nova/nova
Lee Yarwood 0225a61fc4 libvirt: Block swap volume attempts with encrypted volumes prior to Queens
Prior to Queens any attempt to swap between encrypted volumes would
result in unencrypted data being written to the new volume. This
unencrypted data would then be overwritten the next time the volume was
attached to an instance as Nova no longer identified the volume as
encrypted, resulting in the volume being reformatted.

This stable only change uses limited parts of the following changes to
block all swap_volume attempts with encrypted volumes prior to Queens
where this was resolved by Ica323b87fa85a454fca9d46ada3677f18 and also
blocked when using QEMU to decrypt LUKS volumes by
Ibfa64f18bbd2fb70db7791330ed1a64fe61c1.

Ica323b87fa85a454fca9d46ada3677f18fe50022

The request context is provided to swap_volume in order to look up the
encryption metadata of a volume.

Ibfa64f18bbd2fb70db7791330ed1a64fe61c1355

Attempts to swap from an encrypted volume are blocked with a
NotImplementedError exception raised.

I258127fdcd011ccec721d5ff62eb7f128f130336

Attempts to swap from an unencrypted volume to an encrypted volume are
also blocked with a NotImplementedError exception raised.

Ie02d298cd92d5b5ebcbbcd2b0e8be01f197bfafb

The serial of a volume is used as the id if connection_info for the
volume doesn't contain the volume_id key. Required to avoid bug #1746609.

Conflicts:
        nova/tests/unit/compute/test_compute_mgr.py
        nova/tests/unit/virt/libvirt/test_driver.py

NOTE(lyarwood): Conflict due to cinderv3 support for swap_volume not
being present in stable/ocata via
I4b8bd01f1ffe2640fe7313213bf853d2e1bef9dd.

Closes-bug: #1739593
Change-Id: If12e7860baad2899380f06144a0270784a5466b8
(cherry picked from commit 5b64a19361)
2018-04-18 19:57:30 +00:00
..
CA
api Merge "Fix instance lookup in hide_server_addresses extension" into stable/ocata 2018-02-25 15:28:58 +00:00
cells Use six.text_type() when logging Instance object 2017-05-22 10:57:28 +00:00
cert Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
cloudpipe Rename security_group parameter in compute.API:create 2016-11-10 11:25:43 -05:00
cmd Add 'delete_host' command in 'nova-manage cell_v2' 2018-02-13 00:44:41 +00:00
common cors: update default configuration in config 2016-11-05 20:17:42 -04:00
compute libvirt: Block swap volume attempts with encrypted volumes prior to Queens 2018-04-18 19:57:30 +00:00
conductor Merge "Don't try to delete build request during a reschedule" into stable/ocata 2018-03-23 02:11:42 +00:00
conf Document the real behavior of notify_on_state_change 2017-11-27 12:24:18 +00:00
console Merge "tests: Replace use of CONF with monkey patching" 2017-01-24 12:03:07 +00:00
consoleauth Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
db Merge "Fix joins in instance_get_all_by_host" into stable/ocata 2018-03-21 08:33:10 +00:00
hacking [2/3]Replace six.iteritems() with .items() 2017-01-09 09:11:00 +00:00
image Merge "[2/3]Replace six.iteritems() with .items()" 2017-01-21 06:55:52 +00:00
ipv6
keymgr Deprecate barbican options 2016-07-29 15:36:28 -05:00
locale Imported Translations from Zanata 2016-10-27 08:19:38 +00:00
network Merge "Handle exception on adding secgroup" into stable/ocata 2018-01-31 12:51:31 +00:00
notifications Merge "[2/3]Replace six.iteritems() with .items()" 2017-01-21 06:55:52 +00:00
objects Lazy-load instance attributes with read_deleted=yes 2018-02-19 16:38:08 -05:00
pci [2/3]Replace six.iteritems() with .items() 2017-01-09 09:11:00 +00:00
policies Separate CRUD policy for server_groups 2016-11-21 11:43:13 -05:00
scheduler Fix an error in _get_host_states when deleting a compute node 2017-12-21 11:15:22 -05:00
servicegroup Don't use 'updated_at' to check service's status 2016-12-08 09:51:03 +00:00
tests libvirt: Block swap volume attempts with encrypted volumes prior to Queens 2018-04-18 19:57:30 +00:00
virt libvirt: Block swap volume attempts with encrypted volumes prior to Queens 2018-04-18 19:57:30 +00:00
vnc
volume libvirt: Re-initialise volumes, encryptors, and vifs on hard reboot 2018-01-09 01:09:59 +00:00
wsgi Clarify the language in the apache wsgi sample 2017-02-02 15:43:25 -08:00
__init__.py
availability_zones.py Avoid lazy-load error when getting instance AZ 2017-05-31 16:00:42 +00:00
baserpc.py
block_device.py Allow None for block_device_mapping_v2.boot_index 2017-02-09 15:20:06 +00:00
cache_utils.py
config.py Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
context.py Cache database and message queue connection objects 2017-05-19 21:54:25 +00:00
crypto.py
debugger.py
exception.py libvirt: Always disconnect_volume after rebase failures 2017-04-26 21:25:47 +01:00
exception_wrapper.py do not include context to exception notification 2017-03-17 13:00:21 -04:00
filters.py
hash_ring.py Ironic: allow multiple compute services 2016-08-04 23:51:13 +00:00
hooks.py
i18n.py
loadables.py
manager.py Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
policy.py [2/3]Replace six.iteritems() with .items() 2017-01-09 09:11:00 +00:00
profiler.py Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
quota.py [2/3]Replace six.iteritems() with .items() 2017-01-09 09:11:00 +00:00
rpc.py Merge "Add live.migration.force.complete to the legacy notification whitelist" into stable/ocata 2017-10-24 06:19:51 +00:00
safe_utils.py
service.py Integrate OSProfiler and Nova 2017-01-18 15:00:14 +07:00
service_auth.py Add service_token for nova-cinder interaction 2017-01-11 15:49:16 +00:00
signature_utils.py
test.py Expose StandardLogging fixture for use 2017-07-26 14:09:26 +00:00
utils.py Use six.text_type() when logging Instance object 2017-05-22 10:57:28 +00:00
version.py
weights.py
wsgi.py [2/3]Replace six.iteritems() with .items() 2017-01-09 09:11:00 +00:00