
++ # 'error', without checking current migration status. |
| 69 |
++ if not isinstance(ex, exception.InstanceNotFound): |
| 70 |
++ status = migration.status |
| 71 |
++ if status not in ['migrating', 'post-migrating']: |
| 72 |
++ return |
| 73 |
++ |
| 74 |
+ migration.status = 'error' |
| 75 |
+ try: |
| 76 |
+ with migration.obj_as_admin(): |
| 77 |
+@@ -3727,6 +3733,7 @@ class ComputeManager(manager.Manager): |
| 78 |
+ @wrap_exception() |
| 79 |
+ @reverts_task_state |
| 80 |
+ @wrap_instance_event |
| 81 |
++ @errors_out_migration |
| 82 |
+ @wrap_instance_fault |
| 83 |
+ def revert_resize(self, context, instance, migration, reservations): |
| 84 |
+ """Destroys the new instance on the destination machine. |
| 85 |
+@@ -3783,6 +3790,7 @@ class ComputeManager(manager.Manager): |
| 86 |
+ @wrap_exception() |
| 87 |
+ @reverts_task_state |
| 88 |
+ @wrap_instance_event |
| 89 |
++ @errors_out_migration |
| 90 |
+ @wrap_instance_fault |
| 91 |
+ def finish_revert_resize(self, context, instance, reservations, migration): |
| 92 |
+ """Finishes the second half of reverting a resize. |
| 93 |
+@@ -6578,6 +6586,51 @@ class ComputeManager(manager.Manager): |
| 94 |
+ with utils.temporary_mutation(context, read_deleted='yes'): |
| 95 |
+ instance.save() |
| 96 |
+ |
| 97 |
++ @periodic_task.periodic_task(spacing=CONF.instance_delete_interval) |
| 98 |
++ def _cleanup_incomplete_migrations(self, context): |
| 99 |
++ """Delete instance files on failed resize/revert-resize operation |
| 100 |
++ |
| 101 |
++ During resize/revert-resize operation, if that instance gets deleted |
| 102 |
++ in-between then instance files might remain either on source or |
| 103 |
++ destination compute node because of race condition. |
| 104 |
++ """ |
| 105 |
++ LOG.debug('Cleaning up deleted instances with incomplete migration ') |
| 106 |
++ migration_filters = {'host': CONF.host, |
| 107 |
++ 'status': 'error'} |
| 108 |
++ migrations = objects.MigrationList.get_by_filters(context, |
| 109 |
++ migration_filters) |
| 110 |
++ |
| 111 |
++ if not migrations: |
| 112 |
++ return |
| 113 |
++ |
| 114 |
++ inst_uuid_from_migrations = set([migration.instance_uuid for migration |
| 115 |
++ in migrations]) |
| 116 |
++ |
| 117 |
++ inst_filters = {'deleted': True, 'soft_deleted': False, |
| 118 |
++ 'uuid': inst_uuid_from_migrations} |
| 119 |
++ attrs = ['info_cache', 'security_groups', 'system_metadata'] |
| 120 |
++ with utils.temporary_mutation(context, read_deleted='yes'): |
| 121 |
++ instances = objects.InstanceList.get_by_filters( |
| 122 |
++ context, inst_filters, expected_attrs=attrs, use_slave=True) |
| 123 |
++ |
| 124 |
++ for instance in instances: |
| 125 |
++ if instance.host != CONF.host: |
| 126 |
++ for migration in migrations: |
| 127 |
++ if instance.uuid == migration.instance_uuid: |
| 128 |
++ # Delete instance files if not cleanup properly either |
| 129 |
