Merge lp:~james-page/nova/folsom-resync into lp:~openstack-ubuntu-testing/nova/folsom

[James Page]

Resync of pending SRU with security updates.

=== modified file 'debian/changelog'
--- debian/changelog	2013-02-21 20:49:05 +0000
+++ debian/changelog	2013-03-22 13:42:13 +0000
@@ -12,6 +12,23 @@
 
  -- Adam Gandelman <[e-mail]>  Thu, 21 Feb 2013 12:40:55 -0400
 
+nova (2012.2.3-0ubuntu2) quantal-proposed; urgency=low
+
+  * Re-sync with latest security updates.
+  * SECURITY UPDATE: fix denial of service via fixed IPs when using extensions
+    - debian/patches/CVE-2013-1838.patch: add explicit quota for fixed IP
+    - CVE-2013-1838
+  * SECURITY UPDATE: fix VNC token validation
+    - debian/patches/CVE-2013-0335.patch: force console auth service to flush
+      all tokens associated with an instance when it is deleted
+    - CVE-2013-0335
+  * SECURITY UPDATE: fix denial of service
+    - CVE-2013-1664.patch: Add a new utils.safe_minidom_parse_string function
+      and update external API facing Nova modules to use it
+    - CVE-2013-1664
+
+ -- James Page <[e-mail]>  Fri, 22 Mar 2013 12:40:07 +0000
+
 nova (2012.2.3-0ubuntu1) quantal-proposed; urgency=low
 
   * Dropped patches, applied upstream:
@@ -45,6 +62,20 @@
 
  -- Adam Gandelman <[e-mail]>  Tue, 05 Feb 2013 14:11:49 -0400
 
+nova (2012.2.1+stable-20121212-a99a802e-0ubuntu1.4) quantal-security; urgency=low
+
+  * SECURITY UPDATE: fix denial of service via fixed IPs when using extensions
+    - debian/patches/CVE-2013-1838.patch: add explicit quota for fixed IP
+    - CVE-2013-1838
+    - LP: #1125468
+  * SECURITY UPDATE: fix VNC token validation
+    - debian/patches/CVE-2013-0335.patch: force console auth service to flush
+      all tokens associated with an instance when it is deleted
+    - CVE-2013-0335
+    - LP: #1125378
+
+ -- Jamie Strandboge <[e-mail]>  Wed, 20 Mar 2013 09:53:55 -0500
+
 nova (2012.2.1+stable-20121212-a99a802e-0ubuntu1.2) quantal-security; urgency=low
 
   * SECURITY UPDATE: fix denial of service

=== added file 'debian/patches/CVE-2013-0335.patch'
--- debian/patches/CVE-2013-0335.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2013-0335.patch	2013-03-22 13:42:13 +0000
@@ -0,0 +1,378 @@
+From: John Herndon <[e-mail]>
+Date: Fri, 22 Feb 2013 20:43:58 +0000 (+0000)
+Subject: VNC Token Validation
+X-Git-Url: https://review.openstack.org/gitweb?p=openstack%2Fnova.git;a=commitdiff_plain;h=05a3374992bc8ba53ddc9c491b51c4b59eed0a72
+
+VNC Token Validation
+
+Force console auth service to flush all tokens
+associated with an instance when it is deleted.
+This will fix a bug where the console for the
+wrong instance can be connected to via the console
+if the correct circumstances occur. This change also
+makes a call to veriry vnc console tokens when a
+user attempts to connect to a console. This ensures
+the user is connecting to the correct console.
+
+bug 1125378
+Change-Id: I0d83ec6c4dbfef1af912a200ee15f8052f72da96
+---
+
+--- a/nova/common/memorycache.py
++++ b/nova/common/memorycache.py
+@@ -62,3 +62,8 @@ class Client(object):
+         new_value = int(value) + delta
+         self.cache[key] = (self.cache[key][0], str(new_value))
+         return new_value
++
++    def delete(self, key, time=0):
++        """Deletes the value associated with a key."""
