From: Matt Thode <prometheanfire@gentoo.org>
Date: Wed, 11 Mar 2015 05:56:22 +0000 (+0000)
Subject: fixing CVE-2015-0259
X-Git-Url: http://git.tremily.us/gitweb.cgi?a=commitdiff_plain;h=5cc692396dcfe5c3e2101707ca01874790e5e477;p=gentoo.git

fixing CVE-2015-0259

Package-Manager: portage-2.2.14/cvs/Linux x86_64
Manifest-Sign-Key: 0x33ED3FD25AFC78BA
---

diff --git a/sys-cluster/nova/ChangeLog b/sys-cluster/nova/ChangeLog
index 8b2fb3750e88..a03d76cbf82b 100644
--- a/sys-cluster/nova/ChangeLog
+++ b/sys-cluster/nova/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sys-cluster/nova
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.83 2015/02/08 02:44:24 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.84 2015/03/11 05:56:18 prometheanfire Exp $
+
+*nova-2014.2.2-r1 (11 Mar 2015)
+
+  11 Mar 2015; Matthew Thode <prometheanfire@gentoo.org>
+  +files/CVE-2015-0259-2014.2.2.patch, +nova-2014.2.2-r1.ebuild,
+  -nova-2014.2.1.ebuild, -nova-2014.2.2.ebuild:
+  fixing CVE-2015-0259
 
 *nova-2014.2.2 (08 Feb 2015)
 
diff --git a/sys-cluster/nova/Manifest b/sys-cluster/nova/Manifest
index 91a38897bbb0..0dc5b921a934 100644
--- a/sys-cluster/nova/Manifest
+++ b/sys-cluster/nova/Manifest
@@ -1,29 +1,28 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX CVE-2015-0259-2014.2.2.patch 10495 SHA256 50be4a848cc3e9b7d304935472d2ea46a50dc21deac0fac5ce219cd40bf37310 SHA512 cfd57a31bd1081fa0fd35df9ede8dc404284db9134462c6358553bcf2a441eb98cef38dd800be9b9435d8cc8c656a897bcae31123f5eb952e3ab8a8516a6791d WHIRLPOOL 23a63bc15c816ff9de382acb56f92b22e60c56f37c3e21614a6d56fe0563033f8d14601152e005e225a1ef25ee492ff6b169246daac0a91e8f302b615bf72fdb
 AUX nova-sudoers 78 SHA256 9e88c2843fb74cc46802c0b103067ad12915ec50335d05e546a5dba76acb4a76 SHA512 22c0606c6335b2d1a03bd18a319a54f16f76f091b2e8416dbba05ce7c15890beff7f32f0322eb5ba3f2a5c750436cacbe0cee189b390b878e3f0c0df219ef984 WHIRLPOOL bc42ae1d12e9f900b263fd5c3d0f59062f46fbec1ff97c0bceb234082bea5943eb64795b4f5e102b8e2749c6868163e5924467088cad42df09345e3406e5f83c
 AUX nova.initd 627 SHA256 74417e422e6c503ae338bb981934b54a5da57e783bdfed778de6ce9fec3617b8 SHA512 163d5d94f6ce7c67413b9e90161590651329c96e1c8df480d1c983294f43bd596ef75ebe818cd1a8f1557babfd6bbd02a7deaf597d936acfe882dc3c9c5a1f42 WHIRLPOOL b51a0316513d06083f2cfa572427926c14663ab984bcd26a9521bf88699bfefd745e7ff91e9330bae86bd769d809837e010caa948cd133fbd010e820b7ab8448
-DIST nova-2014.2.1.tar.gz 4422203 SHA256 f2a600722e55ba170d756ee54fc20517214865b0521d52ca385336ea311e6d31 SHA512 f04330ecd41548e87ea821d6eb2487644f2ab9f06705b630d9f399bce65fe1abb64dedf37b549efa0ec480b3227c3eec543ee99860205f3b924f18909b202ee0 WHIRLPOOL 436a37b8cba721a5016649b2da40a77270df4608915af49ca18188af80b2d515829a80c620e89baa6138ec20e117fdda1380cf834b8891c73936b671ec8c07c3
