New upstream stable version 1.24.6; fixes CVE-2021-3716.

Add myself via:

  gpg --export 'Eric Blake' | \
  gpg --no-default-keyring --keyring ./libguestfs.keyring --import

0001-server-reset-meta-context-replies-on-starttls.patch

@@ -0,0 +1,39 @@
+From 814d8103fb4b581dc01dfd25d2cd81596576f211 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Mon, 16 Aug 2021 13:43:29 -0500
+Subject: [nbdkit PATCH] server: reset meta context replies on starttls
+
+Related to CVE-2021-3716, but not as severe.  No compliant client will
+send NBD_CMD_BLOCK_STATUS unless it first negotiates
+NBD_OPT_SET_META_CONTEXT.  If an attacker injects a premature
+SET_META_CONTEXT, either the client will never notice (because it
+never uses BLOCK_STATUS), or the client will overwrite the attacker's
+attempt with the client's own SET_META_CONTEXT request after
+encryption is enabled.  So I don't class this as having the potential
+to trigger denial-of-service due to any protocol mismatch between
+compliant client and server (I don't care what happens with
+non-compliant clients).
+
+Fixes: 26455d45 (server: protocol: Implement Block Status "base:allocation".)
+(cherry picked from commit 6c5faac6a37077cf2366388a80862bb00616d0d8)
+---
+ server/protocol-handshake-newstyle.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
+index b94950e2..eb0f3961 100644
+--- a/server/protocol-handshake-newstyle.c
++++ b/server/protocol-handshake-newstyle.c
+@@ -497,6 +497,9 @@ negotiate_handshake_newstyle_options (void)
+         debug ("using TLS on this connection");
+         /* Wipe out any cached state. */
+         conn->structured_replies = false;
++        free (conn->exportname_from_set_meta_context);
++        conn->exportname_from_set_meta_context = NULL;
++        conn->meta_context_base_allocation = false;
+         for_each_backend (b) {
+           struct handle *h = get_handle (conn, b->i);
+           free (h->default_exportname);
+-- 
+2.31.1
+

0001-tests-test-ocaml-debug-hexdump.sh-Fix-test-that-plug.patch

@@ -1,31 +0,0 @@
-From 4076ff58512ee98928b1bdb13274466b175e1a97 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Fri, 2 Jan 2026 11:59:11 +0000
-Subject: [PATCH] tests/test-ocaml-debug-hexdump.sh: Fix test that plugin was
- built
-
-This is supposed to check that the test plugin was built and skip if
-not.  However because the 'requires' function call was missing, it
-actually failed the test if not built.
-
-Fixes: commit ec3be5030656a9126abbb0bceeb5a1ecf6898c6a
----
- tests/test-ocaml-debug-hexdump.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/test-ocaml-debug-hexdump.sh b/tests/test-ocaml-debug-hexdump.sh
-index 5cc71375..3954225e 100755
---- a/tests/test-ocaml-debug-hexdump.sh
-+++ b/tests/test-ocaml-debug-hexdump.sh
-@@ -36,7 +36,7 @@ set -x
- set -u
- 
- plugin=$abs_top_srcdir/tests/test-ocaml-debug-hexdump-plugin.$SOEXT
--test -x "$plugin"
-+requires test -x "$plugin"
- 
- requires_run
- requires_nbdsh_uri
--- 
-2.52.0
-

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-*
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

nbdkit-find-provides

@@ -1,23 +0,0 @@
-#!/bin/bash -
-
-# Generate RPM provides automatically for nbdkit packages and filters.
-# Copyright (C) 2009-2022 Red Hat Inc.
-
-# To test:
-# find /usr/lib64/nbdkit/plugins | ./nbdkit-find-provides VER REL
-# find /usr/lib64/nbdkit/filters | ./nbdkit-find-provides VER REL
-
-ver="$1"
-rel="$2"
-
-function process_file
-{
-    if [[ $1 =~ /plugins/nbdkit-.*-plugin ]] ||
-       [[ $1 =~ /filters/nbdkit-.*-filter ]]; then
-        echo "Provides:" "$(basename $1 .so)" "=" "$ver-$rel"
-    fi
-}
-
-while read line; do
-    process_file "$line"
-done

nbdkit.attr

@@ -1,3 +0,0 @@
-%__nbdkit_provides %{_rpmconfigdir}/nbdkit-find-provides %{version} %{release}
-%__nbdkit_path     %{_libdir}/nbdkit/(plugins|filters)/nbdkit-.*-(plugin|filter)(\.so)?$
-%__nbdkit_flags    exeonly

nbdkit.fc

@@ -1,3 +0,0 @@
-/usr/sbin/nbdkit	 --    gen_context(system_u:object_r:nbdkit_exec_t,s0)
-
-/usr/lib/systemd/system/nbdkit.*	gen_context(system_u:object_r:nbdkit_unit_file_t,s0)

