bup

Package-Manager: portage-2.2.14/cvs/Linux x86_64
Manifest-Sign-Key: 0x33ED3FD25AFC78BA

4 files changed, 24 insertions, 302 deletions

diff --git a/sys-cluster/nova/ChangeLog b/sys-cluster/nova/ChangeLog
index 0d6ca7c5143d..427bc21dd7b5 100644
--- a/sys-cluster/nova/ChangeLog
+++ b/sys-cluster/nova/ChangeLog
@@ -1,6 +1,12 @@
 # ChangeLog for sys-cluster/nova
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.85 2015/03/24 04:20:13 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.86 2015/04/13 03:31:07 prometheanfire Exp $
+
+*nova-2014.2.3 (13 Apr 2015)
+
+  13 Apr 2015; Matthew Thode <prometheanfire@gentoo.org> +nova-2014.2.3.ebuild,
+  -files/CVE-2015-0259-2014.2.2.patch, -nova-2014.2.2-r1.ebuild:
+  bup
 
   24 Mar 2015; Matthew Thode <prometheanfire@gentoo.org>
   nova-2014.2.2-r1.ebuild, nova-2014.2.9999.ebuild:
diff --git a/sys-cluster/nova/Manifest b/sys-cluster/nova/Manifest
index edfdccbe409a..d2f1089fcd8f 100644
--- a/sys-cluster/nova/Manifest
+++ b/sys-cluster/nova/Manifest
@@ -1,28 +1,27 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
-AUX CVE-2015-0259-2014.2.2.patch 10495 SHA256 50be4a848cc3e9b7d304935472d2ea46a50dc21deac0fac5ce219cd40bf37310 SHA512 cfd57a31bd1081fa0fd35df9ede8dc404284db9134462c6358553bcf2a441eb98cef38dd800be9b9435d8cc8c656a897bcae31123f5eb952e3ab8a8516a6791d WHIRLPOOL 23a63bc15c816ff9de382acb56f92b22e60c56f37c3e21614a6d56fe0563033f8d14601152e005e225a1ef25ee492ff6b169246daac0a91e8f302b615bf72fdb
 AUX nova-sudoers 78 SHA256 9e88c2843fb74cc46802c0b103067ad12915ec50335d05e546a5dba76acb4a76 SHA512 22c0606c6335b2d1a03bd18a319a54f16f76f091b2e8416dbba05ce7c15890beff7f32f0322eb5ba3f2a5c750436cacbe0cee189b390b878e3f0c0df219ef984 WHIRLPOOL bc42ae1d12e9f900b263fd5c3d0f59062f46fbec1ff97c0bceb234082bea5943eb64795b4f5e102b8e2749c6868163e5924467088cad42df09345e3406e5f83c
 AUX nova.initd 627 SHA256 74417e422e6c503ae338bb981934b54a5da57e783bdfed778de6ce9fec3617b8 SHA512 163d5d94f6ce7c67413b9e90161590651329c96e1c8df480d1c983294f43bd596ef75ebe818cd1a8f1557babfd6bbd02a7deaf597d936acfe882dc3c9c5a1f42 WHIRLPOOL b51a0316513d06083f2cfa572427926c14663ab984bcd26a9521bf88699bfefd745e7ff91e9330bae86bd769d809837e010caa948cd133fbd010e820b7ab8448
-DIST nova-2014.2.2.tar.gz 4423122 SHA256 18dfd433aa043389318f28890578dcbe3c0606a38360f39ec8df8670150f89d7 SHA512 d2564066c5c96a32cc47e5066b2310611eb2488fb2082f43bf89dccc92ebd8ac536d8f591ebe2b9c1865b22f69acd308e5bb3a2a636f5b27f9ddfa765dd18300 WHIRLPOOL ed563e9caa37bd0df2a587597494fb33525ad84cba46c7c1f7f4f45cffc20c38cf843b642a2e67d99af994c42a4ac5a81b358ec63e7898de3225c6629dc50f24
