{"push_id":554700938,"size":243,"distinct_size":243,"ref":"refs/heads/master","head":"91d04ce611b10a9403ff36ada40899414b011d08","before":"4f16239280ac4a25cc99872e7c88c4a1c9a7a528","commits":[{"sha":"a4f634bd898603225d2218eec220b61a8fd9865c","author":{"email":"3e53127f3ad0d91a1ed4651b133d989b076d9d27@hp.com","name":"anc"},"message":"Restrict keystone cross-tenant ACLs to IDs\n\nThe keystoneauth middleware supports cross-tenant access\ncontrol using the syntax <tenant>:<user> in container ACLs,\nwhere <tenant> and <user> may currently be either a unique\nid or a name. As a result of the keystone v3 API introducing\ndomains, names are no longer globally unique and are only\nunique within a domain. The use of unqualified tenant and\nuser names in this ACL syntax is therefore not 'safe' in a\nkeystone v3 environment.\n\nThis patch modifies keystoneauth to restrict cross-tenant\nACL matching to use only ids for accounts that are not in\nthe default domain. For backwards compatibility,\nnames will still be matched in ACLs when both the requesting\nuser and tenant are known to be in the default domain AND the\naccount's tenant is also in the default domain (the default\ndomain being the domain to which existing tenants are\nmigrated).\n\nAccounts existing prior to this patch are assumed to be for\ntenants in the default domain. New accounts created using a\nv2 token scoped on the tenant are also assumed to be in the\ndefault domain. New accounts created using a v3 token scoped\non the tenant will learn their domain membership from the\ntoken info. New accounts created using any unscoped token,\n(i.e. with a reselleradmin role) will have unknown domain\nmembership and therefore be assumed to NOT be in the default\ndomain.\n\nDespite this provision for backwards compatibility, names\nmust no longer be used when setting new ACLs in any account,\nincluding new accounts in the default domain.\n\nThis change obviously impacts users accustomed to specifying\ncross-tenant ACLs in terms of names, and further work will be\nnecessary to restore those use cases. Some ideas are\ndiscussed under the bug report. With that caveat, this patch\nremoves the reported vulnerability when using\nswift/keystoneauth with a keystone v3 API.\n\nNote: to observe the new 'restricted' behaviour you will need\nto setup keystone user(s) and tenant(s) in a non-default domain\nand set auth_version = v3.0 in the auth_token middleware config\nsection of proxy-server.conf. You may also benefit from the\nkeystone v3 enabled swiftclient patch under review here:\nhttps://review.openstack.org/#/c/91788/\n\nDocImpact\n\nblueprint keystone-v3-support\n\nCloses-Bug:  #1299146\n\nChange-Id: Ib32df093f7450f704127da77ff06b595f57615cb","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/a4f634bd898603225d2218eec220b61a8fd9865c"},{"sha":"43ac76373a353fe74a520108a198b0b563c4f3a2","author":{"email":"c1c925c9b920b95d8c120c191d4bc7dc8d4c8520@rackspace.com","name":"Constantine Peresypkin"},"message":"account to account copy implementation\n\nAdds ability to copy objects between different accounts (on server side)\n\nAdds new header to `PUT` request:\n`X-Copy-From-Account: <account name>`\nAccount name corresponds to the last part of storage URL.\n\nAdds new header to `COPY` request:\n`Destination-Account: <account name>`\nAccount name corresponds to the last part of storage URL.\n\nIf your storage URL is: http://server:8080/v1/AUTH_test\nThen the account name is `AUTH_test`\n\nThese headers should be used alongside `X-Copy-From` and `Destination` headers\nThe legacy headers should specify `<container name>/<object name>` path as usual.\n\nDocImpact\n\nChange-Id: I0285fe6a47df9e699ac20ae4a83b0bf23829e1e6","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/43ac76373a353fe74a520108a198b0b563c4f3a2"},{"sha":"84a1e17f2039e6e5ef732c8931fe47f44f770738","author":{"email":"3e1bd055fa207f12fc3582148e18abe89a6d5a29@intel.com","name":"Yuan Zhou"},"message":"Fix delete versioning objects when previous is expired\n\nWhen deleteing versioned objects proxy will try to restore the previous\ncopy. The COPY request will fail if the previous version is expired but\nnot handled by object-expirer.\n\nThis patch checks COPY respones on the previous copy, if it's\nHTTP_NOT_FOUND(mostly because it's expired) proxy will try to restore\nwith the version before previous.