rpms
/
libnbd
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Compare commits

merge into: rpms:i8c-stream-rhel
Branches Tags
rpms:i10cs
rpms:cs10
rpms:i9c-beta
rpms:c9-beta
rpms:i8c-stream-rhel
rpms:c8-stream-rhel
rpms:i9c
rpms:c9
rpms:i8c-beta-stream-rhel
rpms:c8-beta-stream-rhel
...
pull from: rpms:c9
Branches Tags
rpms:i10cs
rpms:cs10
rpms:i9c-beta
rpms:c9-beta
rpms:i8c-stream-rhel
rpms:c8-stream-rhel
rpms:i9c
rpms:c9
rpms:i8c-beta-stream-rhel
rpms:c8-beta-stream-rhel

No commits in common. 'i8c-stream-rhel' and 'c9' have entirely different histories.
i8c-stream ... c9

29 changed files with 1084 additions and 1978 deletions
Show Stats

2
.gitignore vendored
Unescape View File

@ -1,2 +1,2 @@
SOURCES/libguestfs.keyring
SOURCES/libnbd-1.6.0.tar.gz
SOURCES/libnbd-1.18.1.tar.gz

4
.libnbd.metadata
Unescape View File

@ -1,2 +1,2 @@
1bbc40f501a7fef9eef2a39b701a71aee2fea7c4 SOURCES/libguestfs.keyring
b14ac9349d324df71d26cf3de9fb606c56f18cb0 SOURCES/libnbd-1.6.0.tar.gz
cc1b37b9cfafa515aab3eefd345ecc59aac2ce7b SOURCES/libguestfs.keyring
4f99e6f21edffe62b394aa9c7fb68149e6d4d5e4 SOURCES/libnbd-1.18.1.tar.gz

30
SOURCES/0001-copy-copy-nbd-to-sparse-file.sh-Skip-test-unless-nbd.patch
Unescape View File

@ -1,30 +0,0 @@
From 486799e853aa9df034366303230a1785087a507a Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 8 Jan 2021 12:14:18 +0000
Subject: [PATCH] copy/copy-nbd-to-sparse-file.sh: Skip test unless nbdkit
available.
This test used nbdkit without checking it is available, which broke
the test on RHEL 8 i686.
Fixes: commit 28fe8d9d8d1ecb491070d20f22e2f34bb147f19f
(cherry picked from commit 781cb44b63a87f2d5f40590ab8c446ad2e7b6702)
---
copy/copy-nbd-to-sparse-file.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/copy/copy-nbd-to-sparse-file.sh b/copy/copy-nbd-to-sparse-file.sh
index aa2cb1b9..47ff09ae 100755
--- a/copy/copy-nbd-to-sparse-file.sh
+++ b/copy/copy-nbd-to-sparse-file.sh
@@ -24,6 +24,7 @@ set -x
requires cmp --version
requires dd --version
requires dd oflag=seek_bytes </dev/null
+requires nbdkit --version
requires test -r /dev/urandom
requires test -r /dev/zero
--
2.43.0

88
SOURCES/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch
Unescape View File

@ -0,0 +1,88 @@
From 4451e5b61ca07771ceef3e012223779e7a0c7701 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 30 Oct 2023 12:50:53 -0500
Subject: [PATCH] generator: Fix assertion in ext-mode BLOCK_STATUS,
CVE-2023-5871
Another round of fuzz testing revealed that when a server negotiates
extended headers and replies with a 64-bit flag value where the client
used the 32-bit API command, we were correctly flagging the server's
response as being an EOVERFLOW condition, but then immediately failing
in an assertion failure instead of reporting it to the application.
The following one-byte change to qemu.git at commit fd9a38fd43 allows
the creation of an intentionally malicious server:
| diff --git i/nbd/server.c w/nbd/server.c
| index 859c163d19f..32e1e771a95 100644
| --- i/nbd/server.c
| +++ w/nbd/server.c
| @@ -2178,7 +2178,7 @@ static void nbd_extent_array_convert_to_be(NBDExtentArray *ea)
|
| for (i = 0; i < ea->count; i++) {
| ea->extents[i].length = cpu_to_be64(ea->extents[i].length);
| - ea->extents[i].flags = cpu_to_be64(ea->extents[i].flags);
| + ea->extents[i].flags = ~cpu_to_be64(ea->extents[i].flags);
| }
| }
and can then be detected with the following command line:
$ nbdsh -c - <<\EOF
> def f(a,b,c,d):
> pass
>
> h.connect_systemd_socket_activation(["/path/to/bad/qemu-nbd",
> "-r", "-f", "raw", "TODO"])
> h.block_staus(h.get_size(), 0, f)
> EOF
nbdsh: generator/states-reply-chunk.c:626: enter_STATE_REPLY_CHUNK_REPLY_RECV_BS_ENTRIES: Assertion `(len | flags) <= UINT32_MAX' failed.
Aborted (core dumped)
whereas a fixed libnbd will give:
nbdsh: command line script failed: nbd_block_status: block-status: command failed: Value too large for defined data type
We can either relax the assertion (by changing to 'assert ((len |
flags) <= UINT32_MAX || cmd->error)'), or intentionally truncate flags
to make the existing assertion reliable. This patch goes with the
latter approach.
Sadly, this crash is possible in all existing 1.18.x stable releases,
if they were built with assertions enabled (most distros do this by
default), meaning a malicious server has an easy way to cause a Denial
of Service attack by triggering the assertion failure in vulnerable
clients, so we have assigned this CVE-2023-5871. Mitigating factors:
the crash only happens for a server that sends a 64-bit status block
reply (no known production servers do so; qemu 8.2 will be the first
known server to support extended headers, but it is not yet released);
and as usual, a client can use TLS to guarantee it is connecting only
to a known-safe server. If libnbd is compiled without assertions,
there is no crash or other mistaken behavior; and when assertions are
enabled, the attacker cannot accomplish anything more than a denial of
service.
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Fixes: 20dadb0e10 ("generator: Prepare for extent64 callback", v1.17.4)
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit 177308adb17e81fce7c0f2b2fcf655c5c0b6a4d6)
Signed-off-by: Eric Blake <eblake@redhat.com>
---
generator/states-reply-chunk.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/generator/states-reply-chunk.c b/generator/states-reply-chunk.c
index 5a31c192..8ab7e8ba 100644
--- a/generator/states-reply-chunk.c
+++ b/generator/states-reply-chunk.c
@@ -600,6 +600,7 @@ STATE_MACHINE {
break; /* Skip this and later extents; we already made progress */
/* Expose this extent as an error; we made no progress */
cmd->error = cmd->error ? : EOVERFLOW;
+ flags = (uint32_t)flags;
}
}
--
2.43.0

32
SOURCES/0002-docs-Fix-incorrect-xref-in-libnbd-release-notes-for-.patch
Unescape View File

@ -0,0 +1,32 @@
From c39e31b7a20c7dc8aa12c5fa3f1742824e1e0c76 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 9 Nov 2023 09:40:30 +0000
Subject: [PATCH] docs: Fix incorrect xref in libnbd-release-notes for 1.18
LIBNBD_STRICT_AUTO_FLAG was added to nbd_set_strict_mode(3).
Reported-by: Vera Wu
(cherry picked from commit 4fef3dbc07e631fce58487d25d991e83bbb424b1)
Signed-off-by: Eric Blake <eblake@redhat.com>
---
docs/libnbd-release-notes-1.18.pod | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/docs/libnbd-release-notes-1.18.pod b/docs/libnbd-release-notes-1.18.pod
index 935fab11..836ebe19 100644
--- a/docs/libnbd-release-notes-1.18.pod
+++ b/docs/libnbd-release-notes-1.18.pod
@@ -84,8 +84,8 @@ Golang, OCaml and Python language bindings (Eric Blake).
L<nbd_shutdown(3)> now works correctly when in opt mode (Eric Blake).
-L<nbd_set_string(3)> adds C<LIBNBD_STRICT_AUTO_FLAG> which allows the
-client to test how servers behave when the payload length flag is
+L<nbd_set_strict_mode(3)> adds C<LIBNBD_STRICT_AUTO_FLAG> which allows
+the client to test how servers behave when the payload length flag is
adjusted (Eric Blake).
=head2 Protocol
--
2.43.0

57
SOURCES/0002-generator-Refactor-CONNECT.START-state.patch
Unescape View File

@ -1,57 +0,0 @@
From 5dc2d2261224c9533d2b5ec4df6ed822de4cfc3b Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 4 Feb 2021 17:57:06 +0000
Subject: [PATCH] generator: Refactor CONNECT.START state.
Small, neutral refactoring to the CONNECT.START to make the subsequent
commit easier.
(cherry picked from commit cd231fd94bbfaacdd9b89e7d355ba2bbc83c2aeb)
---
generator/states-connect.c | 21 ++++++++++-----------
1 file changed, 10 insertions(+), 11 deletions(-)
diff --git a/generator/states-connect.c b/generator/states-connect.c
index 392879d4..03b34c7d 100644
--- a/generator/states-connect.c
+++ b/generator/states-connect.c
@@ -47,11 +47,12 @@ disable_nagle (int sock)
STATE_MACHINE {
CONNECT.START:
- int fd;
+ sa_family_t family;
+ int fd, r;
assert (!h->sock);
- fd = socket (h->connaddr.ss_family,
- SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
+ family = h->connaddr.ss_family;
+ fd = socket (family, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
if (fd == -1) {
SET_NEXT_STATE (%.DEAD);
set_error (errno, "socket");
@@ -65,14 +66,12 @@ STATE_MACHINE {
disable_nagle (fd);
- if (connect (fd, (struct sockaddr *) &h->connaddr,
- h->connaddrlen) == -1) {
- if (errno != EINPROGRESS) {
- SET_NEXT_STATE (%.DEAD);
- set_error (errno, "connect");
- return 0;
- }
- }
+ r = connect (fd, (struct sockaddr *) &h->connaddr, h->connaddrlen);
+ if (r == 0 || (r == -1 && errno == EINPROGRESS))
+ return 0;
+ assert (r == -1);
+ SET_NEXT_STATE (%.DEAD);
+ set_error (errno, "connect");
return 0;
CONNECT.CONNECTING:
--
2.43.0

48
SOURCES/0003-generator-Print-a-better-error-message-if-connect-2-.patch
Unescape View File

@ -1,48 +0,0 @@
From f094472efcf34cea8bf1f02a1c5c9442ffc4ca53 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 4 Feb 2021 18:02:46 +0000
Subject: [PATCH] generator: Print a better error message if connect(2) returns
EAGAIN.
The new error message is:
nbd_connect_unix: connect: server backlog overflowed, see https://bugzilla.redhat.com/1925045: Resource temporarily unavailable
Fixes: https://bugzilla.redhat.com/1925045
Thanks: Xin Long, Lukas Doktor, Eric Blake
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
(cherry picked from commit 85ed74960a658a82d7b61b0be07f43d1b2dcede9)
---
generator/states-connect.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/generator/states-connect.c b/generator/states-connect.c
index 03b34c7d..98c26e54 100644
--- a/generator/states-connect.c
+++ b/generator/states-connect.c
@@ -70,6 +70,22 @@ STATE_MACHINE {
if (r == 0 || (r == -1 && errno == EINPROGRESS))
return 0;
assert (r == -1);
+#ifdef __linux__
+ if (errno == EAGAIN && family == AF_UNIX) {
+ /* This can happen on Linux when connecting to a Unix domain
+ * socket, if the server's backlog is full. Unfortunately there
+ * is nothing good we can do on the client side when this happens
+ * since any solution would involve sleeping or busy-waiting. The
+ * only solution is on the server side, increasing the backlog.
+ * But at least improve the error message.
+ * https://bugzilla.redhat.com/1925045
+ */
+ SET_NEXT_STATE (%.DEAD);
+ set_error (errno, "connect: server backlog overflowed, "
+ "see https://bugzilla.redhat.com/1925045");
+ return 0;
+ }
+#endif
SET_NEXT_STATE (%.DEAD);
set_error (errno, "connect");
return 0;
--
2.43.0

205
SOURCES/0003-tests-Check-behavior-of-nbd_set_strict_mode-STRICT_A.patch
Unescape View File

@ -0,0 +1,205 @@
From 32cb9ab9f1701b1a1a826b48f2083cb75adf1e87 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 9 Nov 2023 20:11:08 -0600
Subject: [PATCH] tests: Check behavior of
nbd_set_strict_mode(STRICT_AUTO_FLAG)
While developing extended header support for qemu 8.2, I needed a way
to make libnbd quickly behave as a non-compliant client to test corner
cases in qemu's server code; so I wrote commit 5c1dae9236 ("api: Add
LIBNBD_STRICT_AUTO_FLAG to nbd_set_strict", v1.18.0) to meet my needs.
However, I failed to codify my manual tests of that bit into a unit
test for libnbd, until now. Most sane clients will never call
nbd_set_strict_mode() in the first place (after all, it is explicitly
documented as an integration tool, which is how I used it with my qemu
code development), but it never hurts to make sure we don't break it
even for the relatively small set of users that would ever use it.
The test added here runs in two parts; if you get a SKIP despite
having qemu-nbd, then the first part ran successfully before the
second half gave up due to lack of extended headers in qemu
(presumably qemu 8.1 or older); if you get a PASS, then both parts
were run. However, both parts are inherently fragile, depending on
behavior known to be in qemu 8.2 - while it is unlikely to change in
future qemu releases (at least as long as I continue to maintain NBD
code there), the fact that we are intentionally violating the NBD
protocol means a different server is within its rights to behave
differently than qemu 8.2 did. Hence this test lives in interop/
rather than tests/ because of its strong ties to a particular qemu.
Signed-off-by: Eric Blake <eblake@redhat.com>
(cherry picked from commit 54d4426394c372413f55f648d4ad1d21b3395e07)
Signed-off-by: Eric Blake <eblake@redhat.com>
---
interop/Makefile.am | 2 +
interop/strict-mode-auto-flag.sh | 138 +++++++++++++++++++++++++++++++
2 files changed, 140 insertions(+)
create mode 100755 interop/strict-mode-auto-flag.sh
diff --git a/interop/Makefile.am b/interop/Makefile.am
index d6485adf..ac12d84a 100644
--- a/interop/Makefile.am
+++ b/interop/Makefile.am
@@ -28,6 +28,7 @@ EXTRA_DIST = \
structured-read.sh \
opt-extended-headers.sh \
block-status-payload.sh \
+ strict-mode-auto-flag.sh \
$(NULL)
TESTS_ENVIRONMENT = \
@@ -153,6 +154,7 @@ TESTS += \
interop-qemu-block-size.sh \
opt-extended-headers.sh \
block-status-payload.sh \
+ strict-mode-auto-flag.sh \
$(NULL)
interop_qemu_nbd_SOURCES = \
diff --git a/interop/strict-mode-auto-flag.sh b/interop/strict-mode-auto-flag.sh
new file mode 100755
index 00000000..8f73ea73
--- /dev/null
+++ b/interop/strict-mode-auto-flag.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# nbd client library in userspace
+# Copyright Red Hat
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+# Test effect of AUTO_FLAG bit in set_strict_mode()
+
+source ../tests/functions.sh
+set -e
+set -x
+
+requires truncate --version
+requires qemu-nbd --version
+requires nbdsh --version
+
+file="strict-mode-auto-flag.file"
+rm -f $file
+cleanup_fn rm -f $file
+
+truncate -s 1M $file
+
+# Unconditional part of test: behavior when extended headers are not in use
+$VG nbdsh -c '
+import errno
+
+h.set_request_extended_headers(False)
+args = ["qemu-nbd", "-f", "raw", "'"$file"'"]
+h.connect_systemd_socket_activation(args)
+assert h.get_extended_headers_negotiated() is False
+
+# STRICT_AUTO_FLAG and STRICT_COMMANDS are on by default
+flags = h.get_strict_mode()
+assert flags & nbd.STRICT_AUTO_FLAG
+assert flags & nbd.STRICT_COMMANDS
+
+# Under STRICT_AUTO_FLAG, using or omitting flag does not matter; client
+# side auto-corrects the flag before passing to server
+h.pwrite(b"1"*512, 0, 0)
+h.pwrite(b"2"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+
+# Without STRICT_AUTO_FLAG but still STRICT_COMMANDS, client side now sees
+# attempts to use the flag as invalid
+flags = flags & ~nbd.STRICT_AUTO_FLAG
+h.set_strict_mode(flags)
+h.pwrite(b"3"*512, 0, 0)
+stats = h.stats_bytes_sent()
+try:
+ h.pwrite(b"4"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+ assert False
+except nbd.Error as e:
+ assert e.errnum == errno.EINVAL
+assert stats == h.stats_bytes_sent()
+
+# Warning: fragile test ahead. Without STRICT_COMMANDS, we send unexpected
+# flag to qemu, and expect failure. For qemu <= 8.1, this is safe (those
+# versions did not know the flag, and correctly reject unknown flags with
+# NBD_EINVAL). For qemu 8.2, this also works (qemu knows the flag, but warns
+# that we were not supposed to send it without extended headers). But if
+# future qemu versions change to start silently ignoring the flag (after all,
+# a write command obviously has a payload even without extended headers, so
+# the flag is redundant for NBD_CMD_WRITE), then we may need to tweak this.
+flags = flags & ~nbd.STRICT_COMMANDS
+h.set_strict_mode(flags)
+h.pwrite(b"5"*512, 0, 0)
+stats = h.stats_bytes_sent()
+try:
+ h.pwrite(b"6"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+ print("Did newer qemu change behavior?")
+ assert False
+except nbd.Error as e:
+ assert e.errnum == errno.EINVAL
+assert stats < h.stats_bytes_sent()
+
+h.shutdown()
+'
+
+# Conditional part of test: only run if qemu supports extended headers
+requires nbdinfo --has extended-headers -- [ qemu-nbd -r -f raw "$file" ]
+$VG nbdsh -c '
+import errno
+
+args = ["qemu-nbd", "-f", "raw", "'"$file"'"]
+h.connect_systemd_socket_activation(args)
+assert h.get_extended_headers_negotiated() is True
+
+# STRICT_AUTO_FLAG and STRICT_COMMANDS are on by default
+flags = h.get_strict_mode()
+assert flags & nbd.STRICT_AUTO_FLAG
+assert flags & nbd.STRICT_COMMANDS
+
+# Under STRICT_AUTO_FLAG, using or omitting flag does not matter; client
+# side auto-corrects the flag before passing to server
+h.pwrite(b"1"*512, 0, 0)
+h.pwrite(b"2"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+
+# Without STRICT_AUTO_FLAG but still STRICT_COMMANDS, client side now sees
+# attempts to omit the flag as invalid
+flags = flags & ~nbd.STRICT_AUTO_FLAG
+h.set_strict_mode(flags)
+h.pwrite(b"3"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+stats = h.stats_bytes_sent()
+try:
+ h.pwrite(b"4"*512, 0, 0)
+ assert False
+except nbd.Error as e:
+ assert e.errnum == errno.EINVAL
+assert stats == h.stats_bytes_sent()
+
+# Warning: fragile test ahead. Without STRICT_COMMANDS, omitting the flag
+# is a protocol violation. qemu 8.2 silently ignores the violation; but a
+# future qemu might start failing the command, at which point we would need
+# to tweak this part of the test.
+flags = flags & ~nbd.STRICT_COMMANDS
+h.set_strict_mode(flags)
+h.pwrite(b"5"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
+stats = h.stats_bytes_sent()
+try:
+ h.pwrite(b"6"*512, 0, 0)
+except nbd.Error:
+ print("Did newer qemu change behavior?")
+ assert False
+assert stats < h.stats_bytes_sent()
+
+h.shutdown()
+'
--
2.43.0