-EBUILD nova-2014.2.2-r1.ebuild 6114 SHA256 f792f7fcb14239571fbb1e8ffb301909a90afccd5afc1c23702f81d44935b799 SHA512 c437a80e89a5119b3fc3cda25cbf62cdc9d7561c18ec5f97085578a44f4bf267e39676f4cd84ac6551cde5721756560d9ef37176715ab7abe67b30ffd16e3d3d WHIRLPOOL 3e8728b11172790372e01dcff0682ad6087915b8f697eb91c4c8757644d0111bb4431d4b1fab36afa54980611a96123799542e5071da8ae183a967c87f871cdd
+DIST nova-2014.2.3.tar.gz 4436742 SHA256 5fc1f02c887a4ca9b1968dba71864cdb5e81bfbee3da398c64260be0cf1d7a2b SHA512 320ff0b3d6257834b96629101b0c1d6c4b240004dc8f9775759aa6532d166c8849bc3feef04e001421a75f36bd3516b8df0b595af30d020c3d9c22af843c5099 WHIRLPOOL 653c2485f89df171c03e290ce6cbc61c0a964d64440a0de9ebfda24dec6abac4e1c633d0a0057d7e531590e5bc9d3f048a0fe8b89c8db22007ef72ec24e3ebf7
+EBUILD nova-2014.2.3.ebuild 6067 SHA256 b8ea6d84e8bfbf5c5658b10938d4da15b8dfbb9044b4b4b475ebeb3a89a75793 SHA512 38188b2c1e0eed1fe23002ccfaa81f6782b74276b587b21765f83b359ae67f8757e6222b0bc2c1d819f238c2c943c1ebf5fdab5da1b0bb1de08934b04ba16550 WHIRLPOOL 2db61b4f347a886465b29c02901d9ec3ea7f34e0abb49be18e754269032a7aa932221f918d905a1add52d28672d0e28629dd7d55213fec71ba45b318b4edd5e3
 EBUILD nova-2014.2.9999.ebuild 6075 SHA256 eefe8729db7296ca360cddabfde23258be0a908921d94ab25ea585e199ddf9b1 SHA512 6ebfc8afdcfb33aaccf0bc137360c563572c743d3fb937e18805eba5d13f9a6c027311917327a519ee71492070875528d58fff3f1747b35e1f0031f973decf68 WHIRLPOOL 989b23c9d9edd618c6338731b5763f2a258de2241830e934bfbc26f38f105b61206934ee78188eb760fa47f63f1f65b9df8bf7e2279eb3596d8a99089f74f322
-MISC ChangeLog 18845 SHA256 03f04c805dd208eb50a5ed045f49b111fed70e8ddec9be4baa0875ad79d60c93 SHA512 ad79cc2b0c8a149095665667696486ff20fe5ea727439c1ac04c4fb46cc3320133b7ac7e6ab38810ca79e12c645766a2f4c4809a2dfe779b1210862fc4e58a7f WHIRLPOOL 35768e0333c31d1d460d4cf2e8096f596a7df53db94e5c42d24be2f7ac8a3ba386dbb369fc403093d2a8a7cb9ead7a2e0001cda28757629fc39e0140c50600c1
+MISC ChangeLog 19027 SHA256 8d4e8b7f885464e0e6e9fbbb5182c5c13a8c3d7b5dc6e3c4949456367483ea6e SHA512 7682f6b131693ed7d3cf974b9fc2440d601d93db4024b06b72ee900f624e9bfbd1c2b59125f29698b5fa5eed17528378d2ff99ee5350b9eeb7dd7a0e1d562392 WHIRLPOOL 027561b39f38620ffebbab58ea7100cfc8708f822f2b33bcca57f56ca0252294e8156b4ca79922f7a34d4981e2c4955f94a4d515c298d222e18cb5dab9464083
