summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Merge "Updated from global requirements" into stable/junojuno-eol2014.2.4stable/junoJenkins2015-10-051-1/+1
|\
| * Updated from global requirementsOpenStack Proposal Bot2015-09-251-1/+1
| | | | | | | | Change-Id: I11db5c465840a1763ebc54ea9c5da6674d313b2f
* | Merge "Catch NotAuthenticated exception in import task" into stable/junoJenkins2015-10-022-1/+28
|\ \
| * | Catch NotAuthenticated exception in import taskMike Fedosin2015-10-022-1/+28
| |/ | | | | | | | | | | | | | | | | | | | | | | | | If glance uses registry as data_api then it's possible that token may expire during image import task and Glance will have NotUauthenticated exception. This code adds a correct handling of this exception and allows Glance to remove stale chunks from store. Partial-Bug: #1498163 Change-Id: Ia6e1fe0d27b13b920ee7e728feb5305dec77e066 (cherry picked from ebdf076cc9bd5d9239cdc96c6e7cecc72f852bbb)
* | Cleanup chunks for deleted image if token expiredMike Fedosin2015-10-014-1/+64
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | In patch I47229b366c25367ec1bd48aec684e0880f3dfe60 it was introduced the logic that if image was deleted during file upload when we want to update image status from 'saving' to 'active' it's expected to get Duplicate error and delete stale chunks after that. But if user's token is expired there will be Unathorized exception and chunks will stay in store and clog it. And when, the upload operation for such an image is completed the operator configured quota can be exceeded. This patch fixes the issue of left over chunks for an image which was deleted from saving status, by correcly handle auth exceptions from registry server. This patch fixes the issue of left over chunks for an image which was deleted from saving status, by correctly handle auth exceptions from registry server. Partial-bug: #1498163 Conflicts: glance/api/v1/upload_utils.py (Kilo catches NotFound instead of ImagenotFound) Change-Id: I17a66eca55bfb83107046910e69c4da01415deec (cherry picked from commit 50e3a7c58a9862206d92fef577540c5b144ecbf0)
* Prevent image status being directly modified via v1Stuart McLaren2015-09-225-0/+108
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Users shouldn't be able to change an image's status directly via the v1 API. Some existing consumers of Glance set the x-image-meta-status header in requests to the Glance API, eg: https://github.com/openstack/nova/blob/master/plugins/xenserver/xenapi/etc/xapi.d/plugins/glance#L184 We should try to prevent users setting 'status' via v1, but without breaking existing benign API calls such as these. I've adopted the following approach (which has some prior art in 'protected properties'). If a PUT request is received which contains an x-image-meta-status header: * The user provided status is ignored if it matches the current image status (this prevents benign calls such as the nova one above from breaking). The usual code (eg 200) will be returned. * If the user provided status doesn't match the current image status (ie there is a real attempt to change the value) 403 will be returned. This will break any calls which currently intentionally change the status. APIImpact Closes-bug: 1482371 Change-Id: I44fadf32abb57c962b67467091c3f51c1ccc25e6 (cherry picked from commit 4d08db5b6d42323ac1958ef3b7417d875e7bea8c) (cherry picked from commit 9beca533f42ae1fc87418de0c360e19bc59b24b5)
* Updated from global requirementsOpenStack Proposal Bot2015-08-221-2/+2
| | | | Change-Id: I31b09058d98e1e61e8b724ecfd8682953e2a6808
* Updated from global requirementsOpenStack Proposal Bot2015-07-283-46/+45
| | | | Change-Id: I37d3d83c0d664909980e92224a7318bfa96c4cd5
* Merge "Eventlet green threads not released back to pool" into stable/junoJenkins2015-06-126-4/+58
|\
| * Eventlet green threads not released back to poolabhishekkekane2015-03-116-4/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Presently, the wsgi server allows persist connections. Hence even after the response is sent to the client, it doesn't close the client socket connection. Because of this problem, the green thread is not released back to the pool. In order to close the client socket connection explicitly after the response is sent and read successfully by the client, you simply have to set keepalive to False when you create a wsgi server. DocImpact: Added http_keepalive option (default=True). Conflicts: doc/source/configuring.rst etc/glance-api.conf glance/common/wsgi.py glance/tests/unit/test_opts.py SecurityImpact Closes-Bug: #1361360 Change-Id: I93aaca24935a4f3096210233097dd6b8c5440176 (cherry picked from commit 16a821e00d15520d2f6e940e184bd289b8782620)
