nbdkit-release-notes-1.421

Security

nbdkit-ip-filter(1) has been fixed to close an information leak. In an unusual configuration of the filter, it could leak the list of exports to clients that are supposed to be blocked.

All past security issues and information about how to report new ones can be found in nbdkit-security(1).

Plugins

nbdkit-ondemand-plugin(1) now allows more characters to appear in filenames. Colons are now allowed, so filenames containing MAC addresses can be used, which is useful when using NBD in pre-boot environments. Also add the "share=true" option to allow sharing. (Thanks Markus Hartung)

nbdkit-vddk-plugin(1) now prints the default list of transports in --dump-plugin output. Also this plugin now handles partial chunks correctly when reading extents for disks with a non-aligned size (thanks Ming Xie).

Filters

New nbdkit-time-limit-filter(1) can be used to specify the maximum time limit for a connection. (See also the new --timeout option below).

New nbdkit-lzip-filter(1) implements random access to lzip-compressed files (Jan Felix Langenbach).

Language bindings

Multiple updates to nbdkit-rust-plugin(3) to keep up to date with latest changes in the Rust language (Alan Somers).

Fix crash that happened in nbdkit-ocaml-plugin(3) plugins with OCaml ≥ 5 (thanks Guillaume Munch-Maccagnoni, Gabriel Scherer). Also update the ocamldoc documentation. Fix more OCaml 5 deprecation warnings.

Add support for Tcl 9.0 to nbdkit-tcl-plugin(3).

Server

nbdkit will now try to send the last plugin error message over the NBD protocol to the client, to provide additional information. This requires an NBD client which supports this, such as qemu ≥ 2.12 or libnbd ≥ 1.22.

New nbdkit --timeout flag can be used as a security measure to ensure that clients don't consume resources by opening lots of connections and then not negotiating (or negotiating slowly) the full NBD session.

New nbdkit --keepalive option which enables TCP-level keepalives. This is useful for detecting dead clients.

nbdkit --dump-config output now includes "timeout_option=yes|no" and "vsock_option=yes|no" reflecting whether the --timeout and --vsock options are available.

Bug fixes

Detect and warn about certain conditions which can cause the closed-source VDDK library to crash the server (Matthew Arnold, Nijin Ashok, Eric Blake).

Tests

Plugins from nbdkit 1.38 have been added to the tests/old-plugins directory.

Build

nbdkit should be buildable again on macOS.

Add support for GCC 15.