| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| Install-missed-files.patch | Install missed files diff --git a/MANIFEST.in b/MANIFEST.in new file mode 100644 index 0000000..cf3032d |
Thomas Goirand <zigo@debian.org> | not-needed | 2021-09-28 | ||
| remove-svg-converter-from-doc-conf.py.patch | Remove sphinxcontrib.rsvgconverter from doc conf.py =================================================================== |
Thomas Goirand <zigo@debian.org> | not-needed | 2019-09-28 | ||
| Add-a-healtcheck-url.patch | [PATCH] Add a /healthcheck URL This is useful for operators to configure HAProxy and for monitoring. |
Thomas Goirand <zigo@debian.org> | no | 2020-04-30 | ||
| libvirt_Add_encryption_support_to_qemu-img_create_command.patch | [PATCH] libvirt: Add encryption support to qemu-img create command This adds handling of options needed for qemu-img create to generate encrypted images. diff --git a/nova/tests/unit/virt/libvirt/test_utils.py b/nova/tests/unit/virt/libvirt/test_utils.py index 0b80bde..c648108 100644 |
Lee Yarwood <lyarwood@redhat.com> | no | upstream, https://review.opendev.org/c/openstack/nova/+/826752 | 2024-07-02 | |
| CVE-2024-32498_1_nova-stable-2023.1_Reject_qcow_files_with_data-file_attributes.patch | [PATCH 1/3] Reject qcow files with data-file attributes diff --git a/nova/tests/unit/virt/libvirt/test_utils.py b/nova/tests/unit/virt/libvirt/test_utils.py index 37744ea9f7..015da7e222 100644 |
Dan Smith <dansmith@redhat.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/nova/+/923273 | 2024-06-30 |
| CVE-2024-32498_2_nova-stable-2023.1_Check_images_with_format_inspector_for_safety_2.patch | [PATCH] Check images with format_inspector for safety It has been asserted that we should not be calling qemu-img info on untrusted files. That means we need to know if they have a backing_file, data_file or other unsafe configuration *before* we use qemu-img to probe or convert them. This grafts glance's format_inspector module into nova/images so we can use it to check the file early for safety. The expectation is that this will be moved to oslo.utils (or something) later and thus we will just delete the file from nova and change our import when that happens. format_inspector.py because of autopep8 demands. (cherry picked from commit 9cdce715945619fc851ab3f43c97fab4bae4e35a) (cherry picked from commit f07fa55fd86726eeafcd4c0c687bc49dd4df9f4c) (cherry picked from commit 0acf5ee7b5dfb6ff0f9a9745f5ad2a0ed2bf65bf) |
Dan Smith <dansmith@redhat.com> | no | 2024-04-17 | ||
| CVE-2024-32498_3_nova-stable-2023.1_Additional-qemu-safety-checking-on-base-images_2.patch | [PATCH] Additional qemu safety checking on base images There is an additional way we can be fooled into using a qcow2 file with a data-file, which is uploading it as raw to glance and then booting an instance from it. Because when we go to create the ephemeral disk from a cached base image, we've lost the information about the original source's format, we probe the image's file type without a strict format specified. If a qcow2 file is listed in glance as a raw, we won't notice it until it is too late. This brings over another piece of code (proposed against) glance's format inspector which provides a safe format detection routine. This patch uses that to detect the format of and run a safety check on the base image each time we go to use it to create an ephemeral disk image from it. This also detects QED files and always marks them as unsafe as we do not support that format at all. Since we could be fooled into downloading one and passing it to qemu-img if we don't recognize it, we need to detect and reject it as unsafe. (cherry picked from commit b1b88bf001757546fbbea959f4b73cb344407dfb) (cherry picked from commit 8a0d5f2afaf40c4554419a0b2488ce092eda7a1a) (cherry picked from commit 0269234dc42fe2c320dc4696123cf5132642f9b7) |
Dan Smith <dansmith@redhat.com> | no | 2024-06-24 | ||
| CVE-2024-32498_4_Fix-vmdk_allowed_types-checking_2.patch | [PATCH] Fix vmdk_allowed_types checking This restores the vmdk_allowed_types checking in create_image() that was unintentionally lost by tightening the qemu-type-matches-glance code in the fetch patch recently. Since we are still detecting the format of base images without metadata, we would have treated a vmdk file that claims to be raw as raw in fetch, but then read it like a vmdk once it was used as a base image for something else. (cherry picked from commit 08be7b2a0dc1d7728d8034bc2aab0428c4fb642e) (cherry picked from commit 11301e7e3f0d81a3368632f90608e30d9c647111) (cherry picked from commit 70a435fd519a0ebcc3ac9ad5254fefbf19c93e48) |
