similar to: ANNOUNCE: libnbd 1.2 & nbdkit 1.16 - high performance NBD client and server

A compliant server should not send NBD_REPLY_TYPE_BLOCK_STATUS unless we successfully negotiated a meta context. And our default strictness settings refuse to let us send NBD_CMD_BLOCK_STATUS unless we negotiated a meta context. But when you mix non-default settings (using nbd_set_strict to disable STRICT_COMMANDS) to send a block status without having negotiated it, coupled with a non-compliant

Typing nbdsh --con (the minimum to get an unambiguous prefix for --connect, different from --command) is annoying compared to having a short option. Since it takes a URI as an argument, using -u seems like a reasonable mnemonic. --- sh/nbdsh.pod | 6 ++++-- python/nbdsh.py | 2 +- sh/test-context.sh | 8 ++++---- sh/test-pattern.sh | 2 +- 4 files changed, 10 insertions(+), 8

A devious plugin can cause an 8-fold increase in the reply size in relation to the request size, by alternating status every byte of the request. In the worst case, this can cause the client to reject our response and kill the connection because the response is too large. What's more, it consumes a lot of memory to track that many extents. Let's put an upper bound on the maximum number of

On 10/18/19 10:39 AM, Richard W.M. Jones wrote: > This adds a new API for connecting to AF_VSOCK protocol > (https://wiki.qemu.org/Features/VirtioVsock). > > For example: > > nbd_connect_vsock (nbd, 2, 10809); > > There is no test of this feature because it only works between guest > and host. You cannot start a server and client on the host and talk > between

On Tue, Jan 31, 2023 at 11:52:27AM +0000, Richard W.M. Jones wrote: > On Tue, Jan 31, 2023 at 01:33:25PM +0200, Nir Soffer wrote: > > On Tue, Jan 31, 2023 at 12:34 AM Richard W.M. Jones <rjones at redhat.com> wrote: > > > > > > On Fri, Nov 04, 2022 at 04:18:31PM -0500, Eric Blake wrote: > > > > Document all options in --help output. If -n is not in

When using nbdsh for scripting, it is convenient to let nbdsh fail with status 1 when encountering an API failure. However, doing so by letting the nbd.Error exception leak all the way causes ABRT (at least on Fedora 32 with abrt-python3-handler installed) to assume the program crashed from a programming error, and needlessly complicates clients to have to add try: blocks. Better is if nbdsh

On Tue, Jan 31, 2023 at 01:33:25PM +0200, Nir Soffer wrote: > On Tue, Jan 31, 2023 at 12:34 AM Richard W.M. Jones <rjones at redhat.com> wrote: > > > > On Fri, Nov 04, 2022 at 04:18:31PM -0500, Eric Blake wrote: > > > Document all options in --help output. If -n is not in use, then > > > enhance the banner to print the current state of h, and further tailor

On Thu, Aug 06, 2020 at 09:23:46PM -0500, Eric Blake wrote: > + if (!filename == !directory) { A bit tricksy. In plugins/nbd/nbd.c I used: int c = !!sockname + !!hostname + !!uri + (command.size > 0) + (socket_fd >= 0) + !!raw_cid; /* Check the user passed exactly one connection parameter. */ if (c > 1) { nbdkit_error ("cannot mix Unix ‘socket’, TCP

Copies heavily after a similar addition recently made in nbdkit. --- I'm not sure if .1 or .3 fits better for the man page. With nbdkit, .1 made sense because 'nbdkit' is a standalone program; but with libnbd, our only standalone is nbdsh, yet naming it nbdsh-security seems off. docs/Makefile.am | 7 +++++++ docs/libnbd-security.pod | 32 ++++++++++++++++++++++++++++++++

On 9/15/19 9:55 AM, Richard W.M. Jones wrote: > The source for the easter egg example is not included, but it is: > > org 0x7c00 > ; clear screen > mov ah,0 > mov al,3 > int 0x10 > ; print string > mov ah,0x13 > mov bl,0xa > mov al,1 > mov cx,len > mov dh,0 >

