nova-folsom fixes for bug 480048

Package-Manager: portage-2.1.12.2/cvs/Linux x86_64
Manifest-Sign-Key: 0x2471EB3E40AC5AC3

5 files changed, 456 insertions, 17 deletions

diff --git a/sys-cluster/nova/ChangeLog b/sys-cluster/nova/ChangeLog
index af2594654b12..6b62259baea0 100644
--- a/sys-cluster/nova/ChangeLog
+++ b/sys-cluster/nova/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for sys-cluster/nova
 # Copyright 1999-2013 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.18 2013/08/11 01:24:31 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/ChangeLog,v 1.19 2013/08/11 03:48:28 prometheanfire Exp $
+
+*nova-2012.2.4-r4 (11 Aug 2013)
+
+  11 Aug 2013; Matthew Thode <prometheanfire@gentoo.org>
+  +files/2012.2.4-CVE-2013-2256.patch, +files/2012.2.4-CVE-2013-4185.patch,
+  +nova-2012.2.4-r4.ebuild, -nova-2012.2.4-r3.ebuild:
+  nova-folsom fixes for bug 480048
 
 *nova-2013.1.3 (11 Aug 2013)
 
diff --git a/sys-cluster/nova/Manifest b/sys-cluster/nova/Manifest
index 858d5d5c6b3c..ee3a0bdb9f7b 100644
--- a/sys-cluster/nova/Manifest
+++ b/sys-cluster/nova/Manifest
@@ -1,31 +1,33 @@
 -----BEGIN PGP SIGNED MESSAGE-----
 Hash: SHA256
 
+AUX 2012.2.4-CVE-2013-2256.patch 14502 SHA256 752d430cfda003c42877c16638b8eefbfd1632ca9845e229d40aa0811e203d6f SHA512 51091d2cb4d352ed6f996ee7b261361d6eac51bc9a69c33f9e0c03810fb2da607173331275494517e8bb12c9ba14aaad448b80826ea8f7be0db880e9b1f9d4ec WHIRLPOOL 287ab4cddc376101b0d70c789de635efa18da847e104a7953ff0cafd4bf5f12394abdac457d376d3d0cd7f7ba8d06e2435151d17869db27381f0940f1e5ae937
+AUX 2012.2.4-CVE-2013-4185.patch 4519 SHA256 f2665d38ffc294a53a41f2ca4a83768ed406da5679212919a311648dc1b53b1e SHA512 8a4fd266524a1d297079637e35cacf219b03533bdea5d3279152b898dc473d75c6be91311d21a27f58179246b6337a61de79477655d29ce2319556bf52fbbbc2 WHIRLPOOL ad97c81fe752edcf205b41db1dbb1173b66cc81583134da5a56a7966dcb48dfbe450a869d953946a5be979f915e8ca288b890df0176a3e393ff8ad0fd55147c0
 AUX nova-folsom-4-CVE-2013-2030.patch 1303 SHA256 55ee950de12d27420762b99514a56075bcaf866eb4352dfc038a56eaa2f458f9 SHA512 1dade2e76f559fed97be0259ab1bf16404ee86fcd2039f1e4df78ecf0ddc9cd2ccd8cbb557f4194bc949bc2d9634abef4939f1fbd564ee73def997ce759f6dc3 WHIRLPOOL 45cef89069302b3d73da205600201620115364a5e4d9dc7c850073aed03baff3a731126308ab2ba75d16677d7e32cd17d780640aa8571a753bf797ae664924d1
 AUX nova-folsom-4-CVE-2013-2096.patch 4545 SHA256 b7203f3d380b3d545259060872933e38d40a53b1e9081ab8b93f623fb2a30115 SHA512 f97c4330f4cd8433b150390f22194e86fccf50ecd9300f1b3692e07e3a8b53ee4ec844f191ea28a75298535c66f11aed77c6cb8fb8624b382a793d05e683bc68 WHIRLPOOL 4460bf65d8bffe03f8a4518a99f81f86f6c2f11ce8c6d1ce6ff03ce836da247dc6c8bed73e875a3b47427970291a10d6f34be5b056c4c7fef505ca2bab0b18ed
 AUX nova-grizzly-1-CVE-2013-2096.patch 4019 SHA256 d20b89067fb63f4d37ebc5c258841c3d18bd9e4e59c455f247f8df1a25973be6 SHA512 e4b80eaf8260765534d1a69c1c3883c794e611ac17acf299443b519c09503f0f063bc2ea1b090e1519e30ef3afa84253ce0e2603a764001556e52c6b09bfc814 WHIRLPOOL 44215c9e48d06976ba372421b5de29083a72172f1f02a84649eecd1dff675ecbdde9be69851ca10fe194346ad750e900c1dafa0ea4be8799c4bf055126bd18e7
