← Back to branch summary

~ubuntu-branches/ubuntu/quantal/nova/quantal-proposed

« back to all changes in this revision

Viewing changes to nova/consoleauth/manager.py

  • Committer: Package Import Robot
  • Author(s): James Page
  • Date: 2013-03-22 12:40:07 UTC
  • Revision ID: package-import@ubuntu.com-20130322124007-yulmow8qdfbxsigv
Tags: 2012.2.3-0ubuntu2
* Re-sync with latest security updates.
* SECURITY UPDATE: fix denial of service via fixed IPs when using extensions
  - debian/patches/CVE-2013-1838.patch: add explicit quota for fixed IP
  - CVE-2013-1838
* SECURITY UPDATE: fix VNC token validation
  - debian/patches/CVE-2013-0335.patch: force console auth service to flush
    all tokens associated with an instance when it is deleted
  - CVE-2013-0335
* SECURITY UPDATE: fix denial of service
  - CVE-2013-1664.patch: Add a new utils.safe_minidom_parse_string function
    and update external API facing Nova modules to use it
  - CVE-2013-1664

Show diffs side-by-side

added added

removed removed

Lines of Context:
nova/consoleauth/manager.py
20
20
 
21
21
import time
22
22
 
 
23
from nova.compute import rpcapi as compute_rpcapi
 
24
from nova.db import api as db
23
25
from nova import flags
24
26
from nova import manager
25
27
from nova.openstack.common import cfg
56
58
            from nova.common import memorycache as memcache
57
59
        self.mc = memcache.Client(FLAGS.memcached_servers,
58
60
                                  debug=0)
 
61
        self.compute_rpcapi = compute_rpcapi.ComputeAPI()
 
62
 
 
63
    def _get_tokens_for_instance(self, instance_uuid):
 
64
        tokens_str = self.mc.get(instance_uuid.encode('UTF-8'))
 
65
        if not tokens_str:
 
66
            tokens = []
 
67
        else:
 
68
            tokens = jsonutils.loads(tokens_str)
 
69
        return tokens
59
70
 
60
71
    def authorize_console(self, context, token, console_type, host, port,
61
 
                          internal_access_path):
 
72
                          internal_access_path, instance_uuid=None):
 
73
 
62
74
        token_dict = {'token': token,
 
75
                      'instance_uuid': instance_uuid,
63
76
                      'console_type': console_type,
64
77
                      'host': host,
65
78
                      'port': port,
67
80
                      'last_activity_at': time.time()}
68
81
        data = jsonutils.dumps(token_dict)
69
82
        self.mc.set(token.encode('UTF-8'), data, FLAGS.console_token_ttl)
 
83
        if instance_uuid is not None:
 
84
            tokens = self._get_tokens_for_instance(instance_uuid)
 
85
            tokens.append(token)
 
86
            self.mc.set(instance_uuid.encode('UTF-8'),
 
87
                        jsonutils.dumps(tokens))
 
88
 
70
89
        LOG.audit(_("Received Token: %(token)s, %(token_dict)s)"), locals())
71
90
 
 
91
    def _validate_token(self, context, token):
 
92
        instance_uuid = token['instance_uuid']
 
93
        if instance_uuid is None:
 
94
            return False
 
95
        instance = db.instance_get_by_uuid(context, instance_uuid)
 
96
        return self.compute_rpcapi.validate_console_port(context,
 
97
                                            instance,
 
98
                                            token['port'],
 
99
                                            token['console_type'])
 
100
 
72
101
    def check_token(self, context, token):
73
102
        token_str = self.mc.get(token.encode('UTF-8'))
74
103
        token_valid = (token_str is not None)
75
104
        LOG.audit(_("Checking Token: %(token)s, %(token_valid)s)"), locals())
76
105
        if token_valid:
77
 
            return jsonutils.loads(token_str)
 
106
            token = jsonutils.loads(token_str)
 
107
            if self._validate_token(context, token):
 
108
                return token
 
109
 
 
110
    def delete_tokens_for_instance(self, context, instance_uuid):
 
111
        tokens = self._get_tokens_for_instance(instance_uuid)
 
112
        for token in tokens:
 
113
            self.mc.delete(token)
 
114
        self.mc.delete(instance_uuid.encode('UTF-8'))