From 7c85f02438b745df2cf07687ba1ee7a41f24b9f1 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 5 Aug 2026 06:00:10 -0400 Subject: [PATCH] import Oracle_OSS fence-agents-4.10.0-110.el9_8.5 --- .fence-agents.metadata | 3 +- .gitignore | 3 +- ...oid-timeout-with-large-number-of-VMs.patch | 56 +++++++++++++++++++ SPECS/fence-agents.spec | 37 ++++++++---- 4 files changed, 87 insertions(+), 12 deletions(-) create mode 100644 SOURCES/RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch diff --git a/.fence-agents.metadata b/.fence-agents.metadata index f996a29..c519be5 100644 --- a/.fence-agents.metadata +++ b/.fence-agents.metadata @@ -25,7 +25,7 @@ ac160113ba8b78b0688edda9f9a088c0b4b5ded2 SOURCES/google_api_core-1.30.0-py2.py3- 4a3a5ddc3d1ded24279b89d4ea0c8796f6c2598a SOURCES/google_auth-1.32.0-py2.py3-none-any.whl 9e513ce4e7b36b8e81c607be440e0d6e6afe9833 SOURCES/google_auth_httplib2-0.1.0-py2.py3-none-any.whl dc553afa7a3f23b92ee9ecd27d0b15153c0e9f75 SOURCES/googleapis_common_protos-1.53.0-py2.py3-none-any.whl -74ec77d2e2ef6b2ef8503e6e398faa6f3ba298ae SOURCES/httplib2-0.19.1-py3-none-any.whl +2dca6755693e3b9ef39bc60141285b9a9b27b3e1 SOURCES/httplib2-0.32.0.tar.gz ea36ce1c780dd44f01225dca7f9995a6685a60cc SOURCES/isodate-0.6.1.tar.gz 41fdca818f95b8f0d35298eaab42f4e714dedf19 SOURCES/jinja2-3.1.6.tar.gz 356c48dfea2214dd9e7e2b222a99dddfe9c0d05c SOURCES/jmespath-0.10.0.tar.gz @@ -45,6 +45,7 @@ b21ec03f79d2a7ef4396d909f78130a92455c3c9 SOURCES/msrestazure-0.6.4.post1.tar.gz e0fa19f8fda46a1fa2253477499b116b33f67175 SOURCES/pyasn1-0.4.8.tar.gz 43b89feb6864fe359aae89120627165219de313b SOURCES/pyasn1-modules-0.2.8.tar.gz 38308c2bdb1618339212eb041206e14d1ce84640 SOURCES/pyjwt-2.13.0.tar.gz +3abd3bb547e7b9ba1226990bf03bba2ef7d74439 SOURCES/pyparsing-3.3.2.tar.gz 770968018322c2b3fde684aebe964663c6f5d8c5 SOURCES/pyroute2-0.7.12.tar.gz 1dc2fa004aa6517f1620e55d8a7b8e68a9cf2a47 SOURCES/python-string-utils-1.0.0.tar.gz 3005ff67df93ee276fb8631e17c677df852254ad SOURCES/python_dateutil-2.8.1-py2.py3-none-any.whl diff --git a/.gitignore b/.gitignore index c60679e..8708724 100644 --- a/.gitignore +++ b/.gitignore @@ -25,7 +25,7 @@ SOURCES/google_api_python_client-1.12.8-py2.py3-none-any.whl SOURCES/google_auth-1.32.0-py2.py3-none-any.whl SOURCES/google_auth_httplib2-0.1.0-py2.py3-none-any.whl SOURCES/googleapis_common_protos-1.53.0-py2.py3-none-any.whl -SOURCES/httplib2-0.19.1-py3-none-any.whl +SOURCES/httplib2-0.32.0.tar.gz SOURCES/isodate-0.6.1.tar.gz SOURCES/jinja2-3.1.6.tar.gz SOURCES/jmespath-0.10.0.tar.gz @@ -45,6 +45,7 @@ SOURCES/ptyprocess-0.7.0-py2.py3-none-any.whl SOURCES/pyasn1-0.4.8.tar.gz SOURCES/pyasn1-modules-0.2.8.tar.gz SOURCES/pyjwt-2.13.0.tar.gz +SOURCES/pyparsing-3.3.2.tar.gz SOURCES/pyroute2-0.7.12.tar.gz SOURCES/python-string-utils-1.0.0.tar.gz SOURCES/python_dateutil-2.8.1-py2.py3-none-any.whl diff --git a/SOURCES/RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch b/SOURCES/RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch new file mode 100644 index 0000000..9526e6c --- /dev/null +++ b/SOURCES/RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch @@ -0,0 +1,56 @@ +From 101344d675f5c4f4141a01ec60a3265898cea94d Mon Sep 17 00:00:00 2001 +From: Arslan Ahmad +Date: Tue, 16 Jun 2026 21:02:53 +0530 +Subject: [PATCH] fence_openstack: fix list-action to avoid timeout when there + are 100+ VMs on the hypervisor + +Routine `monitor` actions internally translate to a full `list` command. +On large deployments, fetching all VMs from the Nova API creates