diff --git a/.gitignore b/.gitignore index 4bd7ec0..1229603 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /clog /nbdkit-*.tar.gz /nbdkit-*.tar.gz.sig +/*~ diff --git a/0001-server-reset-meta-context-replies-on-starttls.patch b/0001-server-reset-meta-context-replies-on-starttls.patch new file mode 100644 index 0000000..f302c16 --- /dev/null +++ b/0001-server-reset-meta-context-replies-on-starttls.patch @@ -0,0 +1,39 @@ +From 814d8103fb4b581dc01dfd25d2cd81596576f211 Mon Sep 17 00:00:00 2001 +From: Eric Blake +Date: Mon, 16 Aug 2021 13:43:29 -0500 +Subject: [nbdkit PATCH] server: reset meta context replies on starttls + +Related to CVE-2021-3716, but not as severe. No compliant client will +send NBD_CMD_BLOCK_STATUS unless it first negotiates +NBD_OPT_SET_META_CONTEXT. If an attacker injects a premature +SET_META_CONTEXT, either the client will never notice (because it +never uses BLOCK_STATUS), or the client will overwrite the attacker's +attempt with the client's own SET_META_CONTEXT request after +encryption is enabled. So I don't class this as having the potential +to trigger denial-of-service due to any protocol mismatch between +compliant client and server (I don't care what happens with +non-compliant clients). + +Fixes: 26455d45 (server: protocol: Implement Block Status "base:allocation".) +(cherry picked from commit 6c5faac6a37077cf2366388a80862bb00616d0d8) +--- + server/protocol-handshake-newstyle.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c +index b94950e2..eb0f3961 100644 +--- a/server/protocol-handshake-newstyle.c ++++ b/server/protocol-handshake-newstyle.c +@@ -497,6 +497,9 @@ negotiate_handshake_newstyle_options (void) + debug ("using TLS on this connection"); + /* Wipe out any cached state. */ + conn->structured_replies = false; ++ free (conn->exportname_from_set_meta_context); ++ conn->exportname_from_set_meta_context = NULL; ++ conn->meta_context_base_allocation = false; + for_each_backend (b) { + struct handle *h = get_handle (conn, b->i); + free (h->default_exportname); +-- +2.31.1 + diff --git a/libguestfs.keyring b/libguestfs.keyring index bb3eb55..f0508c8 100644 Binary files a/libguestfs.keyring and b/libguestfs.keyring differ diff --git a/nbdkit.spec b/nbdkit.spec index 977a251..016c2fd 100644 --- a/nbdkit.spec +++ b/nbdkit.spec @@ -39,14 +39,14 @@ ExclusiveArch: x86_64 %global verify_tarball_signature 1 # If there are patches which touch autotools files, set this to 1. -%global patches_touch_autotools 1 +%global patches_touch_autotools %{nil} # The source directory. %global source_directory 1.24-stable Name: nbdkit -Version: 1.24.0 -Release: 2%{?dist} +Version: 1.24.6 +Release: 1%{?dist} Summary: NBD server License: BSD @@ -67,6 +67,9 @@ Source2: libguestfs.keyring # Maintainer script which helps with handling patches. Source3: copy-patches.sh +# Fix SET_META_CONTEXT leaking state across STARTTLS +Patch1: 0001-server-reset-meta-context-replies-on-starttls.patch + BuildRequires: make %if 0%{patches_touch_autotools} BuildRequires: autoconf, automake, libtool @@ -713,6 +716,8 @@ License: BSD Requires: %{name}-server%{?_isa} = %{version}-%{release} Requires: tar +Obsoletes: %{name}-tar-plugin < 1.23.9-3 + %description tar-filter This package is a tar archive filter for %{name}. @@ -1267,69 +1272,50 @@ export LIBGUESTFS_TRACE=1 %changelog -* Fri Jan 08 2021 Mamoru TASAKA - 1.24.0-2 -- F-34: rebuild against ruby 3.0 +* Fri Aug 20 2021 Eric Blake - 1.24.6-1 +- New upstream stable version 1.24.6; fixes CVE-2021-3716. -* Thu Jan 07 2021 Richard W.M. Jones - 1.24.0-1 +* Thu Aug 05 2021 Richard W.M. Jones - 1.24.5-2 +- Fix data corruption in zero and trim on unaligned tail + +* Mon Jun 07 2021 Richard W.M. Jones - 1.24.5-1 +- New upstream stable version 