.gitignore

@@ -1,2 +1,2 @@
 SOURCES/libguestfs.keyring
-SOURCES/nbdkit-1.24.0.tar.gz
+SOURCES/nbdkit-1.32.5.tar.gz

.nbdkit.metadata

@@ -1,2 +1,2 @@
-1bbc40f501a7fef9eef2a39b701a71aee2fea7c4 SOURCES/libguestfs.keyring
-069720cc0d1502b007652101d293a57d7b4d7c41 SOURCES/nbdkit-1.24.0.tar.gz
+cc1b37b9cfafa515aab3eefd345ecc59aac2ce7b SOURCES/libguestfs.keyring
+c8260e2f6fb16a16cefe0cf670fc5a0f41dd7110 SOURCES/nbdkit-1.32.5.tar.gz

SOURCES/0001-cache-cow-Fix-data-corruption-in-zero-and-trim-on-un.patch

@@ -1,82 +0,0 @@
-From 99788909d9ec36e3210cf85976fe5b18da690ddd Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Wed, 4 Aug 2021 20:24:59 +0100
-Subject: [PATCH] cache, cow: Fix data corruption in zero and trim on unaligned
- tail
-
-Commit eb6009b092 ("cache, cow: Reduce use of bounce-buffer") first
-introduced in nbdkit 1.14 added an optimization of the
-read-modify-write mechanism used for unaligned heads and tails when
-zeroing in the cache layer.
-
-Unfortunately the part applied to the tail contained a mistake: It
-zeroes the end of the buffer rather than the beginning.  This causes
-data corruption when you use the zero or trim function with an offset
-and count which is not aligned to the block size.
-
-Although the bug has been around for years, a recent change made it
-more likely to happen.  Commit c1905b0a28 ("cache, cow: Use a 64K
-block size by default") increased the default block size from 4K to
-64K.  Most filesystems use a 4K block size so operations like fstrim
-will make 4K-aligned requests, and with a 4K block size also in the
-cache or cow filter the unaligned case would never have been hit
-before.
-
-We can demonstrate the bug simply by filling a buffer with data
-(100000 bytes in the example), and then trimming that data, which
-ought to zero it out.
-
-Before this commit there is data visible after the trim:
-
-$ nbdkit --filter=cow data "0x21 * 100000" --run 'nbdsh -u $uri -c "h.trim(100000, 0)" ; nbdcopy $uri - | hexdump -C'
-00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-*
-00018000  21 21 21 21 21 21 21 21  21 21 21 21 21 21 21 21  |!!!!!!!!!!!!!!!!|
-*
-000186a0
-
-After this commit the trim completely clears the data:
-
-$ nbdkit --filter=cow data "0x21 * 100000" --run 'nbdsh -u $uri -c "h.trim(100000, 0)" ; nbdcopy $uri - | hexdump -C'
-00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-*
-000186a0
-
-Thanks: Ming Xie for finding the bug
-Fixes: commit eb6009b092ae642ed25f133d487dd40ef7bf70f8
-(cherry picked from commit a0ae7b2158598ce48ac31706319007f716d01c87)
-(cherry picked from commit c0b15574647672cb5c48178333acdd07424692ef)
----
- filters/cache/cache.c | 2 +-
- filters/cow/cow.c     | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/filters/cache/cache.c b/filters/cache/cache.c
-index 91dcc43d..0616cc7b 100644
---- a/filters/cache/cache.c
-+++ b/filters/cache/cache.c
-@@ -493,7 +493,7 @@ cache_zero (struct nbdkit_next_ops *next_ops, void *nxdata,
-     ACQUIRE_LOCK_FOR_CURRENT_SCOPE (&lock);
-     r = blk_read (next_ops, nxdata, blknum, block, err);
-     if (r != -1) {
--      memset (&block[count], 0, blksize - count);
-+      memset (block, 0, count);
-       r = blk_write (next_ops, nxdata, blknum, block, flags, err);
-     }
-     if (r == -1)
-diff --git a/filters/cow/cow.c b/filters/cow/cow.c
-index 51ca64a4..1cfcc4e7 100644
---- a/filters/cow/cow.c
-+++ b/filters/cow/cow.c
-@@ -419,7 +419,7 @@ cow_zero (struct nbdkit_next_ops *next_ops, void *nxdata,
-     ACQUIRE_LOCK_FOR_CURRENT_SCOPE (&lock);
-     r = blk_read (next_ops, nxdata, blknum, block, err);
-     if (r != -1) {
--      memset (&block[count], 0, BLKSIZE - count);
-+      memset (block, 0, count);
-       r = blk_write (blknum, block, err);
-     }
-     if (r == -1)
--- 
-2.31.1
-