 DIST nova-2014.2.2.tar.gz 4423122 SHA256 18dfd433aa043389318f28890578dcbe3c0606a38360f39ec8df8670150f89d7 SHA512 d2564066c5c96a32cc47e5066b2310611eb2488fb2082f43bf89dccc92ebd8ac536d8f591ebe2b9c1865b22f69acd308e5bb3a2a636f5b27f9ddfa765dd18300 WHIRLPOOL ed563e9caa37bd0df2a587597494fb33525ad84cba46c7c1f7f4f45cffc20c38cf843b642a2e67d99af994c42a4ac5a81b358ec63e7898de3225c6629dc50f24
-EBUILD nova-2014.2.1.ebuild 6255 SHA256 4372f7ebe8b6e3a7553f94b6e50f784eba89c39e4989e521577b958123bff306 SHA512 0d72e1c9206f8b70157d06c5c7ae310aa519f3a5f62cc52c9a0fe4eef62dc8296ae8b4480a7639aa8f0f92eac1ecba491bbd9247b8325377a7aeaa9632e8dec4 WHIRLPOOL c823e5c4fad72f300aea9bb977932f1bd3180507c02b526a0ce528690dbc877b13269d3908288d140f0194dc1930a09c28f5feb6b4a3c0aedc9a5fc22d171505
-EBUILD nova-2014.2.2.ebuild 6028 SHA256 16ecfa06919a5c2ba6ef86de3b4d9ecca7346e6d49c9304ea1edfeb52698ef09 SHA512 7d1aa76804253485876aef68e720b25430642a232b7714e9a9262e4c3985c18a454a5d058bb7c50d5ea1642141bec63df3a0537bb930fc2ec80c5032972bafc0 WHIRLPOOL f117c1eb045b9157eca95a8e32dd3a430fc68024f2de8b280bf84dbad962641941ddc260cc44f1f0ad5f6bafe0ba559bf28810fd0b28814655a2170dfa06c4c1
+EBUILD nova-2014.2.2-r1.ebuild 6075 SHA256 768c68931c3824c77330f57060d85cbbab95a47ba47c0c445244ac2c3f918768 SHA512 4e3fff24edea1c733cbba8b0752d4c70d960db5f9be24e4ba8e3c46c2599b381a01a20f9828a97dba7bc810ea0f6e5b07ab8dba9f5f462f7fc257a1a8ce6bf03 WHIRLPOOL 84cd7965f9da416c63f0c4d6d416372f5d121149aa1cda34fdadebbc0e2617c0af5e461e9fc5f34d124f5b29e606ded3fa318eb1329fab2e436b751842467234
 EBUILD nova-2014.2.9999.ebuild 6036 SHA256 9557a538a2a3d2cdef37c57a23286defe0ba64972a60b68937cc3ff9413e6028 SHA512 7ab6258a1b5426ccbc81333ad36a1530a32cb754ce7b86fb86abd82b60f221202f6c4b511113c48142d9dc0703511f03339517201ac4622033d9e057e58f0c31 WHIRLPOOL 6385eb491d5b7d947b377f9534c53a8eb59631300e712ecce615d0e7971e6eea9d0a79f4a014db0fc8f6b2ca18a1cd448a08b8a349ae6fc56c90bcb2808b6553
-MISC ChangeLog 18465 SHA256 49ed1bce3d5793ab0177a0271a2e7dd84ce9a5973bd53ce2ac587fd4270ea286 SHA512 5395b3f2052b244051954273f5e40ccd6438b5469b5588a95634736d360db60ca52b14b0ca9716d58492cf2e174d5d52bc2e0aec0816fb8d9dfa0fb234fb0f9f WHIRLPOOL 8c707b3d50f1e121113f70118eaf22e5e7f9b8117b837032e2da33413f199446e977647eeb5abbcd4eb2c4ebf3b979a043a4b7f19b51a21e6680778a1dc73c00
+MISC ChangeLog 18692 SHA256 a5f564e5d0baf7be34900a9a0a49ea96b488bb00a461330f2689e86d09c84162 SHA512 053c6965040abecb876d3f9576f471ef6b85cc2f03c692d9c8d2500a9ec086ef0850e73976782c53c6ee9f0545d9d75a7ff4fd7edf76997b4d7b2e0260c039c6 WHIRLPOOL 4a97c12f51189f2ab937303cc5a9ab8672649dd3e4feac57dc671d84fab1accf83dad19c0ccda2371816007a4089c0b5b0d7e7ebe1726e70a4ad005c173d70da