++        if key in self.cache:
++            del self.cache[key]
+--- a/nova/compute/api.py
++++ b/nova/compute/api.py
+@@ -1852,7 +1852,8 @@ class API(base.Base):
+ 
+         self.consoleauth_rpcapi.authorize_console(context,
+                 connect_info['token'], console_type, connect_info['host'],
+-                connect_info['port'], connect_info['internal_access_path'])
++                connect_info['port'], connect_info['internal_access_path'],
++                instance["uuid"])
+ 
+         return {'url': connect_info['access_url']}
+ 
+--- a/nova/compute/manager.py
++++ b/nova/compute/manager.py
+@@ -52,6 +52,7 @@ from nova.compute import rpcapi as compu
+ from nova.compute import task_states
+ from nova.compute import utils as compute_utils
+ from nova.compute import vm_states
++from nova import consoleauth
+ import nova.context
+ from nova import exception
+ from nova import flags
+@@ -235,6 +236,7 @@ class ComputeManager(manager.SchedulerDe
+         self.compute_api = compute.API()
+         self.compute_rpcapi = compute_rpcapi.ComputeAPI()
+         self.scheduler_rpcapi = scheduler_rpcapi.SchedulerAPI()
++        self.consoleauth_rpcapi = consoleauth.rpcapi.ConsoleAuthAPI()
+ 
+         super(ComputeManager, self).__init__(service_name="compute",
+                                              *args, **kwargs)
+@@ -926,6 +928,10 @@ class ComputeManager(manager.SchedulerDe
+         self._notify_about_instance_usage(context, instance, "delete.end",
+                 system_metadata=system_meta)
+ 
++        if FLAGS.vnc_enabled:
++            self.consoleauth_rpcapi.delete_tokens_for_instance(context,
++                                                        instance["uuid"])
++
+     @exception.wrap_exception(notifier=notifier, publisher_id=publisher_id())
+     @wrap_instance_fault
+     def terminate_instance(self, context, instance):
+@@ -1989,6 +1995,12 @@ class ComputeManager(manager.SchedulerDe
+         return connection_info
+ 
+     @exception.wrap_exception(notifier=notifier, publisher_id=publisher_id())
++    @wrap_instance_fault
++    def validate_console_port(self, ctxt, instance, port, console_type):
++        console_info = self.driver.get_vnc_console(instance)
++        return console_info['port'] == port
++
++    @exception.wrap_exception(notifier=notifier, publisher_id=publisher_id())
+     @reverts_task_state
+     @wrap_instance_fault
+     def reserve_block_device_name(self, context, instance, device):
+--- a/nova/compute/rpcapi.py
++++ b/nova/compute/rpcapi.py
+@@ -259,6 +259,13 @@ class ComputeAPI(nova.openstack.common.r
+                 instance=instance_p, console_type=console_type),
+                 topic=_compute_topic(self.topic, ctxt, None, instance))
+ 
++    def validate_console_port(self, ctxt, instance, port, console_type):
++        instance_p = jsonutils.to_primitive(instance)
++        return self.call(ctxt, self.make_msg('validate_console_port',
++                instance=instance_p, port=port, console_type=console_type),
++                topic=_compute_topic(self.topic, ctxt,
++                None, instance))
++
+     def host_maintenance_mode(self, ctxt, host_param, mode, host):
+         '''Set host maintenance mode
+ 
+--- a/nova/consoleauth/manager.py
++++ b/nova/consoleauth/manager.py
+@@ -20,6 +20,8 @@
+ 
+ import time
+ 
++from nova.compute import rpcapi as compute_rpcapi
++from nova.db import api as db
+ from nova import flags
+ from nova import manager
+ from nova.openstack.common import cfg
+@@ -56,10 +58,21 @@ class ConsoleAuthManager(manager.Manager
+             from nova.common import memorycache as memcache
+         self.mc = memcache.Client(FLAGS.memcached_servers,
+                                   debug=0)
++        self.compute_rpcapi = compute_rpcapi.ComputeAPI()
++
++    def _get_tokens_for_instance(self, instance_uuid):
++        tokens_str = self.mc.get(instance_uuid.encode('UTF-8'))
++        if not tokens_str:
++            tokens = []
++        else:
++            tokens = jsonutils.loads(tokens_str)
++        return tokens
+ 
+     def authorize_console(self, context, token, console_type, host, port,
+-                          internal_access_path):
++                          internal_access_path, instance_uuid=None):
++
+         token_dict = {'token': token,
++                      'instance_uuid': instance_uuid,
+                       'console_type': console_type,
+                       'host': host,
+                       'port': port,
+@@ -67,11 +80,35 @@ class ConsoleAuthManager(manager.Manager
+                       'last_activity_at': time.time()}
+         data = jsonutils.dumps(token_dict)
+         self.mc.set(token.encode('UTF-8'), data, FLAGS.console_token_ttl)
++        if instance_uuid is not None:
++            tokens = self._get_tokens_for_instance(instance_uuid)
++            tokens.append(token)
++            self.mc.set(instance_uuid.encode('UTF-8'),
++                        jsonutils.dumps(tokens))
++
+         LOG.audit(_("Received Token: %(token)s, %(token_dict)s)"), locals())
+ 
++    def _validate_token(self, context, token):
++        instance_uuid = token['instance_uuid']
++        if instance_uuid is None:
++            return False
++        instance = db.instance_get_by_uuid(context, instance_uuid)
++        return self.compute_rpcapi.validate_console_port(context,
++                                            instance,
++                                            token['port'],
++                                            token['console_type'])
++
+     def check_token(self, context, token):
+         token_str = self.mc.get(token.encode('UTF-8'))
+         token_valid = (token_str is not None)
+         LOG.audit(_("Checking Token: %(token)s, %(token_valid)s)"), locals())
+         if token_valid:
+-            return jsonutils.loads(token_str)
++            token = jsonutils.loads(token_str)
++            if self._validate_token(context, token):
++                return token
++
++    def delete_tokens_for_instance(self, context, instance_uuid):
++        tokens = self._get_tokens_for_instance(instance_uuid)
++        for token in tokens:
++            self.mc.delete(token)
++        self.mc.delete(instance_uuid.encode('UTF-8'))
+--- a/nova/consoleauth/rpcapi.py
++++ b/nova/consoleauth/rpcapi.py
+@@ -49,14 +49,20 @@ class ConsoleAuthAPI(nova.openstack.comm
+                 default_version=self.BASE_RPC_API_VERSION)
+ 
+     def authorize_console(self, ctxt, token, console_type, host, port,
+-                          internal_access_path):
++                          internal_access_path, instance_uuid=None):
+         # The remote side doesn't return anything, but we want to block
+         # until it completes.