SOURCES/0001-ssh-Remove-left-over-comment.patch

@@ -0,0 +1,31 @@
+From e0e592775911ebe2178b04b4b20f95fea2f2fe9c Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 5 Jan 2023 16:05:33 +0000
+Subject: [PATCH] ssh: Remove left over comment
+
+This comment was left over from when I copied the libssh example code.
+It adds no value so remove it.
+
+(cherry picked from commit c93a8957efcc26652b31f5bc359dfd3c4019b4f8)
+---
+ plugins/ssh/ssh.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/plugins/ssh/ssh.c b/plugins/ssh/ssh.c
+index 6cf40c26..aaa7c2b9 100644
+--- a/plugins/ssh/ssh.c
++++ b/plugins/ssh/ssh.c
+@@ -356,10 +356,6 @@ authenticate (struct ssh_handle *h)
+     if (rc == SSH_AUTH_SUCCESS) return 0;
+   }
+ 
+-  /* Example code tries keyboard-interactive here, but we cannot use
+-   * that method from a server.
+-   */
+-
+   if (password != NULL && (method & SSH_AUTH_METHOD_PASSWORD)) {
+     rc = authenticate_password (h->session, password);
+     if (rc == SSH_AUTH_SUCCESS) return 0;
+-- 
+2.31.1
+

SOURCES/0002-server-CVE-2021-3716-reset-structured-replies-on-sta.patch

@@ -1,94 +0,0 @@
-From 6b9d4380df9bd0be91f49aad8c4f47b4e672adde Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Mon, 16 Aug 2021 13:43:29 -0500
-Subject: [PATCH] server: CVE-2021-3716 reset structured replies on starttls
-
-https://nostarttls.secvuln.info/ pointed out a series of CVEs in
-common implementation flaw in various SMTP and IMAP clients and
-servers, all with a common thread of improperly caching plaintext
-state across the STARTTLS encryption boundary; and recommended that
-other protocols with a STARTTLS operation perform a similar audit.
-
-It turns out that nbdkit has the same vulnerability in regards to the
-NBD protocol: when nbdkit is run in opportunistic TLS mode, an
-attacker is able to inject a plaintext NBD_OPT_STRUCTURED_REPLY before
-proxying everything else a client sends to the server; if the server
-then acts on that plaintext request (as nbdkit did before this patch),
-then the server ends up sending structured replies to at least
-NBD_CMD_READ, even though the client was assuming that the transition
-to TLS has ruled out a MitM attack.
-
-On the bright side, nbdkit's behavior on a second
-NBD_OPT_STRUCTURED_REPLY was to still reply with success, so a client
-that always requests structured replies after starting TLS sees no
-difference in behavior (that is, qemu 2.12 and later are immune) (had
-nbdkit given an error to the second request, that may have caused
-confusion to more clients).  And there is always the mitigation of
-using --tls=require, which lets nbdkit reject the MitM message
-pre-encryption.  However, nbd-client 3.15 to the present do not
-understand structured replies, and I have confirmed that a MitM
-attacker can thus cause a denial-of-service attack that does not
-trigger until the client does its first encrypted NBD_CMD_READ.
-
-The NBD spec has been recently tightened to declare the nbdkit
-behavior to be a security hole:
-https://github.com/NetworkBlockDevice/nbd/commit/77e55378096aa
-Fixes: eaa4c6e9a2c4bd (server: Minimal implementation of NBD Structured Replies.)
-
-(cherry picked from commit 09a13dafb7bb3a38ab52eb5501cba786365ba7fd)
-(cherry picked from commit 6185b15a81e6915734d678f0781e31d45a7941a1)
----
- docs/nbdkit-security.pod             | 11 +++++++++--
- server/protocol-handshake-newstyle.c |  3 ++-
- 2 files changed, 11 insertions(+), 3 deletions(-)
-
-diff --git a/docs/nbdkit-security.pod b/docs/nbdkit-security.pod
-index 3a28e54d..5a4e6da8 100644
---- a/docs/nbdkit-security.pod
-+++ b/docs/nbdkit-security.pod
-@@ -10,7 +10,7 @@ For how to report new security issues, see the C<SECURITY> file in the
- top level source directory, also available online here:
- L<https://github.com/libguestfs/nbdkit/blob/master/SECURITY>
- 
--=head2 CVE-2019-14850 
-+=head2 CVE-2019-14850
- denial of service due to premature opening of back-end connection
- 
- See the full announcement and links to mitigation, tests and fixes
-@@ -26,6 +26,13 @@ See the full announcement and links to mitigation, tests and fixes
- here:
- https://www.redhat.com/archives/libguestfs/2019-September/msg00272.html
- 
-+=head2 CVE-2021-3716
-+structured read denial of service attack against starttls
-+
-+See the full announcement and links to mitigation, tests and fixes
-+here:
-+https://www.redhat.com/archives/libguestfs/2021-August/msg00083.html
-+
- =head1 SEE ALSO
- 
- L<nbdkit(1)>.
-@@ -38,4 +45,4 @@ Richard W.M. Jones
- 
- =head1 COPYRIGHT
- 
--Copyright (C) 2013-2020 Red Hat Inc.
-+Copyright (C) 2013-2021 Red Hat Inc.
-diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
-index 0a76a814..b94950e2 100644
---- a/server/protocol-handshake-newstyle.c
-+++ b/server/protocol-handshake-newstyle.c
-@@ -495,7 +495,8 @@ negotiate_handshake_newstyle_options (void)
-           return -1;
-         conn->using_tls = true;
-         debug ("using TLS on this connection");
--        /* Wipe out any cached default export name. */
-+        /* Wipe out any cached state. */
-+        conn->structured_replies = false;
-         for_each_backend (b) {
-           struct handle *h = get_handle (conn, b->i);
-           free (h->default_exportname);
--- 
-2.31.1
-

