--- /dev/null
+From 690c05ca495f1d55a469724c94e1551cbfa836f2 Mon Sep 17 00:00:00 2001
+From: Rajesh Tailor <rajesh.tailor@nttdata.com>
+Date: Wed, 4 Mar 2015 05:05:19 -0800
+Subject: [PATCH] Delete orphaned instance files from compute nodes
+
+While resizing/revert-resizing instance, if instance gets deleted
+in between, then instance files remains either on the source or
+destination compute node.
+
+To address this issue, added a new periodic task
+'_cleanup_incomplete_migrations' which takes care of deleting
+instance files from source/destination compute nodes and then
+mark migration record as failed so that it doesn't appear again
+in the next periodic task run.
+
+SecurityImpact
+
+Closes-Bug: 1392527
+Change-Id: I9866d8e32e99b9f907921f4b226edf7b62bd83a7
+(cherry picked from commit 4655751cdd97a4b527a25c7c0a96044ba212cd19)
+---
+ nova/compute/manager.py | 61 ++++++++++++++++++++++--
+ nova/tests/unit/compute/test_compute_mgr.py | 72 +++++++++++++++++++++++++++++
+ 2 files changed, 129 insertions(+), 4 deletions(-)
+
+diff --git a/nova/compute/manager.py b/nova/compute/manager.py
+index bf5585e..24a5811 100644
+--- a/nova/compute/manager.py
++++ b/nova/compute/manager.py
+@@ -267,15 +267,21 @@ def errors_out_migration(function):
+ def decorated_function(self, context, *args, **kwargs):
+ try:
+ return function(self, context, *args, **kwargs)
+- except Exception:
++ except Exception as ex:
+ with excutils.save_and_reraise_exception():
+ wrapped_func = utils.get_wrapped_function(function)
+ keyed_args = safe_utils.getcallargs(wrapped_func, context,
+ *args, **kwargs)
+ migration = keyed_args['migration']
+- status = migration.status
+- if status not in ['migrating', 'post-migrating']:
+- return
++
++ # NOTE(rajesht): If InstanceNotFound error is thrown from
++ # decorated function, migration status should be set to
++ # 'error', without checking current migration status.
++ if not isinstance(ex, exception.InstanceNotFound):
++ status = migration.status
++ if status not in ['migrating', 'post-migrating']:
++ return
++
+ migration.status = 'error'
+ try:
+ with migration.obj_as_admin():
+@@ -3727,6 +3733,7 @@ class ComputeManager(manager.Manager):
+ @wrap_exception()
+ @reverts_task_state
+ @wrap_instance_event
++ @errors_out_migration
+ @wrap_instance_fault
+ def revert_resize(self, context, instance, migration, reservations):
+ """Destroys the new instance on the destination machine.
+@@ -3783,6 +3790,7 @@ class ComputeManager(manager.Manager):
+ @wrap_exception()
+ @reverts_task_state
+ @wrap_instance_event
++ @errors_out_migration
+ @wrap_instance_fault
+ def finish_revert_resize(self, context, instance, reservations, migration):
+ """Finishes the second half of reverting a resize.
+@@ -6578,6 +6586,51 @@ class ComputeManager(manager.Manager):
+ with utils.temporary_mutation(context, read_deleted='yes'):
+ instance.save()
+
++ @periodic_task.periodic_task(spacing=CONF.instance_delete_interval)
++ def _cleanup_incomplete_migrations(self, context):
++ """Delete instance files on failed resize/revert-resize operation
++
++ During resize/revert-resize operation, if that instance gets deleted
++ in-between then instance files might remain either on source or
++ destination compute node because of race condition.
++ """
++ LOG.debug('Cleaning up deleted instances with incomplete migration ')
++ migration_filters = {'host': CONF.host,
++ 'status': 'error'}
++ migrations = objects.MigrationList.get_by_filters(context,
++ migration_filters)
++
++ if not migrations:
++ return
++
++ inst_uuid_from_migrations = set([migration.instance_uuid for migration
++ in migrations])
++
++ inst_filters = {'deleted': True, 'soft_deleted': False,
++ 'uuid': inst_uuid_from_migrations}
++ attrs = ['info_cache', 'security_groups', 'system_metadata']
++ with utils.temporary_mutation(context, read_deleted='yes'):
++ instances = objects.InstanceList.get_by_filters(
++ context, inst_filters, expected_attrs=attrs, use_slave=True)
++
++ for instance in instances:
++ if instance.host != CONF.host:
++ for migration in migrations:
++ if instance.uuid == migration.instance_uuid:
++ # Delete instance files if not cleanup properly either
++ # from the source or destination compute nodes when
++ # the instance is deleted during resizing.
