components/openstack/glance/patches/08-CVE-2014-9623.patch
branchs11u2-sru
changeset 3947 49b86ceff723
equal deleted inserted replaced
3944:53cdaa2b6b94 3947:49b86ceff723
       
     1 # This patch is taken from community. Fix is present in version 2015.2.2
       
     2 # This fix could be found in following URL
       
     3 # https://review.openstack.org/gitweb?p=openstack/glance.git;a=commit;h=f1260cc771ee068651aa62b972bef49d9af81eb0
       
     4 
       
     5 --- glance-2013.2.3.orginal/glance/api/authorization.py 2015-02-20 03:57:20.678874000 -0600
       
     6 +++ glance-2013.2.3//glance/api/authorization.py        2015-02-20 04:07:24.881647830 -0600
       
     7 @@ -119,10 +119,10 @@
       
     8              raise exception.Forbidden(message
       
     9                                        % self.image.image_id)
       
    10  
       
    11 -    def save(self, image_member):
       
    12 +    def save(self, image_member, from_state=None):
       
    13          if (self.context.is_admin or
       
    14              self.context.owner == image_member.member_id):
       
    15 -            updated_member = self.member_repo.save(image_member)
       
    16 +            updated_member = self.member_repo.save(image_member, from_state=from_state)
       
    17              return proxy_member(self.context, updated_member)
       
    18          else:
       
    19              message = _("You cannot update image member %s")
       
    20 
       
    21 --- glance-2013.2.3.orginal/glance/api/policy.py        2015-02-20 03:57:20.670610060 -0600
       
    22 +++ glance-2013.2.3//glance/api/policy.py       2015-02-20 04:33:34.232748980 -0600
       
    23 @@ -174,9 +174,9 @@
       
    24          self.policy.enforce(self.context, 'get_images', {})
       
    25          return super(ImageRepoProxy, self).list(*args, **kwargs)
       
    26  
       
    27 -    def save(self, image):
       
    28 +    def save(self, image, from_state=None):
       
    29          self.policy.enforce(self.context, 'modify_image', {})
       
    30 -        return super(ImageRepoProxy, self).save(image)
       
    31 +        return super(ImageRepoProxy, self).save(image, from_state=from_state)
       
    32  
       
    33      def add(self, image):
       
    34          self.policy.enforce(self.context, 'add_image', {})
       
    35 @@ -271,9 +271,9 @@
       
    36          self.policy.enforce(self.context, 'get_member', {})
       
    37          return self.member_repo.get(member_id)
       
    38  
       
    39 -    def save(self, member):
       
    40 +    def save(self, member, from_state=None):
       
    41          self.policy.enforce(self.context, 'modify_member', {})
       
    42 -        return self.member_repo.save(member)
       
    43 +        return self.member_repo.save(member, from_state=from_state)
       
    44  
       
    45      def list(self, *args, **kwargs):
       
    46          self.policy.enforce(self.context, 'get_members', {})
       
    47 
       
    48 --- glance-2013.2.3.old/glance/api/v1/upload_utils.py   2014-04-03 11:43:55.000000000 -0700
       
    49 +++ glance-2013.2.3/glance/api/v1/upload_utils.py       2015-03-08 23:28:12.600039932 -0700
       
    50 @@ -139,13 +139,24 @@
       
    51          update_data = {'checksum': checksum,
       
    52                         'size': size}
       
    53          try:
       
    54 -            image_meta = registry.update_image_metadata(req.context,
       
    55 -                                                        image_id,
       
    56 -                                                        update_data)
       
    57 -
       
    58 -        except exception.NotFound as e:
       
    59 -            msg = _("Image %s could not be found after upload. The image may "
       
    60 -                    "have been deleted during the upload.") % image_id
       
    61 +          try:
       
    62 +              state = 'saving'
       
    63 +              image_meta = registry.update_image_metadata(req.context,
       
    64 +                                                      image_id,
       
    65 +                                                       update_data,
       
    66 +                                                       from_state=state)
       
    67 +              image = registry.get_image_metadata(req.context, image_id)
       
    68 +              if image['status'] == 'deleted':
       
    69 +                  raise exception.NotFound()
       
    70 +          except exception.Duplicate:
       
    71 +              image = registry.get_image_metadata(req.context, image_id)
       
    72 +              if image['status'] == 'deleted':
       
    73 +                  raise exception.NotFound()
       
    74 +              else:
       
    75 +                  raise
       
    76 +        except exception.NotFound:
       
    77 +            msg = _("Image %s could not be found after upload. The image may"
       
    78 +                   " have been deleted during the upload.") % image_id
       
    79              LOG.info(msg)
       
    80  
       
    81              # NOTE(jculp): we need to clean up the datastore if an image
       
    82 
       
    83 --- glance-2013.2.3.orginal/glance/api/v2/image_data.py 2015-02-20 03:57:20.678035080 -0600
       