* | Merge "Replace assert statements with proper control-flow" into stable/junoJenkins2015-05-281-8/+7
|\ \
| * | Replace assert statements with proper control-flowGeetika Batra2015-04-171-8/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When python is run with -O assert statements are optimized away. Replacing them with proper control-flow statements (e.g., if, else, elif) prevents the matcher from returning an invalid match. Closes-bug: #1414532 Co-Authored-By: Ian Cordasco <ian.cordasco@rackspace.com> Change-Id: I60b42d5a5d71602be7adc321406ea87dfcf93f46 (cherry picked from commit 6b92b537822539497bc0194fe753fe218d1c70f1)
* | | Updated from global requirementsOpenStack Proposal Bot2015-04-221-2/+2
| | | | | | | | | | | | Change-Id: I54b91aeac9acee944f36e52b8849f039e85df1b2
* | | Bump stable/juno version to 2014.2.4Adam Gandelman2015-04-131-1/+1
|/ / | | | | | | Change-Id: Ia96fd44039b5d52eaf2fe6673a226e7ed2e9ee17
* | Updated from global requirements2014.2.3OpenStack Proposal Bot2015-04-081-3/+3
| | | | | | | | Change-Id: I56925faf2db97b17164a6503104a98991568aad1
* | Fix intermittent unit test failuresStuart McLaren2015-04-011-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following tests have been failing recently: test_update_add_locations_status_exception test_update_replace_duplicate_locations test_update_replace_locations_status_exception They were querying storeurl.com which redirected to www.hugedomains.com, and unexpected exchanges, eg: HTTP/1.1 302 Found. Cache-Control: private. Content-Length: 183. Content-Type: text/html; charset=utf-8. Date: Wed, 01 Apr 2015 19:05:15 GMT. Location: http://www.hugedomains.com/domain_profile.cfm?d=storeurl&e=com. Server: Microsoft-IIS/8.0. X-Powered-By: ASP.NET. Connection: keep-alive. Mocking out the get_size function prevents these real connections. Change-Id: Ia5d867f98ac60479c70362b0477c2a0571ac6e4f Closes-bug: 1437346
* | Updated from global requirementsOpenStack Proposal Bot2015-03-092-2/+2
|/ | | | Change-Id: Icaf04f74bd436d4fd72bcf23ba12b1aba9251601
* Merge "Initiate deletion of image files if the import was interrupted" into ↵Jenkins2015-02-231-15/+25
|\ | | | | | | stable/juno
| * Initiate deletion of image files if the import was interruptedMike Fedosin2015-02-201-15/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the image is deleted by appropriate API call while its content is still being uploaded in import task in v2, an exception is raised and it is not handled in the API code. This leads to the fact that the uploaded image file stays in a storage and clogs it. There existed code that safely removes image files if the exception occurs. SecurityImpact Conflicts: glance/common/scripts/image_import/main.py Closes-Bug: 1371118 Change-Id: I4f7d1aa103f4ce7abf4026e7097b9e76c24135fa (cherry picked from commit 7858d4d95154c8596720365e465cca7858cfec5c)
* | Merge "Updated from global requirements" into stable/junoJenkins2015-02-222-39/+39
|\ \ | |/ |/|
| * Updated from global requirementsOpenStack Proposal Bot2015-02-162-39/+39
| | | | | | | | Change-Id: Iaa8e7716217983deade52823bc100a10ec293b1b
* | Image data remains in backend for deleted imageabhishekkekane2015-02-172-16/+17
|/ | | | | | | | | | | | | | | | | | | | Trying to delete image created using task api (import-from) image gets deleted from the database, but image data remains in the backend. Import task does not update the location of the image and it remains None even image becomes active. Location entry is not added in the database in image_locations table. Added location information to the image before saving the image in the database. SecurityImpact Conflicts: glance/common/scripts/image_import/main.py Change-Id: Ie389de6538a9b98dc51c7d781b81b3ab10b83842 Closes-Bug: #1420696 (cherry picked from commit 78b5b0a9575cd5e9c4543ec0e8fd6072af1f0ebb)
* Merge "Fix copy-from when user_storage_quota is enabled" into stable/junoJenkins2015-02-112-4/+56
|\
| * Fix copy-from when user_storage_quota is enabledAbhijeet Malawade2015-02-022-4/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | If we enable 'user_storage_quota' and try to upload image then it throws 'AttributeError' error. If 'user_storage_quota' parameter is enabled then we need to send image_data as LimitingReader class object to 'store_add_to_backend' method. But currently we are getting image_data as CooperativeReader class object every time. Change-Id: I301d4007c9a4bea8836ee98a9e9685de2104a28e Closes-Bug: 1398903 (cherry picked from commit 2690d6f18333c4b4eee21b296e7ffbde614ee89f)