++ # from the source or destination compute nodes when |
| 130 |
++ # the instance is deleted during resizing. |
| 131 |
++ self.driver.delete_instance_files(instance) |
| 132 |
++ try: |
| 133 |
++ migration.status = 'failed' |
| 134 |
++ with migration.obj_as_admin(): |
| 135 |
++ migration.save() |
| 136 |
++ except exception.MigrationNotFound: |
| 137 |
++ LOG.warning(_LW("Migration %s is not found."), |
| 138 |
++ migration.id, context=context, |
| 139 |
++ instance=instance) |
| 140 |
++ break |
| 141 |
++ |
| 142 |
+ @messaging.expected_exceptions(exception.InstanceQuiesceNotSupported, |
| 143 |
+ exception.NovaException, |
| 144 |
+ NotImplementedError) |
| 145 |
+diff --git a/nova/tests/unit/compute/test_compute_mgr.py b/nova/tests/unit/compute/test_compute_mgr.py |
| 146 |
+index 4b7234e..ee1ab47 100644 |
| 147 |
+--- a/nova/tests/unit/compute/test_compute_mgr.py |
| 148 |
++++ b/nova/tests/unit/compute/test_compute_mgr.py |
| 149 |
+@@ -1374,6 +1374,78 @@ class ComputeManagerUnitTestCase(test.NoDBTestCase): |
| 150 |
+ self.assertFalse(c.cleaned) |
| 151 |
+ self.assertEqual('1', c.system_metadata['clean_attempts']) |
| 152 |
+ |
| 153 |
++ @mock.patch.object(objects.Migration, 'obj_as_admin') |
| 154 |
++ @mock.patch.object(objects.Migration, 'save') |
| 155 |
++ @mock.patch.object(objects.MigrationList, 'get_by_filters') |
| 156 |
++ @mock.patch.object(objects.InstanceList, 'get_by_filters') |
| 157 |
++ def _test_cleanup_incomplete_migrations(self, inst_host, |
| 158 |
++ mock_inst_get_by_filters, |
| 159 |
++ mock_migration_get_by_filters, |
| 160 |
++ mock_save, mock_obj_as_admin): |
| 161 |
++ def fake_inst(context, uuid, host): |
| 162 |
++ inst = objects.Instance(context) |
| 163 |
++ inst.uuid = uuid |
| 164 |
++ inst.host = host |
| 165 |
++ return inst |
| 166 |
++ |
| 167 |
++ def fake_migration(uuid, status, inst_uuid, src_host, dest_host): |
| 168 |
++ migration = objects.Migration() |
| 169 |
++ migration.uuid = uuid |
| 170 |
++ migration.status = status |
| 171 |
++ migration.instance_uuid = inst_uuid |
| 172 |
++ migration.source_compute = src_host |
| 173 |
++ migration.dest_compute = dest_host |
| 174 |
++ return migration |
| 175 |
++ |
| 176 |
++ fake_instances = [fake_inst(self.context, '111', inst_host), |
| 177 |
++ fake_inst(self.context, '222', inst_host)] |
| 178 |
++ |
| 179 |
++ fake_migrations = [fake_migration('123', 'error', '111', |
| 180 |
++ 'fake-host', 'fake-mini'), |
| 181 |
++ fake_migration('456', 'error', '222', |
| 182 |
++ 'fake-host', 'fake-mini')] |
| 183 |
++ |
| 184 |
++ mock_migration_get_by_filters.return_value = fake_migrations |
| 185 |
++ mock_inst_get_by_filters.return_value = fake_instances |
| 186 |
++ |
| 187 |
++ with mock.patch.object(self.compute.driver, 'delete_instance_files'): |
| 188 |
++ self.compute._cleanup_incomplete_migrations(self.context) |
| 189 |
++ |
| 190 |
++ # Ensure that migration status is set to 'failed' after instance |
