fixing CVE-2015-0259

(Portage version: 2.2.14/cvs/Linux x86_64, signed Manifest commit with key 0x33ED3FD25AFC78BA)

4 files changed, 292 insertions, 182 deletions

diff --git a/sys-cluster/nova/ChangeLog b/sys-cluster/nova/ChangeLog
index 8b2fb3750e88..a03d76cbf82b 100644
--- a/sys-cluster/nova/ChangeLog
+++ b/sys-cluster/nova/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sys-cluster/nova
 # Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.83 2015/02/08 02:44:24 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.84 2015/03/11 05:56:18 prometheanfire Exp $
+
+*nova-2014.2.2-r1 (11 Mar 2015)
+
+  11 Mar 2015; Matthew Thode <prometheanfire@gentoo.org>
+  +files/CVE-2015-0259-2014.2.2.patch, +nova-2014.2.2-r1.ebuild,
+  -nova-2014.2.1.ebuild, -nova-2014.2.2.ebuild:
+  fixing CVE-2015-0259
 
 *nova-2014.2.2 (08 Feb 2015)
 
diff --git a/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch b/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
new file mode 100644
index 000000000000..c9de61bd4080
--- /dev/null
+++ b/sys-cluster/nova/files/CVE-2015-0259-2014.2.2.patch
@@ -0,0 +1,282 @@
+From 8998627807f6512a8efd0902ed7c08b4273c7bcf Mon Sep 17 00:00:00 2001
+From: Dave McCowan <dmccowan@cisco.com>
+Date: Tue, 24 Feb 2015 21:35:48 -0500
+Subject: [PATCH] Websocket Proxy should verify Origin header
+
+If the Origin HTTP header passed in the WebSocket handshake does
+not match the host, this could indicate an attempt at a
+cross-site attack.  This commit adds a check to verify
+the origin matches the host.
+
+Closes-Bug: 1409142
+---
+ nova/console/websocketproxy.py            |  37 ++++++++
+ nova/tests/console/test_websocketproxy.py | 143 +++++++++++++++++++++++++++++-
+ 2 files changed, 176 insertions(+), 4 deletions(-)
+
+diff --git a/nova/console/websocketproxy.py b/nova/console/websocketproxy.py
+index ef684f5..ead557c 100644
+--- a/nova/console/websocketproxy.py
++++ b/nova/console/websocketproxy.py
+@@ -22,17 +22,37 @@ import Cookie
+ import socket
+ import urlparse
+ 
++from oslo.config import cfg
+ import websockify
+ 
+ from nova.consoleauth import rpcapi as consoleauth_rpcapi
+ from nova import context
++from nova import exception
+ from nova.i18n import _
+ from nova.openstack.common import log as logging
+ 
+ LOG = logging.getLogger(__name__)
+ 
++CONF = cfg.CONF
++CONF.import_opt('novncproxy_base_url', 'nova.vnc')
++CONF.import_opt('html5proxy_base_url', 'nova.spice', group='spice')
++
+ 
+ class NovaProxyRequestHandlerBase(object):
++    def verify_origin_proto(self, console_type, origin_proto):
++        if console_type == 'novnc':
++            expected_proto = \
++                urlparse.urlparse(CONF.novncproxy_base_url).scheme
++        elif console_type == 'spice-html5':
++            expected_proto = \
++                urlparse.urlparse(CONF.spice.html5proxy_base_url).scheme
++        else:
++            detail = _("Invalid Console Type for WebSocketProxy: '%s'") % \
++                        console_type
++            LOG.audit(detail)
++            raise exception.ValidationError(detail=detail)
++        return origin_proto == expected_proto
++
+     def new_websocket_client(self):
+         """Called after a new WebSocket connection has been established."""
+         # Reopen the eventlet hub to make sure we don't share an epoll
+@@ -62,6 +82,23 @@ class NovaProxyRequestHandlerBase(object):
+         if not connect_info:
+             raise Exception(_("Invalid Token"))
+ 
++        # Verify Origin
++        expected_origin_netloc = self.headers.getheader('Host')
++        origin_url = self.headers.getheader('Origin')
++        origin = urlparse.urlparse(origin_url)
++        origin_netloc = origin.netloc
++        origin_scheme = origin.scheme
++        if origin_netloc == '' or origin_scheme == '':
++            detail = _("Origin header not valid.")
++            raise exception.ValidationError(detail=detail)
++        if expected_origin_netloc != origin_netloc:
++            detail = _("Origin header does not match this host.")
++            raise exception.ValidationError(detail=detail)
++        if not self.verify_origin_proto(connect_info['console_type'],