SOURCES/0002-ssh-Improve-the-error-message-when-all-authenticatio.patch

@@ -0,0 +1,68 @@
+From 916f90972af60576591dea4a4f1d07e4dae6d9cf Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 5 Jan 2023 11:29:32 +0000
+Subject: [PATCH] ssh: Improve the error message when all authentication
+ methods fail
+
+The current error message:
+
+  nbdkit: ssh[1]: error: all possible authentication methods failed
+
+is confusing and non-actionable.  It's hard even for experts to
+understand the relationship between the authentication methods offered
+by a server and what we require.
+
+Try to improve the error message in some common situations, especially
+where password authentication on the server side is disabled but the
+client supplied a password=... parameter.  After this change, you will
+see an actionable error:
+
+  nbdkit: ssh[1]: error: the server does not offer password
+  authentication but you tried to use a password; if you have root
+  access to the server, try editing 'sshd_config' and setting
+  'PasswordAuthentication yes'; otherwise try setting up public key
+  authentication
+
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2158300
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit bea88cff5ac9c42f1a068ad24d43d5ed0506edaa)
+---
+ plugins/ssh/ssh.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/plugins/ssh/ssh.c b/plugins/ssh/ssh.c
+index aaa7c2b9..5a132d8f 100644
+--- a/plugins/ssh/ssh.c
++++ b/plugins/ssh/ssh.c
+@@ -361,6 +361,28 @@ authenticate (struct ssh_handle *h)
+     if (rc == SSH_AUTH_SUCCESS) return 0;
+   }
+ 
++  /* All compatible methods were tried and none worked.  Come up with
++   * an actionable diagnostic message if we recognise the problem.
++   */
++  if (!(method & SSH_AUTH_METHOD_PUBLICKEY) && password == NULL) {
++    nbdkit_error ("the server does not offer public key authentication; "
++                  "try using the password=... parameter");
++    return -1;
++  }
++  if ((method & SSH_AUTH_METHOD_PASSWORD) && password != NULL) {
++    nbdkit_error ("password authentication failed, "
++                  "is the username and password correct?");
++    return -1;
++  }
++  if (!(method & SSH_AUTH_METHOD_PASSWORD) && password != NULL) {
++    nbdkit_error ("the server does not offer password authentication "
++                  "but you tried to use a password; if you have root access "
++                  "to the server, try editing 'sshd_config' and setting "
++                  "'PasswordAuthentication yes'; otherwise try setting up "
++                  "public key authentication");
++    return -1;
++  }
++
+   nbdkit_error ("all possible authentication methods failed");
+   return -1;
+ }
+-- 
+2.31.1
+

SOURCES/0003-luks-Avoid-crash-when-image-does-not-contain-a-LUKS-.patch

@@ -0,0 +1,44 @@
+From dc86950fff020688a17b6ff0dbfea7bdb0d8f1b9 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Tue, 10 Jan 2023 08:39:11 +0000
+Subject: [PATCH] luks: Avoid crash when image does not contain a LUKS header
+
+We attempt to load the LUKS header in the prepare() callback.  If this
+fails, h->h will be NULL and we'll crash in close() when we attempt to
+access and free h->h->masterkey.
+
+This crash could have been triggered another way: if open() followed
+by close() was called, without prepare() or other callbacks.
+
+Reported-by: Ming Xie
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2159581
+(cherry picked from commit cad4b96b17ed4ad7882100efa0d9073ac9d8b11c)
+---
+ filters/luks/luks-encryption.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/filters/luks/luks-encryption.c b/filters/luks/luks-encryption.c
+index 26f81e7b..6f33e76e 100644
+--- a/filters/luks/luks-encryption.c
++++ b/filters/luks/luks-encryption.c
+@@ -856,11 +856,13 @@ load_header (nbdkit_next *next, const char *passphrase)
+ void
+ free_luks_data (struct luks_data *h)
+ {
+-  if (h->masterkey) {
+-    memset (h->masterkey, 0, h->phdr.master_key_len);
+-    free (h->masterkey);
++  if (h) {
++    if (h->masterkey) {
++      memset (h->masterkey, 0, h->phdr.master_key_len);
++      free (h->masterkey);
++    }
++    free (h);
+   }
+-  free (h);
+ }
+ 
+ uint64_t
+-- 
+2.31.1
+