 MISC metadata.xml 911 SHA256 d5ba172160431f66d7d3bfa414209ef83b9e449efd3a55ded6d6ab91b3adeece SHA512 eb2c13ad92930a0792580d276672c7e9aae07ae09109bb6149429dff5e24951509ea95fa182ebdbb8a9a94b5dcbf6b25b580a16878c9b201ffa840270919d30e WHIRLPOOL 0a0eb3e24dade3fb862a89ad92a3da54191fa3bca682a8a512410c5f376d575ef21703cdcb085e7a423b89e8c08bdb682ef53392c43f19fdb0f6fd4984bfd0ce
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iQIbBAEBCAAGBQJVEOYHAAoJEGSje+quGaToWfAP+NJjqqLa20CcmPY8OTe3E/xV
-eQi7tP+n3AXMFjVxPSj6UqBJZQhPrBfVO5DkPbHH1iEVNmi1OOZCHEEptQN46nTe
-3mzo4lj7KTr1JtYrZLOQKs0E9pOIjaIjARPL9cJS3bigeJ1687bCUBYHLbphvbMF
-4wgraeIjPNYBE7THt3szb1QBsjsnHskpMxTiKbwxWa5TZdFcRSHtMUA+Z5AcIPaZ
-YlMeiFdLB+M7o+bUzcgLmlDVe+cyfEg+LNjnE1n70KmvVhmTaaqVSgA8lLCiwsqN
-9TDQ9PgY0hWT8+GlKElU+fnJ1WWoKZCSNbVtHIighvfa7idyOnl4bcWgtiYTBVEN
-I39oRqjLysuN3C+VSarKAnGt7hChtjsoc0MCqbTxioMfCC7NCxiJUJwT1oSNVTqQ
-DIvVwXj1h2m9US5vOvqkyOoFtvf9ANmcUTP1zLUL4eYOgkwwd8Yqx4+69YvyV4at
-yVcwrXAlpCLKxPud5A3zCPT4XUpVUktGEZ3kZqVMqzt0+ejRzhErQY+qgzR0OReA
-xeZxS8iWl5VVPGNBcZqS6a51IXQHGvVc2G38OF8Y6ZDIy1k/EovlZ/4sJLRhWSmY
-2EwGPKTdZvqAPJsFHWSXjetLUXvNVE6m2cjCVcOWg1jl5IhxMnH5WwSvaEppuyoF
-851X+mwOEn8nvtTW4TM=
-=ImoM
+iQIcBAEBCAAGBQJVKziEAAoJEGSje+quGaToTpQQAKmBwEbxYSvvu8jORvlG4gyR
+BgVXxGEjy51l0HaK8Xv/2hiCpXF3HP3fiL6SOTFk3lp1uqHIPPa7/rwfZGFseN3l
+HTYtnvlfSPqU8RIvkzW7thms39pWWR0n41VdpPWkGeE2SNr+QcHZGUXJGnnAQcUv
+vznTJWIyevX1jbVszexY0bh6HANo2uudfiUy7yOnwaTYmFPFT25H0EQ9DDYA8Eie
+7hPep8KwfoFo3s6UfDZMRBND+yNT8ard2Pxuon4wU/TXJRP67EFkEGXaeggvnegV
+dspEDDhjFyZ4fFD7didGlLgb8oXiu3tlJMTK3djC2mCSSinp84WLJl8bZvTvDlHE
+uhjzD792hXgnB6ZKi9C0EkwgC7uwJJkke8iGYDHx2yrTh4C+pHTS7CGurE4TZ2gA
+2gQ36VgTblKHnUQ1Xa4mIg1lfdC9jJWOBIBPEEAz1LNrl4N0j4CgqVugKsy19+vI
+wipYbz9+zjP7rTEJEJrjlaaVDTeg+WptiQsC+FhHf4XzF4A2vzfDA7WxbLPz7vre
+Pmn/SA/Furqtivx2/BIjv5HoHoURrwt03yV6ZpEV7BW9qVDqXp/D/L9GEJkaey2Z
+aFdW7WQoPY4YihaVlX/Ex8oNCmpaYMChCGKfWDp2gdf4N1/o5bdYQvS6Xv2RHVDM
+C1gpeMSdXNZR+2a9l3g0
+=kV53
 -----END PGP SIGNATURE-----
diff --git a/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch b/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
deleted file mode 100644
index c9de61bd4080..000000000000
--- a/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
+++ /dev/null
@@ -1,282 +0,0 @@
-From 8998627807f6512a8efd0902ed7c08b4273c7bcf Mon Sep 17 00:00:00 2001
-From: Dave McCowan <dmccowan@cisco.com>
-Date: Tue, 24 Feb 2015 21:35:48 -0500
-Subject: [PATCH] Websocket Proxy should verify Origin header
-
-If the Origin HTTP header passed in the WebSocket handshake does
-not match the host, this could indicate an attempt at a
-cross-site attack.  This commit adds a check to verify
-the origin matches the host.