nbdkit.if

@@ -1,207 +0,0 @@
-## <summary>policy for nbdkit</summary>
-
-########################################
-## <summary>
-##    Execute nbdkit_exec_t in the nbdkit domain.
-## </summary>
-## <param name="domain">
-## <summary>
-##    Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`nbdkit_domtrans',`
-	gen_require(`
-		type nbdkit_t, nbdkit_exec_t;
-	')
-
-	corecmd_search_bin($1)
-	domtrans_pattern($1, nbdkit_exec_t, nbdkit_t)
-')
-
-######################################
-## <summary>
-##    Execute nbdkit in the caller domain.
-## </summary>
-## <param name="domain">
-##    <summary>
-##    Domain allowed access.
-##    </summary>
-## </param>
-#
-interface(`nbdkit_exec',`
-	gen_require(`
-		type nbdkit_exec_t;
-	')
-    
-	corecmd_search_bin($1)
-	can_exec($1, nbdkit_exec_t)
-')
-
-########################################
-## <summary>
-##    Execute nbdkit in the nbdkit domain, and
-##    allow the specified role the nbdkit domain.
-## </summary>
-## <param name="domain">
-##    <summary>
-##    Domain allowed to transition
-##    </summary>
-## </param>
-## <param name="role">
-##    <summary>
-##    The role to be allowed the nbdkit domain.
-##    </summary>
-## </param>
-#
-interface(`nbdkit_run',`
-	gen_require(`
-		type nbdkit_t;
-		attribute_role nbdkit_roles;
-	')
-
-	nbdkit_domtrans($1)
-	roleattribute $2 nbdkit_roles;
-')
-
-########################################
-## <summary>
-##    Role access for nbdkit
-## </summary>
-## <param name="role">
-##    <summary>
-##    Role allowed access
-##    </summary>
-## </param>
-## <param name="domain">
-##    <summary>
-##    User domain for the role
-##    </summary>
-## </param>
-#
-interface(`nbdkit_role',`
-	gen_require(`
-		type nbdkit_t;
-		attribute_role nbdkit_roles;
-	')
-
-	roleattribute $1 nbdkit_roles;
-
-	nbdkit_domtrans($2)
-
-	ps_process_pattern($2, nbdkit_t)
-	allow $2 nbdkit_t:process { signull signal sigkill };
-')
-
-########################################
-## <summary>
-##	Allow attempts to connect to nbdkit
-##	with a unix stream socket.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain to not audit.
-##	</summary>
-## </param>
-#
-interface(`nbdkit_stream_connect',`
-	gen_require(`
-		type nbdkit_t;
-	')
-
-	allow $1 nbdkit_t:unix_stream_socket connectto;
-')
-
-########################################
-## <summary>
-##      Allow nbdkit_exec_t to be an entrypoint
-##      of the specified domain
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
-## </param>
-## <rolecap/>
-#
-interface(`nbdkit_entrypoint',`
-        gen_require(`
-                type nbdkit_exec_t;
-        ')
-        allow $1 nbdkit_exec_t:file entrypoint;
-')
-
-# ----------------------------------------------------------------------
-# RWMJ: See:
-# https://issues.redhat.com/browse/RHEL-5174?focusedId=23387259&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-23387259
-# Remove this when virt.if gets updated.
-
-########################################
-#
-# Interface compatibility blocks
-#
-# The following definitions ensure compatibility with distribution policy
-# versions that do not contain given interfaces (epel, or older Fedora
-# releases).
-# Each block tests for existence of given interface and defines it if needed.
-#
-
-########################################
-## <summary>
-##      Read and write to svirt_image dirs.
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
-## </param>
-#
-ifndef(`virt_rw_svirt_image_dirs',`
-	interface(`virt_rw_svirt_image_dirs',`
-		gen_require(`
-			type svirt_image_t;
-		')
-
-		allow $1 svirt_image_t:dir rw_dir_perms;
-	')
-')
-
-########################################
-## <summary>
-##      Create svirt_image sock_files.
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
-## </param>
-#
-ifndef(`virt_create_svirt_image_sock_files',`
-	interface(`virt_create_svirt_image_sock_files',`
-		gen_require(`
-			type svirt_image_t;
-		')
-
-		allow $1 svirt_image_t:sock_file create_sock_file_perms;
-	')
-')
-
-########################################
-## <summary>
-## 	Read and write virtlogd pipes.
-## </summary>
-## <param name="domain">
-## <summary>
-##      Domain allowed access.
-## </summary>
-## </param>
-#
-ifndef(`virtlogd_rw_pipes',`
-	interface(`virtlogd_rw_pipes',`
-	        gen_require(`
-	                type virtlogd_t;
-	        ')
-
-	        allow $1 virtlogd_t:fifo_file rw_fifo_file_perms;
-	')
-')