47
SOURCES/0008-build-Move-to-minimum-gnutls-3.5.18.patch → SOURCES/0004-build-Move-to-minimum-gnutls-3.5.18.patch
Unescape View File

@ -1,4 +1,4 @@
From cd4f3bed33d5ffdba6846d270c0e11713bc1caf6 Mon Sep 17 00:00:00 2001
From 596626369b90016f6852610c217da22668158521 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Tue, 25 Jun 2024 10:55:54 +0100
Subject: [PATCH] build: Move to minimum gnutls >= 3.5.18
@ -24,23 +24,23 @@ On RHEL 7 the configure-time test now prints:
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 5ff09cdbbd19226dd2d5015d76134f88dee9321e)
(cherry picked from commit cb6df4f81a97d5d58385d89b0135039f1eddee15)
(cherry picked from commit 177fd0847723640829eff8d1ab102f8d28a7328e)
---
configure.ac | 12 +++---------
lib/crypto.c | 5 +----
2 files changed, 4 insertions(+), 13 deletions(-)
configure.ac | 5 ++---
lib/crypto.c | 6 ------
2 files changed, 2 insertions(+), 9 deletions(-)
diff --git a/configure.ac b/configure.ac
index da3dc38a..29e3b47a 100644
index 91fe004b..c0d6a472 100644
--- a/configure.ac
+++ b/configure.ac
@@ -94,12 +94,13 @@ AC_ARG_WITH([gnutls],
@@ -178,13 +178,13 @@ AC_ARG_WITH([gnutls],
[],
[with_gnutls=check])
AS_IF([test "$with_gnutls" != "no"],[
- PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.3.0], [
+ PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.5.18], [
+ printf "gnutls version is "; $PKG_CONFIG --modversion gnutls
printf "gnutls version is "; $PKG_CONFIG --modversion gnutls
AC_SUBST([GNUTLS_CFLAGS])
AC_SUBST([GNUTLS_LIBS])
AC_DEFINE([HAVE_GNUTLS],[1],[gnutls found at compile time.])
@ -50,33 +50,30 @@ index da3dc38a..29e3b47a 100644
])
])
AM_CONDITIONAL([HAVE_GNUTLS], [test "x$GNUTLS_LIBS" != "x"])
@@ -114,13 +115,6 @@ AS_IF([test "$GNUTLS_LIBS" != ""],[
AC_MSG_RESULT([$tls_priority])
AC_DEFINE_UNQUOTED([TLS_PRIORITY],["$tls_priority"],
[Default TLS session priority string])
-
- # Check for APIs which may not be present.
- old_LIBS="$LIBS"
- LIBS="$GNUTLS_LIBS $LIBS"
- AC_CHECK_FUNCS([\
- gnutls_session_set_verify_cert])
- LIBS="$old_LIBS"
@@ -210,7 +210,6 @@ AS_IF([test "$GNUTLS_LIBS" != ""],[
old_LIBS="$LIBS"
LIBS="$GNUTLS_LIBS $LIBS"
AC_CHECK_FUNCS([\
- gnutls_session_set_verify_cert \
gnutls_transport_is_ktls_enabled \
])
dnl certtool (part of GnuTLS) for testing TLS with certificates.
LIBS="$old_LIBS"
diff --git a/lib/crypto.c b/lib/crypto.c
index a9b3789c..705e114a 100644
index 22a1cfa5..d131f1d0 100644
--- a/lib/crypto.c
+++ b/lib/crypto.c
@@ -28,6 +28,7 @@
@@ -28,10 +28,8 @@
#ifdef HAVE_GNUTLS
#include <gnutls/gnutls.h>
+#include <gnutls/socket.h>
-#ifdef HAVE_GNUTLS_SOCKET_H
#include <gnutls/socket.h>
#endif
-#endif
#include "internal.h"
@@ -512,12 +513,8 @@ set_up_certificate_credentials (struct nbd_handle *h,
#include "nbdkit-string.h"
@@ -532,12 +530,8 @@ set_up_certificate_credentials (struct nbd_handle *h,
return NULL;
found_certificates:

59
SOURCES/0004-opt_go-Tolerate-unplanned-server-death.patch
Unescape View File

@ -1,59 +0,0 @@
From ffe8f0a994c1f2656aa011353b386663d32db69e Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 1 Mar 2021 15:25:31 -0600
Subject: [PATCH] opt_go: Tolerate unplanned server death
While debugging some experimental nbdkit code that was triggering an
assertion failure in nbdkit, I noticed a secondary failure of nbdsh
also dying from an assertion:
libnbd: debug: nbdsh: nbd_opt_go: transition: NEWSTYLE.OPT_GO.SEND -> DEAD
libnbd: debug: nbdsh: nbd_opt_go: option queued, ignoring state machine failure
nbdsh: opt.c:86: nbd_unlocked_opt_go: Assertion `nbd_internal_is_state_negotiating (get_next_state (h))' failed.
Although my trigger was from non-production nbdkit code, libnbd should
never die from an assertion failure merely because a server
disappeared at the wrong moment during an incomplete reply to
NBD_OPT_GO or NBD_OPT_INFO. If this is assigned a CVE, a followup
patch will add mention of it in docs/libnbd-security.pod.
Fixes: bbf1c51392 (api: Give aio_opt_go a completion callback)
(cherry picked from commit fb4440de9cc76e9c14bd3ddf3333e78621f40ad0)
---
lib/opt.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/lib/opt.c b/lib/opt.c
index 2317b72a..e5802f4d 100644
--- a/lib/opt.c
+++ b/lib/opt.c
@@ -1,5 +1,5 @@
/* NBD client library in userspace
- * Copyright (C) 2020 Red Hat Inc.
+ * Copyright (C) 2020-2021 Red Hat Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -83,7 +83,8 @@ nbd_unlocked_opt_go (struct nbd_handle *h)
r = wait_for_option (h);
if (r == 0 && err) {
- assert (nbd_internal_is_state_negotiating (get_next_state (h)));
+ assert (nbd_internal_is_state_negotiating (get_next_state (h)) ||
+ nbd_internal_is_state_dead (get_next_state (h)));
set_error (err, "server replied with error to opt_go request");
return -1;
}
@@ -105,7 +106,8 @@ nbd_unlocked_opt_info (struct nbd_handle *h)
r = wait_for_option (h);
if (r == 0 && err) {
- assert (nbd_internal_is_state_negotiating (get_next_state (h)));
+ assert (nbd_internal_is_state_negotiating (get_next_state (h)) ||
+ nbd_internal_is_state_dead (get_next_state (h)));
set_error (err, "server replied with error to opt_info request");
return -1;
}
--
2.43.0

10
SOURCES/0013-lib-crypto.c-Check-server-certificate-even-when-usin.patch → SOURCES/0005-lib-crypto.c-Check-server-certificate-even-when-usin.patch
Unescape View File

@ -1,4 +1,4 @@
From dab43717f183cf96fcda6a0be22c39801dcfda83 Mon Sep 17 00:00:00 2001
From d8ec4c8ecc5244ed192f58bc3a976c4b2f9cc6d7 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 24 Jun 2024 10:48:12 +0100
Subject: [PATCH] lib/crypto.c: Check server certificate even when using system
@ -23,16 +23,16 @@ nbdinfo: nbd_connect_uri: gnutls_handshake: Error in the certificate verificatio
Reported-by: Jon Szymaniak <jon.szymaniak@gmail.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 87ef41b69929d5d293390ec36b1c10aba2c9a57a)
(cherry picked from commit 81bd57bb8ab0b142207efb9f69a233418fbb4f8f)
(cherry picked from commit 7a6739aeca8250515a449bacd23d09bf40587dec)
---
lib/crypto.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lib/crypto.c b/lib/crypto.c
index 705e114a..4c398b03 100644
index d131f1d0..c542ce6b 100644
--- a/lib/crypto.c
+++ b/lib/crypto.c
@@ -513,9 +513,6 @@ set_up_certificate_credentials (struct nbd_handle *h,
@@ -530,9 +530,6 @@ set_up_certificate_credentials (struct nbd_handle *h,
return NULL;
found_certificates:
@ -42,7 +42,7 @@ index 705e114a..4c398b03 100644
err = gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, ret);
if (err < 0) {
set_error (0, "gnutls_credentials_set: %s", gnutls_strerror (err));
@@ -625,6 +622,9 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
@@ -647,6 +644,9 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
gnutls_deinit (session);
return NULL;
}

40
SOURCES/0005-security-Document-assignment-of-CVE-2021-20286.patch
Unescape View File

@ -1,40 +0,0 @@
From 171ffdde8be590f784086a021a7e6f36c4ecdb4b Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Fri, 12 Mar 2021 17:00:58 -0600
Subject: [PATCH] security: Document assignment of CVE-2021-20286
Now that we finally have a CVE number, it's time to document
the problem (it's low severity, but still a denial of service).
Fixes: fb4440de9cc7 (opt_go: Tolerate unplanned server death)
(cherry picked from commit 40308a005eaa6b2e8f98da8952d0c0cacc51efde)
---
docs/libnbd-security.pod | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
index d8ead875..0cae8462 100644
--- a/docs/libnbd-security.pod
+++ b/docs/libnbd-security.pod
@@ -22,6 +22,12 @@ L<https://www.redhat.com/archives/libguestfs/2019-September/msg00128.html>
See the full announcement here:
L<https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html>
+=head2 CVE-2021-20286
+denial of service when using L<nbd_set_opt_mode(3)>
+
+See the full announcement here:
+L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
+
=head1 SEE ALSO
L<libnbd(3)>.
@@ -34,4 +40,4 @@ Richard W.M. Jones
=head1 COPYRIGHT
-Copyright (C) 2019 Red Hat Inc.
+Copyright (C) 2019-2021 Red Hat Inc.
--
2.43.0

163
SOURCES/0006-copy-Pass-in-dummy-variable-rather-than-errno-to-cal.patch
Unescape View File

@ -1,163 +0,0 @@
From 22572f8ac13e2e8daf91d227eac2f384303fb5b4 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 3 Feb 2022 14:25:57 -0600
Subject: [PATCH] copy: Pass in dummy variable rather than &errno to callback
In several places where asynch handlers manually call the provided
nbd_completion_callback, the value of errno is indeterminate (for
example, in file-ops.c:file_asynch_read(), the previous call to
file_synch_read() already triggered exit() on error, but does not
guarantee what is left in errno on success). As the callback should
be paying attention to the value of *error (to be fixed in the next
patch), we are better off ensuring that we pass in a pointer to a
known-zero value. Besides, passing in &errno carries a risk that if
the callback uses any other library function that alters errno prior
to dereferncing *error, it will no longer see the value we passed in.
Thus, it is easier to use a dummy variable on the stack than to mess
around with errno and it's magic macro expansion into a thread-local
storage location.
Note that several callsites then check if the callback returned -1,
and if so assume that the callback has caused errno to now have a sane
value to pass on to perror. In theory, the fact that we are no longer
passing in &errno means that if the callback assigns into *error but
did not otherwise affect errno (a tenuous assumption, given our
argument above that we could not even guarantee that the callback does
not accidentally alter errno prior to reading *error), our perror call
would no longer reflect the intended error value from the callback.
But in practice, since the callback never actually returned -1, nor
even assigned into *error, the call to perror is dead code; although I
have chosen to defer that additional cleanup to the next patch.
Message-Id: <20220203202558.203013-5-eblake@redhat.com>
Acked-by: Richard W.M. Jones <rjones@redhat.com>
Acked-by: Nir Soffer <nsoffer@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 794c8ce06e995ebd282e8f2b9465a06140572112)
Conflicts:
copy/file-ops.c - no backport of d5f65e56 ("copy: Do not use trim
for zeroing"), so asynch_trim needed same treatment
copy/multi-thread-copying.c - context due to missing refactoring
copy/null-ops.c - no backport of 0b16205e "copy: Implement "null:"
destination."
(cherry picked from commit 26e3dcf80815fe2db320d3046aabc2580c2f7a0d)
---
copy/file-ops.c | 22 +++++++++++++---------
copy/multi-thread-copying.c | 8 +++++---
2 files changed, 18 insertions(+), 12 deletions(-)
diff --git a/copy/file-ops.c b/copy/file-ops.c
index 086348a2..cc312b48 100644
--- a/copy/file-ops.c
+++ b/copy/file-ops.c
@@ -1,5 +1,5 @@
/* NBD client library in userspace.
- * Copyright (C) 2020 Red Hat Inc.
+ * Copyright (C) 2020-2022 Red Hat Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -158,10 +158,11 @@ file_asynch_read (struct rw *rw,
struct command *command,
nbd_completion_callback cb)
{
+ int dummy = 0;
+
file_synch_read (rw, slice_ptr (command->slice),
command->slice.len, command->offset);
- errno = 0;
- if (cb.callback (cb.user_data, &errno) == -1) {
+ if (cb.callback (cb.user_data, &dummy) == -1) {
perror (rw->name);
exit (EXIT_FAILURE);
}
@@ -172,10 +173,11 @@ file_asynch_write (struct rw *rw,
struct command *command,
nbd_completion_callback cb)
{
+ int dummy = 0;
+
file_synch_write (rw, slice_ptr (command->slice),
command->slice.len, command->offset);
- errno = 0;
- if (cb.callback (cb.user_data, &errno) == -1) {
+ if (cb.callback (cb.user_data, &dummy) == -1) {
perror (rw->name);
exit (EXIT_FAILURE);
}
@@ -185,10 +187,11 @@ static bool
file_asynch_trim (struct rw *rw, struct command *command,
nbd_completion_callback cb)
{
+ int dummy = 0;
+
if (!file_synch_trim (rw, command->offset, command->slice.len))
return false;
- errno = 0;
- if (cb.callback (cb.user_data, &errno) == -1) {
+ if (cb.callback (cb.user_data, &dummy) == -1) {
perror (rw->name);
exit (EXIT_FAILURE);
}
@@ -199,10 +202,11 @@ static bool
file_asynch_zero (struct rw *rw, struct command *command,
nbd_completion_callback cb)
{
+ int dummy = 0;
+
if (!file_synch_zero (rw, command->offset, command->slice.len))
return false;
- errno = 0;
- if (cb.callback (cb.user_data, &errno) == -1) {
+ if (cb.callback (cb.user_data, &dummy) == -1) {
perror (rw->name);
exit (EXIT_FAILURE);
}
diff --git a/copy/multi-thread-copying.c b/copy/multi-thread-copying.c
index a7aaa7de..2593ff76 100644
--- a/copy/multi-thread-copying.c
+++ b/copy/multi-thread-copying.c
@@ -1,5 +1,5 @@
/* NBD client library in userspace.
- * Copyright (C) 2020 Red Hat Inc.
+ * Copyright (C) 2020-2022 Red Hat Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -391,6 +391,7 @@ finished_read (void *vp, int *error)
bool last_is_hole = false;
uint64_t i;
struct command *newcommand;
+ int dummy = 0;
/* Iterate over whole blocks in the command, starting on a block
* boundary.
@@ -473,7 +474,7 @@ finished_read (void *vp, int *error)
/* Free the original command since it has been split into
* subcommands and the original is no longer needed.
*/
- free_command (command, &errno);
+ free_command (command, &dummy);
}
return 1; /* auto-retires the command */
@@ -498,6 +499,7 @@ static void
fill_dst_range_with_zeroes (struct command *command)
{
char *data;
+ int dummy = 0;
if (destination_is_zero)
goto free_and_return;
@@ -541,7 +543,7 @@ fill_dst_range_with_zeroes (struct command *command)
free (data);
free_and_return:
- free_command (command, &errno);
+ free_command (command, &dummy);
}
static int
--
2.43.0