 DIST nova-2012.2.4.tar.gz 6286004 SHA256 883a44282514b484a1187c07875834b9c4648555bf20002aceb1d6731ebd0252 SHA512 c05705c7802035232921e7ca9cdcea05571f4771dae573f9364b740553e470d8e4b4e832bf04120c089bad48a75b8493921eefeb28383f70620495a935ad6ec3 WHIRLPOOL 9e8c56b1a66f15f5f6218413e1cd518a0e73f371baea774023a11ad38abccae3e172ec0894fd77f59848685d1993451499916b94c62289d16f57470005e7c123
 DIST nova-2013.1.3.tar.gz 5780115 SHA256 f7c25186920daccb16867c5fd272318beb8cc076e5a55f79b5906618ef2724f4 SHA512 3de29f1cf0789285c7600796588058f056d4196138584bb5ec13a0ea034bbc0569d116a668db67022e302b29995af5960093af1103996269d73dccd62a5dd238 WHIRLPOOL ebb06733a710764004f99da2a69d5479cdd50e35da6d0992233ab9ca0a7a5854a678c5d184d40f97a66fa3abd052b1e6de4629963dd58292f677707997e56239
-EBUILD nova-2012.2.4-r3.ebuild 2674 SHA256 f6bcba48b87962a3d690062fb4b11f5d65bc2ebcd2fec0da184603874c171508 SHA512 25c827a591ec3631278e1479f49373e3f4b086b3eb6c09eda595d364f938ff12e4141898ad0078ac4c56415d3e62a106a0651a9bcd95c858f10c8f6a20566a32 WHIRLPOOL e5149bb51ed417d78a09a2cff7bf7adba6bb7bbd1b9a8ca2c91de10ed42c3feffaebf145872786991429cf4e017ae8d93ccde7fdc8348d5ee08905b8878dc4e5
+EBUILD nova-2012.2.4-r4.ebuild 2762 SHA256 f578262367bc70a2983584a6830bba01a9eed520cbc01725941fa6a47a1ab074 SHA512 be1f5a55ddfb50354b9b7457ca14bd984e20202355b159ba2fcee18b53c79c37afdaf7a89bfb9f564441d61acb2ce6c9bde780500d3ffcaac14b31c82a39413d WHIRLPOOL 4253d166cb8d1fb2c848f42c20f33bf8074da6e927fc826b4729a73e81362268db379bd4806317215fb14320ace441fb59d6a181dc5f8726f15e880a9a682cb2
 EBUILD nova-2013.1.3.ebuild 2973 SHA256 93b6e95df61e8e314c86b20407dc88e5e8b9cbb2775adeb1b81c830172384099 SHA512 2f559ce1c4f9807592667bf9a580751661dc6dd106b9c49943157f74ef0164ded0fc055a914c30d67c833d719f4db0fe9c5cc0a288fb06c73ff44fc2339a8c1b WHIRLPOOL e08b44371408e5ad63e8ee1ccf447c24259c2133ed1882e5a82ddee2ded50d8e8853ea563d76c4802721b42da263a01a08de876ea03ce0acb5fa28b5a88beaf1
 EBUILD nova-2013.1.9999.ebuild 3051 SHA256 0ed811ea3b5e30e584ad87c3f008eaad7ede6631e638f0ff8f62af3d537f026d SHA512 db6bdde3a992ff771f1c66c610b103fe1a9d9217379e28858185be2fb446d71149876d02582074d66f0731c61c31ac71b8732b8c0f8d4d71cce476b0d89876b1 WHIRLPOOL f284f7493e755eb12f4d99568097e120d19a4fd6c87f962095a203819d5e0d5bc65af3eaf16d5af48416aa7d71e44bf0334e475c7a95d160fbadb79d8ae35d2c
 EBUILD nova-9999.ebuild 3025 SHA256 e0702a7f45a0c37359aa3eaec1ad824dc4f11cb951a79f2d01ee2e3bf37dafd5 SHA512 cf1720edd1b2d0e1a2406b912a029d27110d0148ffcff179762678341dfc05be4eea79ac3e6a86dfe1c40c48821b4f6edc8553c2ff0a04f05296f5941ee25f4a WHIRLPOOL cf3bdf79241d5d32301bb6deae1fe91f604ee2186b79dab1715f8a75e235e8bab3834eda2c57cd2e06961becc14c3dcedbe2aae0db1ce96a97ca1adefd5dfcd4
-MISC ChangeLog 4155 SHA256 758fbf9f8935f539233553fbaad7a2ceccbcc3bbe9b8dad0b09584df964a4568 SHA512 9637929c9c11518bda7df0edbc3de4e6c94752af2e59e52946c87aeddcecf5ddf586709ca87b357292454de1dc0f9c8f9873e12014c1c0331580fdb007147acb WHIRLPOOL 84db03dcf42256a0ffe5665b8a6a5551bf21f3d5e786e3caf9e562ffd4536b511b470dad692bde8c6b6f7c28078aaf7c4a850625283e9beaca9db00a9766fc02
