From 4b95b33cb83427dbe57c6cdf3519717b54de8cbb Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Sun, 8 Sep 2019 10:50:09 +0100 Subject: [PATCH 1/5] New stable version 1.0.1. --- libnbd.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index a127cbc..3aa4bf9 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -5,10 +5,10 @@ %global patches_touch_autotools %{nil} # The source directory. -%global source_directory 0.x-unstable-api +%global source_directory 1.0-stable Name: libnbd -Version: 1.0.0 +Version: 1.0.1 Release: 1%{?dist} Summary: NBD client library in userspace @@ -219,6 +219,9 @@ make %{?_smp_mflags} check || { %changelog +* Sun Sep 08 2019 Richard W.M. Jones - 1.0.1-1 +- New stable version 1.0.1. + * Wed Aug 28 2019 Richard W.M. Jones - 1.0.0-1 - New upstream version 1.0.0. diff --git a/sources b/sources index 82ba189..311c0bc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.0.0.tar.gz) = 9d9a60d172b9a0dff0d882db72be7243b6fccceb76d240bc385a55ea2358e317a6792288d443ee068d6c894dc0d80f1a900c8ac7f681babcde98c1b7caf9e61a -SHA512 (libnbd-1.0.0.tar.gz.sig) = 982f723233951bac6f24b0c3a9a2a60379ff1a35bb37058259164666a4e9511634653c2c8f5bed32fc8d4c23083144a9ed73cae159e948e66f52a43734246f8d +SHA512 (libnbd-1.0.1.tar.gz) = 76437cdd05ed0755ff4db055947565197a8e2626d139ee01153f4b370396cffce5233fb1ccc79072e074ba0a0f70768903fd29462dfe2655d34ae191271f7951 +SHA512 (libnbd-1.0.1.tar.gz.sig) = 424c865ace483b3d466882d5fbe069973be361786c6d5bafdc295fa98f39558c8d18abbd3f2a18380ba53482c5308d6da691f5bdceaaedc2cbfa89602342660d From cdfa595f382e8d6c55b2a46ec5cadfdefda78897 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Thu, 12 Sep 2019 08:39:04 +0100 Subject: [PATCH 2/5] Add upstream patch to fix nbdsh (for nbdkit tests). (cherry picked from commit 52e6bd7cc34862eca690b2a0332a623252d216ff) --- 0001-nbdsh-Fix-behaviour-of-globals.patch | 31 +++++++++++++++++++++++ libnbd.spec | 8 +++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 0001-nbdsh-Fix-behaviour-of-globals.patch diff --git a/0001-nbdsh-Fix-behaviour-of-globals.patch b/0001-nbdsh-Fix-behaviour-of-globals.patch new file mode 100644 index 0000000..e0467ab --- /dev/null +++ b/0001-nbdsh-Fix-behaviour-of-globals.patch @@ -0,0 +1,31 @@ +From efd232c089261d4b471ff3e140c28a91c0ae5bbe Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 11 Sep 2019 22:25:57 +0100 +Subject: [PATCH] nbdsh: Fix behaviour of globals. + +https://stackoverflow.com/a/11754346 +(cherry picked from commit d6cbd130101add28431bd6e67aa2ea0430a9234e) +--- + python/nbdsh.py | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/python/nbdsh.py b/python/nbdsh.py +index bb0db64..553e632 100644 +--- a/python/nbdsh.py ++++ b/python/nbdsh.py +@@ -57,8 +57,10 @@ help (nbd) # Display documentation + if not args.command: + code.interact (banner = banner, local = locals(), exitmsg = '') + else: ++ # https://stackoverflow.com/a/11754346 ++ d = dict (locals(), **globals()) + for c in args.command: + if c != '-': +- exec (c) ++ exec (c, d, d) + else: +- exec (sys.stdin.read ()) ++ exec (sys.stdin.read (), d, d) +-- +2.23.0 + diff --git a/libnbd.spec b/libnbd.spec index 3aa4bf9..66126e4 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -9,7 +9,7 @@ Name: libnbd Version: 1.0.