++ self.driver.delete_instance_files(instance)
++ try:
++ migration.status = 'failed'
++ with migration.obj_as_admin():
++ migration.save()
++ except exception.MigrationNotFound:
++ LOG.warning(_LW("Migration %s is not found."),
++ migration.id, context=context,
++ instance=instance)
++ break
++
+ @messaging.expected_exceptions(exception.InstanceQuiesceNotSupported,
+ exception.NovaException,
+ NotImplementedError)
+diff --git a/nova/tests/unit/compute/test_compute_mgr.py b/nova/tests/unit/compute/test_compute_mgr.py
+index 4b7234e..ee1ab47 100644
+--- a/nova/tests/unit/compute/test_compute_mgr.py
++++ b/nova/tests/unit/compute/test_compute_mgr.py
+@@ -1374,6 +1374,78 @@ class ComputeManagerUnitTestCase(test.NoDBTestCase):
+ self.assertFalse(c.cleaned)
+ self.assertEqual('1', c.system_metadata['clean_attempts'])
+
++ @mock.patch.object(objects.Migration, 'obj_as_admin')
++ @mock.patch.object(objects.Migration, 'save')
++ @mock.patch.object(objects.MigrationList, 'get_by_filters')
++ @mock.patch.object(objects.InstanceList, 'get_by_filters')
++ def _test_cleanup_incomplete_migrations(self, inst_host,
++ mock_inst_get_by_filters,
++ mock_migration_get_by_filters,
++ mock_save, mock_obj_as_admin):
++ def fake_inst(context, uuid, host):
++ inst = objects.Instance(context)
++ inst.uuid = uuid
++ inst.host = host
++ return inst
++
++ def fake_migration(uuid, status, inst_uuid, src_host, dest_host):
++ migration = objects.Migration()
++ migration.uuid = uuid
++ migration.status = status
++ migration.instance_uuid = inst_uuid
++ migration.source_compute = src_host
++ migration.dest_compute = dest_host
++ return migration
++
++ fake_instances = [fake_inst(self.context, '111', inst_host),
++ fake_inst(self.context, '222', inst_host)]
++
++ fake_migrations = [fake_migration('123', 'error', '111',
++ 'fake-host', 'fake-mini'),
++ fake_migration('456', 'error', '222',
++ 'fake-host', 'fake-mini')]
++
++ mock_migration_get_by_filters.return_value = fake_migrations
++ mock_inst_get_by_filters.return_value = fake_instances
++
++ with mock.patch.object(self.compute.driver, 'delete_instance_files'):
++ self.compute._cleanup_incomplete_migrations(self.context)
++
++ # Ensure that migration status is set to 'failed' after instance
++ # files deletion for those instances whose instance.host is not
++ # same as compute host where periodic task is running.
++ for inst in fake_instances:
++ if inst.host != CONF.host:
++ for mig in fake_migrations:
++ if inst.uuid == mig.instance_uuid:
++ self.assertEqual('failed', mig.status)
++
++ def test_cleanup_incomplete_migrations_dest_node(self):
++ """Test to ensure instance files are deleted from destination node.
++
++ If instance gets deleted during resizing/revert-resizing operation,
++ in that case instance files gets deleted from instance.host (source
++ host here), but there is possibility that instance files could be
++ present on destination node.
++ This test ensures that `_cleanup_incomplete_migration` periodic
++ task deletes orphaned instance files from destination compute node.
++ """
++ self.flags(host='fake-mini')
++ self._test_cleanup_incomplete_migrations('fake-host')
++
++ def test_cleanup_incomplete_migrations_source_node(self):
++ """Test to ensure instance files are deleted from source node.
++
++ If instance gets deleted during resizing/revert-resizing operation,
++ in that case instance files gets deleted from instance.host (dest
++ host here), but there is possibility that instance files could be
++ present on source node.
++ This test ensures that `_cleanup_incomplete_migration` periodic
++ task deletes orphaned instance files from source compute node.