8
SOURCES/0014-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch → SOURCES/0006-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch
Unescape View File

@ -1,4 +1,4 @@
From 17dc75c8235af7126b3820d5e0be3488efe74671 Mon Sep 17 00:00:00 2001
From af09b72a486fd870ab72170a0cba4b1d6d37894f Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 24 Jun 2024 10:31:10 +0100
Subject: [PATCH] lib/crypto.c: Allow CA verification even if h->hostname is
@ -53,16 +53,16 @@ which is signed by the CA from the nbdkit/tests/pki directory)
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 6ed47a27d14f6f11946bb096d94e5bf21d97083d)
(cherry picked from commit 42ee6d8dd919b241b1f1510f5759673b26fc9731)
(cherry picked from commit 3a427e6d7a83f89299ab6fdaeeffbd9074610ecc)
---
lib/crypto.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/crypto.c b/lib/crypto.c
index 4c398b03..a5177bbb 100644
index c542ce6b..437e24ec 100644
--- a/lib/crypto.c
+++ b/lib/crypto.c
@@ -623,7 +623,7 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
@@ -645,7 +645,7 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
return NULL;
}

318
SOURCES/0007-copy-CVE-2022-0485-Fail-nbdcopy-if-NBD-read-or-write.patch
Unescape View File

@ -1,318 +0,0 @@
From 1b0b732e6a9b4979fccf6a09eb6704264edf675d Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Thu, 3 Feb 2022 14:25:58 -0600
Subject: [PATCH] copy: CVE-2022-0485: Fail nbdcopy if NBD read or write fails
nbdcopy has a nasty bug when performing multi-threaded copies using
asynchronous nbd calls - it was blindly treating the completion of an
asynchronous command as successful, rather than checking the *error
parameter. This can result in the silent creation of a corrupted
image in two different ways: when a read fails, we blindly wrote
garbage to the destination; when a write fails, we did not flag that
the destination was not written.
Since nbdcopy already calls exit() on a synchronous read or write
failure to a file, doing the same for an asynchronous op to an NBD
server is the simplest solution. A nicer solution, but more invasive
to code and thus not done here, might be to allow up to N retries of
the transaction (in case the read or write failure was transient), or
even having a mode where as much data is copied as possible (portions
of the copy that failed would be logged on stderr, and nbdcopy would
still fail with a non-zero exit status, but this would copy more than
just stopping at the first error, as can be done with rsync or
ddrescue).
Note that since we rely on auto-retiring and do NOT call
nbd_aio_command_completed, our completion callbacks must always return
1 (if they do not exit() first), even when acting on *error, so as not
leave the command allocated until nbd_close. As such, there is no
sane way to return an error to a manual caller of the callback, and
therefore we can drop dead code that calls perror() and exit() if the
callback "failed". It is also worth documenting the contract on when
we must manually call the callback during the asynch_zero callback, so
that we do not leak or double-free the command; thankfully, all the
existing code paths were correct.
The added testsuite script demonstrates several scenarios, some of
which fail without the rest of this patch in place, and others which
showcase ways in which sparse images can bypass errors.
Once backports are complete, a followup patch on the main branch will
edit docs/libnbd-security.pod with the mailing list announcement of
the stable branch commit ids and release versions that incorporate
this fix.
Reported-by: Nir Soffer <nsoffer@redhat.com>
Fixes: bc896eec4d ("copy: Implement multi-conn, multiple threads, multiple requests in flight.", v1.5.6)
Fixes: https://bugzilla.redhat.com/2046194
Message-Id: <20220203202558.203013-6-eblake@redhat.com>
Acked-by: Richard W.M. Jones <rjones@redhat.com>
Acked-by: Nir Soffer <nsoffer@redhat.com>
[eblake: fix error message per Nir, tweak requires lines in unit test per Rich]
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 8d444b41d09a700c7ee6f9182a649f3f2d325abb)
Conflicts:
copy/nbdcopy.h - copyright context
copy/null-ops.c - no backport of 0b16205e "copy: Implement "null:"
destination."
copy/copy-nbd-error.sh - no backport of d5f65e56 ("copy: Do not use
trim for zeroing"), so one test needed an additional error-trim-rate;
no backport of 4ff9e62d (copy: Add --request-size option") and friends, so
this version uses larger transactions, so change error rate of 0.5 to 1;
no backport of 0b16205e "copy: Implement "null:" destination.", so use
nbdkit null instead
Note that while the use of NBD_CMD_TRIM can create data corruption, it is
not as severe as what this patch fixes, since trim corruption will only
expose what had previously been on the disk, compared to this patch fixing
a potential leak of nbdcopy heap contents into the destination.
(cherry picked from commit 6c8f2f859926b82094fb5e85c446ea099700fa10)
---
TODO | 1 +
copy/Makefile.am | 4 +-
copy/copy-nbd-error.sh | 81 +++++++++++++++++++++++++++++++++++++
copy/file-ops.c | 17 +++-----
copy/multi-thread-copying.c | 13 ++++++
copy/nbdcopy.h | 7 ++--
6 files changed, 107 insertions(+), 16 deletions(-)
create mode 100755 copy/copy-nbd-error.sh
diff --git a/TODO b/TODO
index 510c219a..19c21d44 100644
--- a/TODO
+++ b/TODO
@@ -35,6 +35,7 @@ nbdcopy:
- Better page cache usage, see nbdkit-file-plugin options
fadvise=sequential cache=none.
- Consider io_uring if there are performance bottlenecks.
+ - Configurable retries in response to read or write failures.
nbdfuse:
- If you write beyond the end of the virtual file, it returns EIO.
diff --git a/copy/Makefile.am b/copy/Makefile.am
index d318388f..3406cd85 100644
--- a/copy/Makefile.am
+++ b/copy/Makefile.am
@@ -1,5 +1,5 @@
# nbd client library in userspace
-# Copyright (C) 2020 Red Hat Inc.
+# Copyright (C) 2020-2022 Red Hat Inc.
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
@@ -30,6 +30,7 @@ EXTRA_DIST = \
copy-nbd-to-small-nbd-error.sh \
copy-nbd-to-sparse-file.sh \
copy-nbd-to-stdout.sh \
+ copy-nbd-error.sh \
copy-progress-bar.sh \
copy-sparse.sh \
copy-sparse-allocated.sh \
@@ -105,6 +106,7 @@ TESTS += \
copy-nbd-to-sparse-file.sh \
copy-stdin-to-nbd.sh \
copy-nbd-to-stdout.sh \
+ copy-nbd-error.sh \
copy-progress-bar.sh \
copy-sparse.sh \
copy-sparse-allocated.sh \
diff --git a/copy/copy-nbd-error.sh b/copy/copy-nbd-error.sh
new file mode 100755
index 00000000..bba71db5
--- /dev/null
+++ b/copy/copy-nbd-error.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# nbd client library in userspace
+# Copyright (C) 2022 Red Hat Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+# Tests several scenarios of handling NBD server errors
+# Serves as a regression test for the CVE-2022-0485 fix.
+
+. ../tests/functions.sh
+
+set -e
+set -x
+
+requires nbdkit --exit-with-parent --version
+requires nbdkit --filter=noextents null --version
+requires nbdkit --filter=error pattern --version
+requires nbdkit --filter=nozero memory --version
+
+fail=0
+
+# Failure to get block status should not be fatal, but merely downgrade to
+# reading the entire image as if data
+echo "Testing extents failures on source"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error pattern 5M \
+ error-extents-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] || fail=1
+
+# Failure to read should be fatal
+echo "Testing read failures on non-sparse source"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error pattern 5M \
+ error-pread-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] && fail=1
+
+# However, reliable block status on a sparse image can avoid the need to read
+echo "Testing read failures on sparse source"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error null 5M \
+ error-pread-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] || fail=1
+
+# Failure to write data should be fatal
+echo "Testing write data failures on arbitrary destination"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v pattern 5M ] \
+ [ nbdkit --exit-with-parent -v --filter=error --filter=noextents \
+ memory 5M error-pwrite-rate=1 ] && fail=1
+
+# However, writing zeroes can bypass the need for normal writes
+echo "Testing write data failures from sparse source"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
+ [ nbdkit --exit-with-parent -v --filter=error --filter=noextents \
+ memory 5M error-pwrite-rate=1 ] || fail=1
+
+# Failure to write zeroes should be fatal
+echo "Testing write zero failures on arbitrary destination"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
+ [ nbdkit --exit-with-parent -v --filter=error memory 5M \
+ error-trim-rate=1 error-zero-rate=1 ] && fail=1
+
+# However, assuming/learning destination is zero can skip need to write
+echo "Testing write failures on pre-zeroed destination"
+$VG nbdcopy --destination-is-zero -- \
+ [ nbdkit --exit-with-parent -v null 5M ] \
+ [ nbdkit --exit-with-parent -v --filter=error memory 5M \
+ error-pwrite-rate=1 error-zero-rate=1 ] || fail=1
+
+# Likewise, when write zero is not advertised, fallback to normal write works
+echo "Testing write zeroes to destination without zero support"
+$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
+ [ nbdkit --exit-with-parent -v --filter=nozero --filter=error memory 5M \
+ error-zero-rate=1 ] || fail=1
+
+exit $fail
diff --git a/copy/file-ops.c b/copy/file-ops.c
index cc312b48..b19af04c 100644
--- a/copy/file-ops.c
+++ b/copy/file-ops.c
@@ -162,10 +162,8 @@ file_asynch_read (struct rw *rw,
file_synch_read (rw, slice_ptr (command->slice),
command->slice.len, command->offset);
- if (cb.callback (cb.user_data, &dummy) == -1) {
- perror (rw->name);
- exit (EXIT_FAILURE);
- }
+ /* file_synch_read called exit() on error */
+ cb.callback (cb.user_data, &dummy);
}
static void
@@ -177,10 +175,8 @@ file_asynch_write (struct rw *rw,
file_synch_write (rw, slice_ptr (command->slice),
command->slice.len, command->offset);
- if (cb.callback (cb.user_data, &dummy) == -1) {
- perror (rw->name);
- exit (EXIT_FAILURE);
- }
+ /* file_synch_write called exit() on error */
+ cb.callback (cb.user_data, &dummy);
}
static bool
@@ -206,10 +202,7 @@ file_asynch_zero (struct rw *rw, struct command *command,
if (!file_synch_zero (rw, command->offset, command->slice.len))
return false;
- if (cb.callback (cb.user_data, &dummy) == -1) {
- perror (rw->name);
- exit (EXIT_FAILURE);
- }
+ cb.callback (cb.user_data, &dummy);
return true;
}
diff --git a/copy/multi-thread-copying.c b/copy/multi-thread-copying.c
index 2593ff76..28749ae7 100644
--- a/copy/multi-thread-copying.c
+++ b/copy/multi-thread-copying.c
@@ -28,6 +28,7 @@
#include <errno.h>
#include <assert.h>
#include <sys/stat.h>
+#include <inttypes.h>
#include <pthread.h>
@@ -374,6 +375,12 @@ finished_read (void *vp, int *error)
{
struct command *command = vp;
+ if (*error) {
+ fprintf (stderr, "read at offset %" PRId64 " failed: %s\n",
+ command->offset, strerror (*error));
+ exit (EXIT_FAILURE);
+ }
+
if (allocated || sparse_size == 0) {
/* If sparseness detection (see below) is turned off then we write
* the whole command.
@@ -552,6 +559,12 @@ free_command (void *vp, int *error)
struct command *command = vp;
struct buffer *buffer = command->slice.buffer;
+ if (*error) {
+ fprintf (stderr, "write at offset %" PRId64 " failed: %s\n",
+ command->offset, strerror (*error));
+ exit (EXIT_FAILURE);
+ }
+
if (buffer != NULL) {
if (--buffer->refs == 0) {
free (buffer->data);
diff --git a/copy/nbdcopy.h b/copy/nbdcopy.h
index 3dcc6dfe..9626a52c 100644
--- a/copy/nbdcopy.h
+++ b/copy/nbdcopy.h
@@ -1,5 +1,5 @@
/* NBD client library in userspace.
- * Copyright (C) 2020 Red Hat Inc.
+ * Copyright (C) 2020-2022 Red Hat Inc.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
@@ -134,7 +134,8 @@ struct rw_ops {
bool (*synch_zero) (struct rw *rw, uint64_t offset, uint64_t count);
/* Asynchronous I/O operations. These start the operation and call
- * 'cb' on completion.
+ * 'cb' on completion. 'cb' will return 1, for auto-retiring with
+ * asynchronous libnbd calls.
*
* The file_ops versions are actually implemented synchronously, but
* still call 'cb'.
@@ -156,7 +157,7 @@ struct rw_ops {
nbd_completion_callback cb);
/* Asynchronously zero. command->slice.buffer is not used. If not possible,
- * returns false.
+ * returns false. 'cb' must be called only if returning true.
*/
bool (*asynch_zero) (struct rw *rw, struct command *command,
nbd_completion_callback cb);
--
2.43.0

