New upstream version 1.0.3.

- Contains fix for remote code execution vulnerability.
- Add new libnbd-security(3) man page.

.gitignore

@@ -1,3 +1,2 @@
 /libnbd-*.tar.gz
 /libnbd-*.tar.gz.sig
-/*~

0002-nbd_connect_tcp-Try-to-return-errno-from-underlying-.patch

@@ -0,0 +1,83 @@
+From d2d3940a65dab60a2caeaf824eaff12fcc85e1f0 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 12 Sep 2019 10:28:19 +0100
+Subject: [PATCH 2/3] nbd_connect_tcp: Try to return errno from underlying
+ connect(2) call.
+
+When we make a TCP connection we have to make multiple underlying
+connect(2) calls, once for each address returned by getaddrinfo.
+Unfortunately this meant that we lost the errno from any of these
+calls:
+
+$ nbdsh -c 'h.connect_tcp ("localhost", "nbd")'
+nbd.Error: nbd_connect_tcp: connect: localhost:nbd: could not connect to remote host
+
+This commit saves the errno from the first failed connect(2):
+
+$ ./run nbdsh -c 'h.connect_tcp ("localhost", "nbd")'
+nbd.Error: nbd_connect_tcp: connect: localhost:nbd: could not connect to remote host: Connection refused (ECONNREFUSED)
+---
+ generator/states-connect.c | 12 ++++++++++--
+ lib/internal.h             |  1 +
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/generator/states-connect.c b/generator/states-connect.c
+index 9e2e1d4..e9b3582 100644
+--- a/generator/states-connect.c
++++ b/generator/states-connect.c
+@@ -128,6 +128,8 @@ disable_nagle (int sock)
+     h->result = NULL;
+   }
+ 
++  h->connect_errno = 0;
++
+   memset (&h->hints, 0, sizeof h->hints);
+   h->hints.ai_family = AF_UNSPEC;
+   h->hints.ai_socktype = SOCK_STREAM;
+@@ -160,7 +162,8 @@ disable_nagle (int sock)
+      * Save errno from most recent connect(2) call. XXX
+      */
+     SET_NEXT_STATE (%^START);
+-    set_error (0, "connect: %s:%s: could not connect to remote host",
++    set_error (h->connect_errno,
++               "connect: %s:%s: could not connect to remote host",
+                h->hostname, h->port);
+     return -1;
+   }
+@@ -182,6 +185,8 @@ disable_nagle (int sock)
+ 
+   if (connect (fd, h->rp->ai_addr, h->rp->ai_addrlen) == -1) {
+     if (errno != EINPROGRESS) {
++      if (h->connect_errno == 0)
++        h->connect_errno = errno;
+       SET_NEXT_STATE (%NEXT_ADDRESS);
+       return 0;
+     }
+@@ -203,8 +208,11 @@ disable_nagle (int sock)
+   /* This checks the status of the original connect call. */
+   if (status == 0)
+     SET_NEXT_STATE (%^MAGIC.START);
+-  else
++  else {
++    if (h->connect_errno == 0)
++      h->connect_errno = status;
+     SET_NEXT_STATE (%NEXT_ADDRESS);
++  }
+   return 0;
+ 
+  CONNECT_TCP.NEXT_ADDRESS:
+diff --git a/lib/internal.h b/lib/internal.h
+index a48edff..ccaca32 100644
+--- a/lib/internal.h
++++ b/lib/internal.h
+@@ -188,6 +188,7 @@ struct nbd_handle {
+   char *hostname, *port;
+   struct addrinfo hints;
+   struct addrinfo *result, *rp;
++  int connect_errno;
+ 
+   /* When sending metadata contexts, this is used. */
+   size_t querynum;
+-- 
+2.23.0
+