+         return self.call(ctxt,
+                 self.make_msg('authorize_console',
+                               token=token, console_type=console_type,
+                               host=host, port=port,
+-                              internal_access_path=internal_access_path))
++                              internal_access_path=internal_access_path,
++                              instance_uuid=instance_uuid))
+ 
+     def check_token(self, ctxt, token):
+         return self.call(ctxt, self.make_msg('check_token', token=token))
++
++    def delete_tokens_for_instance(self, ctxt, instance_uuid):
++        return self.call(ctxt,
++                self.make_msg('delete_tokens_for_instance',
++                              instance_uuid=instance_uuid))
+--- a/nova/tests/compute/test_compute.py
++++ b/nova/tests/compute/test_compute.py
+@@ -1372,6 +1372,24 @@ class ComputeTestCase(BaseTestCase):
+         self.compute._delete_instance(self.context,
+                 instance=jsonutils.to_primitive(instance))
+ 
++    def test_delete_instance_deletes_console_auth_tokens(self):
++        instance = self._create_fake_instance()
++        self.flags(vnc_enabled=True)
++
++        self.tokens_deleted = False
++
++        def fake_delete_tokens(*args, **kwargs):
++            self.tokens_deleted = True
++
++        cauth_rpcapi = self.compute.consoleauth_rpcapi
++        self.stubs.Set(cauth_rpcapi, 'delete_tokens_for_instance',
++                       fake_delete_tokens)
++
++        self.compute._delete_instance(self.context,
++                instance=jsonutils.to_primitive(instance))
++
++        self.assertTrue(self.tokens_deleted)
++
+     def test_instance_termination_exception_sets_error(self):
+         """Test that we handle InstanceTerminationFailure
+         which is propagated up from the underlying driver.
+@@ -4465,7 +4483,9 @@ class ComputeAPITestCase(BaseTestCase):
+                              'console_type': fake_console_type,
+                              'host': 'fake_console_host',
+                              'port': 'fake_console_port',
+-                             'internal_access_path': 'fake_access_path'}
++                             'internal_access_path': 'fake_access_path',
++                             'instance_uuid': fake_instance["uuid"]}
++
+         fake_connect_info2 = copy.deepcopy(fake_connect_info)
+         fake_connect_info2['access_url'] = 'fake_console_url'
+ 
+@@ -4499,6 +4519,36 @@ class ComputeAPITestCase(BaseTestCase):
+ 
+         db.instance_destroy(self.context, instance['uuid'])
+ 
++    def test_validate_console_port(self):
++        self.flags(vnc_enabled=True)
++        instance = jsonutils.to_primitive(self._create_fake_instance())
++
++        def fake_driver_get_console(*args, **kwargs):
++            return {'host': "fake_host", 'port': "5900",
++                    'internal_access_path': None}
++        self.stubs.Set(self.compute.driver, "get_vnc_console",
++                       fake_driver_get_console)
++
++        self.assertTrue(self.compute.validate_console_port(self.context,
++                                                            instance,
++                                                            "5900",
++                                                            "novnc"))
++
++    def test_validate_console_port_wrong_port(self):
++        self.flags(vnc_enabled=True)
++        instance = jsonutils.to_primitive(self._create_fake_instance())
++
++        def fake_driver_get_console(*args, **kwargs):
++            return {'host': "fake_host", 'port': "5900",
++                    'internal_access_path': None}
++        self.stubs.Set(self.compute.driver, "get_vnc_console",
++                       fake_driver_get_console)
++
++        self.assertFalse(self.compute.validate_console_port(self.context,
++                                                            instance,
++                                                            "wrongport",
++                                                            "novnc"))
++
+     def test_console_output(self):
+         fake_instance = {'uuid': 'fake_uuid',
+                          'host': 'fake_compute_host'}
+--- a/nova/tests/compute/test_rpcapi.py
++++ b/nova/tests/compute/test_rpcapi.py
+@@ -168,6 +168,11 @@ class ComputeRpcAPITestCase(test.TestCas
+         self._test_compute_api('get_vnc_console', 'call',
+                 instance=self.fake_instance, console_type='type')
+ 
++    def test_validate_console_port(self):
++        self._test_compute_api('validate_console_port', 'call',
++                instance=self.fake_instance, port="5900",
++                console_type="novnc")
++
+     def test_host_maintenance_mode(self):
+         self._test_compute_api('host_maintenance_mode', 'call',
+                 host_param='param', mode='mode', host='host')
+--- a/nova/tests/consoleauth/test_consoleauth.py
++++ b/nova/tests/consoleauth/test_consoleauth.py
+@@ -45,8 +45,73 @@ class ConsoleauthTestCase(test.TestCase)
+         """Test that tokens expire correctly."""