\n\nCloses-Bug #1308446\nChange-Id: I17f049ea3ef62723effae8086ec427f6e151cd9c","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/84a1e17f2039e6e5ef732c8931fe47f44f770738"},{"sha":"9dcf15f8b50188c592acc4c34e333c738173d516","author":{"email":"f23d94b2a735b6193d3882ae31308d2e41e8282b@redhat.com","name":"Thiago da Silva"},"message":"moving object validation checks to top of PUT method\n\nThis adds a sanity check on x-delete headers as\npart of check_object_creation method\n\nChange-Id: If5069469e433189235b1178ea203b5c8a926f553\nSigned-off-by: Thiago da Silva <thiago@redhat.com>","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/9dcf15f8b50188c592acc4c34e333c738173d516"},{"sha":"4dc718e8c3bd2a8bbe1f2d7a98ad03421a70217f","author":{"email":"3e53127f3ad0d91a1ed4651b133d989b076d9d27@hp.com","name":"Alistair Coles"},"message":"Extra unit tests for check_delete_headers\n\nA few extra tests to verify check_delete_headers in\nconstraints.py. A little duplication of coverage of existing\nproxy/controllers/test_obj.py:TestObjController.test_POST_delete_at\nbut these tests call the recently refactored function directly,\nand also add tests for X-Delete-After taking precedence over\nX-Delete-At.\n\nChange-Id: I129cef15a6feac8a60fd4efbb3535d93f0eaab36","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/4dc718e8c3bd2a8bbe1f2d7a98ad03421a70217f"},{"sha":"b7281cf2c584cde8f516ba206d90024af03236dd","author":{"email":"b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8@not.mn","name":"John Dickinson"},"message":"make the bind_port config setting required\n\nIn a long-term effort to change the recommended ports for Swift,\nthe first step is to require the bind_port in config files. Later,\nwe can change the recommended setting.\n\nAnyone currently explicitly setting the ports will not be affected.\nAnyone not setting the ports will need to specify them to match their\nrings.\n\nDocImpact\n\nChange-Id: Icca83a263acdd0afc9016424a3e9f8c15e944789","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/b7281cf2c584cde8f516ba206d90024af03236dd"},{"sha":"cb55e89bf1892c62a981df6b205d41ebfdee65ef","author":{"email":"5908cf536e9267f3c74e45326928d92a7461a903@gmail.com","name":"Clay Gerrard"},"message":"test tempurl header sanitization priority\n\nChange-Id: I0bb3004a717da2f65196bc56b0f7baef49e649e8","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/cb55e89bf1892c62a981df6b205d41ebfdee65ef"},{"sha":"d2a94bd43c383add237966c9f885be6b890a8141","author":{"email":"04f34fd7097722b74f9dd048871fc2a8becf4237@rackspace.com","name":"Richard (Rick) Hawkins"},"message":"Fix FormPOST max_file_size exceeded bug.\n\nWhen using FormPOST, if the size of the file being posted exceeds\nmax_file_size, a HTTP 499 was being returned rather than HTTP 400.\n\nChange-Id: I48c781735c66eccde3deb6f9c3c184aee964a4a5","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/d2a94bd43c383add237966c9f885be6b890a8141"},{"sha":"eff9ab74a4b88102e8938c52cb01b311f932949e","author":{"email":"fb83e0e14789300227d3551e544c3b5006d2665a@gmail.com","name":"David Goetz"},"message":"Delete expired objects in slightly smarter way.\n\nWhen the expirer tries to delete customer objects, if it just walks through the\ncontainers in order the deamon will tend to send DELETEs to the same container\nhighly concurrently. This will in turn create a lot of asyncs because of all\nthe concurrent deletes. If the deletes were spread out to multiple containers\nit would improve performance and decrease the number of asyncs made.\n\nChange-Id: I3d08118c197b7f18dd7e880bd5664508934ffd24","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/eff9ab74a4b88102e8938c52cb01b311f932949e"},{"sha":"f4d3facdf4b6ec8ee0dcacc7be8999731c68a8ec","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@oliver.net.au","name":"Matthew Oliver"},"message":"Treat 404s as 204 on object delete in proxy\n\nThis change adds an optional overrides map to _make_request method\nin the base Controller class.\n\n  def make_requests(self, req, ring, part, method, path, headers,\n                    query_string='', overrides=None)\n\nWhich will be passed on the the best_response method. If set and\nno quorum it reached, the override map is used to attempt to find\nquorum.