* | Bump stable/juno version to 2014.2.3Matt Riedemann2015-02-091-1/+1
| | | | | | | | | | Change-Id: Ib8a29258d99de75b49a9b19aef36bb99bc5fcac0 Related-Bug: #1419919
* | Merge "Adding filesystem schema check in async task" into stable/juno2014.2.2Jenkins2015-02-032-4/+6
|\ \ | |/ |/|
| * Adding filesystem schema check in async taskZhi Yan Liu2015-01-232-4/+6
| | | | | | | | | | | | | | | | | | | | | | Minor improvement for proper exception. Conflicts: glance/common/scripts/utils.py Change-Id: I7176924a979b6f71a03a13609d81f25f4007770a Signed-off-by: Zhi Yan Liu <zhiyanl@cn.ibm.com> (cherry picked from commit e086049c30218e111a2514673956ce98a6d1d9c0)
* | Updated from global requirementsOpenStack Proposal Bot2015-01-281-1/+1
| | | | | | | | Change-Id: If4546615c246f2a5be6a040bd302eb75db294273
* | Updated from global requirementsOpenStack Proposal Bot2015-01-281-1/+1
|/ | | | Change-Id: Ibbc6b651c36fd97cf4a2faf8575962085e178190
* Cleanup chunks for deleted image that was 'saving'Zhi Yan Liu2015-01-2215-80/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently image data cannot be removed synchronously for an image that is in saving state. And when, the upload operation for such an image is completed the operator configured quota can be exceeded. This patch fixes the issue of left over chunks for an image which was deleted from saving status. However, by the limitation of the design we cannot enforce a global quota check for the image in saving status. This change introduces a inconsonance between http response codes of v1 and v2 APIs. The status codes which we will now see after the upload process completes on an image which was deleted mid way are: v1: 412 Precondition Failed v2: 410 Gone SecurityImpact UpgradeImpact APIImpact Closes-Bug: 1383973 Closes-Bug: 1398830 Closes-Bug: 1188532 Conflicts: glance/api/v1/upload_utils.py glance/api/v2/image_data.py glance/tests/unit/test_domain_proxy.py glance/tests/unit/v1/test_api.py Change-Id: I47229b366c25367ec1bd48aec684e0880f3dfe60 Signed-off-by: Zhi Yan Liu <zhiyanl@cn.ibm.com> (cherry picked from commit 0dc8fbb3479a53c5bba8475d14f4c7206904c5ea)
* Merge "Fix and add a test case for IPv6" into stable/junoJenkins2015-01-221-2/+9
|\
| * Fix and add a test case for IPv6Hui Xiang2015-01-071-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | Fixing and adding a test case in relation to the eventlet ipv6 fix in patch set 23 (https://review.openstack.org/#/c/101079/). * pre-import eventlet for test case test_evnetlet_no_dnspython, which wasn't actually importing eventlet like it described. * add case test_no_evnetlet_no_dnspython Change-Id: I55c40ed735781862f8352afb917058bf475d16fe (cherry picked from commit 9447d37d653d87c89a1daf8f5affe41269beffbd)
* | Merge "Fix getaddrinfo if dnspython is installed" into stable/junoJenkins2015-01-223-0/+114
|\ \ | |/
| * Fix getaddrinfo if dnspython is installedEdward Hope-Morley2015-01-073-0/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If dnspython is present in the environment then eventlet monkeypatches socket.getaddrinfo() with an implementation which doesn't work for IPv6. This patch has also been applied to other Openstack projects such as nova (f2e49ad3) and keystone (3afd9791) in order to work around the same problem and is intended to be used in the same way. Co-authored-by: Hui Xiang <hui.xiang@canonical.com> Closes-Bug: 1331885 (cherry picked from commit bd2a8422d3e8c975d023982c038a59ca0257c6dd) Conflicts: glance/cmd/__init__.py Change-Id: I795e004eac3f032217ff9cb0047f1976306fbb71
* | Updated from global requirementsOpenStack Proposal Bot2015-01-141-2/+2
| | | | | | | | Change-Id: I553edeb3bb07629e1f4d91ed76c82162b6cd4c7d
* | Merge "Prevent file, swift+config and filesystem schemes" into stable/junoJenkins2015-01-123-25/+21
|\ \
| * | Prevent file, swift+config and filesystem schemesGrant Murphy2015-01-083-25/+21
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | This change ensures that 'file', 'filesystem', and 'swift+config' URI schemes are not allowed when setting the location field. A previous fix to CVE-2014-9493 attempted to address this issue but did not include 'filesystem', a URI scheme allowed by the glance_store. Without this fix in place it is possible for a client to access any file the glance-api server has read permissions for. Change-Id: I02cd099a8634b9c7e3cf8f172bcbd33f8edcbc83 Closes-Bug: #1408663 (cherry picked from commit a2d986b976e9325a272e2d422465165315d19fe6)