+MISC ChangeLog 4411 SHA256 3e17411a198263af3de14f3d209687907967e7f9ac07444c1d3e5476803baed5 SHA512 f48414d7ed8c69c99ecadbb7760ed05127d96c30ac531dcf1b425f2db5c7677e25baf6950c31a219654e138f3e197ae9d6b1861584aa9f7260468a324e7e0547 WHIRLPOOL 4aa63af1c43827bf987958b60820178c8927e3627361f00b5469c68d853616de321d3f0d55d22b3ddfebc8f3526ecdee081853d032dc0770714cec41f237b27e
 MISC metadata.xml 407 SHA256 87ac581ad3af018ee16b2c5a8dbc98553ad93fc48bf5cfd62a6f929353049e77 SHA512 4ae00a6fc5411c1795249864317143787b31cb068fb1508f8a1455fd6194254961cca80256e0b437dc131560126cdf5a59d98a5a5064ac49c6e43c1651718a4a WHIRLPOOL 52b178c072593baea26fa3d7e9c06aac003d1a828ffa98de712306f60eeddba92271bc6061d7224a76ac35fa3c1da33213983e998160acf92a6d7027b284bcc0
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.20 (GNU/Linux)
 
-iQIcBAEBCAAGBQJSBugKAAoJECRx6z5ArFrDYc8P/RRIKC+3fzEVrKThXls3s5vN
-j8FTRfIcTEQuziA50k/sfHu0IcQymzOIUqi/wE0lmXDaFqr+G23d06rmAvXqA2Lu
-efRhMxT9og7fdGtCzqEq+aIPXCUo9hx2OggEjDjXb6Khwvvf+BFwM5XiSo+L6+4z
-9dc1FN219QP+LbOKgeYB7R2BSvVkyLEOYdh0H2bynb6A0TAIyzU6YWXrA/M8s9An
-mDShKNH/aC7ejXGaUPBHP92NpYprEUpR+2nmOKO7xUFwWghbH/pqTiT43IQI0bPA
-T/1tLiVg+U7rEKXtgBgyZBmnh4GTTWWOpzKW0FWU0Vpk12+4dt8aJl6K/nKkck55
-s73NZua/C55Yfs+Vcq5+98S8WtEJULcIQ8F5+PJp5MXZwEcvhumvGbnwnYp0PjxG
-KQu6256kJSasO0s8tuEwn7GyHVDar02gC87FMpc4pQiK+GF21lc3jJcmVucPThAp
-OMEOHAIwBDD2VX/fKUL/p6RTVfr6lNRhfh8ms5+/oJAWFZEgwz850M5pma4yVbKv
-PAm6A6eS3VhhmlnNJyJJ4WFPctnQwQlx9FhTz0azL2oZ+ZnDcx/XB/jYZfc8Rhov
-VwJ4am4JLU6O6t3iIs3bZI8MIc2Ngf2lGNYPnDuhYtcEBhcnySKWaLlnZlvlUSpp
-Gew7c/TJuF2CxQjnzQ8F
-=akAU
+iQIcBAEBCAAGBQJSBwnHAAoJECRx6z5ArFrDVk8P/0yBUNuQzroUZbtioLjifKGb
+WusrTx3lQ7xtujGPXuC5BgbtaOsQ0uyv4zZOxv7ki9MC4kSvHoDILrndJNK5uTtq
+JsiCk56k6I8oi/vdcT/wo0lcfp45/V9+Pe3gZ8dmql/yJwqxD8gv1KtXAKy3tqM/
+htTDZJrjxFdYrK0i5yxsxk3KL6pDkZXO1Vc1N4QpVMDBzFoUZcZjZauCNabtFW2V
+NhmKsMXpnqYYdExy/3y1J+nHxVzWrAdQLVKdG9Vr2UpIfaJ+OkK8cnIr4VWdo81c
+CEQ9KXwB7+lDH0gIw5+fi0QVXdvEihhp1m9hVxW5kpXMtDHyhSA0tbPi2uGUCZwZ
+JqvfaAVjjCD0TiU2lHG1x2GRV266oAx4bKQh49CYsCoZpKIYLLhpMULsQDJfHb9F
+YX4ZGx+gdcc6GWMg1YwTTyTkRPUuS5igp85GK7IXmKNXgH3PSB+6vnZkBjjlxuCB
+T/N0/AynLUo390eyDdl/7v711TjRLY8EuRc1H8W+4F0/avp0RGap9O8hOoPFWuqQ
+nQ0vpwlc1iKpqyWvLDqArxSBN3r5sGeGvo9lYpLxbxY0mL7Dini7pZyaz8g45hoP
+B36+vS9jSRRSR+5SY05UQPBr8fu/YcpxsfmjFcjlLO5Wfm/RlLKxpQMn+lqdJR9n
+/2rneLwm/ograeoQW8M6
+=4X4W
 -----END PGP SIGNATURE-----
diff --git a/sys-cluster/nova/files/2012.2.4-CVE-2013-2256.patch b/sys-cluster/nova/files/2012.2.4-CVE-2013-2256.patch
new file mode 100644
index 000000000000..7b2f90663a8c
--- /dev/null
+++ b/sys-cluster/nova/files/2012.2.4-CVE-2013-2256.patch
@@ -0,0 +1,327 @@
+From f7aaf1fa04331522aee2158e372940df92f45cb0 Mon Sep 17 00:00:00 2001
+From: Russell Bryant <rbryant@redhat.com>
+Date: Thu, 27 Jun 2013 21:00:05 +0000
+Subject: [PATCH] Make flavors is_public option actually work
+
+When you create a flavor, you can set an is_public flag to be True or
+False.  It is True by default.  When False, the intention is that the
+flavor is only accessible by an admin, unless you use the flavor_access
+API extension to grant access to specific tenants.
+