1.24.5. + +* Tue May 25 2021 Richard W.M. Jones - 1.24.4-1 +- New upstream stable version 1.24.4. + +* Sat Apr 03 2021 Richard W.M. Jones - 1.24.3-1 +- New upstream stable version 1.24.3. + +* Tue Mar 02 2021 Richard W.M. Jones - 1.24.2-1 +- New upstream stable version 1.24.2. + +* Wed Jan 20 2021 Richard W.M. Jones - 1.24.1-1 +- New upstream stable version 1.24.1. + +* Tue Jan 19 2021 Richard W.M. Jones - 1.24.0-3 +- Obsolete nbdkit-tar-plugin to provide smooth upgrades to F33+. + +* Thu Jan 07 2021 Richard W.M. Jones - 1.24.0-2 - New upstream version 1.24.0. -* Thu Jan 07 2021 Mamoru TASAKA - 1.23.13-2 -- F-34: rebuild against ruby 3.0 +* Thu Jan 07 2021 Richard W.M. Jones - 1.22.5-1 +- New stable version 1.22.5. -* Tue Dec 29 2020 Richard W.M. Jones - 1.23.13-1 -- New upstream development version 1.23.13. -- Add configure --with-extra. +* Tue Dec 15 2020 Richard W.M. Jones - 1.22.4-1 +- New stable version 1.22.4. -* Tue Dec 22 2020 Richard W.M. Jones - 1.23.11-1 -- New upstream development version 1.23.11. -- New nbdkit-checkwrite-filter. +* Sat Sep 26 2020 Richard W.M. Jones - 1.22.3-2 +- Rebuild for OCaml 4.11.1 in Fedora 33. -* Thu Dec 10 2020 Richard W.M. Jones - 1.23.10-2 -- Avoid boto3 dependency on RHEL. +* Tue Sep 22 2020 Richard W.M. Jones - 1.22.3-1 +- New stable version 1.22.3. -* Tue Dec 08 2020 Richard W.M. Jones - 1.23.10-1 -- New upstream development version 1.23.10. -- New nbdkit-sparse-random-plugin. +* Wed Sep 16 2020 Richard W.M. Jones - 1.22.2-1 +- New stable version 1.22.2. -* Thu Dec 03 2020 Richard W.M. Jones - 1.23.9-2 -- Move gzip and tar filters with other filters. -- Remove nbdkit-tar-plugin (replaced with nbdkit-tar-filter), except RHEL 8. -- Do not ship nbdkit-S3-plugin on RHEL. - -* Thu Nov 19 2020 Richard W.M. Jones - 1.23.9-1 -- New upstream development version 1.23.9. -- Add nbdkit-S3-plugin. - -* Mon Nov 02 2020 Richard W.M. Jones - 1.23.8-1 -- New upstream development version 1.23.8. -- Add nbdkit-exitwhen-filter. - -* Mon Oct 05 2020 Richard W.M. Jones - 1.23.7-1 -- New upstream development version 1.23.7. -- Add new NBDKit(3) man page for the OCaml plugin. - -* Tue Sep 22 2020 Richard W.M. Jones - 1.23.6-1 -- New upstream development version 1.23.6. -- New exportname filter. -- Add patch to fix tests. - -* Wed Sep 16 2020 Richard W.M. Jones - 1.23.5-1 -- New upstream development version 1.23.5. - -* Tue Sep 08 2020 Richard W.M. Jones - 1.23.4-1 -- New upstream development version 1.23.4. - -* Sat Sep 05 2020 Richard W.M. Jones - 1.23.3-1 -- New upstream development version 1.23.3. - -* Tue Sep 01 2020 Richard W.M. Jones - 1.23.2-2 -- OCaml 4.11.1 rebuild - -* Tue Sep 01 2020 Richard W.M. Jones - 1.23.2-1 -- New upstream development version 1.23.2. - -* Tue Sep 01 2020 Richard W.M. Jones - 1.22.0-2 -- Reenable sfdisk test because util-linux contains fix. +* Thu Sep 03 2020 Richard W.M. Jones - 1.22.1-1 +- New stable version 1.22.1. * Thu Aug 27 2020 Richard W.M. Jones - 1.22.0-1 - New stable version 1.22.0. diff --git a/sources b/sources index bffaaa7..d2f66a3 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (nbdkit-1.24.0.tar.gz) = cef2976163856b0c46148f9953764ed9ddf59fd2644380375ab34b7a10e981c3bebf892b63771b20a4a34f6ffb59d80f46204a38aa9fd0cd9fef82ff098b35d8 -SHA512 (nbdkit-1.24.0.tar.gz.sig) = 71888a984f3dcb73b87903a9e56bf5a6c6f8114907cb092185e0e3d44ce0406ae62e9671de87fd000f72f73fe732f23c69cdbb2eafa496884846a39fc70f90fa +SHA512 (nbdkit-1.24.6.tar.gz) = fe96ccc0bdc9b8b35e03c9dceb3f7687d34b5b5760d525a474affd5ab425806920b33e14b037b8919463fdfb444fa9de973357bc18d42ef2cb9d3d5067b9592d +SHA512 (nbdkit-1.24.6.tar.gz.sig) = 7de5b35f1c855a006bb8ffea6ef44e4f57df4522347f225eaec558574b31825687f1ea7f8c7f26dd6304eca9924dcf1029fce70b43431b45350131242f70a816