massive +payloads that cause the agent to timeout. + +Changes in this patch: +* Fetch only 1 VM (`limit=1`) during `monitor` operations to eliminate +API overhead and prevent timeouts. + +Signed-off-by: Arslan Ahmad +--- + agents/openstack/fence_openstack.py | 25 +++++++++++++++++-------- + 1 file changed, 17 insertions(+), 8 deletions(-) + +diff --git a/agents/openstack/fence_openstack.py b/agents/openstack/fence_openstack.py +index 4054e5149..b90d80d6a 100644 +--- a/agents/openstack/fence_openstack.py ++++ b/agents/openstack/fence_openstack.py +@@ -52,15 +52,24 @@ def get_cloud(options): + + + def get_nodes_list(conn, options): +- logging.info("Running %s action", options["--action"]) ++ logging.info("Running %s action", options.get("--original-action", options.get("--action"))) + result = {} +- response = conn.servers.list(detailed=True) +- if response is not None: +- for item in response: +- instance_id = item.id +- instance_name = item.name +- instance_status = item.status +- result[instance_id] = (instance_name, translate_status(instance_status)) ++ search_opts = {} ++ max_results = 1 if options.get("--original-action") == "monitor" else None ++ ++ if "--plug" in options: ++ search_opts["uuid"] = options["--plug"] ++ ++ try: ++ response = conn.servers.list(detailed=True, search_opts=search_opts, limit=max_results) ++ if response is not None: ++ for item in response: ++ instance_id = item.id ++ instance_name = item.name ++ instance_status = item.status ++ result[instance_id] = (instance_name, translate_status(instance_status)) ++ except Exception as e: ++ logging.error("Failed to retrieve node list: %s", e) + return result + + diff --git a/SPECS/fence-agents.spec b/SPECS/fence-agents.spec index de5dbe7..d0c5767 100644 --- a/SPECS/fence-agents.spec +++ b/SPECS/fence-agents.spec @@ -47,7 +47,7 @@ Name: fence-agents Summary: Set of unified programs capable of host isolation ("fencing") Version: 4.10.0 -Release: 110%{?alphatag:.%{alphatag}}%{?dist}.3 +Release: 110%{?alphatag:.%{alphatag}}%{?dist}.5 License: GPLv2+ and LGPLv2+ URL: https://github.com/ClusterLabs/fence-agents Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz @@ -108,12 +108,13 @@ Source1502: google_api_python_client-1.12.8-py2.py3-none-any.whl Source1503: googleapis_common_protos-1.53.0-py2.py3-none-any.whl Source1504: google_auth-1.32.0-py2.py3-none-any.whl Source1505: google_auth_httplib2-0.1.0-py2.py3-none-any.whl -Source1506: httplib2-0.19.1-py3-none-any.whl -Source1507: protobuf-3.17.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl -Source1508: pyroute2-0.7.12.tar.gz -Source1509: pytz-2021.1-py2.py3-none-any.whl -Source1510: rsa-4.7.2-py3-none-any.whl -Source1511: uritemplate-3.0.1-py2.py3-none-any.whl +Source1506: pyparsing-3.3.2.tar.gz +Source1507: httplib2-0.32.0.tar.gz +Source1508: protobuf-3.17.3-cp39-cp39-manylinux_2_5_x86_64.manylinux1_x86_64.whl +Source1509: pyroute2-0.7.12.tar.gz +Source1510: pytz-2021.1-py2.py3-none-any.whl +Source1511: rsa-4.7.2-py3-none-any.whl +Source1512: uritemplate-3.0.1-py2.py3-none-any.whl # kubevirt ## pip download --no-binary :all: openshift "ruamel.yaml.clib>=0.1.2" Source1600: %{openshift}-%{openshift_version}.tar.gz @@ -218,6 +219,7 @@ Patch73: RHEL-114753-fence_ibm_powervs-update-api-type-description.patch Patch74: RHEL-128926-1-fence_gce-make-zone-parameter-optional.patch Patch75: RHEL-128926-2-fence_gce-fix-node-list-limit.patch Patch76: RHEL-145088-fence_ibm_vpc-fix-missing-statuses.patch +Patch77: RHEL-186320-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch ### HA support libs/utils ### # all archs @@ -418,6 +420,7 @@ BuildRequires: %{systemd_units} %patch -p1 -P 74 %patch -p1 -P 75 %patch -p1 -P 76 +%patch -p1 -P 77 # prevent compilation of something that won't get used anyway sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac @@ -451,6 +454,8 @@ popd %{__python3} -m pip install --no-build-isolation --user --upgrade --no-index --find-links %{_sourcedir} pip setuptools wheel %ifarch x86_64 LIBS="%{_sourcedir}/requirements-*.txt" +# required for httplib2 +%{__python3} -m pip install --no-build-isolation --upgrade --ignore-installed --prefix "usr" --root support/google --no-index --find-links %{_sourcedir} pyparsing %endif %ifarch ppc64le LIBS="%{_sourcedir}/requirements-common.txt %{_sourcedir}/requirements-ibm.txt" @@ -459,9 +464,11 @@ LIBS="%{_sourcedir}/requirements-common.txt %{_sourcedir}/requirements-ibm.txt" LIBS="%{_sourcedir}/requirements-common.txt" %endif for x in $LIBS; do + # Workaround to be able to install pyparsing with --ignore-installed without pip trying to install it again + [ "$x" = "%{_sourcedir}/requirements-google.txt" ] && { echo "pyparsing" > %{_sourcedir}/constraints-google.txt && ADDITIONAL_OPTS="-c %{_sourcedir}/constraints-google.txt"; } || ADDITIONAL_OPTS="" [ "%{_arch}" = "x86_64" ] && [ "$x" = "%{_sourcedir}/requirements-ibm.txt" ] && continue # use --prefix "usr" due to default varying per arch (and "" uses default unlike on RHEL10+) - %{__python3} -m pip install --no-build-isolation --use-deprecated=legacy-resolver --prefix "usr" --root support/$(echo $x | sed -E "s/.*requirements-(.*).txt/\1/") --no-index --find-links %{_sourcedir} -r $x + %{__python3} -m pip install --no-build-isolation --use-deprecated=legacy-resolver $ADDITIONAL_OPTS --prefix "usr" --root support/$(echo $x | sed -E "s/.*requirements-(.*).txt/\1/") --no-index --find-links %{_sourcedir} -r $x done # kubevirt @@ -616,7 +623,7 @@ This package contains support files including the Python fencing library. %package -n ha-cloud-support License: GPL-2.0-or-later AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND Apache-2.0 AND MIT AND BSD-2-Clause AND BSD-3-Clause AND MPL-2.0 AND Apache-2.0 AND PSF-2.0 AND Unlicense AND ISC Summary: Support libraries for HA Cloud agents -Requires: python3-cryptography python3-requests python3-urllib3 +Requires: python3-cryptography python3-pysocks python3-requests python3-urllib3 %ifarch x86_64 Requires: awscli2 # aliyun @@ -658,7 +665,8 @@ Provides: bundled(python-google-api-client) = 1.12.8 Provides: bundled(python-googleapis-common-protos) = 1.53.0 Provides: bundled(python-google-auth) = 1.32.0 Provides: bundled(python-google-auth-httplib2) = 0.1.0 -Provides: bundled(python-httplib2) = 0.19.1 +Provides: bundled(python-pyparsing) = 3.3.2 +Provides: bundled(python-httplib2) = 0.32.0 Provides: bundled(python-protobuf) = 3.17.3 Provides: bundled(python3-%{pyasn1}) = %{pyasn1_version} Provides: bundled(python3-%{pyasn1modules}) = %{pyasn1modules_version} @@ -1516,6 +1524,15 @@ are located on corosync cluster nodes. %endif %changelog +* Wed Jul 15 2026 Oyvind Albrigtsen - 4.10.0-110.5 +- bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939 + Resolves: RHEL-193808 + +* Mon Jun 22 2026 Arslan Ahmad - 4.10.0-110.4 +- fence_openstack: fix list-action to avoid timeout when + there are 100+ VMs on the hypervisor + Resolves: RHEL-186320 + * Mon Jun 8 2026 Oyvind Albrigtsen - 4.10.0-110.3 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313