-
-Closes-Bug: 1409142
----
- nova/console/websocketproxy.py            |  37 ++++++++
- nova/tests/console/test_websocketproxy.py | 143 +++++++++++++++++++++++++++++-
- 2 files changed, 176 insertions(+), 4 deletions(-)
-
-diff --git a/nova/console/websocketproxy.py b/nova/console/websocketproxy.py
-index ef684f5..ead557c 100644
---- a/nova/console/websocketproxy.py
-+++ b/nova/console/websocketproxy.py
-@@ -22,17 +22,37 @@ import Cookie
- import socket
- import urlparse
- 
-+from oslo.config import cfg
- import websockify
- 
- from nova.consoleauth import rpcapi as consoleauth_rpcapi
- from nova import context
-+from nova import exception
- from nova.i18n import _
- from nova.openstack.common import log as logging
- 
- LOG = logging.getLogger(__name__)
- 
-+CONF = cfg.CONF
-+CONF.import_opt('novncproxy_base_url', 'nova.vnc')
-+CONF.import_opt('html5proxy_base_url', 'nova.spice', group='spice')
-+
- 
- class NovaProxyRequestHandlerBase(object):
-+    def verify_origin_proto(self, console_type, origin_proto):
-+        if console_type == 'novnc':
-+            expected_proto = \
-+                urlparse.urlparse(CONF.novncproxy_base_url).scheme
-+        elif console_type == 'spice-html5':
-+            expected_proto = \
-+                urlparse.urlparse(CONF.spice.html5proxy_base_url).scheme
-+        else:
-+            detail = _("Invalid Console Type for WebSocketProxy: '%s'") % \
-+                        console_type
-+            LOG.audit(detail)
-+            raise exception.ValidationError(detail=detail)
-+        return origin_proto == expected_proto
-+
-     def new_websocket_client(self):
-         """Called after a new WebSocket connection has been established."""
-         # Reopen the eventlet hub to make sure we don't share an epoll
-@@ -62,6 +82,23 @@ class NovaProxyRequestHandlerBase(object):
-         if not connect_info:
-             raise Exception(_("Invalid Token"))
- 
-+        # Verify Origin
-+        expected_origin_netloc = self.headers.getheader('Host')
-+        origin_url = self.headers.getheader('Origin')
-+        origin = urlparse.urlparse(origin_url)
-+        origin_netloc = origin.netloc
-+        origin_scheme = origin.scheme
-+        if origin_netloc == '' or origin_scheme == '':
-+            detail = _("Origin header not valid.")
-+            raise exception.ValidationError(detail=detail)
-+        if expected_origin_netloc != origin_netloc:
-+            detail = _("Origin header does not match this host.")