145
SOURCES/0007-interop-Pass-DCERTS-and-DPSK-as-strings.patch
Unescape View File

@ -0,0 +1,145 @@
From 764fc45a258c08177d01b6b6b6a0e431ee29089a Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 24 Jun 2024 11:49:07 +0100
Subject: [PATCH] interop: Pass -DCERTS and -DPSK as strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Rather than implicitly defining the certificates dir or PSK file in
interop.c, pass the actual paths from the Makefile.
This also allows -DCERTS=NULL which is interpreted as not calling
nbd_set_tls_certificates at all. This makes the test added in a
subsequent commit possible.
No real change here, just refactoring the tests.
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 69ab18442994c68f749e2b84b91d41031ebbb088)
(cherry picked from commit 33d7f3aa8e3cf8c826a534107529e1d409c0c004)
---
interop/Makefile.am | 18 +++++++++---------
interop/interop.c | 11 ++++++-----
2 files changed, 15 insertions(+), 14 deletions(-)
diff --git a/interop/Makefile.am b/interop/Makefile.am
index ac12d84a..4cdc55e9 100644
--- a/interop/Makefile.am
+++ b/interop/Makefile.am
@@ -100,7 +100,7 @@ interop_nbd_server_tls_CPPFLAGS = \
-DSERVER=\"$(NBD_SERVER)\" \
-DSERVER_PARAMS='"-d", "-C", "nbd-server-tls.conf", "0", TMPFILE' \
-DEXPORT_NAME='""' \
- -DCERTS=1 \
+ -DCERTS='"../tests/pki"' \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
interop_nbd_server_tls_LDADD = \
@@ -186,7 +186,7 @@ interop_qemu_nbd_tls_certs_CPPFLAGS = \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"--object", "tls-creds-x509,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests/pki", "--tls-creds", "tls0", "-f", "raw", "-x", "/", TMPFILE' \
-DEXPORT_NAME='"/"' \
- -DCERTS=1 \
+ -DCERTS='"../tests/pki"' \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
interop_qemu_nbd_tls_certs_LDADD = \
@@ -208,7 +208,7 @@ interop_qemu_nbd_tls_psk_CPPFLAGS = \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"--object", "tls-creds-psk,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests", "--tls-creds", "tls0", "-f", "raw", "-x", "/", TMPFILE' \
-DEXPORT_NAME='"/"' \
- -DPSK=1 \
+ -DPSK='"../tests/keys.psk"' \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
interop_qemu_nbd_tls_psk_LDADD = \
@@ -323,7 +323,7 @@ interop_nbdkit_tls_certs_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DCERTS=1 \
+ -DCERTS='"../tests/pki"' \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
interop_nbdkit_tls_certs_LDADD = \
@@ -342,7 +342,7 @@ interop_nbdkit_tls_certs_allow_enabled_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DCERTS=1 \
+ -DCERTS='"../tests/pki"' \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
$(NULL)
interop_nbdkit_tls_certs_allow_enabled_LDADD = \
@@ -361,7 +361,7 @@ interop_nbdkit_tls_certs_allow_fallback_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DCERTS=1 \
+ -DCERTS='"../tests/pki"' \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
-DTLS_FALLBACK=1 \
$(NULL)
@@ -381,7 +381,7 @@ interop_nbdkit_tls_psk_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DPSK=1 \
+ -DPSK='"../tests/keys.psk"' \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
interop_nbdkit_tls_psk_LDADD = \
@@ -400,7 +400,7 @@ interop_nbdkit_tls_psk_allow_enabled_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DPSK=1 \
+ -DPSK='"../tests/keys.psk"' \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
$(NULL)
interop_nbdkit_tls_psk_allow_enabled_LDADD = \
@@ -419,7 +419,7 @@ interop_nbdkit_tls_psk_allow_fallback_CPPFLAGS = \
-DNEEDS_TMPFILE=1 \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", TMPFILE' \
- -DPSK=1 \
+ -DPSK='"../tests/keys.psk"' \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
-DTLS_FALLBACK=1 \
$(NULL)
diff --git a/interop/interop.c b/interop/interop.c
index 20e101d4..d4d6671e 100644
--- a/interop/interop.c
+++ b/interop/interop.c
@@ -41,7 +41,7 @@
#define SIZE (1024*1024)
-#if CERTS || PSK
+#if defined(CERTS) || defined(PSK)
#define TLS 1
#ifndef TLS_MODE
#error "TLS_MODE must be defined when using CERTS || PSK"
@@ -149,13 +149,14 @@ main (int argc, char *argv[])
}
#endif
-#if CERTS
- if (nbd_set_tls_certificates (nbd, "../tests/pki") == -1) {
+#if defined(CERTS)
+ const char *certs = CERTS;
+ if (certs && nbd_set_tls_certificates (nbd, certs) == -1) {
fprintf (stderr, "%s\n", nbd_get_error ());
exit (EXIT_FAILURE);
}
-#elif PSK
- if (nbd_set_tls_psk_file (nbd, "../tests/keys.psk") == -1) {
+#elif defined(PSK)
+ if (nbd_set_tls_psk_file (nbd, PSK) == -1) {
fprintf (stderr, "%s\n", nbd_get_error ());
exit (EXIT_FAILURE);
}
--
2.43.0

53
SOURCES/0008-interop-Add-DEXPECT_FAIL-1-where-we-expect-the-test-.patch
Unescape View File

@ -0,0 +1,53 @@
From fcb7d28e4dd2ab438c6070e7e5b1aae54cc75f28 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 24 Jun 2024 13:54:48 +0100
Subject: [PATCH] interop: Add -DEXPECT_FAIL=1 where we expect the test to fail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit c7a8df4f78f2c1901f5c532f262dadd6cce84750)
(cherry picked from commit 175ee89f4a64c52cdb1412a2a72fc8c52fecaf93)
---
interop/interop.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/interop/interop.c b/interop/interop.c
index d4d6671e..469327ee 100644
--- a/interop/interop.c
+++ b/interop/interop.c
@@ -78,6 +78,7 @@ main (int argc, char *argv[])
int64_t actual_size;
char buf[512];
size_t i;
+ int r;
/* Check requirements or skip the test. */
#ifdef REQUIRES
@@ -174,10 +175,21 @@ main (int argc, char *argv[])
#else
#define NBD_CONNECT nbd_connect_command
#endif
- if (NBD_CONNECT (nbd, args) == -1) {
+ r = NBD_CONNECT (nbd, args);
+#if EXPECT_FAIL
+ if (r != -1) {
+ fprintf (stderr, "%s: expected connection to fail but it did not\n",
+ argv[0]);
+ exit (EXIT_FAILURE);
+ }
+ exit (EXIT_SUCCESS);
+ /*NOTREACHED*/
+#else
+ if (r == -1) {
fprintf (stderr, "%s\n", nbd_get_error ());
exit (EXIT_FAILURE);
}
+#endif
#if TLS
if (TLS_MODE == LIBNBD_TLS_REQUIRE) {
--
2.43.0

84
SOURCES/0009-interop-Test-interop-with-a-bad-system-CA.patch
Unescape View File

@ -0,0 +1,84 @@
From c20ac23a9a3673cca863974ec53f9129392fd447 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 24 Jun 2024 11:39:01 +0100
Subject: [PATCH] interop: Test interop with a bad system CA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This is expected to fail now.
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 1c7db8f3337632f0395dac9b13cf03b100cf1a4a)
(cherry picked from commit cb3519eeefa788b8fef466bf9394eefa9d6a6c18)
---
.gitignore | 1 +
interop/Makefile.am | 26 ++++++++++++++++++++++++++
2 files changed, 27 insertions(+)
diff --git a/.gitignore b/.gitignore
index 0b1cf764..597043e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -113,6 +113,7 @@ Makefile.in
/interop/interop-nbdkit-tls-certs
/interop/interop-nbdkit-tls-certs-allow-enabled
/interop/interop-nbdkit-tls-certs-allow-fallback
+/interop/interop-nbdkit-tls-certs-bad-CA
/interop/interop-nbdkit-tls-psk
/interop/interop-nbdkit-tls-psk-allow-enabled
/interop/interop-nbdkit-tls-psk-allow-fallback
diff --git a/interop/Makefile.am b/interop/Makefile.am
index 4cdc55e9..bc974b99 100644
--- a/interop/Makefile.am
+++ b/interop/Makefile.am
@@ -281,6 +281,7 @@ check_PROGRAMS += \
interop-nbdkit-tls-certs \
interop-nbdkit-tls-certs-allow-enabled \
interop-nbdkit-tls-certs-allow-fallback \
+ interop-nbdkit-tls-certs-bad-CA \
interop-nbdkit-tls-psk \
interop-nbdkit-tls-psk-allow-enabled \
interop-nbdkit-tls-psk-allow-fallback \
@@ -292,6 +293,7 @@ TESTS += \
interop-nbdkit-tls-certs \
interop-nbdkit-tls-certs-allow-enabled \
interop-nbdkit-tls-certs-allow-fallback \
+ interop-nbdkit-tls-certs-bad-CA \
interop-nbdkit-tls-psk \
interop-nbdkit-tls-psk-allow-enabled \
interop-nbdkit-tls-psk-allow-fallback \
@@ -370,6 +372,30 @@ interop_nbdkit_tls_certs_allow_fallback_LDADD = \
$(GNUTLS_LIBS) \
$(NULL)
+# In this test, nbdkit offers a server certificate signed by our CA in
+# the tests/pki directory, but we deliberately tell libnbd to test
+# against the system CA (-DCERTS=NULL). This is expected to fail the
+# connection with the error:
+# libnbd: debug: nbd1: nbd_connect_command: handle dead: nbd_connect_command: gnutls_handshake: Error in the certificate verification. (15/1)
+interop_nbdkit_tls_certs_bad_CA_SOURCES = \
+ interop.c \
+ requires.c \
+ ../tests/requires.h \
+ $(NULL)
+interop_nbdkit_tls_certs_bad_CA_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+ -DREQUIRES=' requires ("test -d ../tests/pki"); ' \
+ -DSERVER=\"$(NBDKIT)\" \
+ -DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "null"' \
+ -DCERTS=NULL \
+ -DTLS_MODE=LIBNBD_TLS_REQUIRE \
+ -DEXPECT_FAIL=1 \
+ $(NULL)
+interop_nbdkit_tls_certs_bad_CA_LDADD = \
+ $(top_builddir)/lib/libnbd.la \
+ $(GNUTLS_LIBS) \
+ $(NULL)
+
interop_nbdkit_tls_psk_SOURCES = \
interop.c \
requires.c \
--
2.43.0

