New upstream stable version 1.24.6; fixes CVE-2021-3716.

Add myself via:

  gpg --export 'Eric Blake' | \
  gpg --no-default-keyring --keyring ./libguestfs.keyring --import

.gitignore

@@ -1,3 +1,4 @@
 /clog
 /nbdkit-*.tar.gz
 /nbdkit-*.tar.gz.sig
+/*~

0001-server-reset-meta-context-replies-on-starttls.patch

@@ -0,0 +1,39 @@
+From 814d8103fb4b581dc01dfd25d2cd81596576f211 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Mon, 16 Aug 2021 13:43:29 -0500
+Subject: [nbdkit PATCH] server: reset meta context replies on starttls
+
+Related to CVE-2021-3716, but not as severe.  No compliant client will
+send NBD_CMD_BLOCK_STATUS unless it first negotiates
+NBD_OPT_SET_META_CONTEXT.  If an attacker injects a premature
+SET_META_CONTEXT, either the client will never notice (because it
+never uses BLOCK_STATUS), or the client will overwrite the attacker's
+attempt with the client's own SET_META_CONTEXT request after
+encryption is enabled.  So I don't class this as having the potential
+to trigger denial-of-service due to any protocol mismatch between
+compliant client and server (I don't care what happens with
+non-compliant clients).
+
+Fixes: 26455d45 (server: protocol: Implement Block Status "base:allocation".)
+(cherry picked from commit 6c5faac6a37077cf2366388a80862bb00616d0d8)
+---
+ server/protocol-handshake-newstyle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
+index b94950e2..eb0f3961 100644
+--- a/server/protocol-handshake-newstyle.c
++++ b/server/protocol-handshake-newstyle.c
+@@ -497,6 +497,9 @@ negotiate_handshake_newstyle_options (void)
+         debug ("using TLS on this connection");
+         /* Wipe out any cached state. */
+         conn->structured_replies = false;
++        free (conn->exportname_from_set_meta_context);
++        conn->exportname_from_set_meta_context = NULL;
++        conn->meta_context_base_allocation = false;
+         for_each_backend (b) {
+           struct handle *h = get_handle (conn, b->i);
+           free (h->default_exportname);
+-- 
+2.31.1
+

nbdkit.spec

@@ -39,14 +39,14 @@ ExclusiveArch:  x86_64
 %global verify_tarball_signature 1
 
 # If there are patches which touch autotools files, set this to 1.
-%global patches_touch_autotools 1
+%global patches_touch_autotools %{nil}
 
 # The source directory.
 %global source_directory 1.24-stable
 
 Name:           nbdkit
-Version:        1.24.0
-Release:        2%{?dist}
+Version:        1.24.6
+Release:        1%{?dist}
 Summary:        NBD server
 
 License:        BSD
@@ -67,6 +67,9 @@ Source2:        libguestfs.keyring
 # Maintainer script which helps with handling patches.
 Source3:        copy-patches.sh
 
+# Fix SET_META_CONTEXT leaking state across STARTTLS
+Patch1:         0001-server-reset-meta-context-replies-on-starttls.patch
+
 BuildRequires: make
 %if 0%{patches_touch_autotools}
 BuildRequires:  autoconf, automake, libtool
@@ -713,6 +716,8 @@ License:        BSD
 Requires:       %{name}-server%{?_isa} = %{version}-%{release}
 Requires:       tar
 
+Obsoletes:      %{name}-tar-plugin < 1.23.9-3
+
 
 %description tar-filter
 This package is a tar archive filter for %{name}.
@@ -1267,69 +1272,50 @@ export LIBGUESTFS_TRACE=1
 
 
 %changelog
-* Fri Jan 08 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.24.0-2
-- F-34: rebuild against ruby 3.0
+* Fri Aug 20 2021 Eric Blake <eblake@redhat.com> - 1.24.6-1
+- New upstream stable version 1.24.6; fixes CVE-2021-3716.
 