+Unfortunately, the only place in the code where this was being enforced
+was when listing flavors through the API.  It would filter out the
+non-public ones for a non-admin.  Otherwise, the flavor was accessible.
+You could get the details, and you could boot an instance with it, if
+you figured out a valid flavor ID.
+
+This patch adds enforcement down in the db layer.  It also fixes one
+place in the API where the context wasn't passed down to enable the
+enforcement to happen.
+
+Fix bug 1194093.
+
+master -> grizzly
+(cherry picked from commit b65d506a5f9d9b2b20777a9aceb44a8ffed6a5de)
+
+Conflicts:
+	nova/api/openstack/compute/contrib/flavor_access.py
+	nova/api/openstack/compute/contrib/flavormanage.py
+	nova/api/openstack/compute/flavors.py
+	nova/compute/api.py
+	nova/db/sqlalchemy/api.py
+	nova/tests/api/openstack/compute/contrib/test_flavor_access.py
+	nova/tests/api/openstack/compute/contrib/test_flavor_disabled.py
+	nova/tests/api/openstack/compute/contrib/test_flavor_manage.py
+	nova/tests/api/openstack/compute/contrib/test_flavor_rxtx.py
+	nova/tests/api/openstack/compute/contrib/test_flavor_swap.py
+	nova/tests/api/openstack/compute/contrib/test_flavorextradata.py
+	nova/tests/api/openstack/compute/test_flavors.py
+	nova/tests/db/test_db_api.py
+
+grizzly -> folsom
+(cherry picked from commit 6df1b7a2a1413a98bffc8b8e0b947f3c90e3bbf5)
+
+Conflicts:
+	nova/db/sqlalchemy/api.py
+	nova/tests/api/openstack/compute/test_flavors.py
+
+Change-Id: I5b37fa0bb19683fe1642fd81222547d4a317054e
+---
+ .../api/openstack/compute/contrib/flavor_access.py |  3 ++-
+ nova/api/openstack/compute/contrib/flavormanage.py |  2 +-
+ nova/api/openstack/compute/flavors.py              |  4 +++-
+ nova/compute/api.py                                |  2 +-
+ nova/compute/instance_types.py                     |  2 +-
+ nova/db/api.py                                     |  4 ++--
+ nova/db/sqlalchemy/api.py                          | 26 +++++++++++++++-------
+ .../compute/contrib/test_flavor_access.py          |  2 +-
+ .../compute/contrib/test_flavor_disabled.py        |  2 +-
+ .../compute/contrib/test_flavor_manage.py          |  3 ++-
+ .../openstack/compute/contrib/test_flavor_rxtx.py  |  2 +-
+ .../openstack/compute/contrib/test_flavor_swap.py  |  2 +-
+ .../compute/contrib/test_flavorextradata.py        |  2 +-
+ nova/tests/api/openstack/compute/test_flavors.py   |  4 ++--
+ 14 files changed, 37 insertions(+), 23 deletions(-)
+
+diff --git a/nova/api/openstack/compute/contrib/flavor_access.py b/nova/api/openstack/compute/contrib/flavor_access.py
+index 9991408..26cd77f 100644
+--- a/nova/api/openstack/compute/contrib/flavor_access.py
++++ b/nova/api/openstack/compute/contrib/flavor_access.py
+@@ -99,7 +99,8 @@ class FlavorAccessController(object):
+         authorize(context)
+ 
+         try:
+-            flavor = instance_types.get_instance_type_by_flavor_id(flavor_id)
++            flavor = instance_types.get_instance_type_by_flavor_id(flavor_id,
++                    ctxt=context)
+         except exception.FlavorNotFound:
+             explanation = _("Flavor not found.")