| 191 |
++ # files deletion for those instances whose instance.host is not |
| 192 |
++ # same as compute host where periodic task is running. |
| 193 |
++ for inst in fake_instances: |
| 194 |
++ if inst.host != CONF.host: |
| 195 |
++ for mig in fake_migrations: |
| 196 |
++ if inst.uuid == mig.instance_uuid: |
| 197 |
++ self.assertEqual('failed', mig.status) |
| 198 |
++ |
| 199 |
++ def test_cleanup_incomplete_migrations_dest_node(self): |
| 200 |
++ """Test to ensure instance files are deleted from destination node. |
| 201 |
++ |
| 202 |
++ If instance gets deleted during resizing/revert-resizing operation, |
| 203 |
++ in that case instance files gets deleted from instance.host (source |
| 204 |
++ host here), but there is possibility that instance files could be |
| 205 |
++ present on destination node. |
| 206 |
++ This test ensures that `_cleanup_incomplete_migration` periodic |
| 207 |
++ task deletes orphaned instance files from destination compute node. |
| 208 |
++ """ |
| 209 |
++ self.flags(host='fake-mini') |
| 210 |
++ self._test_cleanup_incomplete_migrations('fake-host') |
| 211 |
++ |
| 212 |
++ def test_cleanup_incomplete_migrations_source_node(self): |
| 213 |
++ """Test to ensure instance files are deleted from source node. |
| 214 |
++ |
| 215 |
++ If instance gets deleted during resizing/revert-resizing operation, |
| 216 |
++ in that case instance files gets deleted from instance.host (dest |
| 217 |
++ host here), but there is possibility that instance files could be |
| 218 |
++ present on source node. |
| 219 |
++ This test ensures that `_cleanup_incomplete_migration` periodic |
| 220 |
++ task deletes orphaned instance files from source compute node. |
| 221 |
++ """ |
| 222 |
++ self.flags(host='fake-host') |
| 223 |
++ self._test_cleanup_incomplete_migrations('fake-mini') |
| 224 |
++ |
| 225 |
+ def test_attach_interface_failure(self): |
| 226 |
+ # Test that the fault methods are invoked when an attach fails |
| 227 |
+ db_instance = fake_instance.fake_db_instance() |
| 228 |
+-- |
| 229 |
+2.4.5 |
| 230 |
+ |
| 231 |
+ |
| 232 |
|
| 233 |
diff --git a/sys-cluster/nova/nova-2015.1.1-r3.ebuild b/sys-cluster/nova/nova-2015.1.1-r3.ebuild |
| 234 |
new file mode 100644 |
| 235 |
index 0000000..fadb780 |
| 236 |
--- /dev/null |
| 237 |
+++ b/sys-cluster/nova/nova-2015.1.1-r3.ebuild |
| 238 |
@@ -0,0 +1,254 @@ |
| 239 |
+# Copyright 1999-2015 Gentoo Foundation |
| 240 |
+# Distributed under the terms of the GNU General Public License v2 |
| 241 |
+# $Id$ |
| 242 |
+ |
| 243 |
+EAPI=5 |
| 244 |
+PYTHON_COMPAT=( python2_7 ) |
| 245 |
+ |
| 246 |
+inherit distutils-r1 eutils linux-info multilib user |
| 247 |
+ |
| 248 |
+DESCRIPTION="A cloud computing fabric controller (main part of an IaaS system) written in Python" |
| 249 |
+HOMEPAGE="https://launchpad.net/nova" |
| 250 |
+SRC_URI="https://launchpad.net/${PN}/kilo/${PV}/+download/${P}.tar.gz" |