+         token = 'mytok'
+         self.flags(console_token_ttl=1)
++
++        def fake_validate_token(*args, **kwargs):
++            return True
++        self.stubs.Set(self.manager,
++                       "_validate_token",
++                       fake_validate_token)
++
+         self.manager.authorize_console(self.context, token, 'novnc',
+-                                       '127.0.0.1', 'host', '')
++                                       '127.0.0.1', '8080', 'host', "1234")
+         self.assertTrue(self.manager.check_token(self.context, token))
+         time.sleep(1.1)
+         self.assertFalse(self.manager.check_token(self.context, token))
++
++    def test_multiple_tokens_for_instance(self):
++        tokens = ["token" + str(i) for i in xrange(10)]
++        instance = "12345"
++
++        def fake_validate_token(*args, **kwargs):
++            return True
++
++        self.stubs.Set(self.manager, "_validate_token",
++                       fake_validate_token)
++        for token in tokens:
++            self.manager.authorize_console(self.context, token, 'novnc',
++                                          '127.0.0.1', '8080', 'host',
++                                          instance)
++
++        for token in tokens:
++            self.assertTrue(self.manager.check_token(self.context, token))
++
++    def test_delete_tokens_for_instance(self):
++        instance = "12345"
++        tokens = ["token" + str(i) for i in xrange(10)]
++
++        def fake_validate_token(*args, **kwargs):
++            return True
++        self.stubs.Set(self.manager, "_validate_token",
++                       fake_validate_token)
++
++        for token in tokens:
++            self.manager.authorize_console(self.context, token, 'novnc',
++                                          '127.0.0.1', '8080', 'host',
++                                          instance)
++        self.manager.delete_tokens_for_instance(self.context, instance)
++        stored_tokens = self.manager._get_tokens_for_instance(instance)
++
++        self.assertEqual(len(stored_tokens), 0)
++
++        for token in tokens:
++            self.assertFalse(self.manager.check_token(self.context, token))
++
++    def test_wrong_token_has_port(self):
++        token = 'mytok'
++
++        def fake_validate_token(*args, **kwargs):
++            return False
++
++        self.stubs.Set(self.manager, "_validate_token",
++                       fake_validate_token)
++
++        self.manager.authorize_console(self.context, token, 'novnc',
++                                        '127.0.0.1', '8080', 'host',
++                                        instance_uuid='instance')
++        self.assertFalse(self.manager.check_token(self.context, token))
++
++    def test_console_no_instance_uuid(self):
++        self.manager.authorize_console(self.context, "token", 'novnc',
++                                        '127.0.0.1', '8080', 'host',
++                                        instance_uuid=None)
++        self.assertFalse(self.manager.check_token(self.context, "token"))
+--- a/nova/tests/consoleauth/test_rpcapi.py
++++ b/nova/tests/consoleauth/test_rpcapi.py
+@@ -68,7 +68,11 @@ class ConsoleAuthRpcAPITestCase(test.Tes
+     def test_authorize_console(self):
+         self._test_consoleauth_api('authorize_console', token='token',
+                 console_type='ctype', host='h', port='p',
+-                internal_access_path='iap')
++                internal_access_path='iap', instance_uuid="1234")
+ 
+     def test_check_token(self):
+         self._test_consoleauth_api('check_token', token='t')
++
++    def test_delete_tokens_for_instnace(self):
++        self._test_consoleauth_api('delete_tokens_for_instance',
++                                   instance_uuid="instance")

=== added file 'debian/patches/CVE-2013-1838.patch'
--- debian/patches/CVE-2013-1838.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/CVE-2013-1838.patch	2013-03-22 13:42:13 +0000
@@ -0,0 +1,476 @@
+commit dbe94187193da8741b4b8c270c62eb4d9cb0bd8a
+Author: Michael Still <[e-mail]>
+Date:   Fri Mar 1 20:22:39 2013 +0000
+
+    Add quotas for fixed ips.
+    
+    DocImpact: there is now a default quota of 10 fixed ips per tenant.
+    This will need to be adjusted by deployers if that number does not
+    meet their needs.
+    
+    Resolves bug 1125468 for folsom.
+    
+    Change-Id: I970d540cfa6a61b7e903703f845a6453ff55f225
+
+--- a/nova/db/api.py
++++ b/nova/db/api.py
+@@ -507,6 +507,12 @@ def fixed_ip_update(context, address, va
+     """Create a fixed ip from the values dictionary."""
+     return IMPL.fixed_ip_update(context, address, values)
+ 
++
++def fixed_ip_count_by_project(context, project_id, session=None):
++    """Count fixed ips used by project."""