727
SOURCES/0009-tests-Factor-out-some-common-Makefile-flags.patch
Unescape View File

@ -1,727 +0,0 @@
From a852cec30a6540b5c1ea2947195454eef6269944 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 27 Aug 2021 15:12:12 +0100
Subject: [PATCH] tests: Factor out some common Makefile flags
We can use AM_CPPFLAGS, AM_CFLAGS etc to factor out some common flags
in the tests. Note the rules here are complicated, see:
https://www.gnu.org/software/automake/manual/html_node/Flag-Variables-Ordering.html
and for unclear reasons there is no AM_LDADD nor any workaround:
https://stackoverflow.com/questions/29252969/automake-am-ldadd-workaround
This commit is mostly pure refactoring but it also tries to make the
flags usage more consistent across tests so it may have side-effects
like enabling more warnings.
(cherry picked from commit 5fd648f821e9ab3ee08bf360348d1fb01537a267)
(cherry picked from commit 6cb1f74b09beca1ddaef794136f221bfb7bb4faa)
---
interop/Makefile.am | 57 ++++++-------
tests/Makefile.am | 190 ++++++++++++++++++--------------------------
2 files changed, 104 insertions(+), 143 deletions(-)
diff --git a/interop/Makefile.am b/interop/Makefile.am
index 9787c26e..9432ad43 100644
--- a/interop/Makefile.am
+++ b/interop/Makefile.am
@@ -28,6 +28,16 @@ LOG_COMPILER = $(top_builddir)/run
check_PROGRAMS =
TESTS =
+# Common flags.
+# Note there is no such thing as "AM_LDADD".
+AM_CPPFLAGS = \
+ -I$(top_srcdir)/include \
+ -I$(top_srcdir)/tests \
+ $(NULL)
+AM_CFLAGS = \
+ $(WARNINGS_CFLAGS) \
+ $(NULL)
+
if HAVE_NBD_SERVER
check_PROGRAMS += \
@@ -41,22 +51,20 @@ TESTS += \
interop_nbd_server_SOURCES = interop.c
interop_nbd_server_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBD_SERVER)\" \
-DSERVER_PARAMS='"-d", "-C", "/dev/null", "0", tmpfile' \
-DEXPORT_NAME='""'
-interop_nbd_server_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbd_server_LDADD = $(top_builddir)/lib/libnbd.la
list_exports_nbd_server_SOURCES = list-exports.c
list_exports_nbd_server_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBD_SERVER)\" \
-DSERVER_PARAMS='"-C", "$(srcdir)/list-exports-nbd-config", "-d", "0"' \
-DEXPORTS='"disk1", "disk2"' \
-DDESCRIPTIONS='"", ""' \
$(NULL)
-list_exports_nbd_server_CFLAGS = $(WARNINGS_CFLAGS)
list_exports_nbd_server_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_NBD_SERVER
@@ -104,19 +112,18 @@ endif
interop_qemu_nbd_SOURCES = interop.c
interop_qemu_nbd_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSOCKET_ACTIVATION=1 \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"-f", "raw", "-x", "/", tmpfile' \
-DEXPORT_NAME='"/"' \
$(NULL)
-interop_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
interop_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
# qemu-nbd requires absolute path to dir
interop_qemu_nbd_tls_certs_SOURCES = interop.c
interop_qemu_nbd_tls_certs_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSOCKET_ACTIVATION=1 \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"--object", "tls-creds-x509,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests/pki", "--tls-creds", "tls0", "-f", "raw", "-x", "/", tmpfile' \
@@ -124,13 +131,12 @@ interop_qemu_nbd_tls_certs_CPPFLAGS = \
-DCERTS=1 \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
-interop_qemu_nbd_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
interop_qemu_nbd_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
# qemu-nbd requires absolute path to dir
interop_qemu_nbd_tls_psk_SOURCES = interop.c
interop_qemu_nbd_tls_psk_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSOCKET_ACTIVATION=1 \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"--object", "tls-creds-psk,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests", "--tls-creds", "tls0", "-f", "raw", "-x", "/", tmpfile' \
@@ -138,7 +144,6 @@ interop_qemu_nbd_tls_psk_CPPFLAGS = \
-DPSK=1 \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
-interop_qemu_nbd_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
interop_qemu_nbd_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
dirty_bitmap_SOURCES = dirty-bitmap.c
@@ -148,28 +153,24 @@ dirty_bitmap_LDADD = $(top_builddir)/lib/libnbd.la
list_exports_qemu_nbd_SOURCES = list-exports.c
list_exports_qemu_nbd_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSOCKET_ACTIVATION=1 \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"-f", "raw", "-x", "testing", "-D", "data", tmpfile' \
-DEXPORTS='"testing"' \
-DDESCRIPTIONS='"data"' \
$(NULL)
-list_exports_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
list_exports_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
socket_activation_qemu_nbd_SOURCES = socket-activation.c
socket_activation_qemu_nbd_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(QEMU_NBD)\" \
-DSERVER_PARAMS='"-f", "raw", "-x", "", tmpfile' \
$(NULL)
-socket_activation_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
socket_activation_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
structured_read_SOURCES = structured-read.c
-structured_read_CPPFLAGS = -I$(top_srcdir)/include
-structured_read_CFLAGS = $(WARNINGS_CFLAGS)
structured_read_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_QEMU_NBD
@@ -215,88 +216,80 @@ endif
interop_nbdkit_SOURCES = interop.c
interop_nbdkit_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"-s", "--exit-with-parent", "file", tmpfile' \
$(NULL)
-interop_nbdkit_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_certs_SOURCES = interop.c
interop_nbdkit_tls_certs_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", tmpfile' \
-DCERTS=1 \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
-interop_nbdkit_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_certs_allow_enabled_SOURCES = interop.c
interop_nbdkit_tls_certs_allow_enabled_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", tmpfile' \
-DCERTS=1 \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
$(NULL)
-interop_nbdkit_tls_certs_allow_enabled_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_certs_allow_enabled_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_certs_allow_fallback_SOURCES = interop.c
interop_nbdkit_tls_certs_allow_fallback_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", tmpfile' \
-DCERTS=1 \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
-DTLS_FALLBACK=1 \
$(NULL)
-interop_nbdkit_tls_certs_allow_fallback_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_certs_allow_fallback_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_psk_SOURCES = interop.c
interop_nbdkit_tls_psk_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", tmpfile' \
-DPSK=1 \
-DTLS_MODE=LIBNBD_TLS_REQUIRE \
$(NULL)
-interop_nbdkit_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_psk_allow_enabled_SOURCES = interop.c
interop_nbdkit_tls_psk_allow_enabled_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", tmpfile' \
-DPSK=1 \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
$(NULL)
-interop_nbdkit_tls_psk_allow_enabled_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_psk_allow_enabled_LDADD = $(top_builddir)/lib/libnbd.la
interop_nbdkit_tls_psk_allow_fallback_SOURCES = interop.c
interop_nbdkit_tls_psk_allow_fallback_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", tmpfile' \
-DPSK=1 \
-DTLS_MODE=LIBNBD_TLS_ALLOW \
-DTLS_FALLBACK=1 \
$(NULL)
-interop_nbdkit_tls_psk_allow_fallback_CFLAGS = $(WARNINGS_CFLAGS)
interop_nbdkit_tls_psk_allow_fallback_LDADD = $(top_builddir)/lib/libnbd.la
socket_activation_nbdkit_SOURCES = socket-activation.c
socket_activation_nbdkit_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER=\"$(NBDKIT)\" \
-DSERVER_PARAMS='"file", tmpfile' \
$(NULL)
-socket_activation_nbdkit_CFLAGS = $(WARNINGS_CFLAGS)
socket_activation_nbdkit_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_NBDKIT
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 64320cad..436e1c10 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -52,6 +52,18 @@ TESTS_ENVIRONMENT = srcdir=$(srcdir) LIBNBD_DEBUG=1
# Use the ./run script so we're always using the local library and tools.
LOG_COMPILER = $(top_builddir)/run
+# Common flags.
+# Note there is no such thing as "AM_LDADD".
+AM_CPPFLAGS = \
+ -I$(top_srcdir)/include \
+ $(NULL)
+AM_CFLAGS = \
+ $(WARNINGS_CFLAGS) \
+ $(NULL)
+AM_CXXFLAGS = \
+ $(WARNINGS_CFLAGS) \
+ $(NULL)
+
#----------------------------------------------------------------------
# The following tests do not need an NBD server.
@@ -81,45 +93,30 @@ TESTS += \
.PHONY: compile
compile_header_only_SOURCES = compile-header-only.c
-compile_header_only_CPPFLAGS = -I$(top_srcdir)/include
-compile_header_only_CFLAGS = $(WARNINGS_CFLAGS)
compile_header_only_LDADD = $(top_builddir)/lib/libnbd.la
compile_c_SOURCES = compile.c
-compile_c_CPPFLAGS = -I$(top_srcdir)/include
-compile_c_CFLAGS = $(WARNINGS_CFLAGS)
compile_c_LDADD = $(top_builddir)/lib/libnbd.la
compile_ansi_c_SOURCES = compile-ansi-c.c
compile_ansi_c_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-std=c90 -pedantic
-compile_ansi_c_CFLAGS = $(WARNINGS_CFLAGS)
compile_ansi_c_LDADD = $(top_builddir)/lib/libnbd.la
close_null_SOURCES = close-null.c
-close_null_CPPFLAGS = -I$(top_srcdir)/include
-close_null_CFLAGS = $(WARNINGS_CFLAGS)
close_null_LDADD = $(top_builddir)/lib/libnbd.la
debug_SOURCES = debug.c
-debug_CPPFLAGS = -I$(top_srcdir)/include
-debug_CFLAGS = $(WARNINGS_CFLAGS)
debug_LDADD = $(top_builddir)/lib/libnbd.la
debug_environment_SOURCES = debug-environment.c
-debug_environment_CPPFLAGS = -I$(top_srcdir)/include
-debug_environment_CFLAGS = $(WARNINGS_CFLAGS)
debug_environment_LDADD = $(top_builddir)/lib/libnbd.la
version_SOURCES = version.c
-version_CPPFLAGS = -I$(top_srcdir)/include
-version_CFLAGS = $(WARNINGS_CFLAGS)
version_LDADD = $(top_builddir)/lib/libnbd.la
export_name_SOURCES = export-name.c
-export_name_CPPFLAGS = -I$(top_srcdir)/include
-export_name_CFLAGS = $(WARNINGS_CFLAGS)
export_name_LDADD = $(top_builddir)/lib/libnbd.la
if HAVE_CXX
@@ -128,8 +125,6 @@ check_PROGRAMS += compile-cxx
TESTS += compile-cxx
compile_cxx_SOURCES = compile-cxx.cpp
-compile_cxx_CPPFLAGS = -I$(top_srcdir)/include
-compile_cxx_CXXFLAGS = $(WARNINGS_CFLAGS)
compile_cxx_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_CXX
@@ -220,243 +215,208 @@ TESTS += \
$(NULL)
errors_SOURCES = errors.c
-errors_CPPFLAGS = -I$(top_srcdir)/include
-errors_CFLAGS = $(WARNINGS_CFLAGS)
errors_LDADD = $(top_builddir)/lib/libnbd.la
server_death_SOURCES = server-death.c
-server_death_CPPFLAGS = -I$(top_srcdir)/include
-server_death_CFLAGS = $(WARNINGS_CFLAGS)
server_death_LDADD = $(top_builddir)/lib/libnbd.la
shutdown_flags_SOURCES = shutdown-flags.c
-shutdown_flags_CPPFLAGS = -I$(top_srcdir)/include
-shutdown_flags_CFLAGS = $(WARNINGS_CFLAGS)
shutdown_flags_LDADD = $(top_builddir)/lib/libnbd.la
get_size_SOURCES = get-size.c
-get_size_CPPFLAGS = -I$(top_srcdir)/include
-get_size_CFLAGS = $(WARNINGS_CFLAGS)
get_size_LDADD = $(top_builddir)/lib/libnbd.la
read_only_flag_SOURCES = read-only-flag.c
-read_only_flag_CPPFLAGS = -I$(top_srcdir)/include
-read_only_flag_CFLAGS = $(WARNINGS_CFLAGS)
read_only_flag_LDADD = $(top_builddir)/lib/libnbd.la
read_write_flag_SOURCES = read-write-flag.c
-read_write_flag_CPPFLAGS = -I$(top_srcdir)/include
-read_write_flag_CFLAGS = $(WARNINGS_CFLAGS)
read_write_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_flush_flag_SOURCES = eflags.c
can_flush_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_flush \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_flush \
$(NULL)
-can_flush_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_flush_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_flush_flag_SOURCES = eflags.c
can_not_flush_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_flush -Dvalue=false \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_flush -Dvalue=false \
$(NULL)
-can_not_flush_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_flush_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_fua_flag_SOURCES = eflags.c
can_fua_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_fua -Dvalue=native \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_fua -Dvalue=native \
$(NULL)
-can_fua_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_fua_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_fua_flag_SOURCES = eflags.c
can_not_fua_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_fua -Dvalue=none \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_fua -Dvalue=none \
$(NULL)
-can_not_fua_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_fua_flag_LDADD = $(top_builddir)/lib/libnbd.la
is_rotational_flag_SOURCES = eflags.c
is_rotational_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=is_rotational \
+ $(AM_CPPFLAGS) \
+ -Dflag=is_rotational \
$(NULL)
-is_rotational_flag_CFLAGS = $(WARNINGS_CFLAGS)
is_rotational_flag_LDADD = $(top_builddir)/lib/libnbd.la
is_not_rotational_flag_SOURCES = eflags.c
is_not_rotational_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=is_rotational -Dvalue=false \
+ $(AM_CPPFLAGS) \
+ -Dflag=is_rotational -Dvalue=false \
$(NULL)
-is_not_rotational_flag_CFLAGS = $(WARNINGS_CFLAGS)
is_not_rotational_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_trim_flag_SOURCES = eflags.c
can_trim_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_trim \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_trim \
$(NULL)
-can_trim_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_trim_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_trim_flag_SOURCES = eflags.c
can_not_trim_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_trim -Dvalue=false \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_trim -Dvalue=false \
$(NULL)
-can_not_trim_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_trim_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_zero_flag_SOURCES = eflags.c
can_zero_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_zero \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_zero \
$(NULL)
-can_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_zero_flag_SOURCES = eflags.c
can_not_zero_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_zero -Dvalue=false \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_zero -Dvalue=false \
-Dfilter='"--filter=nozero"' \
$(NULL)
-can_not_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_fast_zero_flag_SOURCES = eflags.c
can_fast_zero_flag_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/include -Dflag=can_fast_zero \
-Drequire='"has_can_fast_zero=1"' \
$(NULL)
-can_fast_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_fast_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_fast_zero_flag_SOURCES = eflags.c
can_not_fast_zero_flag_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/include -Dflag=can_fast_zero -Dvalue=false \
-Drequire='"has_can_fast_zero=1"' \
$(NULL)
-can_not_fast_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_fast_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_df_flag_SOURCES = eflags.c
can_df_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_df \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_df \
$(NULL)
-can_df_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_df_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_df_flag_SOURCES = eflags.c
can_not_df_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_df -Dvalue=false -Dno_sr \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_df -Dvalue=false -Dno_sr \
$(NULL)
-can_not_df_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_df_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_multi_conn_flag_SOURCES = eflags.c
can_multi_conn_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_multi_conn \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_multi_conn \
$(NULL)
-can_multi_conn_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_multi_conn_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_multi_conn_flag_SOURCES = eflags.c
can_not_multi_conn_flag_CPPFLAGS = \
- -I$(top_srcdir)/include -Dflag=can_multi_conn -Dvalue=false \
+ $(AM_CPPFLAGS) \
+ -Dflag=can_multi_conn -Dvalue=false \
$(NULL)
-can_not_multi_conn_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_multi_conn_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_cache_flag_SOURCES = eflags.c
can_cache_flag_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/include -Dflag=can_cache -Dvalue=native \
-Drequire='"has_can_cache=1"' \
$(NULL)
-can_cache_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_cache_flag_LDADD = $(top_builddir)/lib/libnbd.la
can_not_cache_flag_SOURCES = eflags.c
can_not_cache_flag_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/include -Dflag=can_cache -Dvalue=none \
-Drequire='"has_can_cache=1"' \
$(NULL)
-can_not_cache_flag_CFLAGS = $(WARNINGS_CFLAGS)
can_not_cache_flag_LDADD = $(top_builddir)/lib/libnbd.la
oldstyle_SOURCES = oldstyle.c
-oldstyle_CPPFLAGS = -I$(top_srcdir)/include
-oldstyle_CFLAGS = $(WARNINGS_CFLAGS)
oldstyle_LDADD = $(top_builddir)/lib/libnbd.la
newstyle_limited_SOURCES = newstyle-limited.c
-newstyle_limited_CPPFLAGS = -I$(top_srcdir)/include
-newstyle_limited_CFLAGS = $(WARNINGS_CFLAGS)
newstyle_limited_LDADD = $(top_builddir)/lib/libnbd.la
opt_abort_SOURCES = opt-abort.c
-opt_abort_CPPFLAGS = -I$(top_srcdir)/include
-opt_abort_CFLAGS = $(WARNINGS_CFLAGS)
opt_abort_LDADD = $(top_builddir)/lib/libnbd.la
opt_list_SOURCES = opt-list.c
opt_list_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSCRIPT='"$(abs_srcdir)/opt-list.sh"' \
$(NULL)
-opt_list_CFLAGS = $(WARNINGS_CFLAGS)
opt_list_LDADD = $(top_builddir)/lib/libnbd.la
opt_info_SOURCES = opt-info.c
opt_info_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSCRIPT='"$(abs_srcdir)/opt-info.sh"' \
$(NULL)
-opt_info_CFLAGS = $(WARNINGS_CFLAGS)
opt_info_LDADD = $(top_builddir)/lib/libnbd.la
opt_list_meta_SOURCES = opt-list-meta.c
-opt_list_meta_CPPFLAGS = \
- -I$(top_srcdir)/include \
- $(NULL)
-opt_list_meta_CFLAGS = $(WARNINGS_CFLAGS)
opt_list_meta_LDADD = $(top_builddir)/lib/libnbd.la
connect_unix_SOURCES = connect-unix.c
-connect_unix_CPPFLAGS = -I$(top_srcdir)/include
-connect_unix_CFLAGS = $(WARNINGS_CFLAGS)
connect_unix_LDADD = $(top_builddir)/lib/libnbd.la
connect_tcp_SOURCES = connect-tcp.c
-connect_tcp_CPPFLAGS = -I$(top_srcdir)/include
-connect_tcp_CFLAGS = $(WARNINGS_CFLAGS)
connect_tcp_LDADD = $(top_builddir)/lib/libnbd.la
aio_parallel_SOURCES = aio-parallel.c
aio_parallel_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/common/include \
$(NULL)
-aio_parallel_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
aio_parallel_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
aio_parallel_load_SOURCES = aio-parallel-load.c
-aio_parallel_load_CPPFLAGS = -I$(top_srcdir)/include
-aio_parallel_load_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
aio_parallel_load_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
synch_parallel_SOURCES = synch-parallel.c
synch_parallel_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/common/include \
$(NULL)
-synch_parallel_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+synch_parallel_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
synch_parallel_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
meta_base_allocation_SOURCES = meta-base-allocation.c
-meta_base_allocation_CPPFLAGS = -I$(top_srcdir)/include
-meta_base_allocation_CFLAGS = $(WARNINGS_CFLAGS)
meta_base_allocation_LDADD = $(top_builddir)/lib/libnbd.la
closure_lifetimes_SOURCES = closure-lifetimes.c
-closure_lifetimes_CPPFLAGS = -I$(top_srcdir)/include
-closure_lifetimes_CFLAGS = $(WARNINGS_CFLAGS)
closure_lifetimes_LDADD = $(top_builddir)/lib/libnbd.la
#----------------------------------------------------------------------
@@ -470,8 +430,10 @@ check_DATA += pki/stamp-pki
TESTS += connect-tls-certs
connect_tls_certs_SOURCES = connect-tls.c
-connect_tls_certs_CPPFLAGS = -I$(top_srcdir)/include -DCERTS=1
-connect_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
+connect_tls_certs_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+ -DCERTS=1 \
+ $(NULL)
connect_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
pki/stamp-pki: $(srcdir)/make-pki.sh
@@ -499,31 +461,36 @@ TESTS += \
check_DATA += keys.psk
connect_tls_psk_SOURCES = connect-tls.c
-connect_tls_psk_CPPFLAGS = -I$(top_srcdir)/include -DPSK=1
-connect_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
+connect_tls_psk_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+ -DPSK=1 \
+ $(NULL)
connect_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
aio_parallel_tls_SOURCES = aio-parallel.c
aio_parallel_tls_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/common/include \
-DTLS=1 \
$(NULL)
-aio_parallel_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+aio_parallel_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
aio_parallel_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
aio_parallel_load_tls_SOURCES = aio-parallel-load.c
-aio_parallel_load_tls_CPPFLAGS = -I$(top_srcdir)/include -DTLS=1
-aio_parallel_load_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+aio_parallel_load_tls_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+ -DTLS=1 \
+ $(NULL)
+aio_parallel_load_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
aio_parallel_load_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
synch_parallel_tls_SOURCES = synch-parallel.c
synch_parallel_tls_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-I$(top_srcdir)/common/include \
-DTLS=1 \
$(NULL)
-synch_parallel_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+synch_parallel_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
synch_parallel_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
keys.psk:
@@ -550,18 +517,19 @@ TESTS += \
RANDOM1 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
connect_uri_nbd_SOURCES = connect-uri.c
connect_uri_nbd_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER_PARAMS='"-p", "$(RANDOM1)"' \
-DPIDFILE='"connect-uri-nbd.pid"' \
- -DURI='"nbd://localhost:$(RANDOM1)/"'
-connect_uri_nbd_CFLAGS = $(WARNINGS_CFLAGS)
+ -DURI='"nbd://localhost:$(RANDOM1)/"' \
+ $(NULL)
+connect_uri_nbd_CFLAGS = $(AM_CFLAGS)
connect_uri_nbd_LDADD = $(top_builddir)/lib/libnbd.la
CONNECT_URI_NBD_UNIX_SOCKET := \
$(shell mktemp /tmp/connect-uri-nbd-unix-socket-XXXXXX)
connect_uri_nbd_unix_SOURCES = connect-uri.c
connect_uri_nbd_unix_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER_PARAMS='"-U", SOCKET' \
-DSOCKET='"$(CONNECT_URI_NBD_UNIX_SOCKET)"' \
-DPIDFILE='"connect-uri-nbd-unix.pid"' \
@@ -584,18 +552,18 @@ TESTS += \
RANDOM2 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
connect_uri_nbds_SOURCES = connect-uri.c
connect_uri_nbds_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-certificates=pki"' \
-DPIDFILE='"connect-uri-nbds.pid"' \
- -DURI='"nbds://localhost:$(RANDOM2)/"'
-connect_uri_nbds_CFLAGS = $(WARNINGS_CFLAGS)
+ -DURI='"nbds://localhost:$(RANDOM2)/"' \
+ $(NULL)
connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
CONNECT_URI_NBDS_UNIX_SOCKET := \
$(shell mktemp /tmp/connect-uri-nbds-unix-socket-XXXXXX)
connect_uri_nbds_unix_SOURCES = connect-uri.c
connect_uri_nbds_unix_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER_PARAMS='"-U", SOCKET, "--tls=require", "--tls-certificates=pki"' \
-DSOCKET='"$(CONNECT_URI_NBDS_UNIX_SOCKET)"' \
-DPIDFILE='"connect-uri-nbds-unix.pid"' \
@@ -617,11 +585,11 @@ TESTS += \
RANDOM3 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
connect_uri_nbds_psk_SOURCES = connect-uri.c
connect_uri_nbds_psk_CPPFLAGS = \
- -I$(top_srcdir)/include \
+ $(AM_CPPFLAGS) \
-DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-psk=keys.psk"' \
-DPIDFILE='"connect-uri-nbds-psk.pid"' \
- -DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"'
-connect_uri_nbds_psk_CFLAGS = $(WARNINGS_CFLAGS)
+ -DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"' \
+ $(NULL)
connect_uri_nbds_psk_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_PSKTOOL
--
2.43.0