0003-interop-Retry-TCP-connections-to-qemu-nbd.patch

@@ -0,0 +1,71 @@
+From b23b5b32250e5a03e4cc38ccf973e25e63ccc6d9 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 12 Sep 2019 10:38:48 +0100
+Subject: [PATCH 3/3] interop: Retry TCP connections to qemu-nbd.
+
+The test interop-qemu-nbd-tls-certs frequently fails on slow (32 bit)
+machines in Fedora Koji.  (Is crypto slow on these already overloaded
+machines?)
+
+As we cannot wait for a signal when qemu-nbd is ready start serving,
+we have to use a sleep.  The current sleep is 5 seconds, which is not
+long enough.  Making the sleep longer would work but is inconsiderate
+for people using faster machines.  Therefore replace this with a retry
+loop with exponential backoff.
+
+I tested this with a simple wrapper around qemu-nbd which did:
+
+  sleep 5; exec /usr/bin/qemu-nbd "$@"
+---
+ interop/interop.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/interop/interop.c b/interop/interop.c
+index 662d871..a3ab39b 100644
+--- a/interop/interop.c
++++ b/interop/interop.c
+@@ -28,6 +28,7 @@
+ #include <fcntl.h>
+ #include <time.h>
+ #include <signal.h>
++#include <errno.h>
+ #include <sys/types.h>
+ 
+ #include <libnbd.h>
+@@ -44,6 +45,7 @@ main (int argc, char *argv[])
+   int port;
+   char port_str[16];
+   pid_t pid = -1;
++  int retry;
+ #endif
+   int64_t actual_size;
+   char buf[512];
+@@ -114,14 +116,19 @@ main (int argc, char *argv[])
+   }
+ 
+   /* Unfortunately there's no good way to wait for qemu-nbd to start
+-   * serving, so ...
++   * serving, so we need to retry here.
+    */
+-  sleep (5);
+-
+-  if (nbd_connect_tcp (nbd, "localhost", port_str) == -1) {
+-    fprintf (stderr, "%s\n", nbd_get_error ());
+-    goto out;
++  for (retry = 0; retry < 5; ++retry) {
++    sleep (1 << retry);
++    if (nbd_connect_tcp (nbd, "localhost", port_str) == -1) {
++      fprintf (stderr, "%s\n", nbd_get_error ());
++      if (nbd_get_errno () != ECONNREFUSED)
++        goto out;
++    }
++    else break;
+   }
++  if (retry == 5)
++    goto out;
+ 
+ #else /* !SERVE_OVER_TCP */
+ 
+-- 
+2.23.0
+

copy-patches.sh

@@ -1,55 +0,0 @@
-#!/bin/bash -
-
-set -e
-
-# Maintainer script to copy patches from the git repo to the current
-# directory.  Use it like this:
-#   ./copy-patches.sh
-
-rhel_version=8.3
-
-# Check we're in the right directory.
-if [ ! -f libnbd.spec ]; then
-    echo "$0: run this from the directory containing 'libnbd.spec'"
-    exit 1
-fi
-
-git_checkout=$HOME/d/libnbd-rhel-$rhel_version
-if [ ! -d $git_checkout ]; then
-    echo "$0: $git_checkout does not exist"
-    echo "This script is only for use by the maintainer when preparing a"
-    echo "libnbd release on RHEL."
-    exit 1
-fi
-
-# Get the base version of libnbd.
-version=`grep '^Version:' libnbd.spec | awk '{print $2}'`
-tag="v$version"
-
-# Remove any existing patches.
-git rm -f [0-9]*.patch ||:
-rm -f [0-9]*.patch
-
-# Get the patches.
-(cd $git_checkout; rm -f [0-9]*.patch; git format-patch -N $tag)
-mv $git_checkout/[0-9]*.patch .
-
-# Remove any not to be applied.
-rm -f *NOT-FOR-RPM*.patch
-
-# Add the patches.
-git add [0-9]*.patch
-
-# Print out the patch lines.
-echo
-echo "--- Copy the following text into libnbd.spec file"
-echo
-
-echo "# Patches."
-for f in [0-9]*.patch; do
-    n=`echo $f | awk -F- '{print $1}'`
-    echo "Patch$n:     $f"
-done
-
-echo
-echo "--- End of text"

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

sources

@@ -1,2 +1,2 @@
-SHA512 (libnbd-1.24.0.tar.gz) = db05b606a19b3efb6a53c05b5b7ea96571892b7540fff1f4df0c53d0f82e3817f724fd0aa665597b58a4613545b03d7df6e1ac8f3fa64c7f85e824ca2221f3ae
-SHA512 (libnbd-1.24.0.tar.gz.sig) = 718b0ebeb3f3fa487682ef93184fc1851f44d3e74695b61e64f32d5de508833dba885aaea9366a29293ad60badce3cfafb8881b61a103559185517a2202fae27
+SHA512 (libnbd-1.0.3.tar.gz) = 47980c6b323046e983ee3c717b832e7cf29ba89e7c2f001a27ecb17ed55a2259ece78d71d661ddec3af45d316a198d80f253d13a265f60ae5a28c30ef84477a1
+SHA512 (libnbd-1.0.3.tar.gz.sig) = 07637d69abea513dfb03982776292a5e8cf5bc2962a3dd6ed36f9ed32e58d52795fa4eb3ba7ca7eee916a7271dba37bb3c2ee57f04a585070e0ba986da3f5cfc

tests/basic-test.sh

@@ -1,15 +0,0 @@
-#!/bin/bash -
-set -e
-set -x
-
-# Enable libnbd debugging.
-export LIBNBD_DEBUG=1
-
-# Connect to nbdkit.
-nbdsh -c - <<EOF
-h.connect_command (["nbdkit", "-s", "--exit-with-parent",
-                    "memory", "size=1G"])
-size = h.get_size ()
-print ("size = %s" % size)
-assert size == 1073741824
-EOF

tests/tests.yml

@@ -1,12 +0,0 @@
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    required_packages:
-    - python3-libnbd
-    - nbdkit
-    tests:
-    - simple:
-        dir: .
-        run: ./basic-test.sh