SOURCES/0003-server-reset-meta-context-replies-on-starttls.patch

@@ -1,40 +0,0 @@
-From add9b794b9dc697a1b52115c997fcfb6e06bf64c Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Mon, 16 Aug 2021 13:43:29 -0500
-Subject: [PATCH] server: reset meta context replies on starttls
-
-Related to CVE-2021-3716, but not as severe.  No compliant client will
-send NBD_CMD_BLOCK_STATUS unless it first negotiates
-NBD_OPT_SET_META_CONTEXT.  If an attacker injects a premature
-SET_META_CONTEXT, either the client will never notice (because it
-never uses BLOCK_STATUS), or the client will overwrite the attacker's
-attempt with the client's own SET_META_CONTEXT request after
-encryption is enabled.  So I don't class this as having the potential
-to trigger denial-of-service due to any protocol mismatch between
-compliant client and server (I don't care what happens with
-non-compliant clients).
-
-Fixes: 26455d45 (server: protocol: Implement Block Status "base:allocation".)
-(cherry picked from commit 6c5faac6a37077cf2366388a80862bb00616d0d8)
-(cherry picked from commit 814d8103fb4b581dc01dfd25d2cd81596576f211)
----
- server/protocol-handshake-newstyle.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/server/protocol-handshake-newstyle.c b/server/protocol-handshake-newstyle.c
-index b94950e2..eb0f3961 100644
---- a/server/protocol-handshake-newstyle.c
-+++ b/server/protocol-handshake-newstyle.c
-@@ -497,6 +497,9 @@ negotiate_handshake_newstyle_options (void)
-         debug ("using TLS on this connection");
-         /* Wipe out any cached state. */
-         conn->structured_replies = false;
-+        free (conn->exportname_from_set_meta_context);
-+        conn->exportname_from_set_meta_context = NULL;
-+        conn->meta_context_base_allocation = false;
-         for_each_backend (b) {
-           struct handle *h = get_handle (conn, b->i);
-           free (h->default_exportname);
--- 
-2.31.1
-

SOURCES/0004-cow-Fix-for-qemu-6.1-which-requires-backing-format.patch

@@ -1,59 +0,0 @@
-From 3c2879a38c299b725091cea45329879e3f46fc99 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Tue, 31 Aug 2021 11:23:27 +0100
-Subject: [PATCH] cow: Fix for qemu 6.1 which requires backing format
-
-The diffing example in the manual created a qcow2 file with a backing
-file but did not specify the backing format.  However qemu 6.1 now
-requires this and fails with:
-
-  qemu-img: cow-diff.qcow2: Backing file specified without backing format
-
-or:
-
-  qemu-img: Could not change the backing file to 'cow-base.img': backing format must be specified
-
-Fix the example by adding the -F option to the command line.
-
-Also there was a test of this rebasing sequence which failed, so this
-commit updates the test too.
-
-(cherry picked from commit 618290ef33ce13b75c1a79fea1f1ffb327b5ba07)
----
- filters/cow/nbdkit-cow-filter.pod | 4 ++--
- tests/test-cow.sh                 | 4 ++--
- 2 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/filters/cow/nbdkit-cow-filter.pod b/filters/cow/nbdkit-cow-filter.pod
-index 4d5ae856..510bdd40 100644
---- a/filters/cow/nbdkit-cow-filter.pod
-+++ b/filters/cow/nbdkit-cow-filter.pod
-@@ -101,8 +101,8 @@ At the end, disconnect the client.
- Run these C<qemu-img> commands to construct a qcow2 file containing
- the differences:
- 
-- qemu-img create -f qcow2 -b nbd:localhost diff.qcow2
-- qemu-img rebase -b disk.img diff.qcow2
-+ qemu-img create -F raw -b nbd:localhost -f qcow2 diff.qcow2
-+ qemu-img rebase -F raw -b disk.img -f qcow2 diff.qcow2
- 
- F<diff.qcow2> now contains the differences between the base
- (F<disk.img>) and the changes stored in nbdkit-cow-filter.  C<nbdkit>
-diff --git a/tests/test-cow.sh b/tests/test-cow.sh
-index 8772afd7..edc4c223 100755
---- a/tests/test-cow.sh
-+++ b/tests/test-cow.sh
-@@ -72,8 +72,8 @@ fi
- # If we have qemu-img, try the hairy rebase operation documented
- # in the nbdkit-cow-filter manual.
- if qemu-img --version >/dev/null 2>&1; then
--    qemu-img create -f qcow2 -b nbd:unix:$sock cow-diff.qcow2
--    time qemu-img rebase -b cow-base.img cow-diff.qcow2
-+    qemu-img create -F raw -b nbd:unix:$sock -f qcow2 cow-diff.qcow2
-+    time qemu-img rebase -F raw -b cow-base.img -f qcow2 cow-diff.qcow2
-     qemu-img info cow-diff.qcow2
- 
-     # This checks the file we created exists.
--- 
-2.31.1
-