+             raise webob.exc.HTTPNotFound(explanation=explanation)
+diff --git a/nova/api/openstack/compute/contrib/flavormanage.py b/nova/api/openstack/compute/contrib/flavormanage.py
+index e7731cc..79551b1 100644
+--- a/nova/api/openstack/compute/contrib/flavormanage.py
++++ b/nova/api/openstack/compute/contrib/flavormanage.py
+@@ -43,7 +43,7 @@ class FlavorManageController(wsgi.Controller):
+ 
+         try:
+             flavor = instance_types.get_instance_type_by_flavor_id(
+-                    id, read_deleted="no")
++                    id, ctxt=context, read_deleted="no")
+         except exception.NotFound, e:
+             raise webob.exc.HTTPNotFound(explanation=e.format_message())
+ 
+diff --git a/nova/api/openstack/compute/flavors.py b/nova/api/openstack/compute/flavors.py
+index 8aa57a2..d51b48a 100644
+--- a/nova/api/openstack/compute/flavors.py
++++ b/nova/api/openstack/compute/flavors.py
+@@ -84,7 +84,9 @@ class Controller(wsgi.Controller):
+     def show(self, req, id):
+         """Return data about the given flavor id."""
+         try:
+-            flavor = instance_types.get_instance_type_by_flavor_id(id)
++            context = req.environ['nova.context']
++            flavor = instance_types.get_instance_type_by_flavor_id(id,
++                    ctxt=context)
+             req.cache_db_flavor(flavor)
+         except exception.NotFound:
+             raise webob.exc.HTTPNotFound()
+diff --git a/nova/compute/api.py b/nova/compute/api.py
+index 5319d04..ca78830 100644
+--- a/nova/compute/api.py
++++ b/nova/compute/api.py
+@@ -1080,7 +1080,7 @@ class API(base.Base):
+     #NOTE(bcwaldon): this doesn't really belong in this class
+     def get_instance_type(self, context, instance_type_id):
+         """Get an instance type by instance type id."""
+-        return instance_types.get_instance_type(instance_type_id)
++        return instance_types.get_instance_type(instance_type_id, ctxt=context)
+ 
+     def get(self, context, instance_id):
+         """Get a single instance with the given instance_id."""
+diff --git a/nova/compute/instance_types.py b/nova/compute/instance_types.py
+index 6869672..5be97c1 100644
+--- a/nova/compute/instance_types.py
++++ b/nova/compute/instance_types.py
+@@ -163,7 +163,7 @@ def get_instance_type_by_flavor_id(flavorid, ctxt=None, read_deleted="yes"):
+     if ctxt is None:
+         ctxt = context.get_admin_context(read_deleted=read_deleted)
+ 
+-    return db.instance_type_get_by_flavor_id(ctxt, flavorid)
++    return db.instance_type_get_by_flavor_id(ctxt, flavorid, read_deleted)
+ 
+ 
+ def get_instance_type_access_by_flavor_id(flavorid, ctxt=None):
+diff --git a/nova/db/api.py b/nova/db/api.py
+index 9f2ff73..40db686 100644
+--- a/nova/db/api.py
++++ b/nova/db/api.py
+@@ -1460,9 +1460,9 @@ def instance_type_get_by_name(context, name):
+     return IMPL.instance_type_get_by_name(context, name)
+ 
+ 
+-def instance_type_get_by_flavor_id(context, id):
++def instance_type_get_by_flavor_id(context, id, read_deleted=None):
+     """Get instance type by flavor id."""