15
SOURCES/0015-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch → SOURCES/0010-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch
Unescape View File

@ -1,4 +1,4 @@
From 1f82b6d2d894bf567926f4ae52f4362654db8f38 Mon Sep 17 00:00:00 2001
From a2541de206b3560fdfadf5dfada2cac1b69c09a1 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Tue, 25 Jun 2024 11:12:56 +0100
Subject: [PATCH] lib/uri.c: Allow tls-verify-peer to be overridden in URIs
@ -12,18 +12,17 @@ Since some clients might be depending on this, allow
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 75641c6b30155abce272f60cf3518a65654aa401)
(cherry picked from commit caad9cfb5dda0957c4b15cc85738a4c6ac856e8b)
(cherry picked from commit 4bfc3176de535350f884732b8793574e37714d2a)
(cherry picked from commit b12466821fc534fb68d5b8e695832ee03496e0af)
---
generator/API.ml | 5 +++++
lib/uri.c | 32 ++++++++++++++++++++++++++++++++
2 files changed, 37 insertions(+)
diff --git a/generator/API.ml b/generator/API.ml
index 4b2a62e8..69ee428d 100644
index c4547615..f2752f25 100644
--- a/generator/API.ml
+++ b/generator/API.ml
@@ -1306,6 +1306,11 @@ Note this is not allowed by default - see next section.
@@ -1994,6 +1994,11 @@ Note this is not allowed by default - see next section.
Set the PSK file. See L<nbd_set_tls_psk_file(3)>. Note
this is not allowed by default - see next section.
@ -36,10 +35,10 @@ index 4b2a62e8..69ee428d 100644
=head2 Disable URI features
diff --git a/lib/uri.c b/lib/uri.c
index c8d9041e..8dfefd00 100644
index 0c8e87cf..969e88be 100644
--- a/lib/uri.c
+++ b/lib/uri.c
@@ -140,6 +140,31 @@ error:
@@ -150,6 +150,31 @@ parse_uri_queries (const char *query_raw, uri_query_list *list)
return -1;
}
@ -71,7 +70,7 @@ index c8d9041e..8dfefd00 100644
int
nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
{
@@ -271,6 +296,13 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
@@ -298,6 +323,13 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
if (nbd_unlocked_set_tls_psk_file (h, queries.ptr[i].value) == -1)
goto cleanup;
}

149
SOURCES/0010-tests-connect-uri.c-Ensure-Unix-domain-socket-is-cle.patch
Unescape View File

@ -1,149 +0,0 @@
From da628792ddf7a3d3cb8f8b770c7dbb9b9d67444b Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Sat, 24 Apr 2021 21:40:58 +0100
Subject: [PATCH] tests/connect-uri.c: Ensure Unix domain socket is cleaned up
on exit
Commit 70f83fed13 ("tests: Create test sockets in /tmp instead of
local directory.") aimed to create sockets with short path names in
/tmp. However it never cleaned them up. Worse still, every time the
Makefile was evaluated at all a temporary file was created.
Fix this properly in the C file.
Fixes: commit 70f83fed131c7e52b1a31a28d9acaf19f6c11d57
(cherry picked from commit f5955c4c5bb0269e192b906a3ef98601aa63ad59)
(cherry picked from commit 502f0b59ec1dbd64c6c64279316e03540258a54c)
---
tests/Makefile.am | 16 ++++++----------
tests/connect-uri.c | 45 +++++++++++++++++++++++++++++++++++++++------
2 files changed, 45 insertions(+), 16 deletions(-)
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 436e1c10..ed5585a5 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -525,15 +525,13 @@ connect_uri_nbd_CPPFLAGS = \
connect_uri_nbd_CFLAGS = $(AM_CFLAGS)
connect_uri_nbd_LDADD = $(top_builddir)/lib/libnbd.la
-CONNECT_URI_NBD_UNIX_SOCKET := \
- $(shell mktemp /tmp/connect-uri-nbd-unix-socket-XXXXXX)
connect_uri_nbd_unix_SOURCES = connect-uri.c
connect_uri_nbd_unix_CPPFLAGS = \
$(AM_CPPFLAGS) \
- -DSERVER_PARAMS='"-U", SOCKET' \
- -DSOCKET='"$(CONNECT_URI_NBD_UNIX_SOCKET)"' \
+ -DNEEDS_UNIX_SOCKET=1 \
+ -DSERVER_PARAMS='"-U", UNIX_SOCKET' \
-DPIDFILE='"connect-uri-nbd-unix.pid"' \
- -DURI='"nbd+unix:///?socket=" SOCKET'
+ -DURI='"nbd+unix:///?socket="' # UNIX_SOCKET appended
connect_uri_nbd_unix_CFLAGS = $(WARNINGS_CFLAGS)
connect_uri_nbd_unix_LDADD = $(top_builddir)/lib/libnbd.la
@@ -559,15 +557,13 @@ connect_uri_nbds_CPPFLAGS = \
$(NULL)
connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
-CONNECT_URI_NBDS_UNIX_SOCKET := \
- $(shell mktemp /tmp/connect-uri-nbds-unix-socket-XXXXXX)
connect_uri_nbds_unix_SOURCES = connect-uri.c
connect_uri_nbds_unix_CPPFLAGS = \
$(AM_CPPFLAGS) \
- -DSERVER_PARAMS='"-U", SOCKET, "--tls=require", "--tls-certificates=pki"' \
- -DSOCKET='"$(CONNECT_URI_NBDS_UNIX_SOCKET)"' \
+ -DNEEDS_UNIX_SOCKET=1 \
+ -DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-certificates=pki"' \
-DPIDFILE='"connect-uri-nbds-unix.pid"' \
- -DURI='"nbds+unix:///?socket=" SOCKET'
+ -DURI='"nbds+unix:///?socket="' # UNIX_SOCKET appended
connect_uri_nbds_unix_CFLAGS = $(WARNINGS_CFLAGS)
connect_uri_nbds_unix_LDADD = $(top_builddir)/lib/libnbd.la
diff --git a/tests/connect-uri.c b/tests/connect-uri.c
index 6e7d1685..ce9e4d9b 100644
--- a/tests/connect-uri.c
+++ b/tests/connect-uri.c
@@ -29,16 +29,49 @@
#include <libnbd.h>
+#ifdef NEEDS_UNIX_SOCKET
+#define UNIX_SOCKET tmp
+static char tmp[] = "/tmp/nbdXXXXXX";
+
+static void
+unlink_unix_socket (void)
+{
+ unlink (UNIX_SOCKET);
+}
+#endif /* NEEDS_UNIX_SOCKET */
+
int
main (int argc, char *argv[])
{
struct nbd_handle *nbd;
pid_t pid;
size_t i;
+#ifdef NEEDS_UNIX_SOCKET
+ char *uri;
+#else
+ const char *uri = URI;
+#endif
+
+#ifdef NEEDS_UNIX_SOCKET
+ int fd = mkstemp (UNIX_SOCKET);
+ if (fd == -1 ||
+ close (fd) == -1) {
+ perror (UNIX_SOCKET);
+ exit (EXIT_FAILURE);
+ }
+ /* We have to remove the temporary file first, since we will create
+ * a socket in its place, and ensure the socket is removed on exit.
+ */
+ unlink_unix_socket ();
+ atexit (unlink_unix_socket);
-#ifdef SOCKET
- unlink (SOCKET);
+ /* uri = URI + UNIX_SOCKET */
+ if (asprintf (&uri, "%s%s", URI, UNIX_SOCKET) == -1) {
+ perror ("asprintf");
+ exit (EXIT_FAILURE);
+ }
#endif
+
unlink (PIDFILE);
pid = fork ();
@@ -75,13 +108,13 @@ main (int argc, char *argv[])
nbd_set_uri_allow_local_file (nbd, true);
- if (nbd_connect_uri (nbd, URI) == -1) {
+ if (nbd_connect_uri (nbd, uri) == -1) {
fprintf (stderr, "%s\n", nbd_get_error ());
exit (EXIT_FAILURE);
}
/* Check we negotiated the right kind of connection. */
- if (strncmp (URI, "nbds", 4) == 0) {
+ if (strncmp (uri, "nbds", 4) == 0) {
if (! nbd_get_tls_negotiated (nbd)) {
fprintf (stderr, "%s: failed to negotiate a TLS connection\n",
argv[0]);
@@ -95,8 +128,8 @@ main (int argc, char *argv[])
}
nbd_close (nbd);
-#ifdef SOCKET
- unlink (SOCKET);
+#ifdef NEEDS_UNIX_SOCKET
+ free (uri);
#endif
exit (EXIT_SUCCESS);
}
--
2.43.0

11
SOURCES/0016-docs-security-Add-link-to-TLS-server-certificate-che.patch → SOURCES/0011-docs-security-Add-link-to-TLS-server-certificate-che.patch
Unescape View File

@ -1,23 +1,22 @@
From 437d3aedd5ecbcb8d5234665015c5813a6ca1712 Mon Sep 17 00:00:00 2001
From dfa2a23c7638e325694101fe81b5330ceede68f9 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Tue, 25 Jun 2024 17:53:47 +0100
Subject: [PATCH] docs: security: Add link to TLS server certificate checking
announcement
(cherry picked from commit 9c723aa660c6ee7d224afbfc16eb7450d21fb9cf)
(cherry picked from commit 9b77d853d82c291f74b51305d58e9db7f555a254)
(cherry picked from commit b477be4ed47daa6ba73c176ae8b0288ec8e84f23)
(cherry picked from commit 820f45a58fda50dc7d5e126c55403e33824cffe4)
---
docs/libnbd-security.pod | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
index 0cae8462..b31f3f8b 100644
index 216efa43..c9960d8c 100644
--- a/docs/libnbd-security.pod
+++ b/docs/libnbd-security.pod
@@ -28,6 +28,11 @@ denial of service when using L<nbd_set_opt_mode(3)>
@@ -45,6 +45,11 @@ negative size result from nbd_get_size(3)
See the full announcement here:
L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html>
+=head2 multiple flaws in TLS server certificate checking
+

194
SOURCES/0011-lib-Allow-tls-certificates-DIR-query-parameter-in-UR.patch
Unescape View File

@ -1,194 +0,0 @@
From ee3f88640062372d04406da321270a775377eb6c Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Fri, 3 Sep 2021 08:42:31 +0100
Subject: [PATCH] lib: Allow tls-certificates=<DIR> query parameter in URIs
For nbd_connect_uri, this allows a non-default path to a certificates
directory to be specified. For example:
nbds+unix://user@/?socket=/tmp/sock&tls-certificates=tests/pki
nbd_get_uri is also extended to produce the tls-certificates query
field if nbd_set_tls_certificates was called.
The main work here is extending the test suite so it actually tests
TLS URIs properly. Firstly we need to add --tls-verify-peer to the
nbdkit command line so it checks TLS client credentials at all
(previously it enabled TLS but didn't verify the client). Then we
need to add tests which use TLS certificates (previously only PSK was
being tested). And finally I loosened the rules for comparing URIs
since the order that query strings are returned by nbd_get_uri is not
necessarily the same as the query strings in nbd_connect_uri.
(cherry picked from commit 847e0b9830f6a9f07b4c242e1a500cd2b90cca5a)
(cherry picked from commit 5e85582ec79460c95552f06c6d6c41d15dae092f)
---
.gitignore | 5 +++--
generator/API.ml | 10 ++++++++++
lib/uri.c | 14 ++++++++++++--
tests/Makefile.am | 47 +++++++++++++++++++++++++++++------------------
4 files changed, 54 insertions(+), 22 deletions(-)
diff --git a/.gitignore b/.gitignore
index 4935b81b..c974e27b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -167,9 +167,10 @@ Makefile.in
/tests/connect-unix
/tests/connect-uri-nbd
/tests/connect-uri-nbd-unix
-/tests/connect-uri-nbds
+/tests/connect-uri-nbds-certs
/tests/connect-uri-nbds-psk
-/tests/connect-uri-nbds-unix
+/tests/connect-uri-nbds-unix-certs
+/tests/connect-uri-nbds-unix-psk
/tests/debug
/tests/debug-environment
/tests/errors
diff --git a/generator/API.ml b/generator/API.ml
index a46c6407..4b2a62e8 100644
--- a/generator/API.ml
+++ b/generator/API.ml
@@ -1231,6 +1231,11 @@ Connect over the Unix domain socket F</tmp/nbd.sock> to
an NBD server running locally. The export name is set to C<foo>
(note without any leading C</> character).
+=item C<nbds+unix://alice@/?socket=/tmp/nbd.sock&tls-certificates=certs>
+
+Connect over a Unix domain socket, enabling TLS and setting the
+path to a directory containing certificates and keys.
+
=item C<nbd+vsock:///>
In this scenario libnbd is running in a virtual machine. Connect
@@ -1291,6 +1296,11 @@ Specifies the Unix domain socket to connect on.
Must be present for the C<+unix> transport and must not
be present for the other transports.
+=item B<tls-certificates=>F<DIR>
+
+Set the certificates directory. See L<nbd_set_tls_certificates(3)>.
+Note this is not allowed by default - see next section.
+
=item B<tls-psk-file=>F<PSKFILE>
Set the PSK file. See L<nbd_set_tls_psk_file(3)>. Note
diff --git a/lib/uri.c b/lib/uri.c
index 9f5a2901..c8d9041e 100644
--- a/lib/uri.c
+++ b/lib/uri.c
@@ -249,9 +249,19 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
if (tls && nbd_unlocked_set_tls (h, LIBNBD_TLS_REQUIRE) == -1)
goto cleanup;
- /* Look for some tls-* parameters. XXX More to come. */
+ /* Look for some tls-* parameters. */
for (i = 0; i < queries.size; i++) {
- if (strcmp (queries.ptr[i].name, "tls-psk-file") == 0) {
+ if (strcmp (queries.ptr[i].name, "tls-certificates") == 0) {
+ if (! h->uri_allow_local_file) {
+ set_error (EPERM,
+ "local file access (tls-certificates) is not allowed, "
+ "call nbd_set_uri_allow_local_file to enable this");
+ goto cleanup;
+ }
+ if (nbd_unlocked_set_tls_certificates (h, queries.ptr[i].value) == -1)
+ goto cleanup;
+ }
+ else if (strcmp (queries.ptr[i].name, "tls-psk-file") == 0) {
if (! h->uri_allow_local_file) {
set_error (EPERM,
"local file access (tls-psk-file) is not allowed, "
diff --git a/tests/Makefile.am b/tests/Makefile.am
index ed5585a5..3c33b747 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -539,33 +539,32 @@ if HAVE_GNUTLS
if HAVE_CERTTOOL
check_PROGRAMS += \
- connect-uri-nbds \
- connect-uri-nbds-unix \
+ connect-uri-nbds-certs \
+ connect-uri-nbds-unix-certs \
$(NULL)
TESTS += \
- connect-uri-nbds \
- connect-uri-nbds-unix \
+ connect-uri-nbds-certs \
+ connect-uri-nbds-unix-certs \
$(NULL)
RANDOM2 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
-connect_uri_nbds_SOURCES = connect-uri.c
-connect_uri_nbds_CPPFLAGS = \
+connect_uri_nbds_certs_SOURCES = connect-uri.c
+connect_uri_nbds_certs_CPPFLAGS = \
$(AM_CPPFLAGS) \
- -DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-certificates=pki"' \
- -DPIDFILE='"connect-uri-nbds.pid"' \
- -DURI='"nbds://localhost:$(RANDOM2)/"' \
+ -DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-verify-peer", "--tls-certificates=pki"' \
+ -DPIDFILE='"connect-uri-nbds-certs.pid"' \
+ -DURI='"nbds://localhost:$(RANDOM2)/?tls-certificates=pki"' \
$(NULL)
-connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
+connect_uri_nbds_certs_LDADD = $(top_builddir)/lib/libnbd.la
-connect_uri_nbds_unix_SOURCES = connect-uri.c
-connect_uri_nbds_unix_CPPFLAGS = \
+connect_uri_nbds_unix_certs_SOURCES = connect-uri.c
+connect_uri_nbds_unix_certs_CPPFLAGS = \
$(AM_CPPFLAGS) \
-DNEEDS_UNIX_SOCKET=1 \
- -DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-certificates=pki"' \
- -DPIDFILE='"connect-uri-nbds-unix.pid"' \
- -DURI='"nbds+unix:///?socket="' # UNIX_SOCKET appended
-connect_uri_nbds_unix_CFLAGS = $(WARNINGS_CFLAGS)
-connect_uri_nbds_unix_LDADD = $(top_builddir)/lib/libnbd.la
+ -DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-verify-peer", "--tls-certificates=pki"' \
+ -DPIDFILE='"connect-uri-nbds-unix-certs.pid"' \
+ -DURI='"nbds+unix://alice@/?tls-certificates=pki&socket="' # UNIX_SOCKET appended
+connect_uri_nbds_unix_certs_LDADD = $(top_builddir)/lib/libnbd.la
endif HAVE_CERTTOOL
@@ -573,21 +572,33 @@ if HAVE_PSKTOOL
check_PROGRAMS += \
connect-uri-nbds-psk \
+ connect-uri-nbds-unix-psk \
$(NULL)
TESTS += \
connect-uri-nbds-psk \
+ connect-uri-nbds-unix-psk \
$(NULL)
RANDOM3 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
connect_uri_nbds_psk_SOURCES = connect-uri.c
connect_uri_nbds_psk_CPPFLAGS = \
$(AM_CPPFLAGS) \
- -DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-psk=keys.psk"' \
+ -DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-verify-peer", "--tls-psk=keys.psk"' \
-DPIDFILE='"connect-uri-nbds-psk.pid"' \
-DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"' \
$(NULL)
connect_uri_nbds_psk_LDADD = $(top_builddir)/lib/libnbd.la
+connect_uri_nbds_unix_psk_SOURCES = connect-uri.c
+connect_uri_nbds_unix_psk_CPPFLAGS = \
+ $(AM_CPPFLAGS) \
+ -DNEEDS_UNIX_SOCKET=1 \
+ -DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-verify-peer", "--tls-psk=keys.psk"' \
+ -DPIDFILE='"connect-uri-nbds-unix-psk.pid"' \
+ -DURI='"nbds+unix://alice@/?tls-psk-file=keys.psk&socket="' # UNIX_SOCKET appended \
+ $(NULL)
+connect_uri_nbds_unix_psk_LDADD = $(top_builddir)/lib/libnbd.la
+
endif HAVE_PSKTOOL
endif HAVE_GNUTLS
--
2.43.0