++ """
++ self.flags(host='fake-host')
++ self._test_cleanup_incomplete_migrations('fake-mini')
++
+ def test_attach_interface_failure(self):
+ # Test that the fault methods are invoked when an attach fails
+ db_instance = fake_instance.fake_db_instance()
+--
+2.4.5
+
+
--- /dev/null
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI=5
+PYTHON_COMPAT=( python2_7 )
+
+inherit distutils-r1 eutils linux-info multilib user
+
+DESCRIPTION="A cloud computing fabric controller (main part of an IaaS system) written in Python"
+HOMEPAGE="https://launchpad.net/nova"
+SRC_URI="https://launchpad.net/${PN}/kilo/${PV}/+download/${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="+compute compute-only iscsi +kvm +memcached mysql +novncproxy openvswitch postgres +rabbitmq sqlite test xen"
+REQUIRED_USE="!compute-only? ( || ( mysql postgres sqlite ) )
+ compute-only? ( compute !rabbitmq !memcached !mysql !postgres !sqlite )
+ compute? ( ^^ ( kvm xen ) )"
+
+DEPEND="
+ dev-python/setuptools[${PYTHON_USEDEP}]
+ >=dev-python/pbr-0.8[${PYTHON_USEDEP}]
+ <dev-python/pbr-1.0[${PYTHON_USEDEP}]
+ app-admin/sudo
+ test? (
+ ${RDEPEND}
+ >=dev-python/hacking-0.10.0[${PYTHON_USEDEP}]
+ <dev-python/hacking-0.11[${PYTHON_USEDEP}]
+ >=dev-python/coverage-3.6[${PYTHON_USEDEP}]
+ >=dev-python/fixtures-0.3.14[${PYTHON_USEDEP}]
+ <dev-python/fixtures-1.3.0[${PYTHON_USEDEP}]
+ >=dev-python/mock-1.0[${PYTHON_USEDEP}]
+ <dev-python/mock-1.1.0[${PYTHON_USEDEP}]
+ >=dev-python/mox3-0.7.0[${PYTHON_USEDEP}]
+ <dev-python/mox3-0.8.0[${PYTHON_USEDEP}]
+ dev-python/mysql-python[${PYTHON_USEDEP}]
+ dev-python/psycopg[${PYTHON_USEDEP}]
+ >=dev-python/python-barbicanclient-3.0.1[${PYTHON_USEDEP}]
+ <dev-python/python-barbicanclient-3.1.0[${PYTHON_USEDEP}]
+ >=dev-python/python-ironicclient-0.4.1[${PYTHON_USEDEP}]
+ <dev-python/python-ironicclient-0.6.0[${PYTHON_USEDEP}]
+ >=dev-python/subunit-0.0.18[${PYTHON_USEDEP}]
+ >=dev-python/requests-mock-0.6.0[${PYTHON_USEDEP}]
+ >=dev-python/sphinx-1.1.2[${PYTHON_USEDEP}]
+ !~dev-python/sphinx-1.2.0[${PYTHON_USEDEP}]
+ <dev-python/sphinx-1.3[${PYTHON_USEDEP}]
+ >=dev-python/oslo-sphinx-2.5.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-sphinx-2.6.0[${PYTHON_USEDEP}]
+ >=dev-python/oslotest-1.5.1[${PYTHON_USEDEP}]
+ <dev-python/oslotest-1.6.0[${PYTHON_USEDEP}]
+ >=dev-python/testrepository-0.0.18[${PYTHON_USEDEP}]
+ >=dev-python/testtools-0.9.36[${PYTHON_USEDEP}]
+ !~dev-python/testtools-1.2.0[${PYTHON_USEDEP}]
+ >=dev-python/tempest-lib-0.4.0[${PYTHON_USEDEP}]
+ <dev-python/tempest-lib-0.5.0[${PYTHON_USEDEP}]
+ >=dev-python/suds-0.4[${PYTHON_USEDEP}]
+ >=dev-python/oslo-vmware-0.11.1[${PYTHON_USEDEP}]
+ <dev-python/oslo-vmware-0.12.0[${PYTHON_USEDEP}]
+ )"
+
+# barbicanclient is in here for doc generation
+RDEPEND="
+ compute-only? (
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
+ )
+ sqlite? (
+ >=dev-python/sqlalchemy-0.9.7[sqlite,${PYTHON_USEDEP}]
+ <=dev-python/sqlalchemy-0.9.99[sqlite,${PYTHON_USEDEP}]
+ )
+ mysql? (
+ dev-python/mysql-python
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
+ )
+ postgres? (
+ dev-python/psycopg:2
+ >=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
+ <=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
+ )
+ >=dev-python/boto-2.32.1[${PYTHON_USEDEP}]
+ >=dev-python/decorator-3.4.0[${PYTHON_USEDEP}]