++    return IMPL.fixed_ip_count_by_project(context, project_id,
++                                          session=session)
++
+ ####################
+ 
+ 
+--- a/nova/db/sqlalchemy/api.py
++++ b/nova/db/sqlalchemy/api.py
+@@ -1273,6 +1273,27 @@ def fixed_ip_update(context, address, va
+         fixed_ip_ref.save(session=session)
+ 
+ 
++@require_context
++def fixed_ip_count_by_project(context, project_id, session=None):
++    authorize_project_context(context, project_id)
++
++    # NOTE(mikal): Yes I know this is horrible, but I couldn't
++    # get a query using a join working, mainly because of a failure
++    # to be able to express the where clause sensibly. Patches
++    # welcome.
++    session = get_session()
++    with session.begin():
++        instance_uuid_query = model_query(context, models.Instance.uuid,
++                                          read_deleted="no", session=session).\
++                                 filter(models.Instance.project_id == \
++                                            project_id)
++        uuid_filter = models.FixedIp.instance_uuid.in_(instance_uuid_query)
++        return model_query(context, models.FixedIp, read_deleted="no",
++                           session=session).\
++                           filter(uuid_filter).\
++                           count()
++
++
+ ###################
+ 
+ 
+--- a/nova/exception.py
++++ b/nova/exception.py
+@@ -998,6 +998,10 @@ class FloatingIpLimitExceeded(QuotaError
+     message = _("Maximum number of floating ips exceeded")
+ 
+ 
++class FixedIpLimitExceeded(QuotaError):
++    message = _("Maximum number of fixed ips exceeded")
++
++
+ class MetadataLimitExceeded(QuotaError):
+     message = _("Maximum number of metadata items exceeds %(allowed)d")
+ 
+--- a/nova/network/manager.py
++++ b/nova/network/manager.py
+@@ -1294,37 +1294,53 @@ class NetworkManager(manager.SchedulerDe
+         address = None
+         instance_ref = self.db.instance_get(context, instance_id)
+ 
+-        if network['cidr']:
+-            address = kwargs.get('address', None)
+-            if address:
+-                address = self.db.fixed_ip_associate(context,
+-                                                     address,
+-                                                     instance_ref['uuid'],
+-                                                     network['id'])
+-            else:
+-                address = self.db.fixed_ip_associate_pool(context.elevated(),
+-                                                          network['id'],
+-                                                          instance_ref['uuid'])
+-            self._do_trigger_security_group_members_refresh_for_instance(
+-                                                                   instance_id)
+-            get_vif = self.db.virtual_interface_get_by_instance_and_network
+-            vif = get_vif(context, instance_ref['uuid'], network['id'])
+-            values = {'allocated': True,
+-                      'virtual_interface_id': vif['id']}
+-            self.db.fixed_ip_update(context, address, values)
+-
+-        name = instance_ref['display_name']
+-
+-        if self._validate_instance_zone_for_dns_domain(context, instance_ref):
+-            uuid = instance_ref['uuid']
+-            self.instance_dns_manager.create_entry(name, address,
+-                                                   "A",
+-                                                   self.instance_dns_domain)
+-            self.instance_dns_manager.create_entry(uuid, address,
+-                                                   "A",
+-                                                   self.instance_dns_domain)
+-        self._setup_network_on_host(context, network)
+-        return address
++        # Check the quota; can't put this in the API because we get
++        # called into from other places
++        try:
++            reservations = QUOTAS.reserve(context, fixed_ips=1)
++        except exception.OverQuota:
++            pid = context.project_id
++            LOG.warn(_("Quota exceeded for %(pid)s, tried to allocate "
++                       "fixed IP") % locals())
++            raise exception.FixedIpLimitExceeded()
++
++        try:
++            if network['cidr']:
++                address = kwargs.get('address', None)
++                if address:
++                    address = self.db.fixed_ip_associate(context,
++                                                         address,
++                                                         instance_ref['uuid'],
++                                                         network['id'])
++                else:
++                    address = self.db.fixed_ip_associate_pool(
++                        context.elevated(), network['id'],
++                        instance_ref['uuid'])
++                self._do_trigger_security_group_members_refresh_for_instance(
++                    instance_id)
++                get_vif = self.db.virtual_interface_get_by_instance_and_network
++                vif = get_vif(context, instance_ref['uuid'], network['id'])
++                values = {'allocated': True,
++                          'virtual_interface_id': vif['id']}
++                self.db.fixed_ip_update(context, address, values)
++
++            name = instance_ref['display_name']
++
++            if self._validate_instance_zone_for_dns_domain(context,
++                                                           instance_ref):
++                uuid = instance_ref['uuid']
++                self.instance_dns_manager.create_entry(
++                    name, address, "A", self.instance_dns_domain)
++                self.instance_dns_manager.create_entry(
++                    uuid, address, "A", self.instance_dns_domain)
++            self._setup_network_on_host(context, network)
++
++            QUOTAS.commit(context, reservations)
++            return address
++
++        except Exception:
++            with excutils.save_and_reraise_exception():
++                QUOTAS.rollback(context, reservations)
+ 
+     def deallocate_fixed_ip(self, context, address, host=None, teardown=True):
+         """Returns a fixed ip to the pool."""