| 251 |
+ |
| 252 |
+LICENSE="Apache-2.0" |
| 253 |
+SLOT="0" |
| 254 |
+KEYWORDS="~amd64 ~x86" |
| 255 |
+IUSE="+compute compute-only iscsi +kvm +memcached mysql +novncproxy openvswitch postgres +rabbitmq sqlite test xen" |
| 256 |
+REQUIRED_USE="!compute-only? ( || ( mysql postgres sqlite ) ) |
| 257 |
+ compute-only? ( compute !rabbitmq !memcached !mysql !postgres !sqlite ) |
| 258 |
+ compute? ( ^^ ( kvm xen ) )" |
| 259 |
+ |
| 260 |
+DEPEND=" |
| 261 |
+ dev-python/setuptools[${PYTHON_USEDEP}] |
| 262 |
+ >=dev-python/pbr-0.8[${PYTHON_USEDEP}] |
| 263 |
+ <dev-python/pbr-1.0[${PYTHON_USEDEP}] |
| 264 |
+ app-admin/sudo |
| 265 |
+ test? ( |
| 266 |
+ ${RDEPEND} |
| 267 |
+ >=dev-python/hacking-0.10.0[${PYTHON_USEDEP}] |
| 268 |
+ <dev-python/hacking-0.11[${PYTHON_USEDEP}] |
| 269 |
+ >=dev-python/coverage-3.6[${PYTHON_USEDEP}] |
| 270 |
+ >=dev-python/fixtures-0.3.14[${PYTHON_USEDEP}] |
| 271 |
+ <dev-python/fixtures-1.3.0[${PYTHON_USEDEP}] |
| 272 |
+ >=dev-python/mock-1.0[${PYTHON_USEDEP}] |
| 273 |
+ <dev-python/mock-1.1.0[${PYTHON_USEDEP}] |
| 274 |
+ >=dev-python/mox3-0.7.0[${PYTHON_USEDEP}] |
| 275 |
+ <dev-python/mox3-0.8.0[${PYTHON_USEDEP}] |
| 276 |
+ dev-python/mysql-python[${PYTHON_USEDEP}] |
| 277 |
+ dev-python/psycopg[${PYTHON_USEDEP}] |
| 278 |
+ >=dev-python/python-barbicanclient-3.0.1[${PYTHON_USEDEP}] |
| 279 |
+ <dev-python/python-barbicanclient-3.1.0[${PYTHON_USEDEP}] |
| 280 |
+ >=dev-python/python-ironicclient-0.4.1[${PYTHON_USEDEP}] |
| 281 |
+ <dev-python/python-ironicclient-0.6.0[${PYTHON_USEDEP}] |
| 282 |
+ >=dev-python/subunit-0.0.18[${PYTHON_USEDEP}] |
| 283 |
+ >=dev-python/requests-mock-0.6.0[${PYTHON_USEDEP}] |
| 284 |
+ >=dev-python/sphinx-1.1.2[${PYTHON_USEDEP}] |
| 285 |
+ !~dev-python/sphinx-1.2.0[${PYTHON_USEDEP}] |
| 286 |
+ <dev-python/sphinx-1.3[${PYTHON_USEDEP}] |
| 287 |
+ >=dev-python/oslo-sphinx-2.5.0[${PYTHON_USEDEP}] |
| 288 |
+ <dev-python/oslo-sphinx-2.6.0[${PYTHON_USEDEP}] |
| 289 |
+ >=dev-python/oslotest-1.5.1[${PYTHON_USEDEP}] |
| 290 |
+ <dev-python/oslotest-1.6.0[${PYTHON_USEDEP}] |
| 291 |
+ >=dev-python/testrepository-0.0.18[${PYTHON_USEDEP}] |
| 292 |
+ >=dev-python/testtools-0.9.36[${PYTHON_USEDEP}] |
| 293 |
+ !~dev-python/testtools-1.2.0[${PYTHON_USEDEP}] |
| 294 |
+ >=dev-python/tempest-lib-0.4.0[${PYTHON_USEDEP}] |
| 295 |
+ <dev-python/tempest-lib-0.5.0[${PYTHON_USEDEP}] |
| 296 |
+ >=dev-python/suds-0.4[${PYTHON_USEDEP}] |
| 297 |
+ >=dev-python/oslo-vmware-0.11.1[${PYTHON_USEDEP}] |
| 298 |
+ <dev-python/oslo-vmware-0.12.0[${PYTHON_USEDEP}] |
| 299 |
+ )" |
| 300 |
+ |
| 301 |
+# barbicanclient is in here for doc generation |
| 302 |
+RDEPEND=" |
| 303 |
+ compute-only? ( |
| 304 |
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}] |
| 305 |
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}] |
| 306 |
+ ) |
| 307 |
+ sqlite? ( |
| 308 |
+ >=dev-python/sqlalchemy-0.9.7[sqlite,${PYTHON_USEDEP}] |