10
SOURCES/0017-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch → SOURCES/0012-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch
Unescape View File

@ -1,4 +1,4 @@
From 626331d88fdf8ed87dc066faeb836fc5926f5420 Mon Sep 17 00:00:00 2001
From 8334404ee0883dcfa90697b6fdae541ed4751b79 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 1 Aug 2024 15:17:29 +0100
Subject: [PATCH] docs/libnbd-security.pod: Assign CVE-2024-7383
@ -9,19 +9,17 @@ found in libnbd certificate checking.
Reported-by: Jon Szymaniak
Thanks: Mauro Matteo Cascella
(cherry picked from commit 81a22ac6697ccdeb13509aba3072609251d1378b)
(cherry picked from commit 599281af594db8414d856db409846b04fce03824)
(cherry picked from commit 8f7dce2b6d6716f9eec0f352a3c420ae84a84be9)
---
docs/libnbd-security.pod | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
index b31f3f8b..4c3b5bbd 100644
index c9960d8c..ece0cf5a 100644
--- a/docs/libnbd-security.pod
+++ b/docs/libnbd-security.pod
@@ -28,7 +28,8 @@ denial of service when using L<nbd_set_opt_mode(3)>
@@ -45,7 +45,8 @@ negative size result from nbd_get_size(3)
See the full announcement here:
L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html>
-=head2 multiple flaws in TLS server certificate checking
+=head2 CVE-2024-7383

33
SOURCES/0012-tests-make-pki.sh-Use-Subject-Alternative-Name-for-s.patch
Unescape View File

@ -1,33 +0,0 @@
From 10ca0d72932092b09475893de233f17d3eff8a72 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 4 Aug 2022 13:28:25 +0100
Subject: [PATCH] tests/make-pki.sh: Use Subject Alternative Name for server
certificate
This allows us to test this feature.
(cherry picked from nbdkit commit 0c50bef16f9d6705add8db85c7ea7b4523770fba)
(cherry picked from commit 38eabf6df05fae109212a4ce9afc9c0fe63c2f0e)
(cherry picked from commit b07898e1ee70b0641ec5233d6e8f7fa16b63c287)
---
tests/make-pki.sh | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tests/make-pki.sh b/tests/make-pki.sh
index d4f61204..03f4faa1 100755
--- a/tests/make-pki.sh
+++ b/tests/make-pki.sh
@@ -75,6 +75,9 @@ chmod 0600 $1/server-key.pem
cat > $1/server.info <<EOF
organization = Test
cn = localhost
+dns_name = localhost
+ip_address = 127.0.0.1
+ip_address = ::1
tls_www_server
encryption_key
signing_key
--
2.43.0

2
SOURCES/copy-patches.sh
Unescape View File

@ -6,7 +6,7 @@ set -e
# directory. Use it like this:
# ./copy-patches.sh
rhel_version=8.10
rhel_version=9.4
# Check we're in the right directory.
if [ ! -f libnbd.spec ]; then

17
SOURCES/libnbd-1.18.1.tar.gz.sig
Unescape View File

@ -0,0 +1,17 @@
-----BEGIN PGP SIGNATURE-----
iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAmU2izoRHHJpY2hAYW5u
ZXhpYS5vcmcACgkQkXOPc+G3aKA+txAAkLeWdvH2ryibEyqMeyejvh9vMgQO5I46
LaygI8jDi+XG+rGy7imiwIxxWvyCZI3y2U5MFudLZoFi+gCyVAC+LeBxjF41NBGz
fbgwFaQHrCbxyLlsj9OcR6M0+EPU8NXXPPGgXZNcnf7tHNZkTO0OGS9chml0wXHA
Zx9WheHl6wbLTVIAtLWOJqzRQj80RlcPC+De1wZL+WFMPMkfF8L8K5FRNsfeTIXn
l31d1R0g5QOMTTqBiKE2iopPmVmA5uC/adWCuqF3mzzjzCkHp+Ux/Ys99tkCETrU
jUuHgJ+1pYjn4Lmt/HUwXQZD3L+RkNAWWQziY/3ejK31tGxZqR/XTwq5RPrc6Qs1
/zuoWvSWJZZo9yvX1Iq2RQAaZF5724V/svm+HgaCakaK8EJEj6sntM0OhAl2pRC4
G45Kb2o7k016WgL8plNOlrbHNxaruBcPrkFYDMoyy3KLnWaw3OYMARTD5w/Pd4dC
CJa3tIXIKedhXw9xDtEWfxiKIHfO+LBHBMjpW9KzP/oxE2akmcJZJT+JNpsrpdzV
O6mbVDPedWd5LQQ1bNmwzxkCsMEC9HFhVbCaTuYuSXe/By04Norns4xyEJyDXlG/
QqFgEUS8R+V9xwYHoAPg5RUmycXubSmm64iTAQNqc46QsxeP0Va7gpbrPLe5qVk/
irUsxdBhGIM=
=pgmp
-----END PGP SIGNATURE-----

17
SOURCES/libnbd-1.6.0.tar.gz.sig
Unescape View File

@ -1,17 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAl/3RFQRHHJpY2hAYW5u
ZXhpYS5vcmcACgkQkXOPc+G3aKD9aw/+Pfg3owjJmhTcCyFvuH2lgiiBb+qL2An+
hsoax6dM5JxzV6x1Ikgn3C8z2+dLRMowo2FrRgpzTwfaS+ngLDipSC04hKl9MhFN
7OPLCm+L7wcP7KUk4cC0qTSHpHkApo2SP3/bD7vVBYZMYSjgUVFcRoqZlRl3N9RF
7XNsxA2YG9bV4Ln3KbB+k2uxIKNUZIVjmEpretVbb+NTKW9C23ZHicSHYB+Eok1M
iTN6j66rYFn0Xb+L2v7jty19tSdYOMbkdSn0KpniURAWevjjVWGqcojMqW4YuAZ5
h2MpRfyKFyusbsbtX5bjICTu6+AgFFUALKH7ReDs1RY1cEph9XdBLVulXTggxY05
E3I1Nns1YmjRlV6ky2Abl2e+Doc44mycINRlwL2q8+Q3TqlVVPFXoVTWxIJ6/Uae
tqnEwWIa2wGv3KU1KLNbWTn1z6I8NM/Nj+7pMKDNnxJzFmHEjL94tmG+iNmHsF34
vWBZ1q7h9EezxHLOPFYDjlpS+IxeuXakbpuTX2jXvi3zSAbr5WmRR1uO8dAiwu9b
RwOHRmVQOFLAAICYTZDmxl42DpWs5Z2aP7eRwpe8/MOSRiAVepjhUD/bsdaFwmBR
8Z7CGNzyTtt+sy5l7cPBYZ+4RdxWgFEBceBbHs06zdlD/Pui288UQVB/0e9AXYOc
wluyWT1v7sA=
=BaN1
-----END PGP SIGNATURE-----