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: NBD client library in userspace License: LGPLv2+ @@ -22,6 +22,9 @@ Source1: http://libguestfs.org/download/libnbd/%{source_directory}/%{name # https://pgp.key-server.io/pks/lookup?search=rjones%40redhat.com&fingerprint=on&op=vindex Source2: libguestfs.keyring +# Upstream patch to fix nbdsh. +Patch0001: 0001-nbdsh-Fix-behaviour-of-globals.patch + %if 0%{patches_touch_autotools} BuildRequires: autoconf, automake, libtool %endif @@ -219,6 +222,9 @@ make %{?_smp_mflags} check || { %changelog +* Thu Sep 12 2019 Richard W.M. Jones - 1.1.1-2 +- Add upstream patch to fix nbdsh (for nbdkit tests). + * Sun Sep 08 2019 Richard W.M. Jones - 1.0.1-1 - New stable version 1.0.1. From 8651382d3edb35effa51bde7e72e2a1ced3b9b41 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Thu, 12 Sep 2019 11:04:11 +0100 Subject: [PATCH 3/5] Fix interop tests on slow machines. --- 0001-nbdsh-Fix-behaviour-of-globals.patch | 5 +- ...Try-to-return-errno-from-underlying-.patch | 83 +++++++++++++++++++ ...op-Retry-TCP-connections-to-qemu-nbd.patch | 71 ++++++++++++++++ libnbd.spec | 3 + 4 files changed, 159 insertions(+), 3 deletions(-) create mode 100644 0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch create mode 100644 0003-interop-Retry-TCP-connections-to-qemu-nbd.patch diff --git a/0001-nbdsh-Fix-behaviour-of-globals.patch b/0001-nbdsh-Fix-behaviour-of-globals.patch index e0467ab..738a607 100644 --- a/0001-nbdsh-Fix-behaviour-of-globals.patch +++ b/0001-nbdsh-Fix-behaviour-of-globals.patch @@ -1,10 +1,9 @@ -From efd232c089261d4b471ff3e140c28a91c0ae5bbe Mon Sep 17 00:00:00 2001 +From d6cbd130101add28431bd6e67aa2ea0430a9234e Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Wed, 11 Sep 2019 22:25:57 +0100 -Subject: [PATCH] nbdsh: Fix behaviour of globals. +Subject: [PATCH 1/3] nbdsh: Fix behaviour of globals. https://stackoverflow.com/a/11754346 -(cherry picked from commit d6cbd130101add28431bd6e67aa2ea0430a9234e) --- python/nbdsh.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch b/0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch new file mode 100644 index 0000000..f96314c --- /dev/null +++ b/0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch @@ -0,0 +1,83 @@ +From d2d3940a65dab60a2caeaf824eaff12fcc85e1f0 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Thu, 12 Sep 2019 10:28:19 +0100 +Subject: [PATCH 2/3] nbd_connect_tcp: Try to return errno from underlying + connect(2) call. + +When we make a TCP connection we have to make multiple underlying +connect(2) calls, once for each address returned by getaddrinfo. +Unfortunately this meant that we lost the errno from any of these +calls: + +$ nbdsh -c 'h.connect_tcp ("localhost", "nbd")' +nbd.Error: nbd_connect_tcp: connect: localhost:nbd: could not connect to remote host + +This commit saves the errno from the first failed connect(2): + +$ ./run nbdsh -c 'h.connect_tcp ("localhost", "nbd")' +nbd.Error: nbd_connect_tcp: connect: localhost:nbd: could not connect to remote host: Connection refused (ECONNREFUSED) +--- + generator/states-connect.c | 12 ++++++++++-- + lib/internal.h | 1 + + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/generator/states-connect.c b/generator/states-connect.c +index 9e2e1d4..e9b3582 100644 +--- a/generator/states-connect.c ++++ b/generator/states-connect.c +@@ -128,6 +128,8 @@ disable_nagle (int sock) + h->result = NULL; + } + ++ h->connect_errno = 0; ++ + memset (&h->hints, 0, sizeof h->hints); + h->hints.ai_family = AF_UNSPEC; + h->hints.ai_socktype = SOCK_STREAM; +@@ -160,7 +162,8 @@ disable_nagle (int sock) + * Save errno from most recent connect(2) call. XXX + */ + SET_NEXT_STATE (%^START); +- set_error (0, "connect: %s:%s: could not connect to remote host", ++ set_error (h->connect_errno, ++ "connect: %s:%s: could not connect to remote host", + h->hostname, h->port); + return -1; + } +@@ -182,6 +185,8 @@ disable_nagle (int sock) + + if (connect (fd, h->rp->ai_addr, h->rp->ai_addrlen) == -1) { + if (errno != EINPROGRESS) { ++ if (h->connect_errno == 0) ++ h->connect_errno = errno; + SET_NEXT_STATE (%NEXT_ADDRESS); + return 0; + } +@@ -203,8 +208,11 @@ disable_nagle (int sock) + /* This checks the status of the original connect call. */ + if (status == 0) + SET_NEXT_STATE (%^MAGIC.START); +- else ++ else { ++ if (h->connect_errno == 0) ++ h->connect_errno = status; + SET_NEXT_STATE (%NEXT_ADDRESS); ++ } + return 0; + + CONNECT_TCP.NEXT_ADDRESS: +diff --git a/lib/internal.h b/lib/internal.h +index a48edff..ccaca32 100644 +--- a/lib/internal.h ++++ b/lib/internal.h +@@ -188,6 +188,7 @@ struct nbd_handle { + char *hostname, *port; + struct addrinfo hints; + struct addrinfo *result, *rp; ++ int connect_errno; + + /* When sending metadata contexts, this is used. */ + size_t querynum; +-- +2.23.0 + diff --git a/0003-interop-Retry-TCP-connections-to-qemu-nbd.patch b/0003-interop-Retry-TCP-connections-to-qemu-nbd.patch new file mode 100644 index 0000000..d141920 --- /dev/null +++ b/0003-interop-Retry-TCP-connections-to-qemu-nbd.patch @@ -0,0 +1,71 @@ +From b23b5b32250e5a03e4cc38ccf973e25e63ccc6d9 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Thu, 12 Sep 2019 10:38:48 +0100 +Subject: [PATCH 3/3] interop: Retry TCP connections to qemu-nbd. + +The test interop-qemu-nbd-tls-certs frequently fails on slow (32 bit) +machines in Fedora Koji. (Is crypto slow on these already overloaded +machines?) + +As we cannot wait for a signal when qemu-nbd is ready start serving, +we have to use a sleep. The current sleep is 5 seconds, which is not +long enough. Making the sleep longer would work but is inconsiderate +for people using faster machines. Therefore replace this with a retry +loop with exponential backoff. + +I tested this with a simple wrapper around qemu-nbd which did: + + sleep 5; exec /usr/bin/qemu-nbd "$@" +--- + interop/interop.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/interop/interop.c b/interop/interop.c +index 662d871..a3ab39b 100644 +--- a/interop/interop.c ++++ b/interop/interop.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -44,6 +45,7 @@ main (int argc, char *argv[]) + int port; + char port_str[16]; + pid_t pid = -1; ++ int retry; + #endif + int64_t actual_size; + char buf[512]; +@@ -114,14 +116,19 @@ main (int argc, char *argv[]) + } + + /* Unfortunately there's no good way to wait for qemu-nbd to start +- * serving, so ... ++ * serving, so we need to retry here. + */ +- sleep (5); +- +- if (nbd_connect_tcp (nbd, "localhost", port_str) == -1) { +- fprintf (stderr, "%s\n", nbd_get_error ()); +- goto out; ++ for (retry = 0; retry < 5; ++retry) { ++ sleep (1 << retry); ++ if (nbd_connect_tcp (nbd, "localhost", port_str) == -1) { ++ fprintf (stderr, "%s\n", nbd_get_error ()); ++ if (nbd_get_errno () != ECONNREFUSED) ++ goto out; ++ } ++ else break; + } ++ if (retry == 5) ++ goto out; + + #else /* !SERVE_OVER_TCP */ + +-- +2.23.0 + diff --git a/libnbd.spec b/libnbd.spec index 66126e4..d5664b3 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -24,6 +24,8 @@ Source2: libguestfs.keyring # Upstream patch to fix nbdsh. Patch0001: 0001-nbdsh-Fix-behaviour-of-globals.patch +Patch0002: 0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch +Patch0003: 0003-interop-Retry-TCP-connections-to-qemu-nbd.patch %if 0%{patches_touch_autotools} BuildRequires: autoconf, automake, libtool @@ -224,6 +226,7 @@ make %{?_smp_mflags} check || { %changelog * Thu Sep 12 2019 Richard W.M. Jones - 1.1.1-2 - Add upstream patch to fix nbdsh (for nbdkit tests). +- Fix interop tests on slow machines. * Sun Sep 08 2019 Richard W.M. Jones - 1.0.1-1 - New stable version 1.0.1. From 19fec5b94162002f7f53349459cece20adaf7fb1 Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Tue, 17 Sep 2019 16:42:32 +0100 Subject: [PATCH 4/5] New upstream version 1.0.2. Remove patches which are upstream. Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842). (cherry picked from commit 46c80ed0b2c29dbada7ba671361d245dfd26488d) --- 0001-nbdsh-Fix-behaviour-of-globals.patch | 30 ----------------------- libnbd.spec | 16 ++++++++---- sources | 4 +-- 3 files changed, 13 insertions(+), 37 deletions(-) delete mode 100644 0001-nbdsh-Fix-behaviour-of-globals.patch diff --git a/0001-nbdsh-Fix-behaviour-of-globals.patch b/0001-nbdsh-Fix-behaviour-of-globals.patch deleted file mode 100644 index 738a607..0000000 --- a/0001-nbdsh-Fix-behaviour-of-globals.patch +++ /dev/null @@ -1,30 +0,0 @@ -From d6cbd130101add28431bd6e67aa2ea0430a9234e Mon Sep 17 00:00:00 2001 -From: "Richard W.M. Jones" -Date: Wed, 11 Sep 2019 22:25:57 +0100 -Subject: [PATCH 1/3] nbdsh: Fix behaviour of globals. - -https://stackoverflow.com/a/11754346 ---- - python/nbdsh.py | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/python/nbdsh.py b/python/nbdsh.py -index bb0db64..553e632 100644 ---- a/python/nbdsh.py -+++ b/python/nbdsh.py -@@ -57,8 +57,10 @@ help (nbd) # Display documentation - if not args.command: - code.interact (banner = banner, local = locals(), exitmsg = '') - else: -+ # https://stackoverflow.com/a/11754346 -+ d = dict (locals(), **globals()) - for c in args.command: - if c != '-': -- exec (c) -+ exec (c, d, d) - else: -- exec (sys.stdin.read ()) -+ exec (sys.stdin.read (), d, d) --- -2.23.0 - diff --git a/libnbd.spec b/libnbd.spec index d5664b3..8f9e779 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -8,8 +8,8 @@ %global source_directory 1.0-stable Name: libnbd -Version: 1.0.1 -Release: 2%{?dist} +Version: 1.0.2 +Release: 1%{?dist} Summary: NBD client library in userspace License: LGPLv2+ @@ -22,8 +22,8 @@ Source1: http://libguestfs.org/download/libnbd/%{source_directory}/%{name # https://pgp.key-server.io/pks/lookup?search=rjones%40redhat.com&fingerprint=on&op=vindex Source2: libguestfs.keyring -# Upstream patch to fix nbdsh. -Patch0001: 0001-nbdsh-Fix-behaviour-of-globals.patch +# These patches are upstream in the master branch but not in the +# stable-1.0 branch. They make the tests more stable. Patch0002: 0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch Patch0003: 0003-interop-Retry-TCP-connections-to-qemu-nbd.patch @@ -224,7 +224,13 @@ make %{?