| 309 |
+ <=dev-python/sqlalchemy-0.9.99[sqlite,${PYTHON_USEDEP}] |
| 310 |
+ ) |
| 311 |
+ mysql? ( |
| 312 |
+ dev-python/mysql-python |
| 313 |
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}] |
| 314 |
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}] |
| 315 |
+ ) |
| 316 |
+ postgres? ( |
| 317 |
+ dev-python/psycopg:2 |
| 318 |
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}] |
| 319 |
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}] |
| 320 |
+ ) |
| 321 |
+ >=dev-python/boto-2.32.1[${PYTHON_USEDEP}] |
| 322 |
+ >=dev-python/decorator-3.4.0[${PYTHON_USEDEP}] |
| 323 |
+ >=dev-python/eventlet-0.16.1[${PYTHON_USEDEP}] |
| 324 |
+ !~dev-python/eventlet-0.17.0[${PYTHON_USEDEP}] |
| 325 |
+ >=dev-python/jinja-2.6[${PYTHON_USEDEP}] |
| 326 |
+ >=dev-python/keystonemiddleware-1.5.0[${PYTHON_USEDEP}] |
| 327 |
+ <dev-python/keystonemiddleware-1.6.0[${PYTHON_USEDEP}] |
| 328 |
+ >=dev-python/lxml-2.3[${PYTHON_USEDEP}] |
| 329 |
+ >=dev-python/routes-1.12.3-r1[${PYTHON_USEDEP}] |
| 330 |
+ !~dev-python/routes-2.0[${PYTHON_USEDEP}] |
| 331 |
+ >=dev-python/webob-1.2.3[${PYTHON_USEDEP}] |
| 332 |
+ >=dev-python/greenlet-0.3.2[${PYTHON_USEDEP}] |
| 333 |
+ >=dev-python/pastedeploy-1.5.0-r1[${PYTHON_USEDEP}] |
| 334 |
+ dev-python/paste[${PYTHON_USEDEP}] |
| 335 |
+ ~dev-python/sqlalchemy-migrate-0.9.5[${PYTHON_USEDEP}] |
| 336 |
+ >=dev-python/netaddr-0.7.12[${PYTHON_USEDEP}] |
| 337 |
+ >=dev-python/paramiko-1.13.0[${PYTHON_USEDEP}] |
| 338 |
+ dev-python/pyasn1[${PYTHON_USEDEP}] |
| 339 |
+ >=dev-python/Babel-1.3[${PYTHON_USEDEP}] |
| 340 |
+ >=dev-python/iso8601-0.1.9[${PYTHON_USEDEP}] |
| 341 |
+ >=dev-python/jsonschema-2.0.0[${PYTHON_USEDEP}] |
| 342 |
+ <dev-python/jsonschema-3.0.0[${PYTHON_USEDEP}] |
| 343 |
+ >=dev-python/python-cinderclient-1.1.0[${PYTHON_USEDEP}] |
| 344 |
+ <dev-python/python-cinderclient-1.2.0[${PYTHON_USEDEP}] |
| 345 |
+ >=dev-python/python-neutronclient-2.3.11[${PYTHON_USEDEP}] |
| 346 |
+ <dev-python/python-neutronclient-2.5.0[${PYTHON_USEDEP}] |
| 347 |
+ >=dev-python/python-glanceclient-0.15.0[${PYTHON_USEDEP}] |
| 348 |
+ <dev-python/python-glanceclient-0.18.0[${PYTHON_USEDEP}] |
| 349 |
+ >=dev-python/python-barbicanclient-3.0.1[${PYTHON_USEDEP}] |
| 350 |
+ <dev-python/python-barbicanclient-3.1.0[${PYTHON_USEDEP}] |
| 351 |
+ >=dev-python/six-1.9.0[${PYTHON_USEDEP}] |
| 352 |
+ >=dev-python/stevedore-1.3.0[${PYTHON_USEDEP}] |
| 353 |
+ <dev-python/stevedore-1.4.0[${PYTHON_USEDEP}] |
| 354 |
+ >=dev-python/websockify-0.6.0[${PYTHON_USEDEP}] |
| 355 |
+ <dev-python/websockify-0.7.0[${PYTHON_USEDEP}] |
| 356 |
+ >=dev-python/oslo-concurrency-1.8.2[${PYTHON_USEDEP}] |
| 357 |
+ <dev-python/oslo-concurrency-1.9.0[${PYTHON_USEDEP}] |
| 358 |
+ >=dev-python/oslo-config-1.9.3[${PYTHON_USEDEP}] |
| 359 |
+ <dev-python/oslo-config-1.10.0[${PYTHON_USEDEP}] |
| 360 |
+ >=dev-python/oslo-context-0.2.0[${PYTHON_USEDEP}] |
| 361 |