++                                          origin.scheme):
++            detail = _("Origin header protocol does not match this host.")
++            raise exception.ValidationError(detail=detail)
++
+         self.msg(_('connect info: %s'), str(connect_info))
+         host = connect_info['host']
+         port = int(connect_info['port'])
+diff --git a/nova/tests/console/test_websocketproxy.py b/nova/tests/console/test_websocketproxy.py
+index 1e51a4d..b125c54 100644
+--- a/nova/tests/console/test_websocketproxy.py
++++ b/nova/tests/console/test_websocketproxy.py
+@@ -16,10 +16,14 @@
+ 
+ 
+ import mock
++from oslo.config import cfg
+ 
+ from nova.console import websocketproxy
++from nova import exception
+ from nova import test
+ 
++CONF = cfg.CONF
++
+ 
+ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+ 
+@@ -31,15 +35,72 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         self.wh.msg = mock.MagicMock()
+         self.wh.do_proxy = mock.MagicMock()
+         self.wh.headers = mock.MagicMock()
++        CONF.set_override('novncproxy_base_url',
++                          'https://example.net:6080/vnc_auto.html')
++        CONF.set_override('html5proxy_base_url',
++                          'https://example.net:6080/vnc_auto.html',
++                          'spice')
++
++    def _fake_getheader(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'https://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_bad_token(self, header):
++        if header == 'cookie':
++            return 'token="XXX"'
++        elif header == 'Origin':
++            return 'https://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_bad_origin(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'https://bad-origin-example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_blank_origin(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return ''
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
++
++    def _fake_getheader_http(self, header):
++        if header == 'cookie':
++            return 'token="123-456-789"'
++        elif header == 'Origin':
++            return 'http://example.net:6080'
++        elif header == 'Host':
++            return 'example.net:6080'
++        else:
++            return
+ 
+     @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
+     def test_new_websocket_client(self, check_token):
+         check_token.return_value = {
+             'host': 'node1',
+-            'port': '10000'
++            'port': '10000',
++            'console_type': 'novnc'
+         }
+         self.wh.socket.return_value = '<socket>'
+         self.wh.path = "ws://127.0.0.1/?token=123-456-789"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.wh.new_websocket_client()
+ 
+@@ -52,6 +113,7 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         check_token.return_value = False
+ 
+         self.wh.path = "ws://127.0.0.1/?token=XXX"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
+         check_token.assert_called_with(mock.ANY, token="XXX")
+@@ -60,11 +122,12 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+     def test_new_websocket_client_novnc(self, check_token):
+         check_token.return_value = {
+             'host': 'node1',
+-            'port': '10000'
++            'port': '10000',
++            'console_type': 'novnc'
+         }
+         self.wh.socket.return_value = '<socket>'
+         self.wh.path = "http://127.0.0.1/"
+-        self.wh.headers.getheader.return_value = "token=123-456-789"
++        self.wh.headers.getheader = self._fake_getheader
+ 
+         self.wh.new_websocket_client()
+ 
+@@ -77,7 +140,79 @@ class NovaProxyRequestHandlerBaseTestCase(test.TestCase):
+         check_token.return_value = False
+ 
+         self.wh.path = "http://127.0.0.1/"
+-        self.wh.headers.getheader.return_value = "token=XXX"
++        self.wh.headers.getheader = self._fake_getheader_bad_token
+ 
+         self.assertRaises(Exception, self.wh.new_websocket_client)  # noqa
+         check_token.assert_called_with(mock.ANY, token="XXX")
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_header(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_bad_origin