nbdkit.te

@@ -1,100 +0,0 @@
-policy_module(nbdkit, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-gen_require(`
-    type unconfined_t;
-')
-
-type nbdkit_t;
-type nbdkit_exec_t;
-application_domain(nbdkit_t, nbdkit_exec_t)
-mcs_constrained(nbdkit_t)
-role system_r types nbdkit_t;
-
-type nbdkit_home_t;
-userdom_user_home_content(nbdkit_home_t)
-
-type nbdkit_tmp_t;
-files_tmp_file(nbdkit_tmp_t)
-
-type nbdkit_unit_file_t;
-systemd_unit_file(nbdkit_unit_file_t)
-
-permissive nbdkit_t;
-
-########################################
-#
-# nbdkit local policy
-#
-allow nbdkit_t self:capability { setgid setuid };
-allow nbdkit_t self:fifo_file rw_fifo_file_perms;
-allow nbdkit_t self:netlink_route_socket rw_netlink_socket_perms;
-allow nbdkit_t self:process { fork setsockcreate signal_perms };
-allow nbdkit_t self:tcp_socket create_stream_socket_perms;
-allow nbdkit_t self:udp_socket create_socket_perms;
-
-manage_dirs_pattern(nbdkit_t, nbdkit_tmp_t, nbdkit_tmp_t)
-manage_files_pattern(nbdkit_t, nbdkit_tmp_t, nbdkit_tmp_t) 
-userdom_user_tmp_filetrans(nbdkit_t, nbdkit_tmp_t, { dir file })
-
-manage_dirs_pattern(nbdkit_t, nbdkit_home_t, nbdkit_home_t)
-manage_files_pattern(nbdkit_t, nbdkit_home_t, nbdkit_home_t) 
-userdom_user_home_dir_filetrans(nbdkit_t, nbdkit_home_t, { dir file })
-
-corenet_tcp_connect_http_port(nbdkit_t)
-corenet_tcp_connect_ssh_port(nbdkit_t)
-corenet_tcp_connect_tftp_port(nbdkit_t)
-corenet_tcp_bind_generic_port(nbdkit_t)
-corenet_tcp_bind_generic_node(nbdkit_t)
-
-domain_use_interactive_fds(nbdkit_t)
-
-files_read_etc_files(nbdkit_t)
-
-init_abstract_socket_activation(nbdkit_t)
-init_ioctl_stream_sockets(nbdkit_t)
-init_rw_stream_sockets(nbdkit_t)
-
-optional_policy(`
-	auth_use_nsswitch(nbdkit_t)
-')
-
-optional_policy(`
-	logging_send_syslog_msg(nbdkit_t)
-')
-
-optional_policy(`
-	miscfiles_read_localization(nbdkit_t)
-	miscfiles_read_generic_certs(nbdkit_t)
-')
-
-optional_policy(`
-	sysnet_dns_name_resolve(nbdkit_t)
-	sysnet_read_config(nbdkit_t)
-')
-
-optional_policy(`
-	userdom_read_user_home_content_files(nbdkit_t)
-	userdom_use_inherited_user_ptys(nbdkit_t)
-')
-
-optional_policy(`
-	virt_create_svirt_image_sock_files(nbdkit_t)
-	virt_read_qemu_pid_files(nbdkit_t)
-	virtlogd_rw_pipes(nbdkit_t)
-	virt_rw_svirt_image(nbdkit_t)
-	virt_rw_svirt_image_dirs(nbdkit_t)
-	virt_search_lib(nbdkit_t)
-	virt_stream_connect_svirt(nbdkit_t)
-')
-
-
-# FIXME: It would be nice to allow libvirt to transition nbdkit_exec_t to 
-# nbdkit_t when libvirtd was started manually from the commandline (i.e. in 
-# unconfined_t), but we don't want this transition to happen automatically 
-# when starting directly from the shell. I'm not sure how to achieve this...  
-#nbdkit_domtrans(unconfined_t, nbdkit_exec_t, nbdkit_t)

sources

@@ -1,2 +1,2 @@
-SHA512 (nbdkit-1.47.1.tar.gz) = 0c9d1da067bf1f7b6ba38dad33e86dff1fe893ff2e4a349dfcd6b259295fd00670e6af6c195e130d8a847520a78a730003315e60afda8eb94758e2195bd1a775
-SHA512 (nbdkit-1.47.1.tar.gz.sig) = 131d9bc191155186408ef7a577f9d2a2cc1fd1b53cbda755d19ff8de1341479a517fab79cc87f04a1bca5518046c24a8647cb4949d5c4d6fdca19ca968604c16
+SHA512 (nbdkit-1.24.6.tar.gz) = fe96ccc0bdc9b8b35e03c9dceb3f7687d34b5b5760d525a474affd5ab425806920b33e14b037b8919463fdfb444fa9de973357bc18d42ef2cb9d3d5067b9592d
+SHA512 (nbdkit-1.24.6.tar.gz.sig) = 7de5b35f1c855a006bb8ffea6ef44e4f57df4522347f225eaec558574b31825687f1ea7f8c7f26dd6304eca9924dcf1029fce70b43431b45350131242f70a816

tests/basic-test.sh

@@ -1,6 +0,0 @@
-#!/bin/bash -
-set -e
-set -x
-
-# Run nbdkit and check that nbdinfo can connect back to it.
-nbdkit -U - memory 1G --run 'nbdinfo "$uri"'

tests/tests.yml

@@ -1,12 +0,0 @@
-- hosts: localhost
-  roles:
-  - role: standard-test-basic
-    tags:
-    - classic
-    required_packages:
-    - libnbd
-    - nbdkit
-    tests:
-    - simple:
-        dir: .
-        run: ./basic-test.sh