\n\nThe overrides map is in the form:\n\n    { <response>: <override response>, .. }\n\nThe ObjectController, in the DELETE method now passes an override map\nto make_requests method in the base Controller class in the form of:\n\n    { 404: 204 }\n\nStatuses/responses that have been overridden are used in calculation\nof the quorum but never returned to the user. They are replaced by:\n\n    (STATUS, '', '', '')\n\nAnd left out of the search for best response.\n\nChange-Id: Ibf969eac3a09d67668d5275e808ed626152dd7eb\nCloses-Bug: 1318375","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/f4d3facdf4b6ec8ee0dcacc7be8999731c68a8ec"},{"sha":"8329095f1149d8ef8877b2b0cc87c4f11d167a4f","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"account to account copy implementation\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/8329095f1149d8ef8877b2b0cc87c4f11d167a4f"},{"sha":"ab96796dc8d1da9037330da0822c8b8d2264d192","author":{"email":"3e53127f3ad0d91a1ed4651b133d989b076d9d27@hp.com","name":"Alistair Coles"},"message":"Fix broken www-authenticate functional test\n\ntestQuotedWWWAuthenticateHeader functional test started failing\ndue to a change to keystonemiddleware.auth_token, which now adds\nits own www-authenticate header in addition to the one that swift\nkeystoneauth adds.\n\nThis patch changes the functional test to check expected\nswift generated header value is in the concatenation of\nwww-authenticate values.\n\nVerified that functional tests still pass using tempauth.\n\nCloses-Bug: 1368048\nChange-Id: I913af077df800a559d259c1622f286ad10eae9df","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/ab96796dc8d1da9037330da0822c8b8d2264d192"},{"sha":"902f0d357a816de385c15ecb0891c1705fb602b2","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"make the bind_port config setting required\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/902f0d357a816de385c15ecb0891c1705fb602b2"},{"sha":"0b1029e4d617fc2fd582e6266d77155aa13fe037","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"test tempurl header sanitization priority\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/0b1029e4d617fc2fd582e6266d77155aa13fe037"},{"sha":"2a174bfb106ded0eb39e9eb8a32e4dc555ab3750","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"moving object validation checks to top of PUT method\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/2a174bfb106ded0eb39e9eb8a32e4dc555ab3750"},{"sha":"1f02740197d12f6ce8a275b9dc61d506c20eea40","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"Extra unit tests for check_delete_headers\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/1f02740197d12f6ce8a275b9dc61d506c20eea40"},{"sha":"a03732e142540e5a7d6cb11de5232f0642beb20d","author":{"email":"3e53127f3ad0d91a1ed4651b133d989b076d9d27@hp.com","name":"Alistair Coles"},"message":"Add comments to clarify change to www-authenticate test\n\nTrivial patch to tidy-up change to the functional test for\nwww-authenticate header and add a comment to explain\nthat multiple header values might be returned.\n\nChange-Id: If62cb3fd9e11450a2be0cec71e80ecb74a959d04\nRelated-bug: 1368048","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/a03732e142540e5a7d6cb11de5232f0642beb20d"},{"sha":"5c9835125802c51e2eb2823f5208d53c358a5e84","author":{"email":"9812ae5e49856f8a90d0997be826cde1716c70cc@enovance.com","name":"Christian Schwede"},"message":"Fix RingBuilder._build_max_replicas_by_tier docstring\n\nThe current docstring doesn't include zones, and the order of the\nentries is not up to date with the current code. Let's fix this.\n\nChange-Id: Ibabd79427b83d9e8c86b2caeb93dee219c8274c0","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/5c9835125802c51e2eb2823f5208d53c358a5e84"},{"sha":"ca915156fb2ce4fe4356f54fb2cee7bd01185af5","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"Fix FormPOST max_file_size exceeded bug.\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/ca915156fb2ce4fe4356f54fb2cee7bd01185af5"},{"sha":"034fae630cfd652093ef53164a7f9f43bde67336","author":{"email":"d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","name":"Jenkins"},"message":"Merge \"Restrict keystone cross-tenant ACLs to IDs\"","distinct":true,"url":"https://api.github.com/repos/williamsdoug/swift/commits/034fae630cfd652093ef53164a7f9f43bde67336"}]}