+-    return IMPL.instance_type_get_by_flavor_id(context, id)
++    return IMPL.instance_type_get_by_flavor_id(context, id, read_deleted)
+ 
+ 
+ def instance_type_destroy(context, name):
+diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
+index 7fcc4f8..ea32168 100644
+--- a/nova/db/sqlalchemy/api.py
++++ b/nova/db/sqlalchemy/api.py
+@@ -3910,7 +3910,7 @@ def instance_type_create(context, values):
+             pass
+         try:
+             instance_type_get_by_flavor_id(context, values['flavorid'],
+-                                           session)
++                    read_deleted='no', session=session)
+             raise exception.InstanceTypeExists(name=values['name'])
+         except exception.FlavorNotFound:
+             pass
+@@ -3952,9 +3952,16 @@ def _dict_with_extra_specs(inst_type_query):
+ 
+ 
+ def _instance_type_get_query(context, session=None, read_deleted=None):
+-    return model_query(context, models.InstanceTypes, session=session,
++    query = model_query(context, models.InstanceTypes, session=session,
+                        read_deleted=read_deleted).\
+-                     options(joinedload('extra_specs'))
++                       options(joinedload('extra_specs'))
++    if not context.is_admin:
++        the_filter = [models.InstanceTypes.is_public == True]
++        the_filter.extend([
++            models.InstanceTypes.projects.any(project_id=context.project_id)
++        ])
++        query = query.filter(or_(*the_filter))
++    return query
+ 
+ 
+ @require_context
+@@ -4029,9 +4036,11 @@ def instance_type_get_by_name(context, name, session=None):
+ 
+ 
+ @require_context
+-def instance_type_get_by_flavor_id(context, flavor_id, session=None):
++def instance_type_get_by_flavor_id(context, flavor_id, read_deleted,
++                                   session=None):
+     """Returns a dict describing specific flavor_id"""
+-    result = _instance_type_get_query(context, session=session).\
++    result = _instance_type_get_query(context, read_deleted=read_deleted,
++                                      session=session).\
+                     filter_by(flavorid=flavor_id).\
+                     first()
+ 
+@@ -4083,7 +4092,7 @@ def instance_type_access_add(context, flavor_id, project_id):
+     session = get_session()
+     with session.begin():
+         instance_type_ref = instance_type_get_by_flavor_id(context, flavor_id,
+-                                                           session=session)
++                read_deleted='no', session=session)
+         instance_type_id = instance_type_ref['id']
+         access_ref = _instance_type_access_query(context, session=session).\
+                         filter_by(instance_type_id=instance_type_id).\
+@@ -4111,7 +4120,7 @@ def instance_type_access_remove(context, flavor_id, project_id):
+     session = get_session()
+     with session.begin():
+         instance_type_ref = instance_type_get_by_flavor_id(context, flavor_id,
+-                                                           session=session)
++                read_deleted='no', session=session)
+         instance_type_id = instance_type_ref['id']
+         access_ref = _instance_type_access_query(context, session=session).\
+                         filter_by(instance_type_id=instance_type_id).\
+@@ -4447,7 +4456,8 @@ def instance_type_extra_specs_update_or_create(context, flavor_id,
+                                                specs):
+     session = get_session()
+     spec_ref = None
+-    instance_type = instance_type_get_by_flavor_id(context, flavor_id)
++    instance_type = instance_type_get_by_flavor_id(context, flavor_id,
++                                                   read_deleted='no')
+     for key, value in specs.iteritems():
+         try:
+             spec_ref = instance_type_extra_specs_get_item(
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavor_access.py b/nova/tests/api/openstack/compute/contrib/test_flavor_access.py
+index 0bf1f1b..075810b 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavor_access.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavor_access.py
+@@ -68,7 +68,7 @@ def fake_get_instance_type_access_by_flavor_id(flavorid):
+     return res
+ 
+ 
+-def fake_get_instance_type_by_flavor_id(flavorid):
++def fake_get_instance_type_by_flavor_id(flavorid, ctxt=None):
+     return INSTANCE_TYPES[flavorid]
+ 
+ 
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavor_disabled.py b/nova/tests/api/openstack/compute/contrib/test_flavor_disabled.py
+index 1225b56..933178a 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavor_disabled.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavor_disabled.py
+@@ -44,7 +44,7 @@ FAKE_FLAVORS = {
+ }
+ 
+ 
+-def fake_instance_type_get_by_flavor_id(flavorid):
++def fake_instance_type_get_by_flavor_id(flavorid, ctxt=None):
+     return FAKE_FLAVORS['flavor %s' % flavorid]
+ 
+ 
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavor_manage.py b/nova/tests/api/openstack/compute/contrib/test_flavor_manage.py
+index 70fd5e4..7174ed2 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavor_manage.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavor_manage.py
+@@ -25,7 +25,8 @@ from nova import test
+ from nova.tests.api.openstack import fakes
+ 
+ 
+-def fake_get_instance_type_by_flavor_id(flavorid, read_deleted='yes'):
++def fake_get_instance_type_by_flavor_id(flavorid, ctxt=None,
++                                        read_deleted='yes'):
+     if flavorid == 'failtest':
+         raise exception.NotFound("Not found sucka!")