    84 +++ glance-2013.2.3//glance/api/v2/image_data.py        2015-02-20 05:49:21.505608540 -0600
       
    85 @@ -24,6 +24,7 @@
       
    86  import glance.domain
       
    87  import glance.gateway
       
    88  import glance.notifier
       
    89 +from glance.openstack.common import excutils
       
    90  import glance.openstack.common.log as logging
       
    91  import glance.store
       
    92  
       
    93 @@ -53,11 +54,12 @@
       
    94              try:
       
    95                  image_repo.save(image)
       
    96                  image.set_data(data, size)
       
    97 -                image_repo.save(image)
       
    98 -            except exception.NotFound as e:
       
    99 -                msg = (_("Image %s could not be found after upload."
       
   100 -                       "The image may have been deleted during the upload: %s")
       
   101 -                       % (image_id, e))
       
   102 +                image_repo.save(image, from_state='saving')
       
   103 +            except (exception.NotFound, exception.Conflict):
       
   104 +                msg = (_("Image %s could not be found after upload. "
       
   105 +                         "The image may have been deleted during the "
       
   106 +                         "upload, cleaning up the chunks uploaded.") %
       
   107 +                       image_id)
       
   108                  LOG.warn(msg)
       
   109                  raise webob.exc.HTTPGone(explanation=msg,
       
   110                                           request=req,
       
   111 @@ -111,6 +113,10 @@
       
   112              raise webob.exc.HTTPServiceUnavailable(explanation=msg,
       
   113                                                     request=req)
       
   114  
       
   115 +        except webob.exc.HTTPGone as e:
       
   116 +            with excutils.save_and_reraise_exception():
       
   117 +                LOG.error(_("Failed to upload image data due to HTTP error"))
       
   118 +
       
   119          except webob.exc.HTTPError as e:
       
   120              LOG.error(_("Failed to upload image data due to HTTP error"))
       
   121              raise
       
   122 
       
   123 
       
   124 
       
   125 
       
   126 diff --git glance-2013.2.3/glance/db/__init__.py glance-2013.2.3/glance/db/__init__.py
       
   127 
       
   128 index a59447d..379cf6f 100644 (file)
       
   129 
       
   130 
       
   131 --- glance-2013.2.3/glance/db/__init__.py
       
   132 +++ glance-2013.2.3/glance/db/__init__.py
       
   133 @@ -162,7 +162,7 @@ class ImageRepo(object):
       
   134          image.created_at = new_values['created_at']
       
   135          image.updated_at = new_values['updated_at']
       
   136  
       
   137 -    def save(self, image):
       
   138 +    def save(self, image, from_state=None):
       
   139          image_values = self._format_image_to_db(image)
       
   140          if image_values['size'] > CONF.image_size_cap:
       
   141              raise exception.ImageSizeLimitExceeded
       
   142 @@ -170,7 +170,8 @@ class ImageRepo(object):
       
   143              new_values = self.db_api.image_update(self.context,
       
   144                                                    image.image_id,
       
   145                                                    image_values,
       
   146 -                                                  purge_props=True)
       
   147 +                                                  purge_props=True,
       
   148 +                                                  from_state=from_state)
       
   149          except (exception.NotFound, exception.Forbidden):
       
   150              msg = _("No image found with ID %s") % image.image_id
       
   151              raise exception.NotFound(msg)
       
   152 @@ -263,7 +264,7 @@ class ImageMemberRepo(object):
       
   153              msg = _("The specified member %s could not be found")
       
   154              raise exception.NotFound(msg % image_member.id)
       
   155  
       
   156 -    def save(self, image_member):
       
   157 +    def save(self, image_member, from_state=None):
       
   158          image_member_values = self._format_image_member_to_db(image_member)
       
   159          try:
       
   160              new_values = self.db_api.image_member_update(self.context,
       
   161 
       
   162 
       
   163 diff --git glance-2013.2.3/glance/domain/proxy.py glance-2013.2.3/glance/domain/proxy.py
       
   164 
       
   165 index 89f138c..b27b448 100644 (file)
       
   166 
       
   167 
       
   168 --- glance-2013.2.3/glance/domain/proxy.py
       
   169 +++ glance-2013.2.3/glance/domain/proxy.py
       
   170 @@ -94,9 +94,9 @@ class Repo(object):
       
   171          result = self.base.add(base_item)
       
   172          return self.helper.proxy(result)
       
   173  
       
   174 -    def save(self, item):
       
   175 +    def save(self, item, from_state=None):
       
   176          base_item = self.helper.unproxy(item)
       
   177 -        result = self.base.save(base_item)
       
   178 +        result = self.base.save(base_item, from_state=from_state)
       