+@@ -1334,6 +1350,13 @@ class NetworkManager(manager.SchedulerDe
+                 context.elevated(read_deleted='yes'),
+                 fixed_ip_ref['instance_uuid'])
+ 
++        try:
++            reservations = QUOTAS.reserve(context, fixed_ips=-1)
++        except Exception:
++            reservations = None
++            LOG.exception(_("Failed to update usages deallocating "
++                            "fixed IP"))
++
+         self._do_trigger_security_group_members_refresh_for_instance(
+             instance['uuid'])
+ 
+@@ -1373,6 +1396,10 @@ class NetworkManager(manager.SchedulerDe
+                 #             callback will get called by nova-dhcpbridge.
+                 self.driver.release_dhcp(dev, address, vif['address'])
+ 
++        # Commit the reservations
++        if reservations:
++            QUOTAS.commit(context, reservations)
++
+     def lease_fixed_ip(self, context, address):
+         """Called by dhcp-bridge when ip is leased."""
+         LOG.debug(_('Leased IP |%(address)s|'), locals(), context=context)
+--- a/nova/quota.py
++++ b/nova/quota.py
+@@ -50,6 +50,10 @@ quota_opts = [
+     cfg.IntOpt('quota_floating_ips',
+                default=10,
+                help='number of floating ips allowed per project'),
++    cfg.IntOpt('quota_fixed_ips',
++               default=10,
++               help=('number of fixed ips allowed per project (this should be '
++                     'at least the number of instances allowed)')),
+     cfg.IntOpt('quota_metadata_items',
+                default=128,
+                help='number of metadata items allowed per instance'),
+@@ -778,6 +782,11 @@ def _sync_floating_ips(context, project_
+             context, project_id, session=session))
+ 
+ 
++def _sync_fixed_ips(context, project_id, session):
++    return dict(fixed_ips=db.fixed_ip_count_by_project(
++            context, project_id, session=session))
++
++
+ def _sync_security_groups(context, project_id, session):
+     return dict(security_groups=db.security_group_count_by_project(
+             context, project_id, session=session))
+@@ -794,6 +803,7 @@ resources = [
+     ReservableResource('gigabytes', _sync_volumes, 'quota_gigabytes'),
+     ReservableResource('floating_ips', _sync_floating_ips,
+                        'quota_floating_ips'),
++    ReservableResource('fixed_ips', _sync_fixed_ips, 'quota_fixed_ips'),
+     AbsoluteResource('metadata_items', 'quota_metadata_items'),
+     AbsoluteResource('injected_files', 'quota_injected_files'),
+     AbsoluteResource('injected_file_content_bytes',
+--- a/nova/tests/api/openstack/compute/contrib/test_quota_classes.py
++++ b/nova/tests/api/openstack/compute/contrib/test_quota_classes.py
+@@ -25,10 +25,11 @@ from nova.tests.api.openstack import fak
+ def quota_set(class_name):
+     return {'quota_class_set': {'id': class_name, 'metadata_items': 128,
+             'volumes': 10, 'gigabytes': 1000, 'ram': 51200,
+-            'floating_ips': 10, 'instances': 10, 'injected_files': 5,
+-            'cores': 20, 'injected_file_content_bytes': 10240,
+-            'security_groups': 10, 'security_group_rules': 20,
+-            'key_pairs': 100, 'injected_file_path_bytes': 255}}
++            'floating_ips': 10, 'fixed_ips': 10, 'instances': 10,
++            'injected_files': 5, 'cores': 20,
++            'injected_file_content_bytes': 10240, 'security_groups': 10,
++            'security_group_rules': 20, 'key_pairs': 100,
++            'injected_file_path_bytes': 255}}
+ 
+ 
+ class QuotaClassSetsTest(test.TestCase):
+@@ -44,6 +45,7 @@ class QuotaClassSetsTest(test.TestCase):
+             'ram': 51200,
+             'volumes': 10,
+             'floating_ips': 10,
++            'fixed_ips': 10,
+             'metadata_items': 128,
+             'gigabytes': 1000,
+             'injected_files': 5,
+@@ -91,7 +93,8 @@ class QuotaClassSetsTest(test.TestCase):
+         body = {'quota_class_set': {'instances': 50, 'cores': 50,
+                                     'ram': 51200, 'volumes': 10,
+                                     'gigabytes': 1000, 'floating_ips': 10,
+-                                    'metadata_items': 128, 'injected_files': 5,
++                                    'fixed_ips': 10, 'metadata_items': 128,
++                                    'injected_files': 5,
+                                     'injected_file_content_bytes': 10240,
+                                     'injected_file_path_bytes': 255,
+                                     'security_groups': 10,
+@@ -139,6 +142,7 @@ class QuotaTemplateXMLSerializerTest(tes
+                 gigabytes=40,
+                 ram=50,
+                 floating_ips=60,
++                fixed_ips=10,
+                 instances=70,
+                 injected_files=80,
+                 security_groups=10,