490
SPECS/libnbd.spec
Unescape View File

@ -5,15 +5,15 @@
%global patches_touch_autotools 1
# The source directory.
%global source_directory 1.6-stable
%global source_directory 1.18-stable
Name: libnbd
Version: 1.6.0
Release: 6%{?dist}
Version: 1.18.1
Release: 4%{?dist}
Summary: NBD client library in userspace
License: LGPLv2+
URL: https://github.com/libguestfs/libnbd
License: LGPL-2.0-or-later AND BSD-3-Clause
URL: https://gitlab.com/nbdkit/libnbd
Source0: http://libguestfs.org/download/libnbd/%{source_directory}/%{name}-%{version}.tar.gz
Source1: http://libguestfs.org/download/libnbd/%{source_directory}/%{name}-%{version}.tar.gz.sig
@ -25,27 +25,22 @@ Source2: libguestfs.keyring
# Maintainer script which helps with handling patches.
Source3: copy-patches.sh
# Patches come from this upstream branch:
# https://github.com/libguestfs/libnbd/tree/rhel-8.10
# Patches are stored in the upstream repository:
# https://gitlab.com/nbdkit/libnbd/-/commits/rhel-9.4/
# Patches.
Patch0001: 0001-copy-copy-nbd-to-sparse-file.sh-Skip-test-unless-nbd.patch
Patch0002: 0002-generator-Refactor-CONNECT.START-state.patch
Patch0003: 0003-generator-Print-a-better-error-message-if-connect-2-.patch
Patch0004: 0004-opt_go-Tolerate-unplanned-server-death.patch
Patch0005: 0005-security-Document-assignment-of-CVE-2021-20286.patch
Patch0006: 0006-copy-Pass-in-dummy-variable-rather-than-errno-to-cal.patch
Patch0007: 0007-copy-CVE-2022-0485-Fail-nbdcopy-if-NBD-read-or-write.patch
Patch0008: 0008-build-Move-to-minimum-gnutls-3.5.18.patch
Patch0009: 0009-tests-Factor-out-some-common-Makefile-flags.patch
Patch0010: 0010-tests-connect-uri.c-Ensure-Unix-domain-socket-is-cle.patch
Patch0011: 0011-lib-Allow-tls-certificates-DIR-query-parameter-in-UR.patch
Patch0012: 0012-tests-make-pki.sh-Use-Subject-Alternative-Name-for-s.patch
Patch0013: 0013-lib-crypto.c-Check-server-certificate-even-when-usin.patch
Patch0014: 0014-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch
Patch0015: 0015-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch
Patch0016: 0016-docs-security-Add-link-to-TLS-server-certificate-che.patch
Patch0017: 0017-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch
Patch0001: 0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch
Patch0002: 0002-docs-Fix-incorrect-xref-in-libnbd-release-notes-for-.patch
Patch0003: 0003-tests-Check-behavior-of-nbd_set_strict_mode-STRICT_A.patch
Patch0004: 0004-build-Move-to-minimum-gnutls-3.5.18.patch
Patch0005: 0005-lib-crypto.c-Check-server-certificate-even-when-usin.patch
Patch0006: 0006-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch
Patch0007: 0007-interop-Pass-DCERTS-and-DPSK-as-strings.patch
Patch0008: 0008-interop-Add-DEXPECT_FAIL-1-where-we-expect-the-test-.patch
Patch0009: 0009-interop-Test-interop-with-a-bad-system-CA.patch
Patch0010: 0010-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch
Patch0011: 0011-docs-security-Add-link-to-TLS-server-certificate-che.patch
Patch0012: 0012-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch
%if 0%{patches_touch_autotools}
BuildRequires: autoconf, automake, libtool
@ -57,20 +52,29 @@ BuildRequires: gnupg2
# For the core library.
BuildRequires: gcc
BuildRequires: make
BuildRequires: /usr/bin/pod2man
BuildRequires: gnutls-devel
BuildRequires: libxml2-devel
# For nbdfuse.
BuildRequires: fuse, fuse-devel
BuildRequires: fuse3, fuse3-devel
%if !0%{?rhel}
# For nbdublk
BuildRequires: liburing-devel >= 2.2
BuildRequires: ubdsrv-devel >= 1.0-3.rc6
%endif
# For the Python 3 bindings.
BuildRequires: python3-devel
%ifnarch %{ix86}
# For the OCaml bindings.
BuildRequires: ocaml
BuildRequires: ocaml-findlib-devel
BuildRequires: ocaml-ocamldoc
%endif
# Only for building the examples.
BuildRequires: glib2-devel
@ -82,20 +86,33 @@ BuildRequires: bash-completion
BuildRequires: coreutils
BuildRequires: gcc-c++
BuildRequires: gnutls-utils
#BuildRequires: jq
BuildRequires: iproute
BuildRequires: jq
%if !0%{?rhel}
BuildRequires: nbd
%endif
BuildRequires: util-linux
# On RHEL, maybe even in Fedora in future, we do not build qemu-img or
# nbdkit for i686. These are only needed for the test suite so make
# them optional. This reduces our test exposure on 32 bit platforms,
# although there is still Fedora/armv7 and some upstream testing.
%ifnarch %{ix86}
BuildRequires: qemu-img
BuildRequires: nbdkit
BuildRequires: nbdkit-data-plugin
#BuildRequires: nbdkit-eval-plugin
BuildRequires: nbdkit-eval-plugin
BuildRequires: nbdkit-memory-plugin
BuildRequires: nbdkit-null-plugin
BuildRequires: nbdkit-pattern-plugin
BuildRequires: nbdkit-sh-plugin
#BuildRequires: nbdkit-sparse-random-plugin
#BuildRequires: nbd
BuildRequires: qemu-img
BuildRequires: nbdkit-sparse-random-plugin
%endif
%ifnarch %{ix86}
# The OCaml runtime system does not provide this symbol
%global __ocaml_requires_opts -x Stdlib__Callback
%endif
BuildRequires: util-linux
%description
@ -121,7 +138,6 @@ The key features are:
%package devel
Summary: Development headers for %{name}
License: LGPLv2+ and BSD
Requires: %{name}%{?_isa} = %{version}-%{release}
@ -129,6 +145,7 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
This package contains development headers for %{name}.
%ifnarch %{ix86}
%package -n ocaml-%{name}
Summary: OCaml language bindings for %{name}
Requires: %{name}%{?_isa} = %{version}-%{release}
@ -147,6 +164,7 @@ Requires: ocaml-%{name}%{?_isa} = %{version}-%{release}
This package contains OCaml language development package for
%{name}. Install this if you want to compile OCaml software which
uses %{name}.
%endif
%package -n python3-%{name}
@ -165,14 +183,28 @@ python3-%{name} contains Python 3 bindings for %{name}.
%package -n nbdfuse
Summary: FUSE support for %{name}
License: LGPLv2+ and BSD
Requires: %{name}%{?_isa} = %{version}-%{release}
Recommends: fuse3
%description -n nbdfuse
This package contains FUSE support for %{name}.
%if !0%{?rhel}
%package -n nbdublk
Summary: Userspace NBD block device
Requires: %{name}%{?_isa} = %{version}-%{release}
Recommends: kernel >= 6.0.0
Recommends: %{_sbindir}/ublk
%description -n nbdublk
This package contains a userspace NBD block device
based on %{name}.
%endif
%package bash-completion
Summary: Bash tab-completion for %{name}
BuildArch: noarch
@ -189,8 +221,7 @@ for %{name}.
%prep
%if 0%{verify_tarball_signature}
tmphome="$(mktemp -d)"
gpgv2 --homedir "$tmphome" --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
%endif
%autosetup -p1
%if 0%{patches_touch_autotools}
@ -204,9 +235,14 @@ autoreconf -i
--with-tls-priority=@LIBNBD,SYSTEM \
PYTHON=%{__python3} \
--enable-python \
%ifnarch %{ix86}
--enable-ocaml \
%else
--disable-ocaml \
%endif
--enable-fuse \
--disable-golang
--disable-golang \
--disable-rust
make %{?_smp_mflags}
@ -220,30 +256,48 @@ find $RPM_BUILD_ROOT -name '*.la' -delete
# Delete the golang man page since we're not distributing the bindings.
rm $RPM_BUILD_ROOT%{_mandir}/man3/libnbd-golang.3*
%ifarch %{ix86}
# Delete the OCaml man page on i686.
rm $RPM_BUILD_ROOT%{_mandir}/man3/libnbd-ocaml.3*
%endif
%if 0%{?rhel}
# Delete nbdublk on RHEL.
rm $RPM_BUILD_ROOT%{_datadir}/bash-completion/completions/nbdublk
%endif
%check
function skip_test ()
{
for f in "$@"; do
rm -f "$f"
echo 'exit 77' > "$f"
chmod +x "$f"
done
}
# interop/structured-read.sh fails with the old qemu-nbd in Fedora 29,
# so disable it there.
%if 0%{?fedora} <= 29
rm interop/structured-read.sh
touch interop/structured-read.sh
chmod +x interop/structured-read.sh
skip_test interop/structured-read.sh
%endif
# interop/interop-qemu-storage-daemon.sh fails in RHEL 9 because of
# this bug in qemu:
# https://lists.nongnu.org/archive/html/qemu-devel/2021-03/threads.html#03544
%if 0%{?rhel}
skip_test interop/interop-qemu-storage-daemon.sh
%endif
# All fuse tests fail in Koji with:
# fusermount: entry for fuse/test-*.d not found in /etc/mtab
# for unknown reasons but probably related to the Koji environment.
for f in fuse/test-*.sh; do
rm $f
touch $f
chmod +x $f
done
skip_test fuse/test-*.sh
# info/info-map-base-allocation-json.sh fails because of a bug in
# jq 1.5 in RHEL 8 (fixed in later versions).
rm info/info-map-base-allocation-json.sh
touch info/info-map-base-allocation-json.sh
chmod +x info/info-map-base-allocation-json.sh
# IPv6 loopback connections fail in Koji.
make -C tests connect-tcp6 ||:
skip_test tests/connect-tcp6
make %{?_smp_mflags} check || {
for f in $(find -name test-suite.log); do
@ -256,12 +310,14 @@ make %{?_smp_mflags} check || {
%files
%doc README
%doc README.md
%license COPYING.LIB
%{_bindir}/nbdcopy
%{_bindir}/nbddump
%{_bindir}/nbdinfo
%{_libdir}/libnbd.so.*
%{_mandir}/man1/nbdcopy.1*
%{_mandir}/man1/nbddump.1*
%{_mandir}/man1/nbdinfo.1*
@ -277,12 +333,12 @@ make %{?_smp_mflags} check || {
%{_mandir}/man3/nbd_*.3*
%ifnarch %{ix86}
%files -n ocaml-%{name}
%{_libdir}/ocaml/nbd
%exclude %{_libdir}/ocaml/nbd/*.a
%exclude %{_libdir}/ocaml/nbd/*.cmxa
%exclude %{_libdir}/ocaml/nbd/*.cmx
%exclude %{_libdir}/ocaml/nbd/*.mli
%dir %{_libdir}/ocaml/nbd
%{_libdir}/ocaml/nbd/META
%{_libdir}/ocaml/nbd/*.cma
%{_libdir}/ocaml/nbd/*.cmi
%{_libdir}/ocaml/stublibs/dllmlnbd.so
%{_libdir}/ocaml/stublibs/dllmlnbd.so.owner
@ -290,13 +346,16 @@ make %{?_smp_mflags} check || {
%files -n ocaml-%{name}-devel
%doc ocaml/examples/*.ml
%license ocaml/examples/LICENSE-FOR-EXAMPLES
%{_libdir}/ocaml/nbd/*.a
%ifarch %{ocaml_native_compiler}
%{_libdir}/ocaml/nbd/*.cmxa
%{_libdir}/ocaml/nbd/*.cmx
%endif
%{_libdir}/ocaml/nbd/*.a
%{_libdir}/ocaml/nbd/*.mli
%{_mandir}/man3/libnbd-ocaml.3*
%{_mandir}/man3/NBD.3*
%{_mandir}/man3/NBD.*.3*
%endif
%files -n python3-%{name}
@ -313,60 +372,325 @@ make %{?_smp_mflags} check || {
%{_mandir}/man1/nbdfuse.1*
%if !0%{?rhel}
%files -n nbdublk
%{_bindir}/nbdublk
%{_mandir}/man1/nbdublk.1*
%endif
%files bash-completion
%dir %{_datadir}/bash-completion/completions
%{_datadir}/bash-completion/completions/nbdcopy
%{_datadir}/bash-completion/completions/nbddump
%{_datadir}/bash-completion/completions/nbdfuse
%{_datadir}/bash-completion/completions/nbdinfo
%{_datadir}/bash-completion/completions/nbdsh
%if !0%{?rhel}
%{_datadir}/bash-completion/completions/nbdublk
%endif
%changelog
* Tue Aug 27 2024 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-6.el8
* Tue Aug 27 2024 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-4
- Fix CVE-2024-7383 NBD server improper certificate validation
resolves: RHEL-52728
resolves: RHEL-52730
* Mon Nov 13 2023 Eric Blake <eblake@redhat.com> - 1.18.1-3
- Backport unit test of recent libnbd API addition
resolves: RHEL-16292
* Wed Nov 01 2023 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-2
- Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871)
resolves: RHEL-15143
* Tue Oct 24 2023 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-1
- Rebase to 1.18.1
resolves: RHEL-14476
* Tue Apr 18 2023 Richard W.M. Jones <rjones@redhat.com> - 1.16.0-1
- Rebase to 1.16.0
resolves: rhbz#2168628
* Tue Jan 03 2023 Richard W.M. Jones <rjones@redhat.com> - 1.14.2-1
- Rebase to new stable branch version 1.14.2
resolves: rhbz#2135764
* Thu Jul 28 2022 Richard W.M. Jones <rjones@redhat.com> - 1.12.6-1
- Rebase to new stable branch version 1.12.6
resolves: rhbz#2059288
- New tool: nbddump
- nbdcopy: Use preferred block size for copying
related: rhbz#2047660
- Fix remote TLS failures
resolves: rhbz#2111524
(and 2111813)
* Thu Feb 10 2022 Richard W.M. Jones <rjones@redhat.com> - 1.10.5-1
- Rebase to new stable branch version 1.10.5
resolves: rhbz#2011708
- Map uint32_t to OCaml int64 to avoid signedness problems
resolves: rhbz#2040610
- CVE-2022-0485 nbdcopy destination image corruption
- New upstream API to control initialization of pread buffer
resolves: rhbz#2046194
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.8.2-3
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Fri Jul 30 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.2-2
- Fix nbdcopy progress bar.
- Add nbdinfo --map --totals and --can/--is options.
resolves: rhbz#1950630
* Sat Jul 03 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.2-1
- New upstream stable version 1.8.2.
* Wed Jun 23 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.1-2
- Bump and rebuild
resolves: rhbz#1975316
* Fri Jun 11 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.1-1
- New upstream stable version 1.8.1.
* Mon Jun 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.0-1
- New upstream version 1.8.0.
* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.7.12-2
- Rebuilt for Python 3.10
* Sat May 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.12-1
- New upstream version 1.7.12.
* Thu May 20 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.11-1
- New upstream version 1.7.11.
* Sun Dec 10 2023 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 1.6.0-5.el8
- Rebuilt for MSVSphere 8.8
* Fri May 14 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.10-1
- New upstream version 1.7.10.
* Mon Feb 7 2022 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-5.el8
- Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails
resolves: rhbz#2045718
* Thu Apr 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.9-1
- New upstream version 1.7.9.
- Switch to fuse3.
- Make nbdfuse package recommend fuse3 (to get fusermount3).
* Thu Sep 2 2021 Danilo C. L. de Paula <ddepaula@redhat.com> - 1.6.0-4.el8
- Resolves: bz#2000225
(Rebase virt:rhel module:stream based on AV-8.6)
* Sat Apr 24 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.8-1
- New upstream development version 1.7.8.
* Mon Jul 13 2020 Danilo C. L. de Paula <ddepaula@redhat.com> - 1.2.2
- Resolves: bz#1844296
(Upgrade components in virt:rhel module:stream for RHEL-8.3 release)
* Sat Apr 10 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.7-1
- New upstream development version 1.7.7.
- +BR iproute
- Add skip_test helper function.
- Skip connect-tcp6 test which fails under Koji.
* Wed Feb 5 2020 Richard W.M. Jones <rjones@redhat.com> - 1.2.2-1
- New stable release 1.2.2.
* Thu Apr 08 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.6-1
- New upstream development version 1.7.6.
* Tue Dec 3 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.1-1
- New stable release 1.2.1.
* Sat Apr 03 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.5-1
- New upstream development version 1.7.5.
* Mon Mar 15 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.4-1
- New upstream development version 1.7.4.
* Mon Mar 15 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-3
- Update documentation for CVE-2021-20286.
- Workaround broken interop/interop-qemu-storage-daemon.sh test in RHEL 9.
* Thu Mar 4 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-2
- Add fix for nbdkit test suite.
* Tue Mar 2 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-1
- New upstream version 1.7.3.
* Mon Mar 1 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-3
- OCaml 4.12.0 build
* Wed Feb 24 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-2
- Disable nbd BR on RHEL.
* Mon Feb 22 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-1
- New upstream version 1.7.2.
* Fri Jan 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-6
- Disable BR qemu-img on i686.
* Thu Jan 28 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-3
- Disable BR nbdkit on i686 because it breaks ELN/RHEL 9.
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Wed Jan 20 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-1
- New upstream development version 1.7.1.
* Thu Jan 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-1
- New upstream stable version 1.6.0.
* Tue Dec 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.9-1
- New upstream development version 1.5.9.
* Thu Dec 03 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.8-1
- New upstream development version 1.5.8.
- Unify Fedora and RHEL spec files.
* Wed Nov 25 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.7-1
- New upstream development version 1.5.7.
- Add some more test suite buildrequires lines.
- Fix bogus date in changelog.
* Thu Nov 12 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.6-1
- New upstream development version 1.5.6.
* Mon Nov 02 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.5-1
- New upstream development version 1.5.5.
* Mon Oct 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.4-1
- New upstream development version 1.5.4.
- More OCaml man pages.
* Sat Sep 26 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.3-1
- New upstream development version 1.5.3.
* Thu Sep 10 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.2-1
- New upstream development version 1.5.2.
* Tue Sep 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.1-1
- New upstream development version 1.5.1.
* Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 1.4.0-2
- OCaml 4.11.1 rebuild
* Tue Aug 25 2020 Richard W.M. Jones <rjones@redhat.com> - 1.4.0-1
- New stable release 1.4.0.
* Fri Aug 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-3
- Bump release and rebuild.
* Fri Aug 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-2
- OCaml 4.11.0 rebuild
* Thu Aug 20 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-1
- New upstream version 1.3.12.
* Thu Aug 6 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.11-1
- New upstream version 1.3.11.
* Tue Aug 4 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.10-1
- New upstream version 1.3.10.
* Wed Jul 29 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.9-3
- Bump and rebuild.
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Tue Jul 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.9-1
- New upstream version 1.3.9.
- New tool: nbdinfo.
* Fri Jul 17 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.8-2
- New upstream version 1.3.8.
- New tool: nbdcopy
- Add upstream patch to fix compilation with glibc from Rawhide.
* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 1.3.7-3
- Rebuilt for Python 3.9
* Mon May 04 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.7-2
- OCaml 4.11.0+dev2-2020-04-22 rebuild
* Thu Apr 23 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.7-1
- New upstream version 1.3.7.
* Tue Apr 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-5
- OCaml 4.11.0 pre-release attempt 2
* Fri Apr 17 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-4
- OCaml 4.11.0 pre-release
- Add upstream patch to fix one of the tests that fails on slow machines.
* Thu Apr 02 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-2
- Update all OCaml dependencies for RPM 4.16.
* Tue Mar 31 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-1
- New upstream development version 1.3.6.
- Golang bindings are contained in this release but not distributed.
* Wed Mar 11 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.5-2
- Fix bogus runtime Requires of new bash-completion package.
* Tue Mar 10 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.5-1
- New upstream development version 1.3.5.
- Add new bash-completion subpackage.
* Sat Feb 29 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.4-1
- New upstream development version 1.3.4.
* Wed Feb 26 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.3-2
- OCaml 4.10.0 final.
* Wed Feb 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.3-1
- New upstream development version 1.3.3.
* Thu Jan 30 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.2-1
- New upstream development version 1.3.2.
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Sun Jan 19 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-4
- Bump release and rebuild.
* Sun Jan 19 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-3
- OCaml 4.10.0+beta1 rebuild.
* Thu Dec 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-2
- Rebuild for OCaml 4.09.0.
* Tue Dec 03 2019 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-1
- New upstream development version 1.3.1.
* Wed Nov 27 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.0-2
- Use gpgverify macro instead of explicit gpgv2 command.
* Thu Nov 14 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.0-1
- New stable release 1.2.0.
- New stable release 1.2.0
* Sat Nov 09 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.9-1
- New upstream version 1.1.9.
- Add new nbdkit-release-notes-1.2(1) man page.
* Wed Nov 06 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.8-1
- New upstream version 1.1.8.
* Thu Oct 24 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.7-1
- New upstream version 1.1.7.
* Wed Oct 9 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
- New upstream version 1.0.3.
* Sat Oct 19 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.6-1
- New upstream version 1.1.6.
* Sat Oct 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.5-1
- New upstream version 1.1.5.
- New tool and subpackage nbdfuse.
* Wed Oct 9 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.4-1
- New upstream version 1.1.4.
- Contains fix for remote code execution vulnerability.
- Add new libnbd-security(3) man page.
* Tue Sep 17 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
- New upstream version 1.0.2.
* Tue Oct 1 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.3-1
- New upstream version 1.1.3.
* Tue Sep 17 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.2-1
- New upstream version 1.1.2.
- Remove patches which are upstream.
- Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
- Fix previous commit message.
* Thu Sep 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.1-2
* Thu Sep 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.1-2
- Add upstream patch to fix nbdsh (for nbdkit tests).
- Fix interop tests on slow machines.
* Sun Sep 08 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.1-1
- New stable version 1.0.1.
* Sun Sep 08 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.1-1
- New development version 1.1.1.
* Wed Aug 28 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.0-1
- New upstream version 1.0.0.

Write Preview
Loading…
Cancel
Save