 MISC metadata.xml 911 SHA256 d5ba172160431f66d7d3bfa414209ef83b9e449efd3a55ded6d6ab91b3adeece SHA512 eb2c13ad92930a0792580d276672c7e9aae07ae09109bb6149429dff5e24951509ea95fa182ebdbb8a9a94b5dcbf6b25b580a16878c9b201ffa840270919d30e WHIRLPOOL 0a0eb3e24dade3fb862a89ad92a3da54191fa3bca682a8a512410c5f376d575ef21703cdcb085e7a423b89e8c08bdb682ef53392c43f19fdb0f6fd4984bfd0ce
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
-iQIcBAEBCAAGBQJU1s2kAAoJEGSje+quGaToHLkQAMTNgwozvzYA1FnSM6hZrssi
-fyij+a3EXKqF/mMpxGTyNvyFHLK1nkxEnHsdmGcVoFoa3t1qHte3PNQDIAP9EhjG
-SnFNrp1uK7IAjzoZVsmFrLF7GQLk+/cn8bSTNYtMEDlAo+biiF6UeP2jX4yIl5fY
-7QI111IhgaPHlxYNIds0eCzjMxVs3Jl6pS06gvNtveEUF7BJlSmA5aAxVvLKReXu
-fG7KlShRsTBLw9dZJgT/3bcH6nh0KqChjbNV7JAiAn4rEgeHVC97TwsioYOLiaCq
-siBBMJiGSr9pj9ZUPZ4EZIq5u02h2BCJ/T9Toi5ZyvjoXru0kM91anWD6IMIJ1XT
-ng9yyGsbOl4qrZZe9TWdZkjlrYMywsEESjFvgsDGCHSMoSfzDZrucUqlX04L1snI
-ffiw1L1LPVQKDf8px8Rh6VNB+IrAbcmOY/+1OOPkbVyFMiAluG92vSkIA4I0DA/7
-V63oupoyhqJE5xE4sKQ1zyp8/7IwAqQx0AsNr9rk96M0SY5moGVL0Ee22J1PsFSm
-QUU3firoVDrnsPTZ/W+Mp5kQJV3PjlBzPJzqMjqrXClEb3LyDYtg+1euwmyBJM6l
-21r+8gcyhxsnGKzZO3OGHwFO4+IHd21D06z99RRqjo7YaumqthLhPkpUGLPBIKsv
-/7WVMCTwEcq4ux1KQyqs
-=ILNf
+iQIcBAEBCAAGBQJU/9k0AAoJEGSje+quGaTovXQP/1sSbZOKbRI8QIerh6jMzWUI
+z9y4XzELJGnJSoYaxkWapu85FTMu7azBRMpoi0HCfBdTgt/EQ2lbhKDx+7MqZ3Gw
+aqJA31icfdCGztkNkRy7MqJBsQX0hxvL1U7rkvzlA0aQihVzDb1g40ocsq/8oVFG
+GrPMy0NB5gB5gy79FRrpodpCQ+Y4LLFz4yis97GSrxOCjELEoBlPmvidghzi5rew
+mtaLmE6LOsayjtDTJELonfeyvCsbiJSJGuXTBgTQbtpRYSwCC1g8vXpjq/p5oorG
+KHTTAD4WAhy3IocjeRzn3k8yzM8NoaG/BaO8kWiZp5g36PU96UkaDezAVLIH5nU8
+8gzsA6ErK9kvaY1ZxGH6fexv7x5ihzAufyHRvFcaedMEhDoOyL+zs3/BQ26seRH8
+nvvj8N956qdlAyf5mhLEXOoVTe2MRekrLE9aqqbutjrX9Jv/AXymL2Y7/yxEID53
+rC/e5K3o8WpePydAW4yQeEC0x3U8oF9P5UctqptzX7OyBfzh3jOjVpvMyW1xQfW/
+NiJtJI25JD5GdI4wCg9phS8w4/qjhT7S6vVSM07uBRaGlVgDiBbwOnRYgqA9gDDd
+OU1B9yiWhZcl3itzgKcRfj2yoMrDQjXsnyLUMtK2jWQ89S2QFvcSVFcjnfyTs8l+
+9bFiu2spbmK5tI0yl7Ci
+=LyAv
 -----END PGP SIGNATURE-----
diff --git a/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch b/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
new file mode 100644
index 000000000000..c9de61bd4080
--- /dev/null
+++ b/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
@@ -0,0 +1,282 @@
+From 8998627807f6512a8efd0902ed7c08b4273c7bcf Mon Sep 17 00:00:00 2001
+From: Dave McCowan <dmccowan@cisco.com>
+Date: Tue, 24 Feb 2015 21:35:48 -0500
+Subject: [PATCH] Websocket Proxy should verify Origin header
+
+If the Origin HTTP header passed in the WebSocket handshake does
+not match the host, this could indicate an attempt at a
+cross-site attack.  This commit adds a check to verify
+the origin matches the host.