SOURCES/0004-curl-Enable-multi-conn-for-read-only-connections.patch

@@ -0,0 +1,95 @@
+From 3f74004478d3590840d7eba97a590b7ec954957f Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 2 Feb 2023 13:59:32 +0000
+Subject: [PATCH] curl: Enable multi-conn for read-only connections
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Comparing before and after this commit shows approximately double the
+performance.  In other tests this allowed us to download files from
+web servers at line speed.
+
+  Benchmark 1:  nbdkit -r curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run "nbdcopy -p \$uri null:"
+    Time (mean ± σ):     943.8 ms ±  18.8 ms    [User: 316.2 ms, System: 1029.7 ms]
+    Range (min … max):   923.7 ms … 989.2 ms    10 runs
+
+  Benchmark 2:  ~/d/nbdkit/nbdkit -r curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run "nbdcopy -p \$uri null:"
+    Time (mean ± σ):     455.0 ms ±   6.2 ms    [User: 542.2 ms, System: 1824.7 ms]
+    Range (min … max):   449.1 ms … 471.6 ms    10 runs
+
+  Summary
+    ' ~/d/nbdkit/nbdkit -r curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run "nbdcopy -p \$uri null:" ' ran
+      2.07 ± 0.05 times faster than ' nbdkit -r curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run "nbdcopy -p \$uri null:" '
+
+Multi-conn is enabled only when we know the connection is read-only:
+
+  $ ./nbdkit -r curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run ' nbdinfo $uri ' | grep can_multi_conn
+	can_multi_conn: true
+  $ ./nbdkit curl file:/var/tmp/jammy-server-cloudimg-amd64.raw --run ' nbdinfo $uri ' | grep can_multi_conn
+	can_multi_conn: false
+
+See also:
+https://listman.redhat.com/archives/libguestfs/2023-February/030581.html
+
+Reviewed-by: Eric Blake <eblake@redhat.com>
+(cherry picked from commit bb0f93ad7b9de451874d0c54188bf69cd37c5409)
+---
+ plugins/curl/curl.c     | 14 ++++++++++++++
+ plugins/curl/curldefs.h |  1 +
+ 2 files changed, 15 insertions(+)
+
+diff --git a/plugins/curl/curl.c b/plugins/curl/curl.c
+index e89bea99..eeba5aa4 100644
+--- a/plugins/curl/curl.c
++++ b/plugins/curl/curl.c
+@@ -455,6 +455,7 @@ curl_open (int readonly)
+     nbdkit_error ("calloc: %m");
+     return NULL;
+   }
++  h->readonly = readonly;
+ 
+   h->c = curl_easy_init ();
+   if (h->c == NULL) {
+@@ -764,6 +765,18 @@ curl_get_size (void *handle)
+   return h->exportsize;
+ }
+ 
++/* Multi-conn is safe for read-only connections, but HTTP does not
++ * have any concept of flushing so we cannot use it for read-write
++ * connections.
++ */
++static int
++curl_can_multi_conn (void *handle)
++{
++  struct curl_handle *h = handle;
++
++  return !! h->readonly;
++}
++
+ /* NB: The terminology used by libcurl is confusing!
+  *
+  * WRITEFUNCTION / write_cb is used when reading from the remote server
+@@ -907,6 +920,7 @@ static struct nbdkit_plugin plugin = {
+   .open              = curl_open,
+   .close             = curl_close,
+   .get_size          = curl_get_size,
++  .can_multi_conn    = curl_can_multi_conn,
+   .pread             = curl_pread,
+   .pwrite            = curl_pwrite,
+ };
+diff --git a/plugins/curl/curldefs.h b/plugins/curl/curldefs.h
+index f3095f92..9d4949f3 100644
+--- a/plugins/curl/curldefs.h
++++ b/plugins/curl/curldefs.h
+@@ -64,6 +64,7 @@ extern const char *user_agent;
+ /* The per-connection handle. */
+ struct curl_handle {
+   CURL *c;
++  int readonly;
+   bool accept_range;
+   int64_t exportsize;
+   char errbuf[CURL_ERROR_SIZE];
+-- 
+2.31.1
+