+     elif not str(flavorid) == '1234':
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavor_rxtx.py b/nova/tests/api/openstack/compute/contrib/test_flavor_rxtx.py
+index 52163c7..afa2259 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavor_rxtx.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavor_rxtx.py
+@@ -43,7 +43,7 @@ FAKE_FLAVORS = {
+ }
+ 
+ 
+-def fake_instance_type_get_by_flavor_id(flavorid):
++def fake_instance_type_get_by_flavor_id(flavorid, ctxt=None):
+     return FAKE_FLAVORS['flavor %s' % flavorid]
+ 
+ 
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavor_swap.py b/nova/tests/api/openstack/compute/contrib/test_flavor_swap.py
+index 75e9cd7..3fd1ae9 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavor_swap.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavor_swap.py
+@@ -43,7 +43,7 @@ FAKE_FLAVORS = {
+ }
+ 
+ 
+-def fake_instance_type_get_by_flavor_id(flavorid):
++def fake_instance_type_get_by_flavor_id(flavorid, ctxt=None):
+     return FAKE_FLAVORS['flavor %s' % flavorid]
+ 
+ 
+diff --git a/nova/tests/api/openstack/compute/contrib/test_flavorextradata.py b/nova/tests/api/openstack/compute/contrib/test_flavorextradata.py
+index 8f5301a..9654605 100644
+--- a/nova/tests/api/openstack/compute/contrib/test_flavorextradata.py
++++ b/nova/tests/api/openstack/compute/contrib/test_flavorextradata.py
+@@ -23,7 +23,7 @@ from nova import test
+ from nova.tests.api.openstack import fakes
+ 
+ 
+-def fake_get_instance_type_by_flavor_id(flavorid):
++def fake_get_instance_type_by_flavor_id(flavorid, ctxt=None):
+     return {
+         'id': flavorid,
+         'flavorid': str(flavorid),
+diff --git a/nova/tests/api/openstack/compute/test_flavors.py b/nova/tests/api/openstack/compute/test_flavors.py
+index 77d40df..cfa3429 100644
+--- a/nova/tests/api/openstack/compute/test_flavors.py
++++ b/nova/tests/api/openstack/compute/test_flavors.py
+@@ -54,7 +54,7 @@ FAKE_FLAVORS = {
+ }
+ 
+ 
+-def fake_instance_type_get_by_flavor_id(flavorid):
++def fake_instance_type_get_by_flavor_id(flavorid, ctxt=None):
+     return FAKE_FLAVORS['flavor %s' % flavorid]
+ 
+ 
+@@ -80,7 +80,7 @@ def empty_instance_type_get_all(inactive=False, filters=None):
+     return {}
+ 
+ 
+-def return_instance_type_not_found(flavor_id):
++def return_instance_type_not_found(flavor_id, ctxt=None):
+     raise exception.InstanceTypeNotFound(flavor_id=flavor_id)
+ 
+ 
+-- 
+1.8.1.5
+
diff --git a/sys-cluster/nova/files/2012.2.4-CVE-2013-4185.patch b/sys-cluster/nova/files/2012.2.4-CVE-2013-4185.patch
new file mode 100644
index 000000000000..3e02ae10a473
--- /dev/null
+++ b/sys-cluster/nova/files/2012.2.4-CVE-2013-4185.patch
@@ -0,0 +1,101 @@
+From d4ee081c5c0a5132781235177c430ebcf72b0b0b Mon Sep 17 00:00:00 2001
+From: Vishvananda Ishaya <vishvananda@gmail.com>
+Date: Fri, 19 Jul 2013 10:23:59 -0700
+Subject: [PATCH] Use cached nwinfo for secgroup rules
+
+This stops a potential DOS with source security groups by using the
+db cached version of the network info instead of calling out to
+the network api multiple times.
+
+Fixes bug 1184041
+
+Change-Id: Id5f24ecf0e8cce60c27a9aecbc6e606c4c44d6b6
+(cherry picked from commit 85aac04704350566d6b06aa7a3b99649946c672c)
+---
+ nova/db/sqlalchemy/api.py  |  2 ++
+ nova/tests/test_libvirt.py |  4 +++-
+ nova/tests/test_xenapi.py  |  5 +++--
+ nova/virt/firewall.py      | 12 +++---------
+ 4 files changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
+index 7fcc4f8..6d3b139 100644
+--- a/nova/db/sqlalchemy/api.py
++++ b/nova/db/sqlalchemy/api.py
+@@ -3649,6 +3649,8 @@ def security_group_rule_get_by_security_group(context, security_group_id,
+     return _security_group_rule_get_query(context, session=session).\
+             filter_by(parent_group_id=security_group_id).\
+             options(joinedload_all('grantee_group.instances.instance_type')).\
++            options(joinedload('grantee_group.instances.'