+
+Closes-Bug: 1409142
+---
+ nova/console/websocketproxy.py            |  37 ++++++++
+ nova/tests/console/test_websocketproxy.py | 143 +++++++++++++++++++++++++++++-
+ 2 files changed, 176 insertions(+), 4 deletions(-)
+
+diff --git a/nova/console/websocketproxy.py b/nova/console/websocketproxy.py
+index ef684f5..ead557c 100644
+--- a/nova/console/websocketproxy.py
++++ b/nova/console/websocketproxy.py
+@@ -22,17 +22,37 @@ import Cookie
+ import socket
+ import urlparse
+ 
++from oslo.config import cfg
+ import websockify
+ 
+ from nova.consoleauth import rpcapi as consoleauth_rpcapi
+ from nova import context
++from nova import exception
+ from nova.i18n import _
+ from nova.openstack.common import log as logging
+ 
+ LOG = logging.getLogger(__name__)
+ 
++CONF = cfg.CONF
++CONF.import_opt('novncproxy_base_url', 'nova.vnc')
++CONF.import_opt('html5proxy_base_url', 'nova.spice', group='spice')
++
+ 
+ class NovaProxyRequestHandlerBase(object):
++    def verify_origin_proto(self, console_type, origin_proto):
++        if console_type == 'novnc':
++            expected_proto = \
++                urlparse.urlparse(CONF.novncproxy_base_url).scheme
++        elif console_type == 'spice-html5':
++            expected_proto = \
++                urlparse.urlparse(CONF.spice.html5proxy_base_url).scheme
++        else:
++            detail = _("Invalid Console Type for WebSocketProxy: '%s'") % \
++                        console_type
++            LOG.audit(detail)
++            raise exception.ValidationError(detail=detail)
++        return origin_proto == expected_proto
++
+     def new_websocket_client(self):
+         """Called after a new WebSocket connection has been established."""
+         # Reopen the eventlet hub to make sure we don't share an epoll
+@@ -62,6 +82,23 @@ class NovaProxyRequestHandlerBase(object):
+         if not connect_info:
+             raise Exception(_("Invalid Token"))
+ 
++        # Verify Origin
++        expected_origin_netloc = self.headers.getheader('Host')
++        origin_url = self.headers.getheader('Origin')
++        origin = urlparse.urlparse(origin_url)
++        origin_netloc = origin.netloc
++        origin_scheme = origin.scheme
++        if origin_netloc == '' or origin_scheme == '':
++            detail = _("Origin header not valid.")
++            raise exception.ValidationError(detail=detail)
++        if expected_origin_netloc != origin_netloc:
++            detail = _("Origin header does not match this host.")
++            raise exception.ValidationError(detail=detail)
++        if not self.verify_origin_proto(connect_info['console_type'],
++                                          origin.scheme):
++            detail = _("Origin header protocol does not match this host.")