-* Thu Jan 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.0-1
+* Thu Aug 05 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.5-2
+- Fix data corruption in zero and trim on unaligned tail
+
+* Mon Jun 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.5-1
+- New upstream stable version 1.24.5.
+
+* Tue May 25 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.4-1
+- New upstream stable version 1.24.4.
+
+* Sat Apr 03 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.3-1
+- New upstream stable version 1.24.3.
+
+* Tue Mar 02 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.2-1
+- New upstream stable version 1.24.2.
+
+* Wed Jan 20 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.1-1
+- New upstream stable version 1.24.1.
+
+* Tue Jan 19 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.0-3
+- Obsolete nbdkit-tar-plugin to provide smooth upgrades to F33+.
+
+* Thu Jan 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.24.0-2
 - New upstream version 1.24.0.
 
-* Thu Jan 07 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1.23.13-2
-- F-34: rebuild against ruby 3.0
+* Thu Jan 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.22.5-1
+- New stable version 1.22.5.
 
-* Tue Dec 29 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.13-1
-- New upstream development version 1.23.13.
-- Add configure --with-extra.
+* Tue Dec 15 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.4-1
+- New stable version 1.22.4.
 
-* Tue Dec 22 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.11-1
-- New upstream development version 1.23.11.
-- New nbdkit-checkwrite-filter.
+* Sat Sep 26 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.3-2
+- Rebuild for OCaml 4.11.1 in Fedora 33.
 
-* Thu Dec 10 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.10-2
-- Avoid boto3 dependency on RHEL.
+* Tue Sep 22 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.3-1
+- New stable version 1.22.3.
 
-* Tue Dec 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.10-1
-- New upstream development version 1.23.10.
-- New nbdkit-sparse-random-plugin.
+* Wed Sep 16 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.2-1
+- New stable version 1.22.2.
 
-* Thu Dec 03 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.9-2
-- Move gzip and tar filters with other filters.
-- Remove nbdkit-tar-plugin (replaced with nbdkit-tar-filter), except RHEL 8.
-- Do not ship nbdkit-S3-plugin on RHEL.
-
-* Thu Nov 19 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.9-1
-- New upstream development version 1.23.9.
-- Add nbdkit-S3-plugin.
-
-* Mon Nov 02 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.8-1
-- New upstream development version 1.23.8.
-- Add nbdkit-exitwhen-filter.
-
-* Mon Oct 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.7-1
-- New upstream development version 1.23.7.
-- Add new NBDKit(3) man page for the OCaml plugin.
-
-* Tue Sep 22 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.6-1
-- New upstream development version 1.23.6.
-- New exportname filter.
-- Add patch to fix tests.
-
-* Wed Sep 16 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.5-1
-- New upstream development version 1.23.5.
-
-* Tue Sep 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.4-1
-- New upstream development version 1.23.4.
-
-* Sat Sep 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.3-1
-- New upstream development version 1.23.3.
-
-* Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.2-2
-- OCaml 4.11.1 rebuild
-
-* Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 1.23.2-1
-- New upstream development version 1.23.2.
-
-* Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.0-2
-- Reenable sfdisk test because util-linux contains fix.
+* Thu Sep 03 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.1-1
+- New stable version 1.22.1.
 
 * Thu Aug 27 2020 Richard W.M. Jones <rjones@redhat.com> - 1.22.0-1
 - New stable version 1.22.0.

sources

@@ -1,2 +1,2 @@
-SHA512 (nbdkit-1.24.0.tar.gz) = cef2976163856b0c46148f9953764ed9ddf59fd2644380375ab34b7a10e981c3bebf892b63771b20a4a34f6ffb59d80f46204a38aa9fd0cd9fef82ff098b35d8
-SHA512 (nbdkit-1.24.0.tar.gz.sig) = 71888a984f3dcb73b87903a9e56bf5a6c6f8114907cb092185e0e3d44ce0406ae62e9671de87fd000f72f73fe732f23c69cdbb2eafa496884846a39fc70f90fa
+SHA512 (nbdkit-1.24.6.tar.gz) = fe96ccc0bdc9b8b35e03c9dceb3f7687d34b5b5760d525a474affd5ab425806920b33e14b037b8919463fdfb444fa9de973357bc18d42ef2cb9d3d5067b9592d
+SHA512 (nbdkit-1.24.6.tar.gz.sig) = 7de5b35f1c855a006bb8ffea6ef44e4f57df4522347f225eaec558574b31825687f1ea7f8c7f26dd6304eca9924dcf1029fce70b43431b45350131242f70a816