++                               'info_cache')).\
+             all()
+ 
+ 
+diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py
+index b26a006..e956eb0 100644
+--- a/nova/tests/test_libvirt.py
++++ b/nova/tests/test_libvirt.py
+@@ -3240,7 +3240,9 @@ class IptablesFirewallTestCase(test.TestCase):
+         from nova.network import linux_net
+         linux_net.iptables_manager.execute = fake_iptables_execute
+ 
+-        _fake_stub_out_get_nw_info(self.stubs, lambda *a, **kw: network_model)
++        from nova.compute import utils as compute_utils
++        self.stubs.Set(compute_utils, 'get_nw_info_for_instance',
++                       lambda instance: network_model)
+ 
+         network_info = network_model.legacy()
+         self.fw.prepare_instance_filter(instance_ref, network_info)
+diff --git a/nova/tests/test_xenapi.py b/nova/tests/test_xenapi.py
+index 0cf69d6..7a8f9b4 100644
+--- a/nova/tests/test_xenapi.py
++++ b/nova/tests/test_xenapi.py
+@@ -1690,8 +1690,9 @@ class XenAPIDom0IptablesFirewallTestCase(stubs.XenAPITestBase):
+         network_model = fake_network.fake_get_instance_nw_info(self.stubs,
+                                                       1, spectacular=True)
+ 
+-        fake_network.stub_out_nw_api_get_instance_nw_info(self.stubs,
+-                                      lambda *a, **kw: network_model)
++        from nova.compute import utils as compute_utils
++        self.stubs.Set(compute_utils, 'get_nw_info_for_instance',
++                       lambda instance: network_model)
+ 
+         network_info = network_model.legacy()
+         self.fw.prepare_instance_filter(instance_ref, network_info)
+diff --git a/nova/virt/firewall.py b/nova/virt/firewall.py
+index a093a35..7c22c86 100644
+--- a/nova/virt/firewall.py
++++ b/nova/virt/firewall.py
+@@ -17,10 +17,10 @@
+ #    License for the specific language governing permissions and limitations
+ #    under the License.
+ 
++from nova.compute import utils as compute_utils
+ from nova import context
+ from nova import db
+ from nova import flags
+-from nova import network
+ from nova.network import linux_net
+ from nova.openstack.common import cfg
+ from nova.openstack.common import importutils
+@@ -405,15 +405,9 @@ class IptablesFirewallDriver(FirewallDriver):
+                     fw_rules += [' '.join(args)]
+                 else:
+                     if rule['grantee_group']:
+-                        # FIXME(jkoelker) This needs to be ported up into
+-                        #                 the compute manager which already
+-                        #                 has access to a nw_api handle,
+-                        #                 and should be the only one making
+-                        #                 making rpc calls.
+-                        nw_api = network.API()
+                         for instance in rule['grantee_group']['instances']:
+-                            nw_info = nw_api.get_instance_nw_info(ctxt,
+-                                                                  instance)
++                            nw_info = compute_utils.get_nw_info_for_instance(
++                                    instance)
+ 
+                             ips = [ip['address']
+                                 for ip in nw_info.fixed_ips()
+-- 
+1.8.1.5
+
diff --git a/sys-cluster/nova/nova-2012.2.4-r3.ebuild b/sys-cluster/nova/nova-2012.2.4-r4.ebuild
index f08ab6c27de0..84343ee8697c 100644
--- a/sys-cluster/nova/nova-2012.2.4-r3.ebuild
+++ b/sys-cluster/nova/nova-2012.2.4-r4.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2013 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2012.2.4-r3.ebuild,v 1.1 2013/06/25 19:04:50 prometheanfire Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-cluster/nova/nova-2012.2.4-r4.ebuild,v 1.1 2013/08/11 03:48:28 prometheanfire Exp $
 
 EAPI=5
 PYTHON_COMPAT=( python2_7 )
@@ -46,6 +46,8 @@ RDEPEND="=dev-python/amqplib-0.6.1
 PATCHES=(
 	"${FILESDIR}/nova-folsom-4-CVE-2013-2030.patch"
 	"${FILESDIR}/nova-folsom-4-CVE-2013-2096.patch"
+	"${FILESDIR}/2012.2.4-CVE-2013-2256.patch"
+	"${FILESDIR}/2012.2.4-CVE-2013-4185.patch"
 )
 
 python_install() {