++            raise exception.ValidationError(detail=detail)
++
+         self.msg(_('connect info: %s'), str(connect_info))
+         host = connect_info['host']
+         port = int(connect_info['port'])
+diff --git a/nova/tests/console/test_websocketproxy.py b/nova/tests/console/test_websocketproxy.py
+index 1e51a4d..b125c54 100644
+--- a/nova/tests/console/test_websocketproxy.py
++++ b/nova/tests/console/test_websocketproxy.py
+@@ -16,10 +16,14 @@
+ 
+ 
+ import mock
++from oslo.config import cfg
+ 
+ from nova.console import websocketproxy
++from nova import exception
+ from nova import test
+ 
++CONF = cfg.CONF
++
+ 
+ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+ 
+@@ -31,15 +35,72 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         self.wh.msg = mock.MagicMock()
+         self.wh.do_proxy = mock.MagicMock()
+         self.wh.headers = mock.MagicMock()
++        CONF.set_override('novncproxy_base_url',
++                          'https://example.net:6080/vnc_auto.html')
++        CONF.set_override('html5proxy_base_url',
++                          'https://example.net:6080/vnc_auto.html',
++                          'spice')
++
++    def _fake_getheader(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'https://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_bad_token(self, header):
++        if header == 'cookie':
++            return 'token="XXX"'
++        elif header == 'Origin':
++            return 'https://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_bad_origin(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'https://bad-origin-example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_blank_origin(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return ''
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_http(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'http://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
+ 
+     @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
+     def test_new_websocket_client(self, check_token):
+         check_token.return_value = {
+             'host': 'node1',
+-            'port': '10000'
++            'port': '10000',
++            'console_type': 'novnc'
+         }
+         self.wh.socket.return_value = '<socket>'
+         self.wh.path = "ws://127.0.0.1/?token=123-456-789"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.wh.new_websocket_client()
+ 
+@@ -52,6 +113,7 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         check_token.return_value = False
+ 
+         self.wh.path = "ws://127.0.0.1/?token=XXX"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
+         check_token.assert_called_with(mock.ANY, token="XXX")
+@@ -60,11 +122,12 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+     def test_new_websocket_client_novnc(self, check_token):
+         check_token.return_value = {
+             'host': 'node1',
+-            'port': '10000'
++            'port': '10000',
++            'console_type': 'novnc'
+         }
+         self.wh.socket.return_value = '<socket>'
+         self.wh.path = "http://127.0.0.1/"
+-        self.wh.headers.getheader.return_value = "token=123-456-789"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.wh.new_websocket_client()
+ 
+@@ -77,7 +140,79 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         check_token.return_value = False
+ 
+         self.wh.path = "http://127.0.0.1/"
+-        self.wh.headers.getheader.return_value = "token=XXX"
++        self.wh.headers.getheader = self._fake_getheader_bad_token
+ 
+         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
+         check_token.assert_called_with(mock.ANY, token="XXX")
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_header(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_bad_origin
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_blank_origin_header(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_blank_origin