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_blank_origin_header(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_blank_origin
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_proto_vnc(self,
++                                                             check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'novnc'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_http
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_origin_proto_spice(self,
++                                                               check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'spice-html5'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader_http
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
++
++    @mock.patch('nova.consoleauth.rpcapi.ConsoleAuthAPI.check_token')
++    def test_new_websocket_client_novnc_bad_console_type(self, check_token):
++        check_token.return_value = {
++            'host': 'node1',
++            'port': '10000',
++            'console_type': 'bad-console-type'
++        }
++
++        self.wh.path = "http://127.0.0.1/"
++        self.wh.headers.getheader = self._fake_getheader
++
++        self.assertRaises(exception.ValidationError,
++                          self.wh.new_websocket_client)
+-- 
+1.9.3 (Apple Git-50)
+
diff --git a/sys-cluster/nova/nova-2014.2.1.ebuild b/sys-cluster/nova/nova-2014.2.1.ebuild
deleted file mode 100644
index 616773d06256..000000000000
--- a/sys-cluster/nova/nova-2014.2.1.ebuild
+++ /dev/null
@@ -1,180 +0,0 @@
-# Copyright 1999-2015 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.1.ebuild,v 1.2 2015/01/13 04:16:16 prometheanfire Exp $
-
-EAPI=5
-PYTHON_COMPAT=( python2_7 )
-
-inherit distutils-r1 eutils linux-info multilib user
-
-DESCRIPTION="A cloud computing fabric controller (main part of an IaaS system) written in Python"
-HOMEPAGE="https://launchpad.net/nova"
-SRC_URI="http://launchpad.net/${PN}/juno/${PV}/+download/${P}.tar.gz"
-
-LICENSE="Apache-2.0"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-IUSE="+compute +kvm +network +novncproxy sqlite mysql postgres xen"
-REQUIRED_USE="|| ( mysql postgres sqlite )
-			  compute? ( || ( kvm xen ) )"
-
-DEPEND="dev-python/setuptools[${PYTHON_USEDEP}]
-		>=dev-python/pbr-0.8[${PYTHON_USEDEP}]
-		<dev-python/pbr-1.0[${PYTHON_USEDEP}]
-		app-admin/sudo"
-
-RDEPEND="
-	sqlite? (
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[sqlite,${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[sqlite,${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[sqlite,${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[sqlite,${PYTHON_USEDEP}]
-			)
-		)
-	)
-	mysql? (
-		dev-python/mysql-python
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
-			)
-		)
-	)
-	postgres? (
-		dev-python/psycopg:2
-		|| (
-			(
-				>=dev-python/sqlalchemy-0.8.4[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.8.99[${PYTHON_USEDEP}]
-			)
-			(
-				>=dev-python/sqlalchemy-0.9.7[${PYTHON_USEDEP}]
-				<=dev-python/sqlalchemy-0.9.99[${PYTHON_USEDEP}]
-			)
-		)
-	)
-	>=dev-python/anyjson-0.3.3[${PYTHON_USEDEP}]
-	>=dev-python/boto-2.32.1[${PYTHON_USEDEP}]
-	>=dev-python/decorator-3.4.0[${PYTHON_USEDEP}]
-	>=dev-python/eventlet-0.15.1[${PYTHON_USEDEP}]
-	dev-python/jinja[${PYTHON_USEDEP}]
-	>=dev-python/keystonemiddleware-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/kombu-2.5.0[${PYTHON_USEDEP}]
-	>=dev-python/lxml-2.3[${PYTHON_USEDEP}]
-	>=dev-python/routes-1.12.3-r1[${PYTHON_USEDEP}]
-	!~dev-python/routes-2.0[${PYTHON_USEDEP}]
-	>=dev-python/webob-1.2.3[${PYTHON_USEDEP}]
-	>=dev-python/greenlet-0.3.2[${PYTHON_USEDEP}]
-	>=dev-python/pastedeploy-1.5.0-r1[${PYTHON_USEDEP}]
-	dev-python/paste[${PYTHON_USEDEP}]
-	>=dev-python/sqlalchemy-migrate-0.9.1[${PYTHON_USEDEP}]
-	!~dev-python/sqlalchemy-migrate-0.9.2[${PYTHON_USEDEP}]
-	>=dev-python/netaddr-0.7.12[${PYTHON_USEDEP}]
-	>=dev-python/suds-0.4[${PYTHON_USEDEP}]
-	>=dev-python/paramiko-1.13.0[${PYTHON_USEDEP}]
-	dev-python/posix_ipc[${PYTHON_USEDEP}]
-	dev-python/pyasn1[${PYTHON_USEDEP}]
-	>=dev-python/Babel-1.3[${PYTHON_USEDEP}]
-	>=dev-python/iso8601-0.1.9[${PYTHON_USEDEP}]
-	>=dev-python/jsonschema-2.0.0[${PYTHON_USEDEP}]
-	<dev-python/jsonschema-3.0.0[${PYTHON_USEDEP}]