+ <dev-python/oslo-context-0.3.0[${PYTHON_USEDEP}] |
| 362 |
+ >=dev-python/oslo-log-1.0.0[${PYTHON_USEDEP}] |
| 363 |
+ <dev-python/oslo-log-1.1.0[${PYTHON_USEDEP}] |
| 364 |
+ >=dev-python/oslo-serialization-1.4.0[${PYTHON_USEDEP}] |
| 365 |
+ <dev-python/oslo-serialization-1.5.0[${PYTHON_USEDEP}] |
| 366 |
+ >=dev-python/oslo-utils-1.4.0[${PYTHON_USEDEP}] |
| 367 |
+ <dev-python/oslo-utils-1.5.0[${PYTHON_USEDEP}] |
| 368 |
+ >=dev-python/oslo-db-1.7.0[${PYTHON_USEDEP}] |
| 369 |
+ <dev-python/oslo-db-1.8.0[${PYTHON_USEDEP}] |
| 370 |
+ >=dev-python/oslo-rootwrap-1.6.0[${PYTHON_USEDEP}] |
| 371 |
+ <dev-python/oslo-rootwrap-1.7.0[${PYTHON_USEDEP}] |
| 372 |
+ >=dev-python/oslo-messaging-1.8.0[${PYTHON_USEDEP}] |
| 373 |
+ <dev-python/oslo-messaging-1.9.0[${PYTHON_USEDEP}] |
| 374 |
+ >=dev-python/oslo-i18n-1.5.0[${PYTHON_USEDEP}] |
| 375 |
+ <dev-python/oslo-i18n-1.6.0[${PYTHON_USEDEP}] |
| 376 |
+ >=dev-python/rfc3986-0.2.0[${PYTHON_USEDEP}] |
| 377 |
+ >=dev-python/oslo-middleware-1.0.0[${PYTHON_USEDEP}] |
| 378 |
+ <dev-python/oslo-middleware-1.1.0[${PYTHON_USEDEP}] |
| 379 |
+ >=dev-python/psutil-1.1.1[${PYTHON_USEDEP}] |
| 380 |
+ <dev-python/psutil-2.0.0[${PYTHON_USEDEP}] |
| 381 |
+ dev-python/libvirt-python[${PYTHON_USEDEP}] |
| 382 |
+ app-emulation/libvirt[iscsi?] |
| 383 |
+ novncproxy? ( www-apps/novnc ) |
| 384 |
+ sys-apps/iproute2 |
| 385 |
+ openvswitch? ( net-misc/openvswitch ) |
| 386 |
+ rabbitmq? ( net-misc/rabbitmq-server ) |
| 387 |
+ memcached? ( net-misc/memcached |
| 388 |
+ dev-python/python-memcached ) |
| 389 |
+ sys-fs/sysfsutils |
| 390 |
+ sys-fs/multipath-tools |
| 391 |
+ net-misc/bridge-utils |
| 392 |
+ compute? ( |
| 393 |
+ app-cdr/cdrkit |
| 394 |
+ kvm? ( app-emulation/qemu ) |
| 395 |
+ xen? ( app-emulation/xen |
| 396 |
+ app-emulation/xen-tools ) |
| 397 |
+ ) |
| 398 |
+ iscsi? ( |
| 399 |
+ sys-fs/lsscsi |
| 400 |
+ >=sys-block/open-iscsi-2.0.872-r3 |
| 401 |
+ )" |
| 402 |
+ |
| 403 |
+PATCHES=( |
| 404 |
+ "${FILESDIR}/CVE-2015-3241-kilo.patch" |
| 405 |
+ "${FILESDIR}/CVE-2015-3280_2015.1.1.patch.patch" |
| 406 |
+) |
| 407 |
+ |
| 408 |
+pkg_setup() { |
| 409 |
+ linux-info_pkg_setup |
| 410 |
+ CONFIG_CHECK_MODULES="BLK_DEV_NBD VHOST_NET IP6_NF_FILTER IP6_NF_IPTABLES IP_NF_TARGET_REJECT \ |
| 411 |
+ IP_NF_MANGLE IP_NF_TARGET_MASQUERADE NF_NAT_IPV4 IP_NF_FILTER IP_NF_IPTABLES \ |
| 412 |
+ NF_CONNTRACK_IPV4 NF_DEFRAG_IPV4 NF_NAT_IPV4 NF_NAT NF_CONNTRACK NETFILTER_XTABLES \ |
| 413 |
+ ISCSI_TCP SCSI_DH DM_MULTIPATH DM_SNAPSHOT" |
| 414 |
+ if linux_config_exists; then |
| 415 |
+ for module in ${CONFIG_CHECK_MODULES}; do |
| 416 |
+ linux_chkconfig_present ${module} || ewarn "${module} needs to be enabled in kernel" |
| 417 |
+ done |
| 418 |
+ fi |
| 419 |
+ enewgroup nova |
| 420 |
+ enewuser nova -1 -1 /var/lib/nova nova |
| 421 |
+} |
| 422 |
+ |
| 423 |
+python_prepare() { |
| 424 |
+ distutils-r1_python_prepare |
| 425 |