+--- a/nova/tests/api/openstack/compute/contrib/test_quotas.py
++++ b/nova/tests/api/openstack/compute/contrib/test_quotas.py
+@@ -26,11 +26,12 @@ from nova.tests.api.openstack import fak
+ 
+ def quota_set(id):
+     return {'quota_set': {'id': id, 'metadata_items': 128, 'volumes': 10,
+-            'gigabytes': 1000, 'ram': 51200, 'floating_ips': 10,
+-            'instances': 10, 'injected_files': 5, 'cores': 20,
+-            'injected_file_content_bytes': 10240,
+-            'security_groups': 10, 'security_group_rules': 20,
+-            'key_pairs': 100, 'injected_file_path_bytes': 255}}
++                          'gigabytes': 1000, 'ram': 51200, 'floating_ips': 10,
++                          'fixed_ips': 10, 'instances': 10,
++                          'injected_files': 5, 'cores': 20,
++                          'injected_file_content_bytes': 10240,
++                          'security_groups': 10, 'security_group_rules': 20,
++                          'key_pairs': 100, 'injected_file_path_bytes': 255}}
+ 
+ 
+ class QuotaSetsTest(test.TestCase):
+@@ -46,6 +47,7 @@ class QuotaSetsTest(test.TestCase):
+             'ram': 51200,
+             'volumes': 10,
+             'floating_ips': 10,
++            'fixed_ips': 10,
+             'metadata_items': 128,
+             'gigabytes': 1000,
+             'injected_files': 5,
+@@ -88,6 +90,7 @@ class QuotaSetsTest(test.TestCase):
+                     'volumes': 10,
+                     'gigabytes': 1000,
+                     'floating_ips': 10,
++                    'fixed_ips': 10,
+                     'metadata_items': 128,
+                     'injected_files': 5,
+                     'injected_file_path_bytes': 255,
+@@ -120,7 +123,7 @@ class QuotaSetsTest(test.TestCase):
+                               'injected_file_path_bytes': 255,
+                               'security_groups': 10,
+                               'security_group_rules': 20,
+-                              'key_pairs': 100}}
++                              'key_pairs': 100, 'fixed_ips': 10}}
+ 
+         req = fakes.HTTPRequest.blank('/v2/fake4/os-quota-sets/update_me',
+                                       use_admin_context=True)
+@@ -171,6 +174,7 @@ class QuotaXMLSerializerTest(test.TestCa
+                 gigabytes=40,
+                 ram=50,
+                 floating_ips=60,
++                fixed_ips=10,
+                 instances=70,
+                 injected_files=80,
+                 security_groups=10,
+--- a/nova/tests/network/test_manager.py
++++ b/nova/tests/network/test_manager.py
+@@ -30,6 +30,7 @@ from nova.openstack.common import import
+ from nova.openstack.common import log as logging
+ from nova.openstack.common import rpc
+ import nova.policy
++from nova import quota
+ from nova import test
+ from nova.tests import fake_network
+ from nova import utils
+@@ -278,6 +279,7 @@ class FlatNetworkTestCase(test.TestCase)
+         self.mox.StubOutWithMock(db,
+                               'virtual_interface_get_by_instance_and_network')
+         self.mox.StubOutWithMock(db, 'fixed_ip_update')
++        self.mox.StubOutWithMock(quota.QUOTAS, 'reserve')
+ 
+         db.fixed_ip_update(mox.IgnoreArg(),
+                            mox.IgnoreArg(),
+@@ -291,6 +293,10 @@ class FlatNetworkTestCase(test.TestCase)
+         db.instance_get(mox.IgnoreArg(),
+                         mox.IgnoreArg()).AndReturn({'security_groups':
+                                                              [{'id': 0}]})
++
++        quota.QUOTAS.reserve(mox.IgnoreArg(),
++                             fixed_ips=mox.IgnoreArg()).AndReturn(None)
++
+         db.fixed_ip_associate_pool(mox.IgnoreArg(),
+                                    mox.IgnoreArg(),
+                                    mox.IgnoreArg()).AndReturn('192.168.0.101')
+@@ -310,6 +316,7 @@ class FlatNetworkTestCase(test.TestCase)
+         self.mox.StubOutWithMock(db,
+                               'virtual_interface_get_by_instance_and_network')
+         self.mox.StubOutWithMock(db, 'fixed_ip_update')
++        self.mox.StubOutWithMock(quota.QUOTAS, 'reserve')
+ 
+         db.fixed_ip_update(mox.IgnoreArg(),
+                            mox.IgnoreArg(),
+@@ -323,6 +330,10 @@ class FlatNetworkTestCase(test.TestCase)
+         db.instance_get(mox.IgnoreArg(),
+                         mox.IgnoreArg()).AndReturn({'security_groups':
+                                                              [{'id': 0}]})
++
++        quota.QUOTAS.reserve(mox.IgnoreArg(),
++                             fixed_ips=mox.IgnoreArg()).AndReturn(None)
++
+         db.fixed_ip_associate_pool(mox.IgnoreArg(),
+                                    mox.IgnoreArg(),
+                                    mox.IgnoreArg()).AndReturn('192.168.0.101')