SOURCES/0005-vddk-Include-VDDK-major-library-version-in-dump-plug.patch

@@ -1,141 +0,0 @@
-From 9e20e2696fdb68008c9b4f1c36298f813320e381 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Sat, 23 Oct 2021 16:16:39 +0100
-Subject: [PATCH] vddk: Include VDDK major library version in --dump-plugin
- output
-
-Although it doesn't seem to be possible to get the precise VDDK
-version, With a relatively simple change we can at least return the
-VDDK major version.  Currently this can be 5, 6 or 7.
-
-(cherry picked from commit 8700649d147948897f3b97810a1dff37924bdd6e)
----
- plugins/vddk/nbdkit-vddk-plugin.pod |  4 ++++
- plugins/vddk/vddk.c                 | 29 +++++++++++++++++++----------
- tests/test-vddk-real-dump-plugin.sh |  2 ++
- 3 files changed, 25 insertions(+), 10 deletions(-)
-
-diff --git a/plugins/vddk/nbdkit-vddk-plugin.pod b/plugins/vddk/nbdkit-vddk-plugin.pod
-index 8b14eda0..822b96be 100644
---- a/plugins/vddk/nbdkit-vddk-plugin.pod
-+++ b/plugins/vddk/nbdkit-vddk-plugin.pod
-@@ -417,6 +417,10 @@ at runtime.
- If this is printed then the C<nfchostport=PORT> parameter is supported
- by this build.
- 
-+=item C<vddk_library_version=...>
-+
-+The VDDK major library version: 5, 6, 7, ...
-+
- =item C<vddk_dll=...>
- 
- Prints the full path to the VDDK shared library.  Since this requires
-diff --git a/plugins/vddk/vddk.c b/plugins/vddk/vddk.c
-index 69193504..291283f4 100644
---- a/plugins/vddk/vddk.c
-+++ b/plugins/vddk/vddk.c
-@@ -77,6 +77,7 @@ int vddk_debug_datapath = 1;
- static void *dl;                           /* dlopen handle */
- static bool init_called;                   /* was InitEx called */
- static __thread int error_suppression;     /* threadlocal error suppression */
-+static int library_version;                /* VDDK major: 5, 6, 7, ... */
- 
- static enum { NONE = 0, ZLIB, FASTLZ, SKIPZ } compression; /* compression */
- static char *config;                       /* config */
-@@ -297,7 +298,10 @@ vddk_config (const char *key, const char *value)
- static void
- load_library (bool load_error_is_fatal)
- {
--  static const char *sonames[] = {
-+  static struct {
-+    const char *soname;
-+    int library_version;
-+  } libs[] = {
-     /* Prefer the newest library in case multiple exist.  Check two
-      * possible directories: the usual VDDK installation puts .so
-      * files in an arch-specific subdirectory of $libdir (our minimum
-@@ -305,12 +309,13 @@ load_library (bool load_error_is_fatal)
-      * but our testsuite is easier to write if we point libdir
-      * directly to a stub .so.
-      */
--    "lib64/libvixDiskLib.so.7",
--    "libvixDiskLib.so.7",
--    "lib64/libvixDiskLib.so.6",
--    "libvixDiskLib.so.6",
--    "lib64/libvixDiskLib.so.5",
--    "libvixDiskLib.so.5",
-+    { "lib64/libvixDiskLib.so.7", 7 },
-+    { "libvixDiskLib.so.7",       7 },
-+    { "lib64/libvixDiskLib.so.6", 6 },
-+    { "libvixDiskLib.so.6",       6 },
-+    { "lib64/libvixDiskLib.so.5", 5 },
-+    { "libvixDiskLib.so.5",       5 },
-+    { NULL }
-   };
-   size_t i;
-   CLEANUP_FREE char *orig_error = NULL;
-@@ -323,19 +328,20 @@ load_library (bool load_error_is_fatal)
-     }
-   }
- 
--  for (i = 0; i < sizeof sonames / sizeof sonames[0]; ++i) {
-+  for (i = 0; libs[i].soname != NULL; ++i) {
-     CLEANUP_FREE char *path;
- 
-     /* Set the full path so that dlopen will preferentially load the
-      * system libraries from the same directory.
-      */
--    if (asprintf (&path, "%s/%s", libdir, sonames[i]) == -1) {
-+    if (asprintf (&path, "%s/%s", libdir, libs[i].soname) == -1) {
-       nbdkit_error ("asprintf: %m");
-       exit (EXIT_FAILURE);
-     }
- 
-     dl = dlopen (path, RTLD_NOW);
-     if (dl != NULL) {
-+      library_version = libs[i].library_version;
-       /* Now that we found the library, ensure that LD_LIBRARY_PATH
-        * includes its directory for all future loads.  This may modify
-        * path in-place and/or re-exec nbdkit, but that's okay.
-@@ -356,10 +362,12 @@ load_library (bool load_error_is_fatal)
-                   "If '%s' is located on a non-standard path you may need to\n"
-                   "set libdir=/path/to/vmware-vix-disklib-distrib.\n\n"
-                   "See nbdkit-vddk-plugin(1) man page section \"LIBRARY LOCATION\" for details.",
--                  orig_error ? : "(unknown error)", sonames[0]);
-+                  orig_error ? : "(unknown error)", libs[0].soname);
-     exit (EXIT_FAILURE);
-   }
- 
-+  assert (library_version >= 5);
-+
-   /* Load symbols. */
- #define STUB(fn,ret,args)                                         \
-   do {                                                            \
-@@ -474,6 +482,7 @@ vddk_dump_plugin (void)
- 
-   printf ("vddk_default_libdir=%s\n", VDDK_LIBDIR);
-   printf ("vddk_has_nfchostport=1\n");
-+  printf ("vddk_library_version=%d\n", library_version);
- 
- #if defined(HAVE_DLADDR)
-   /* It would be nice to print the version of VDDK from the shared
-diff --git a/tests/test-vddk-real-dump-plugin.sh b/tests/test-vddk-real-dump-plugin.sh
-index 1479e416..59c79693 100755
---- a/tests/test-vddk-real-dump-plugin.sh
-+++ b/tests/test-vddk-real-dump-plugin.sh
-@@ -51,10 +51,12 @@ rm -f $files
- cleanup_fn rm -f $files
- 
- nbdkit -f -v vddk libdir="$vddkdir" --dump-plugin > $out
-+cat $out
- 
- # Check the vddk_* entries are set.
- grep ^vddk_default_libdir= $out
- grep ^vddk_has_nfchostport= $out
-+grep ^vddk_library_version= $out
- grep ^vddk_dll= $out
- 
- dll="$(grep ^vddk_dll $out | cut -d= -f2)"
--- 
-2.31.1
-