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_proto_vnc(self,
++                                                             check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_http
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_proto_spice(self,
++                                                               check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'spice-html5'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_http
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_console_type(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'bad-console-type'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
+-- 
+1.9.3 (Apple Git-50)
+
diff --git a/sys-cluster/nova/nova-2014.2.1.ebuild b/sys-cluster/nova/nova-2014.2.1.ebuild
deleted file mode 100644
index 616773d06256..000000000000
--- a/sys-cluster/nova/nova-2014.2.1.ebuild
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright 1999-2015 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.1.ebuild,v 1.2 2015/01/13 04:16:16 prometheanfire Exp $
-
-EAPI=5
-PYTHON_COMPAT=( python2_7 )
-
-inherit distutils-r1 eutils linux-info multilib user
-
-DESCRIPTION="A cloud computing fabric controller (main part of an IaaS system) written in Python"
-HOMEPAGE="https://launchpad.net/nova"
-SRC_URI="http://launchpad.net/${PN}/juno/${PV}/+download/${P}.tar.gz"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-IUSE="+compute +kvm +network +novncproxy sqlite mysql postgres xen"
-REQUIRED_USE="|| ( mysql postgres sqlite )
-			  compute? ( || ( kvm xen ) )"
-
-DEPEND="dev-python/setuptools[${PYTHON_USEDEP}]
-		>=dev-python/pbr-0.8[${PYTHON_USEDEP}]
-		<dev-python/pbr-1.0[${PYTHON_USEDEP}]
-		app-admin/sudo"
-
-RDEPEND="
-	sqlite? (
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[sqlite,${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[sqlite,${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[sqlite,${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[sqlite,${PYTHON_USEDEP}]
-			)
-		)
-	)
-	mysql? (
-		dev-python/mysql-python
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
-			)
-		)
-	)
-	postgres? (
-		dev-python/psycopg:2
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
-			)
-		)
-	)
-	>=dev-python/anyjson-0.3.3[${PYTHON_USEDEP}]
-	>=dev-python/boto-2.32.1[${PYTHON_USEDEP}]
-	>=dev-python/decorator-3.4.0[${PYTHON_USEDEP}]
-	>=dev-python/eventlet-0.15.1[${PYTHON_USEDEP}]
-	dev-python/jinja[${PYTHON_USEDEP}]
-	>=dev-python/keystonemiddleware-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/kombu-2.5.0[${PYTHON_USEDEP}]
-	>=dev-python/lxml-2.3[${PYTHON_USEDEP}]
-	>=dev-python/routes-1.12.3-r1[${PYTHON_USEDEP}]
-	!~dev-python/routes-2.0[${PYTHON_USEDEP}]
-	>=dev-python/webob-1.2.3[${PYTHON_USEDEP}]
-	>=dev-python/greenlet-0.3.2[${PYTHON_USEDEP}]
-	>=dev-python/pastedeploy-1.5.0-r1[${PYTHON_USEDEP}]
-	dev-python/paste[${PYTHON_USEDEP}]
-	>=dev-python/sqlalchemy-migrate-0.9.1[${PYTHON_USEDEP}]
-	!~dev-python/sqlalchemy-migrate-0.9.2[${PYTHON_USEDEP}]
-	>=dev-python/netaddr-0.7.12[${PYTHON_USEDEP}]
-	>=dev-python/suds-0.4[${PYTHON_USEDEP}]
-	>=dev-python/paramiko-1.13.0[${PYTHON_USEDEP}]
-	dev-python/posix_ipc[${PYTHON_USEDEP}]
-	dev-python/pyasn1[${PYTHON_USEDEP}]
-	>=dev-python/Babel-1.3[${PYTHON_USEDEP}]
-	>=dev-python/iso8601-0.1.9[${PYTHON_USEDEP}]
-	>=dev-python/jsonschema-2.0.0[${PYTHON_USEDEP}]
-	<dev-python/jsonschema-3.0.0[${PYTHON_USEDEP}]
-	>=dev-python/python-cinderclient-1.1.0[${PYTHON_USEDEP}]
-	>=dev-python/python-neutronclient-2.3.6[${PYTHON_USEDEP}]
-	<=dev-python/python-neutronclient-3.0.0[${PYTHON_USEDEP}]
-	>=dev-python/python-glanceclient-0.14.0[${PYTHON_USEDEP}]
-	>=dev-python/python-keystoneclient-0.10.0[${PYTHON_USEDEP}]
-	>=dev-python/six-1.7.0[${PYTHON_USEDEP}]
-	>=dev-python/stevedore-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/websockify-0.6.0[${PYTHON_USEDEP}]