+ sed -i 's/python/python2\.7/g' tools/config/generate_sample.sh || die |
| 426 |
+} |
| 427 |
+ |
| 428 |
+python_compile() { |
| 429 |
+ distutils-r1_python_compile |
| 430 |
+ ./tools/config/generate_sample.sh -b ./ -p nova -o etc/nova || die |
| 431 |
+} |
| 432 |
+ |
| 433 |
+python_test() { |
| 434 |
+ # turn multiprocessing off, testr will use it --parallel |
| 435 |
+ local DISTUTILS_NO_PARALLEL_BUILD=1 |
| 436 |
+ testr init |
| 437 |
+ testr run --parallel || die "failed testsuite under python2.7" |
| 438 |
+} |
| 439 |
+ |
| 440 |
+python_install() { |
| 441 |
+ distutils-r1_python_install |
| 442 |
+ |
| 443 |
+ if use !compute-only; then |
| 444 |
+ for svc in api cert conductor consoleauth network scheduler spicehtml5proxy xvpvncproxy; do |
| 445 |
+ newinitd "${FILESDIR}/nova.initd" "nova-${svc}" |
| 446 |
+ done |
| 447 |
+ fi |
| 448 |
+ use compute && newinitd "${FILESDIR}/nova.initd" "nova-compute" |
| 449 |
+ use novncproxy && newinitd "${FILESDIR}/nova.initd" "nova-novncproxy" |
| 450 |
+ |
| 451 |
+ diropts -m 0750 -o nova -g qemu |
| 452 |
+ dodir /var/log/nova /var/lib/nova/instances |
| 453 |
+ diropts -m 0750 -o nova -g nova |
| 454 |
+ |
| 455 |
+ insinto /etc/nova |
| 456 |
+ insopts -m 0640 -o nova -g nova |
| 457 |
+ newins "etc/nova/nova.conf.sample" "nova.conf" |
| 458 |
+ doins "etc/nova/api-paste.ini" |
| 459 |
+ doins "etc/nova/logging_sample.conf" |
| 460 |
+ doins "etc/nova/policy.json" |
| 461 |
+ doins "etc/nova/rootwrap.conf" |
| 462 |
+ #rootwrap filters |
| 463 |
+ insinto /etc/nova/rootwrap.d |
| 464 |
+ doins "etc/nova/rootwrap.d/api-metadata.filters" |
| 465 |
+ doins "etc/nova/rootwrap.d/compute.filters" |
| 466 |
+ doins "etc/nova/rootwrap.d/network.filters" |
| 467 |
+ #copy migration conf file (not coppied on install via setup.py script) |
| 468 |
+ insopts -m 0644 |
| 469 |
+ insinto /usr/$(get_libdir)/python2.7/site-packages/nova/db/sqlalchemy/migrate_repo/ |
| 470 |
+ doins "nova/db/sqlalchemy/migrate_repo/migrate.cfg" |
| 471 |
+ #copy the CA cert dir (not coppied on install via setup.py script) |
| 472 |
+ cp -R "${S}/nova/CA" "${D}/usr/$(get_libdir)/python2.7/site-packages/nova/" || die "installing CA files failed" |
| 473 |
+ |
| 474 |
+ #add sudoers definitions for user nova |
| 475 |
+ insinto /etc/sudoers.d/ |
| 476 |
+ insopts -m 0600 -o root -g root |
| 477 |
+ doins "${FILESDIR}/nova-sudoers" |
| 478 |
+ |
| 479 |
+ if use iscsi ; then |
| 480 |
+ # Install udev rules for handle iscsi disk with right links under /dev |
| 481 |
+ udev_newrules "${FILESDIR}/openstack-scsi-disk.rules" 60-openstack-scsi-disk.rules |
| 482 |
+ |
| 483 |
+ insinto /etc/nova/ |
| 484 |
+ doins "${FILESDIR}/scsi-openscsi-link.sh" |
| 485 |
+ fi |
| 486 |
+} |
| 487 |
+ |
| 488 |
+pkg_postinst() { |
| 489 |
+ if use iscsi ; then |
| 490 |
+ elog "iscsid needs to be running if you want cinder to connect" |
| 491 |
+ fi |
| 492 |
+} |
Archives