   179          return self.helper.proxy(result)
       
   180  
       
   181      def remove(self, item):
       
   182 
       
   183 
       
   184 
       
   185 diff --git glance-2013.2.3/glance/store/__init__.py glance-2013.2.3/glance/store/__init__.py
       
   186 
       
   187 index 273b7c7..ae3b4c8 100644 (file)
       
   188 
       
   189 
       
   190 --- glance-2013.2.3/glance/store/__init__.py
       
   191 +++ glance-2013.2.3/glance/store/__init__.py
       
   192 @@ -446,7 +446,7 @@ class ImageRepoProxy(glance.domain.proxy.Repo):
       
   193          self._set_acls(image)
       
   194          return result
       
   195  
       
   196 -    def save(self, image):
       
   197 +    def save(self, image, from_state=None):
       
   198          result = super(ImageRepoProxy, self).save(image)
       
   199          self._set_acls(image)
       
   200          return result
       
   201 
       
   202 --- glance-2013.2.3.orginal/glance/quota/__init__.py    2015-02-20 03:57:20.466150810 -0600
       
   203 +++ glance-2013.2.3/glance/quota/__init__.py    2015-02-25 04:44:45.714636070 -0600
       
   204 @@ -36,6 +36,28 @@
       
   205                                               item_proxy_class=ImageProxy,
       
   206                                               item_proxy_kwargs=proxy_kwargs)
       
   207  
       
   208 +    def _enforce_image_property_quota(self, attempted):
       
   209 +        if CONF.image_property_quota < 0:
       
   210 +            # If value is negative, allow unlimited number of properties
       
   211 +            return
       
   212 +
       
   213 +        maximum = CONF.image_property_quota
       
   214 +        if attempted > maximum:
       
   215 +            kwargs = {'attempted': attempted, 'maximum': maximum}
       
   216 +            exc = exception.ImagePropertyLimitExceeded(**kwargs)
       
   217 +            LOG.debug(six.text_type(exc))
       
   218 +            raise exc
       
   219 +
       
   220 +    def save(self, image, from_state=None):
       
   221 +        if image.added_new_properties():
       
   222 +            self._enforce_image_property_quota(len(image.extra_properties))
       
   223 +        return super(ImageRepoProxy, self).save(image, from_state=from_state)
       
   224 +
       
   225 +    def add(self, image):
       
   226 +        self._enforce_image_property_quota(len(image.extra_properties))
       
   227 +        return super(ImageRepoProxy, self).add(image)
       
   228 +
       
   229 +
       
   230  
       
   231  class ImageFactoryProxy(glance.domain.proxy.ImageFactory):
       
   232      def __init__(self, factory, context, db_api):
       
   233 
       
   234 --- glance-2013.2.3.orginal/glance/registry/client/v1/api.py    2015-02-20 03:57:20.477473040 -0600
       
   235 +++ glance-2013.2.3/glance/registry/client/v1/api.py    2015-02-26 02:15:02.437773030 -0600
       
   236 @@ -164,11 +164,11 @@
       
   237  
       
   238  
       
   239  def update_image_metadata(context, image_id, image_meta,
       
   240 -                          purge_props=False):
       
   241 +                          purge_props=False, from_state=None):
       
   242      LOG.debug(_("Updating image metadata for image %s..."), image_id)
       
   243      c = get_registry_client(context)
       
   244 -    return c.update_image(image_id, image_meta, purge_props)
       
   245 -
       
   246 +    return c.update_image(image_id, image_meta, purge_props,
       
   247 +                          from_state=from_state)
       
   248  
       
   249  def delete_image_metadata(context, image_id):
       
   250      LOG.debug(_("Deleting image metadata for image %s..."), image_id)
       
   251 
       
   252 --- glance-2013.2.3.orginal/glance/registry/client/v1/client.py 2015-02-20 03:57:20.477107680 -0600
       
   253 +++ glance-2013.2.3/glance/registry/client/v1/client.py 2015-02-26 02:25:21.498753360 -0600
       
   254 @@ -165,7 +165,8 @@
       
   255          image = data['image']
       
   256          return self.decrypt_metadata(image)
       
   257  
       
   258 -    def update_image(self, image_id, image_metadata, purge_props=False):
       
   259 +    def update_image(self, image_id, image_metadata, purge_props=False,
       
   260 +                     from_state=None):
       
   261          """
       
   262          Updates Registry's information about an image
       
   263          """
       
   264 @@ -174,6 +175,7 @@
       
   265  
       
   266          encrypted_metadata = self.encrypt_metadata(image_metadata['image'])
       
   267          image_metadata['image'] = encrypted_metadata
       
   268 +        image_metadata['from_state'] = from_state
       
   269          body = json.dumps(image_metadata)
       
   270  
       
   271          headers = {
       
   272