-	<dev-python/websockify-0.7.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-config-1.4.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-db-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-rootwrap-1.3.0[${PYTHON_USEDEP}]
-	>=dev-python/pycadf-0.6.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-messaging-1.4.0[${PYTHON_USEDEP}]
-	!~dev-python/oslo-messaging-1.5.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-i18n-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/lockfile-0.8[${PYTHON_USEDEP}]
-	>=dev-python/simplejson-2.2.0[${PYTHON_USEDEP}]
-	>=dev-python/rfc3986-0.2.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-vmware-0.6.0[${PYTHON_USEDEP}]
-	dev-python/libvirt-python[${PYTHON_USEDEP}]
-	novncproxy? ( www-apps/novnc )
-	sys-apps/iproute2
-	net-misc/openvswitch
-	net-misc/rabbitmq-server
-	sys-fs/sysfsutils
-	sys-fs/multipath-tools
-	net-misc/bridge-utils
-	kvm? ( app-emulation/qemu )
-	xen? ( app-emulation/xen
-		   app-emulation/xen-tools )"
-
-PATCHES=(
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-	CONFIG_CHECK_MODULES="NBD VHOST_NET IP6TABLE_FILTER IP6_TABLES IPT_REJECT \
-	IPTABLE_MANGLE IPT_MASQUERADE IPTABLE_NAT IPTABLE_FILTER IP_TABLES \
-	NF_CONNTRACK_IPV4 NF_DEFRAG_IPV4 NF_NAT_IPV4 NF_NAT NF_CONNTRACK X_TABLES \
-	ISCSI_TCP SCSI_DH DM_MULTIPATH DM_SNAPSHOT"
-	if linux_config_exists; then
-		for module in ${CONFIG_CHECK_MODULES}; do
-			linux_chkconfig_present ${module} || ewarn "${module} needs to be enabled in kernel"
-		done
-	fi
-	enewgroup nova
-	enewuser nova -1 -1 /var/lib/nova nova
-}
-
-python_compile() {
-	distutils-r1_python_compile
-	./tools/config/generate_sample.sh -b ./ -p nova -o etc/nova
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	for svc in api cert compute conductor consoleauth network scheduler spicehtml5proxy xvpvncproxy; do
-		newinitd "${FILESDIR}/nova.initd" "nova-${svc}"
-	done
-	use compute && newinitd "${FILESDIR}/nova.initd" "nova-compute"
-	use novncproxy && newinitd "${FILESDIR}/nova.initd" "nova-novncproxy"
-
-	diropts -m 0750 -o nova -g qemu
-	dodir /var/log/nova /var/lib/nova/instances
-	diropts -m 0750 -o nova -g nova
-
-	insinto /etc/nova
-	insopts -m 0640 -o nova -g nova
-	newins "etc/nova/nova.conf.sample" "nova.conf"
-	doins "etc/nova/api-paste.ini"
-	doins "etc/nova/logging_sample.conf"
-	doins "etc/nova/policy.json"
-	doins "etc/nova/rootwrap.conf"
-	#rootwrap filters
-	insinto /etc/nova/rootwrap.d
-	doins "etc/nova/rootwrap.d/api-metadata.filters"
-	doins "etc/nova/rootwrap.d/compute.filters"
-	doins "etc/nova/rootwrap.d/network.filters"
-	#copy migration conf file (not coppied on install via setup.py script)
-	insinto /usr/$(get_libdir)/python2.7/site-packages/nova/db/sqlalchemy/migrate_repo/
-	doins "nova/db/sqlalchemy/migrate_repo/migrate.cfg"
-	#copy the CA cert dir (not coppied on install via setup.py script)
-	cp -R "${S}/nova/CA" "${D}/usr/$(get_libdir)/python2.7/site-packages/nova/" || die "installing CA files failed"
-
-	#add sudoers definitions for user nova
-	insinto /etc/sudoers.d/
-	insopts -m 0600 -o root -g root
-	doins "${FILESDIR}/nova-sudoers"
-}
diff --git a/sys-cluster/nova/nova-2014.2.2.ebuild b/sys-cluster/nova/nova-2014.2.2-r1.ebuild
similarity index 98%
rename from sys-cluster/nova/nova-2014.2.2.ebuild
rename to sys-cluster/nova/nova-2014.2.2-r1.ebuild
index f737a082270b..4e73b64eb125 100644
--- a/sys-cluster/nova/nova-2014.2.2.ebuild
+++ b/sys-cluster/nova/nova-2014.2.2-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.2.ebuild,v 1.1 2015/02/08 02:44:24 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.2-r1.ebuild,v 1.1 2015/03/11 05:56:18 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -100,6 +100,7 @@ RDEPEND="
 		   app-emulation/xen-tools )"
 
 PATCHES=(
+	"${FILESDIR}/CVE-2015-0259-2014.2.2.patch"
 )
 
 pkg_setup() {