SOURCES/0006-vddk-Only-print-vddk_library_version-when-we-managed.patch

@@ -1,55 +0,0 @@
-From b8b376cf39d97c9f523a9867612126088b43c523 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Sat, 23 Oct 2021 19:50:52 +0100
-Subject: [PATCH] vddk: Only print vddk_library_version when we managed to load
- the library
-
-Because --dump-plugin calls load_library (false) it won't fail if we
-didn't manage to load the library.  This results in library_version
-being 0, which we printed incorrectly.
-
-Resolve this problem by not printing the vddk_library_version entry in
-this case.
-
-Fixes: commit 8700649d147948897f3b97810a1dff37924bdd6e
-(cherry picked from commit a3fba12c3e9c2113009f556360ae0bd04c45f6bb)
----
- plugins/vddk/nbdkit-vddk-plugin.pod | 1 +
- plugins/vddk/vddk.c                 | 9 ++++++++-
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/plugins/vddk/nbdkit-vddk-plugin.pod b/plugins/vddk/nbdkit-vddk-plugin.pod
-index 822b96be..c56faddc 100644
---- a/plugins/vddk/nbdkit-vddk-plugin.pod
-+++ b/plugins/vddk/nbdkit-vddk-plugin.pod
-@@ -420,6 +420,7 @@ by this build.
- =item C<vddk_library_version=...>
- 
- The VDDK major library version: 5, 6, 7, ...
-+If this is omitted it means the library could not be loaded.
- 
- =item C<vddk_dll=...>
- 
-diff --git a/plugins/vddk/vddk.c b/plugins/vddk/vddk.c
-index 291283f4..96615749 100644
---- a/plugins/vddk/vddk.c
-+++ b/plugins/vddk/vddk.c
-@@ -482,7 +482,14 @@ vddk_dump_plugin (void)
- 
-   printf ("vddk_default_libdir=%s\n", VDDK_LIBDIR);
-   printf ("vddk_has_nfchostport=1\n");
--  printf ("vddk_library_version=%d\n", library_version);
-+
-+  /* Because load_library (false) we might not have loaded VDDK, in
-+   * which case we didn't set library_version.  Note this cannot
-+   * happen in the normal (non-debug-plugin) path because there we use
-+   * load_library (true).
-+   */
-+  if (library_version > 0)
-+    printf ("vddk_library_version=%d\n", library_version);
- 
- #if defined(HAVE_DLADDR)
-   /* It would be nice to print the version of VDDK from the shared
--- 
-2.31.1
-