-+            raise exception.ValidationError(detail=detail)
-+        if not self.verify_origin_proto(connect_info['console_type'],
-+                                          origin.scheme):
-+            detail = _("Origin header protocol does not match this host.")
-+            raise exception.ValidationError(detail=detail)
-+
-         self.msg(_('connect info: %s'), str(connect_info))
-         host = connect_info['host']
-         port = int(connect_info['port'])
-diff --git a/nova/tests/console/test_websocketproxy.py b/nova/tests/console/test_websocketproxy.py
-index 1e51a4d..b125c54 100644
---- a/nova/tests/console/test_websocketproxy.py
-+++ b/nova/tests/console/test_websocketproxy.py
-@@ -16,10 +16,14 @@
- 
- 
- import mock
-+from oslo.config import cfg
- 
- from nova.console import websocketproxy
-+from nova import exception
- from nova import test
- 
-+CONF = cfg.CONF
-+
- 
- class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
- 
-@@ -31,15 +35,72 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
-         self.wh.msg = mock.MagicMock()
-         self.wh.do_proxy = mock.MagicMock()
-         self.wh.headers = mock.MagicMock()
-+        CONF.set_override('novncproxy_base_url',
-+                          'https://example.net:6080/vnc_auto.html')
-+        CONF.set_override('html5proxy_base_url',
-+                          'https://example.net:6080/vnc_auto.html',
-+                          'spice')
-+
-+    def _fake_getheader(self, header):
-+        if header == 'cookie':
-+            return 'token="123-456-789"'
-+        elif header == 'Origin':
-+            return 'https://example.net:6080'
-+        elif header == 'Host':
-+            return 'example.net:6080'
-+        else:
-+            return
-+
-+    def _fake_getheader_bad_token(self, header):
-+        if header == 'cookie':
-+            return 'token="XXX"'
-+        elif header == 'Origin':
-+            return 'https://example.net:6080'
-+        elif header == 'Host':
-+            return 'example.net:6080'
-+        else:
-+            return
-+
-+    def _fake_getheader_bad_origin(self, header):
-+        if header == 'cookie':
-+            return 'token="123-456-789"'
-+        elif header == 'Origin':
-+            return 'https://bad-origin-example.net:6080'
-+        elif header == 'Host':
-+            return 'example.net:6080'
-+        else:
-+            return
-+
-+    def _fake_getheader_blank_origin(self, header):
-+        if header == 'cookie':
-+            return 'token="123-456-789"'
-+        elif header == 'Origin':
-+            return ''
-+        elif header == 'Host':
-+            return 'example.net:6080'
-+        else:
-+            return
-+
-+    def _fake_getheader_http(self, header):
-+        if header == 'cookie':
-+            return 'token="123-456-789"'
-+        elif header == 'Origin':
-+            return 'http://example.net:6080'
-+        elif header == 'Host':
-+            return 'example.net:6080'
-+        else:
-+            return
- 
-     @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-     def test_new_websocket_client(self, check_token):
-         check_token.return_value = {
-             'host': 'node1',
--            'port': '10000'
-+            'port': '10000',
-+            'console_type': 'novnc'
-         }
-         self.wh.socket.return_value = '<socket>'
-         self.wh.path = "ws://127.0.0.1/?token=123-456-789"
-+        self.wh.headers.getheader = self._fake_getheader
- 
-         self.wh.new_websocket_client()
- 
-@@ -52,6 +113,7 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
-         check_token.return_value = False
- 
-         self.wh.path = "ws://127.0.0.1/?token=XXX"
-+        self.wh.headers.getheader = self._fake_getheader
- 
-         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
-         check_token.assert_called_with(mock.ANY, token="XXX")
-@@ -60,11 +122,12 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
-     def test_new_websocket_client_novnc(self, check_token):
-         check_token.return_value = {
-             'host': 'node1',
--            'port': '10000'