_smp_mflags} check || { %changelog -* Thu Sep 12 2019 Richard W.M. Jones - 1.1.1-2 +* Tue Sep 17 2019 Richard W.M. Jones - 1.0.2-1 +- New upstream version 1.0.2. +- Remove patches which are upstream. +- Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842). +- Fix previous commit message. + +* Thu Sep 12 2019 Richard W.M. Jones - 1.0.1-2 - Add upstream patch to fix nbdsh (for nbdkit tests). - Fix interop tests on slow machines. diff --git a/sources b/sources index 311c0bc..662596e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.0.1.tar.gz) = 76437cdd05ed0755ff4db055947565197a8e2626d139ee01153f4b370396cffce5233fb1ccc79072e074ba0a0f70768903fd29462dfe2655d34ae191271f7951 -SHA512 (libnbd-1.0.1.tar.gz.sig) = 424c865ace483b3d466882d5fbe069973be361786c6d5bafdc295fa98f39558c8d18abbd3f2a18380ba53482c5308d6da691f5bdceaaedc2cbfa89602342660d +SHA512 (libnbd-1.0.2.tar.gz) = 18a6a10ca28e1f5eb1b9e4e6d1ee8cff3fd62e76f374ef326937a97f614008c41f69ec9177240086b28313e1654ce5ebe4469c40464b76a5da298be92ac5fd7d +SHA512 (libnbd-1.0.2.tar.gz.sig) = a4a52160fa88f5b927d61c2ac538e2ed2ce12028d11314e67d56ec73b31376c277184e8920c996372c45f8fec5b69f946379159666ce1e3ae4cacaf9f3bf2e6a From ab35bd208f74913f563b22b49c2093181b2e5d6d Mon Sep 17 00:00:00 2001 From: "Richard W.M. Jones" Date: Wed, 9 Oct 2019 09:36:57 +0100 Subject: [PATCH 5/5] New upstream version 1.0.3. - Contains fix for remote code execution vulnerability. - Add new libnbd-security(3) man page. --- libnbd.spec | 8 +++++++- sources | 4 ++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/libnbd.spec b/libnbd.spec index 8f9e779..e4e04f1 100644 --- a/libnbd.spec +++ b/libnbd.spec @@ -8,7 +8,7 @@ %global source_directory 1.0-stable Name: libnbd -Version: 1.0.2 +Version: 1.0.3 Release: 1%{?dist} Summary: NBD client library in userspace @@ -191,6 +191,7 @@ make %{?_smp_mflags} check || { %{_libdir}/libnbd.so %{_libdir}/pkgconfig/libnbd.pc %{_mandir}/man3/libnbd.3* +%{_mandir}/man3/libnbd-security.3* %{_mandir}/man3/nbd_*.3* @@ -224,6 +225,11 @@ make %{?_smp_mflags} check || { %changelog +* Wed Oct 9 2019 Richard W.M. Jones - 1.0.3-1 +- New upstream version 1.0.3. +- Contains fix for remote code execution vulnerability. +- Add new libnbd-security(3) man page. + * Tue Sep 17 2019 Richard W.M. Jones - 1.0.2-1 - New upstream version 1.0.2. - Remove patches which are upstream. diff --git a/sources b/sources index 662596e..a4390bd 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libnbd-1.0.2.tar.gz) = 18a6a10ca28e1f5eb1b9e4e6d1ee8cff3fd62e76f374ef326937a97f614008c41f69ec9177240086b28313e1654ce5ebe4469c40464b76a5da298be92ac5fd7d -SHA512 (libnbd-1.0.2.tar.gz.sig) = a4a52160fa88f5b927d61c2ac538e2ed2ce12028d11314e67d56ec73b31376c277184e8920c996372c45f8fec5b69f946379159666ce1e3ae4cacaf9f3bf2e6a +SHA512 (libnbd-1.0.3.tar.gz) = 47980c6b323046e983ee3c717b832e7cf29ba89e7c2f001a27ecb17ed55a2259ece78d71d661ddec3af45d316a198d80f253d13a265f60ae5a28c30ef84477a1 +SHA512 (libnbd-1.0.3.tar.gz.sig) = 07637d69abea513dfb03982776292a5e8cf5bc2962a3dd6ed36f9ed32e58d52795fa4eb3ba7ca7eee916a7271dba37bb3c2ee57f04a585070e0ba986da3f5cfc