+ >=dev-python/eventlet-0.16.1[${PYTHON_USEDEP}]
+ !~dev-python/eventlet-0.17.0[${PYTHON_USEDEP}]
+ >=dev-python/jinja-2.6[${PYTHON_USEDEP}]
+ >=dev-python/keystonemiddleware-1.5.0[${PYTHON_USEDEP}]
+ <dev-python/keystonemiddleware-1.6.0[${PYTHON_USEDEP}]
+ >=dev-python/lxml-2.3[${PYTHON_USEDEP}]
+ >=dev-python/routes-1.12.3-r1[${PYTHON_USEDEP}]
+ !~dev-python/routes-2.0[${PYTHON_USEDEP}]
+ >=dev-python/webob-1.2.3[${PYTHON_USEDEP}]
+ >=dev-python/greenlet-0.3.2[${PYTHON_USEDEP}]
+ >=dev-python/pastedeploy-1.5.0-r1[${PYTHON_USEDEP}]
+ dev-python/paste[${PYTHON_USEDEP}]
+ ~dev-python/sqlalchemy-migrate-0.9.5[${PYTHON_USEDEP}]
+ >=dev-python/netaddr-0.7.12[${PYTHON_USEDEP}]
+ >=dev-python/paramiko-1.13.0[${PYTHON_USEDEP}]
+ dev-python/pyasn1[${PYTHON_USEDEP}]
+ >=dev-python/Babel-1.3[${PYTHON_USEDEP}]
+ >=dev-python/iso8601-0.1.9[${PYTHON_USEDEP}]
+ >=dev-python/jsonschema-2.0.0[${PYTHON_USEDEP}]
+ <dev-python/jsonschema-3.0.0[${PYTHON_USEDEP}]
+ >=dev-python/python-cinderclient-1.1.0[${PYTHON_USEDEP}]
+ <dev-python/python-cinderclient-1.2.0[${PYTHON_USEDEP}]
+ >=dev-python/python-neutronclient-2.3.11[${PYTHON_USEDEP}]
+ <dev-python/python-neutronclient-2.5.0[${PYTHON_USEDEP}]
+ >=dev-python/python-glanceclient-0.15.0[${PYTHON_USEDEP}]
+ <dev-python/python-glanceclient-0.18.0[${PYTHON_USEDEP}]
+ >=dev-python/python-barbicanclient-3.0.1[${PYTHON_USEDEP}]
+ <dev-python/python-barbicanclient-3.1.0[${PYTHON_USEDEP}]
+ >=dev-python/six-1.9.0[${PYTHON_USEDEP}]
+ >=dev-python/stevedore-1.3.0[${PYTHON_USEDEP}]
+ <dev-python/stevedore-1.4.0[${PYTHON_USEDEP}]
+ >=dev-python/websockify-0.6.0[${PYTHON_USEDEP}]
+ <dev-python/websockify-0.7.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-concurrency-1.8.2[${PYTHON_USEDEP}]
+ <dev-python/oslo-concurrency-1.9.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-config-1.9.3[${PYTHON_USEDEP}]
+ <dev-python/oslo-config-1.10.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-context-0.2.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-context-0.3.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-log-1.0.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-log-1.1.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-serialization-1.4.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-serialization-1.5.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-utils-1.4.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-utils-1.5.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-db-1.7.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-db-1.8.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-rootwrap-1.6.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-rootwrap-1.7.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-messaging-1.8.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-messaging-1.9.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-i18n-1.5.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-i18n-1.6.0[${PYTHON_USEDEP}]
+ >=dev-python/rfc3986-0.2.0[${PYTHON_USEDEP}]
+ >=dev-python/oslo-middleware-1.0.0[${PYTHON_USEDEP}]
+ <dev-python/oslo-middleware-1.1.0[${PYTHON_USEDEP}]
+ >=dev-python/psutil-1.1.1[${PYTHON_USEDEP}]
+ <dev-python/psutil-2.0.0[${PYTHON_USEDEP}]
+ dev-python/libvirt-python[${PYTHON_USEDEP}]
+ app-emulation/libvirt[iscsi?]