* | Updated from global requirementsOpenStack Proposal Bot2015-01-111-1/+1
|/ | | | Change-Id: Id5ce4617bf6ea152ff5dd31a69c4d7c9bb833601
* Merge "To prevent client use v2 patch api to handle file and swift location" ↵Jenkins2014-12-189-131/+221
|\ | | | | | | into stable/juno
| * To prevent client use v2 patch api to handle file and swift locationZhi Yan Liu2014-12-189-131/+221
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The change will be used to restrict client to download and delete any file in glance-api server. The same resone and logic as what we did in v1: https://github.com/openstack/glance/blob/master/glance/api/v1/images.py#L429 Closes-Bug: bug/1400966 DocImpact Note: Even this change could fully resolve the problem for Glance, but we still need to fix this issue from glance_store perspective separatelly due to other projects can use the lib directly. Conflicts: glance/api/v1/images.py glance/location.py glance/tests/functional/v2/test_images.py glance/tests/unit/test_store_location.py glance/tests/unit/v1/test_api.py (cherry-picked from 4afdb017aa1ccef01482f117cb8d0736a6da38ed) Signed-off-by: Zhi Yan Liu <zhiyanl@cn.ibm.com> Change-Id: I72dbead3cb2dcb87f52658ddb880e26880cc229b
* | Updated from global requirementsOpenStack Proposal Bot2014-12-161-2/+2
|/ | | | Change-Id: I38909f327f5d168fca2f53a8e32eb39db5d98ee9
* Bump stable/juno next version to 2014.2.2Alan Pevec2014-12-051-1/+1
| | | | Change-Id: If016d6f492c2b23d6ce3e77731cd1d9de94a9b18
* Updated from global requirements2014.2.1OpenStack Proposal Bot2014-12-051-1/+1
| | | | Change-Id: I75172700283a95e1e056b8ee35688e9a83321e72
* Updated from global requirementsOpenStack Proposal Bot2014-12-031-1/+1
| | | | Change-Id: Iee5554ddc36e58163d260175964dad8b759c94ec
* Disable osprofiler by defaultLouis Taylor2014-11-284-6/+18
| | | | | | | | | | | This could cause issues when upgrading to juno, since if config files are not updated osprofiler can crash. It is disabled by default in other services, such as cinder and heat. Change-Id: Ide1be0d42e9e3640560564005b2ce1ffdf554e25 Closes-Bug: #1387320 (cherry picked from commit 090cb56ba100d53dc7c95148dde77a8a4969adfe)
* Merge "Improve error log for expired image location url" into stable/junoJenkins2014-11-272-0/+21
|\
| * Improve error log for expired image location urlankitagrawal2014-10-222-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If image is not present at the specified location while creating instance from image, then HTTPInternalServerError 500 response along with stack trace is logged on nova compute which does not help user to understand the exact cause of failure. Return HTTPNotFound error to the nova compute in case of image url got expired or image is not present at the given location to give clear indication of the cause of failure to user. Closes-Bug: #1198566 Change-Id: I9acd9112aeae8d3b3c0c3921f306e716e5808c2e (cherry picked from commit 633bec8fd45897735e1fcb9844903fe597903b21)
* | Merge "Make RequestContext use auth_token (not auth_tok)" into stable/junoJenkins2014-11-2613-86/+71
|\ \
| * | Make RequestContext use auth_token (not auth_tok)Stuart McLaren2014-11-1313-86/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RequestContext class from oslo-incubator uses 'auth_token'. Glance's RequestContext uses 'auth_tok' -- which is inconsistent. glance_store currently uses the oslo 'auth_token'. We should not assume a 1-1 mapping from the glance_store to glance, nor should we have glance_store support both 'auth_token' and 'auth_tok'. Therefore Glance should be updated to use 'auth_token'. This change was generated automatically with: $ for file in `find glance -name '*\.py' -exec grep -wl auth_tok "{}" \;` ; \ do sed --in-place 's/\<auth_tok\>/auth_token/g' $file ; done In addition, the set_auth_token function was removed. This had been used by Nova to work around the auth_tok <-> auth_token inconsistency, but was removed in mid-2012 as part of the move to python-glanceclient so is no longer needed. In conjuction with other changes this fixes image upload when using the multi-tenant Swift store. Change-Id: Ic8a5f44088990fd8f6290a5622b823f59ef365fc Partial-bug: #1385213 (cherry picked from commit cc7ae2abd5c67b5573ca609e27c79d5c4f9a528d)
* | | Merge "Swift Multi-tenant store: Pass context on upload" into stable/junoJenkins2014-11-261-1/+2
|\ \ \ | |/ /
View Lorry Controller Status