+@@ -376,6 +387,7 @@ class FlatNetworkTestCase(test.TestCase)
+         self.mox.StubOutWithMock(db,
+                               'virtual_interface_get_by_instance_and_network')
+         self.mox.StubOutWithMock(db, 'fixed_ip_update')
++        self.mox.StubOutWithMock(quota.QUOTAS, 'reserve')
+ 
+         db.fixed_ip_update(mox.IgnoreArg(),
+                            mox.IgnoreArg(),
+@@ -390,6 +402,9 @@ class FlatNetworkTestCase(test.TestCase)
+                         mox.IgnoreArg()).AndReturn({'security_groups':
+                                                              [{'id': 0}]})
+ 
++        quota.QUOTAS.reserve(mox.IgnoreArg(),
++                             fixed_ips=mox.IgnoreArg()).AndReturn(None)
++
+         db.fixed_ip_associate_pool(mox.IgnoreArg(),
+                                    mox.IgnoreArg(),
+                                    mox.IgnoreArg()).AndReturn(fixedip)
+--- a/nova/tests/test_quota.py
++++ b/nova/tests/test_quota.py
+@@ -723,6 +723,7 @@ class DbQuotaDriverTestCase(test.TestCas
+                    quota_volumes=10,
+                    quota_gigabytes=1000,
+                    quota_floating_ips=10,
++                   quota_fixed_ips=10,
+                    quota_metadata_items=128,
+                    quota_injected_files=5,
+                    quota_injected_file_content_bytes=10 * 1024,
+@@ -755,6 +756,7 @@ class DbQuotaDriverTestCase(test.TestCas
+                 volumes=10,
+                 gigabytes=1000,
+                 floating_ips=10,
++                fixed_ips=10,
+                 metadata_items=128,
+                 injected_files=5,
+                 injected_file_content_bytes=10 * 1024,
+@@ -791,6 +793,7 @@ class DbQuotaDriverTestCase(test.TestCas
+                 volumes=10,
+                 gigabytes=500,
+                 floating_ips=10,
++                fixed_ips=10,
+                 metadata_items=64,
+                 injected_files=5,
+                 injected_file_content_bytes=5 * 1024,
+@@ -847,6 +850,7 @@ class DbQuotaDriverTestCase(test.TestCas
+         self._stub_quota_class_get_all_by_name()
+ 
+     def test_get_project_quotas(self):
++        self.maxDiff = None
+         self._stub_get_by_project()
+         result = self.driver.get_project_quotas(
+             FakeContext('test_project', 'test_class'),
+@@ -888,6 +892,11 @@ class DbQuotaDriverTestCase(test.TestCas
+                     in_use=2,
+                     reserved=0,
+                     ),
++                fixed_ips=dict(
++                    limit=10,
++                    in_use=0,
++                    reserved=0,
++                    ),
+                 metadata_items=dict(
+                     limit=64,
+                     in_use=0,
+@@ -926,6 +935,7 @@ class DbQuotaDriverTestCase(test.TestCas
+                 ))
+ 
+     def test_get_project_quotas_alt_context_no_class(self):
++        self.maxDiff = None
+         self._stub_get_by_project()
+         result = self.driver.get_project_quotas(
+             FakeContext('other_project', 'other_class'),
+@@ -966,6 +976,11 @@ class DbQuotaDriverTestCase(test.TestCas
+                     in_use=2,
+                     reserved=0,
+                     ),
++                fixed_ips=dict(
++                    limit=10,
++                    in_use=0,
++                    reserved=0,
++                    ),
+                 metadata_items=dict(
+                     limit=128,
+                     in_use=0,
+@@ -1004,6 +1019,7 @@ class DbQuotaDriverTestCase(test.TestCas
+                 ))
+ 
+     def test_get_project_quotas_alt_context_with_class(self):
++        self.maxDiff = None
+         self._stub_get_by_project()
+         result = self.driver.get_project_quotas(
+             FakeContext('other_project', 'other_class'),
+@@ -1045,6 +1061,11 @@ class DbQuotaDriverTestCase(test.TestCas
+                     in_use=2,
+                     reserved=0,
+                     ),
++                fixed_ips=dict(
++                    limit=10,
++                    in_use=0,
++                    reserved=0,
++                    ),
+                 metadata_items=dict(
+                     limit=64,
+                     in_use=0,
+@@ -1145,6 +1166,9 @@ class DbQuotaDriverTestCase(test.TestCas
+                 floating_ips=dict(
+                     limit=10,
+                     ),
++                fixed_ips=dict(
++                    limit=10,
++                    ),
+                 metadata_items=dict(
+                     limit=64,
+                     ),

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-11-02 13:33:39 +0000
+++ debian/patches/series	2013-03-22 13:42:13 +0000
@@ -4,3 +4,5 @@
 fix-docs-build-without-network.patch
 avoid_setuptools_git_dependency.patch
 rbd-security.patch
+CVE-2013-1838.patch
+CVE-2013-0335.patch