+ novncproxy? ( www-apps/novnc )
+ sys-apps/iproute2
+ openvswitch? ( net-misc/openvswitch )
+ rabbitmq? ( net-misc/rabbitmq-server )
+ memcached? ( net-misc/memcached
+ dev-python/python-memcached )
+ sys-fs/sysfsutils
+ sys-fs/multipath-tools
+ net-misc/bridge-utils
+ compute? (
+ app-cdr/cdrkit
+ kvm? ( app-emulation/qemu )
+ xen? ( app-emulation/xen
+ app-emulation/xen-tools )
+ )
+ iscsi? (
+ sys-fs/lsscsi
+ >=sys-block/open-iscsi-2.0.872-r3
+ )"
+
+PATCHES=(
+ "${FILESDIR}/CVE-2015-3241-kilo.patch"
+ "${FILESDIR}/CVE-2015-3280_2015.1.1.patch.patch"
+)
+
+pkg_setup() {
+ linux-info_pkg_setup
+ CONFIG_CHECK_MODULES="BLK_DEV_NBD VHOST_NET IP6_NF_FILTER IP6_NF_IPTABLES IP_NF_TARGET_REJECT \
+ IP_NF_MANGLE IP_NF_TARGET_MASQUERADE NF_NAT_IPV4 IP_NF_FILTER IP_NF_IPTABLES \
+ NF_CONNTRACK_IPV4 NF_DEFRAG_IPV4 NF_NAT_IPV4 NF_NAT NF_CONNTRACK NETFILTER_XTABLES \
+ ISCSI_TCP SCSI_DH DM_MULTIPATH DM_SNAPSHOT"
+ if linux_config_exists; then
+ for module in ${CONFIG_CHECK_MODULES}; do
+ linux_chkconfig_present ${module} || ewarn "${module} needs to be enabled in kernel"
+ done
+ fi
+ enewgroup nova
+ enewuser nova -1 -1 /var/lib/nova nova
+}
+
+python_prepare() {
+ distutils-r1_python_prepare
+ sed -i 's/python/python2\.7/g' tools/config/generate_sample.sh || die
+}
+
+python_compile() {
+ distutils-r1_python_compile
+ ./tools/config/generate_sample.sh -b ./ -p nova -o etc/nova || die
+}
+
+python_test() {
+ # turn multiprocessing off, testr will use it --parallel
+ local DISTUTILS_NO_PARALLEL_BUILD=1
+ testr init
+ testr run --parallel || die "failed testsuite under python2.7"
+}
+
+python_install() {
+ distutils-r1_python_install
+
+ if use !compute-only; then
+ for svc in api cert conductor consoleauth network scheduler spicehtml5proxy xvpvncproxy; do
+ newinitd "${FILESDIR}/nova.initd" "nova-${svc}"
+ done
+ fi
+ use compute && newinitd "${FILESDIR}/nova.initd" "nova-compute"
+ use novncproxy && newinitd "${FILESDIR}/nova.initd" "nova-novncproxy"
+
+ diropts -m 0750 -o nova -g qemu
+ dodir /var/log/nova /var/lib/nova/instances
+ diropts -m 0750 -o nova -g nova
+
+ insinto /etc/nova
+ insopts -m 0640 -o nova -g nova
+ newins "etc/nova/nova.conf.sample" "nova.conf"
+ doins "etc/nova/api-paste.ini"
+ doins "etc/nova/logging_sample.conf"
+ doins "etc/nova/policy.json"
+ doins "etc/nova/rootwrap.conf"
+ #rootwrap filters
+ insinto /etc/nova/rootwrap.d
+ doins "etc/nova/rootwrap.d/api-metadata.filters"
+ doins "etc/nova/rootwrap.d/compute.filters"
+ doins "etc/nova/rootwrap.d/network.filters"
+ #copy migration conf file (not coppied on install via setup.py script)
+ insopts -m 0644
+ insinto /usr/$(get_libdir)/python2.7/site-packages/nova/db/sqlalchemy/migrate_repo/
+ doins "nova/db/sqlalchemy/migrate_repo/migrate.cfg"
+ #copy the CA cert dir (not coppied on install via setup.py script)
+ cp -R "${S}/nova/CA" "${D}/usr/$(get_libdir)/python2.7/site-packages/nova/" || die "installing CA files failed"
+
+ #add sudoers definitions for user nova
+ insinto /etc/sudoers.d/
+ insopts -m 0600 -o root -g root
+ doins "${FILESDIR}/nova-sudoers"
+
+ if use iscsi ; then
+ # Install udev rules for handle iscsi disk with right links under /dev
+ udev_newrules "${FILESDIR}/openstack-scsi-disk.rules" 60-openstack-scsi-disk.rules
+
+ insinto /etc/nova/
+ doins "${FILESDIR}/scsi-openscsi-link.sh"
+ fi
+}
+
+pkg_postinst() {
+ if use iscsi ; then
+ elog "iscsid needs to be running if you want cinder to connect"
+ fi
+}
projects / gentoo.git / commitdiff