Dan Smith <dansmith@redhat.com> | no | 2024-07-01 | ||
| CVE-2024-40767_1_port_format_inspector_tests_from_glance_antelope.patch | CVE-2024-40767: port format inspector tests from glance This commit is a direct port of the format inspector unit tests from glance as of commit 0d8e79b713bc31a78f0f4eac14ee594ca8520999 . the only changes to the test are as follows . "from glance.common import format_inspector" was updated to "from nova.image import format_inspector" . "from glance.tests import utils as test_utils" was replaced with "from nova import test" . "test_utils.BaseTestCase" was replaced with "test.NoDBTestCase" . "glance-unittest-formatinspector-" was replaced with "nova-unittest-formatinspector-" . This makes the test funtional in nova. . TestFormatInspectors requries qemu-img to be installed on the host which would be a new depency for executing unit tests. to avoid that we skip TestFormatInspectors if qemu-img is not installed. TestFormatInspectorInfra and TestFormatInspectorsTargeted do not have a qemu-img dependency so no changes to the test assertions were required. diff --git a/nova/tests/unit/image/test_format_inspector.py b/nova/tests/unit/image/test_format_inspector.py new file mode 100644 index 0000000..4bda796 |
Sean Mooney <work@seanmooney.info> | no | debian | upstream, https://review.opendev.org/c/openstack/nova/+/923731 | 2024-07-10 |
| CVE-2024-40767_2_Reproduce_iso_regression_with_deep_format_inspection_antelope.patch | CVE-2024-40767: Reproduce iso regression with deep format inspection This change adds a reproducer for the regression in iso file support when workarounds.disable_deep_image_inspection = False diff --git a/nova/tests/unit/image/test_format_inspector.py b/nova/tests/unit/image/test_format_inspector.py index 4bda796..9bd99c0 100644 |
Sean Mooney <work@seanmooney.info> | no | debian | upstream, https://review.opendev.org/c/openstack/nova/+/923732 | 2024-07-10 |
| CVE-2024-40767_3_Add-iso-file-format-inspector_antelope.patch | CVE-2024-40767: Add iso file format inspector This change includes unit tests for the ISO format inspector using mkisofs to generate the iso files. . A test for stashing qcow content in the system_area of an iso file is also included. . This change modifies format_inspector.detect_file_format to evaluate all inspectors until they are complete and raise an InvalidDiskInfo exception if multiple formats match. diff --git a/nova/image/format_inspector.py b/nova/image/format_inspector.py index 8e57d7e..49cb759 100644 |
Sean Mooney <work@seanmooney.info> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/nova/+/923733 | 2024-07-10 |
| CVE-2024-40767_4_Change-force_format-strategy-to-catch-mismatches_antelope.patch | CVE-2024-40767: Change force_format strategy to catch mismatches When we moved the qemu-img command in fetch_to_raw() to force the format to what we expect, we lost the ability to identify and react to situations where qemu-img detected a file as a format that is not supported by us (i.e. identfied and safety-checked by format_inspector). In the case of some of the other VMDK variants that we don't support, we need to be sure to catch any case where qemu-img thinks it's something other than raw when we think it is, which will be the case for those formats we don't support. . Note this also moves us from explicitly using the format_inspector that we're told by glance is appropriate, to using our own detection. We assert that we agree with glance and as above, qemu agrees with us. This helps us avoid cases where the uploader lies about the image format, causing us to not run the appropriate safety check. AMI formats are a liability here since we have a very hard time asserting what they are and what they will be detected as later in the pipeline, so there is still special-casing for those. diff --git a/nova/tests/unit/virt/libvirt/test_utils.py b/nova/tests/unit/virt/libvirt/test_utils.py index bc95e55cd4..6609db6432 100644 |
Dan Smith <dansmith@redhat.com> | yes | debian upstream | upstream, https://bugs.launchpad.net/nova/+bug/2071734 | 2024-07-10 |