-	>=dev-python/python-cinderclient-1.1.0[${PYTHON_USEDEP}]
-	>=dev-python/python-neutronclient-2.3.6[${PYTHON_USEDEP}]
-	<=dev-python/python-neutronclient-3.0.0[${PYTHON_USEDEP}]
-	>=dev-python/python-glanceclient-0.14.0[${PYTHON_USEDEP}]
-	>=dev-python/python-keystoneclient-0.10.0[${PYTHON_USEDEP}]
-	>=dev-python/six-1.7.0[${PYTHON_USEDEP}]
-	>=dev-python/stevedore-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/websockify-0.6.0[${PYTHON_USEDEP}]
-	<dev-python/websockify-0.7.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-config-1.4.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-db-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-rootwrap-1.3.0[${PYTHON_USEDEP}]
-	>=dev-python/pycadf-0.6.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-messaging-1.4.0[${PYTHON_USEDEP}]
-	!~dev-python/oslo-messaging-1.5.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-i18n-1.0.0[${PYTHON_USEDEP}]
-	>=dev-python/lockfile-0.8[${PYTHON_USEDEP}]
-	>=dev-python/simplejson-2.2.0[${PYTHON_USEDEP}]
-	>=dev-python/rfc3986-0.2.0[${PYTHON_USEDEP}]
-	>=dev-python/oslo-vmware-0.6.0[${PYTHON_USEDEP}]
-	dev-python/libvirt-python[${PYTHON_USEDEP}]
-	novncproxy? ( www-apps/novnc )
-	sys-apps/iproute2
-	net-misc/openvswitch
-	net-misc/rabbitmq-server
-	sys-fs/sysfsutils
-	sys-fs/multipath-tools
-	net-misc/bridge-utils
-	kvm? ( app-emulation/qemu )
-	xen? ( app-emulation/xen
-		   app-emulation/xen-tools )"
-
-PATCHES=(
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-	CONFIG_CHECK_MODULES="NBD VHOST_NET IP6TABLE_FILTER IP6_TABLES IPT_REJECT \
-	IPTABLE_MANGLE IPT_MASQUERADE IPTABLE_NAT IPTABLE_FILTER IP_TABLES \
-	NF_CONNTRACK_IPV4 NF_DEFRAG_IPV4 NF_NAT_IPV4 NF_NAT NF_CONNTRACK X_TABLES \
-	ISCSI_TCP SCSI_DH DM_MULTIPATH DM_SNAPSHOT"
-	if linux_config_exists; then
-		for module in ${CONFIG_CHECK_MODULES}; do
-			linux_chkconfig_present ${module} || ewarn "${module} needs to be enabled in kernel"
-		done
-	fi
-	enewgroup nova
-	enewuser nova -1 -1 /var/lib/nova nova
-}
-
-python_compile() {
-	distutils-r1_python_compile
-	./tools/config/generate_sample.sh -b ./ -p nova -o etc/nova
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	for svc in api cert compute conductor consoleauth network scheduler spicehtml5proxy xvpvncproxy; do
-		newinitd "${FILESDIR}/nova.initd" "nova-${svc}"
-	done
-	use compute && newinitd "${FILESDIR}/nova.initd" "nova-compute"
-	use novncproxy && newinitd "${FILESDIR}/nova.initd" "nova-novncproxy"
-
-	diropts -m 0750 -o nova -g qemu
-	dodir /var/log/nova /var/lib/nova/instances
-	diropts -m 0750 -o nova -g nova
-
-	insinto /etc/nova
-	insopts -m 0640 -o nova -g nova
-	newins "etc/nova/nova.conf.sample" "nova.conf"
-	doins "etc/nova/api-paste.ini"
-	doins "etc/nova/logging_sample.conf"
-	doins "etc/nova/policy.json"
-	doins "etc/nova/rootwrap.conf"
-	#rootwrap filters
-	insinto /etc/nova/rootwrap.d
-	doins "etc/nova/rootwrap.d/api-metadata.filters"
-	doins "etc/nova/rootwrap.d/compute.filters"
-	doins "etc/nova/rootwrap.d/network.filters"
-	#copy migration conf file (not coppied on install via setup.py script)
-	insinto /usr/$(get_libdir)/python2.7/site-packages/nova/db/sqlalchemy/migrate_repo/
-	doins "nova/db/sqlalchemy/migrate_repo/migrate.cfg"
-	#copy the CA cert dir (not coppied on install via setup.py script)
-	cp -R "${S}/nova/CA" "${D}/usr/$(get_libdir)/python2.7/site-packages/nova/" || die "installing CA files failed"
-
-	#add sudoers definitions for user nova
-	insinto /etc/sudoers.d/
-	insopts -m 0600 -o root -g root
-	doins "${FILESDIR}/nova-sudoers"
-}
diff --git a/sys-cluster/nova/nova-2014.2.2.ebuild b/sys-cluster/nova/nova-2014.2.2-r1.ebuild
index f737a082270b..4e73b64eb125 100644
--- a/sys-cluster/nova/nova-2014.2.2.ebuild
+++ b/sys-cluster/nova/nova-2014.2.2-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2015 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.2.ebuild,v 1.1 2015/02/08 02:44:24 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2014.2.2-r1.ebuild,v 1.1 2015/03/11 05:56:18 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -100,6 +100,7 @@ RDEPEND="
 		   app-emulation/xen-tools )"
 
 PATCHES=(
+	"${FILESDIR}/CVE-2015-0259-2014.2.2.patch"
 )
 
 pkg_setup() {