-+            'port': '10000',
-+            'console_type': 'novnc'
-         }
-         self.wh.socket.return_value = '<socket>'
-         self.wh.path = "http://127.0.0.1/"
--        self.wh.headers.getheader.return_value = "token=123-456-789"
-+        self.wh.headers.getheader = self._fake_getheader
- 
-         self.wh.new_websocket_client()
- 
-@@ -77,7 +140,79 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
-         check_token.return_value = False
- 
-         self.wh.path = "http://127.0.0.1/"
--        self.wh.headers.getheader.return_value = "token=XXX"
-+        self.wh.headers.getheader = self._fake_getheader_bad_token
- 
-         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
-         check_token.assert_called_with(mock.ANY, token="XXX")
-+
-+    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-+    def test_new_websocket_client_novnc_bad_origin_header(self, check_token):
-+        check_token.return_value = {
-+            'host': 'node1',
-+            'port': '10000',
-+            'console_type': 'novnc'
-+        }
-+
-+        self.wh.path = "http://127.0.0.1/"
-+        self.wh.headers.getheader = self._fake_getheader_bad_origin
-+
-+        self.assertRaises(exception.ValidationError,
-+                          self.wh.new_websocket_client)
-+
-+    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-+    def test_new_websocket_client_novnc_blank_origin_header(self, check_token):
-+        check_token.return_value = {
-+            'host': 'node1',
-+            'port': '10000',
-+            'console_type': 'novnc'
-+        }
-+
-+        self.wh.path = "http://127.0.0.1/"
-+        self.wh.headers.getheader = self._fake_getheader_blank_origin
-+
-+        self.assertRaises(exception.ValidationError,
-+                          self.wh.new_websocket_client)
-+
-+    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-+    def test_new_websocket_client_novnc_bad_origin_proto_vnc(self,
-+                                                             check_token):
-+        check_token.return_value = {
-+            'host': 'node1',
-+            'port': '10000',
-+            'console_type': 'novnc'
-+        }
-+
-+        self.wh.path = "http://127.0.0.1/"
-+        self.wh.headers.getheader = self._fake_getheader_http
-+
-+        self.assertRaises(exception.ValidationError,
-+                          self.wh.new_websocket_client)
-+
-+    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-+    def test_new_websocket_client_novnc_bad_origin_proto_spice(self,
-+                                                               check_token):
-+        check_token.return_value = {
-+            'host': 'node1',
-+            'port': '10000',
-+            'console_type': 'spice-html5'
-+        }
-+
-+        self.wh.path = "http://127.0.0.1/"
-+        self.wh.headers.getheader = self._fake_getheader_http
-+
-+        self.assertRaises(exception.ValidationError,
-+                          self.wh.new_websocket_client)
-+
-+    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
-+    def test_new_websocket_client_novnc_bad_console_type(self, check_token):
-+        check_token.return_value = {
-+            'host': 'node1',
-+            'port': '10000',
-+            'console_type': 'bad-console-type'
-+        }
-+
-+        self.wh.path = "http://127.0.0.1/"
-+        self.wh.headers.getheader = self._fake_getheader
-+
-+        self.assertRaises(exception.ValidationError,
-+                          self.wh.new_websocket_client)
--- 
-1.9.3 (Apple Git-50)
-
diff --git a/sys-cluster/nova/nova-2014.2.2-r1.ebuild b/sys-cluster/nova/nova-2014.2.3.ebuild
index adf04faba0b7..fea20ac42217 100644
--- a/sys-cluster/nova/nova-2014.2.2-r1.ebuild
+++ b/sys-cluster/nova/nova-2014.2.3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.2-r1.ebuild,v 1.2 2015/03/24 04:20:13 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.3.ebuild,v 1.1 2015/04/13 03:31:07 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -100,7 +100,6 @@ RDEPEND="
 		   app-emulation/xen-tools )"
 
 PATCHES=(
-	"${FILESDIR}/CVE-2015-0259-2014.2.2.patch"
 )
 
 pkg_setup() {