On 9/26/20 11:36 AM, Richard W.M. Jones wrote: > --- > info/Makefile.am | 4 + > info/info-map-base-allocation-json.sh | 52 ++++++++++ > info/info-map-base-allocation.sh | 49 ++++++++++ > info/nbdinfo.c | 134 ++++++++++++++++++++++++-- > info/nbdinfo.pod | 39 +++++++- > 5 files changed, 271

This is a series of patches to libnbd and nbdkit adding AF_VSOCK support. On the host side it allows you to start an nbdkit instance which listens on a virtio-vsock socket: $ ./nbdkit -fv --vsock memory 1G ... nbdkit: debug: bound to vsock 2:10809 On the guest side you can then use libnbd to connect to the server: $ ./run nbdsh -c 'h.connect_vsock(2, 10809)' -c

We discovered a possible Downgrade Attack in libnbd. Lifecycle --------- Reported: 2019-09-14 Fixed: 2019-09-16 Published: 2019-09-16 There is no CVE number assigned for this issue yet, but the bug is being categorized and processed by Red Hat's security team which may result in a CVE being published later. Description ----------- Libnbd includes the method nbd_set_tls(h,

When using nbdsh for scripting, it is convenient to let nbdsh fail with status 1 when encountering an API failure. However, doing so by letting the nbd.Error exception leak all the way causes ABRT (on Fedora 32 at least) to assume the program crashed from a programming error, and needlessly complicates clients to have to add try: blocks. Better is if nbdsh itself prints the same stack trace that

We decided to not request the "base:allocation" context by default (if a client wants to use block_status on a different context, then they'd have to get any default request out of the way); however, block status is useless without at least one meta context. This adds a convenience knob for requesting that, and has the nice benefit of working with the --connect command line option

On 9/24/19 4:23 PM, Richard W.M. Jones wrote: > The cover letter was rather brief, let me try to explain this change > some more ... > > When we created libnbd, we needed the definitions of various NBD > protocol things (like protocol message layouts, constants etc). We > copied a header file from nbdkit which provided these. Over time this > header file has diverged from

Try doing: $ nbdsh nbd> h.connect_command (["nbdkit", "-s", "null"]) At this point you may observe your laptop fan starts to spin and nbdkit is consuming 100% of CPU. In all other respects everything works fine, you can send commands etc. Anyway I tracked the issue down. nbdkit sits in a loop continuously reading stdin, each read(2) call returning EAGAIN.

This program allows you to turn a network block device source into a FUSE filesystem containing a virtual file: $ nbdkit memory 128M $ mkdir mp $ nbdfuse mp/ramdisk nbd://localhost & $ ls -l mp total 0 -rw-rw-rw-. 1 rjones rjones 134217728 Oct 12 15:09 ramdisk $ dd if=/dev/urandom bs=1M count=128 of=mp/ramdisk conv=notrunc,nocreat 128+0 records in 128+0 records out

On Sat, Jul 15, 2023 at 08:49:51PM -0500, Eric Blake wrote: > A compliant server should not send NBD_REPLY_TYPE_BLOCK_STATUS unless > we successfully negotiated a meta context. And our default strictness > settings refuse to let us send NBD_CMD_BLOCK_STATUS unless we > negotiated a meta context. But when you mix non-default settings > (using nbd_set_strict to disable

With new enough libnbd, we already support vsock by virtue of uri=; however, it's also nice to allow direct exposure of the nbd_connect_vsock() api. Signed-off-by: Eric Blake <eblake@redhat.com> --- As with commit 7ce9feef, there is no easy way to add testsuite coverage for this. plugins/nbd/nbdkit-nbd-plugin.pod | 30 +++++++++----- plugins/nbd/nbd.c | 65