SOURCES/0007-vddk-Add-support-for-VDDK-8.0.0.patch

@@ -1,53 +0,0 @@
-From e850f65053d89ad54c27280f48506da5eb631a68 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Fri, 18 Nov 2022 09:43:19 +0000
-Subject: [PATCH] vddk: Add support for VDDK 8.0.0
-
-There are no changes in any of the structures or enums that we rely on.
-
-Reported-by: Ming Xie
-Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2143889
-(cherry picked from commit dbe12ed499baeea94d603db55cad9e971e0ebcf0)
----
- plugins/vddk/nbdkit-vddk-plugin.pod | 2 +-
- plugins/vddk/vddk.c                 | 4 +++-
- 2 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/plugins/vddk/nbdkit-vddk-plugin.pod b/plugins/vddk/nbdkit-vddk-plugin.pod
-index c56faddc..c94c41eb 100644
---- a/plugins/vddk/nbdkit-vddk-plugin.pod
-+++ b/plugins/vddk/nbdkit-vddk-plugin.pod
-@@ -419,7 +419,7 @@ by this build.
- 
- =item C<vddk_library_version=...>
- 
--The VDDK major library version: 5, 6, 7, ...
-+The VDDK major library version: 5, 6, 7, 8, ...
- If this is omitted it means the library could not be loaded.
- 
- =item C<vddk_dll=...>
-diff --git a/plugins/vddk/vddk.c b/plugins/vddk/vddk.c
-index 96615749..2140789a 100644
---- a/plugins/vddk/vddk.c
-+++ b/plugins/vddk/vddk.c
-@@ -77,7 +77,7 @@ int vddk_debug_datapath = 1;
- static void *dl;                           /* dlopen handle */
- static bool init_called;                   /* was InitEx called */
- static __thread int error_suppression;     /* threadlocal error suppression */
--static int library_version;                /* VDDK major: 5, 6, 7, ... */
-+static int library_version;                /* VDDK major: 5, 6, 7, 8, ... */
- 
- static enum { NONE = 0, ZLIB, FASTLZ, SKIPZ } compression; /* compression */
- static char *config;                       /* config */
-@@ -309,6 +309,8 @@ load_library (bool load_error_is_fatal)
-      * but our testsuite is easier to write if we point libdir
-      * directly to a stub .so.
-      */
-+    { "lib64/libvixDiskLib.so.8", 8 },
-+    { "libvixDiskLib.so.8",       8 },
-     { "lib64/libvixDiskLib.so.7", 7 },
-     { "libvixDiskLib.so.7",       7 },
-     { "lib64/libvixDiskLib.so.6", 6 },
--- 
-2.31.1
-

SOURCES/copy-patches.sh

@@ -6,7 +6,7 @@ set -e
 # directory.  Use it like this:
 #   ./copy-patches.sh
 
-rhel_version=8.8
+rhel_version=9.2
 
 # Check we're in the right directory.
 if [ ! -f nbdkit.spec ]; then

SOURCES/nbdkit-1.24.0.tar.gz.sig

@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAl/3RBgRHHJpY2hAYW5u
-ZXhpYS5vcmcACgkQkXOPc+G3aKBIIRAAmgoGrmJ8aYO7z+kKgNFjd/p0QxRTZhS/
-ol59ojG6jIzN2x/C2PFbRmPB6HJTEg4anrDX04WrP6R+lID1RrH9pTFQabv0YDQC
-z49oeXAqINYHvAqgFUJCwlymd7BHEYUudLlK3yu7gQKxMM+J/2v0glpxrtLM7KlD
-vvSZkVfbvHlCWIbMWLWIaRHeoWZIXNOjsAp3uEWN2YgikDoxbXVKoh07JoQx5tJ5
-2U+a/zo4BQuRspjnhmWc252ZF/8d954/L8J+2mKvbRRf2iAmsqPgS+MNi7WKWO4K
-w7/urKn0osuOaArs5xYHJnApmJ9U88CzZpoHQkYhcGgnDOipW9ByJRzT41vVQPW5
-IluQODpZUuawWtRIwV/Eoi+LaV2gINAL48Afr02UFYj4gmYQ5TeayLP7NKRQO0VL
-jwL4Z3a0cDyUX4i1OArn2ll8THfiog38HfLb70AG1l3P1BVoVVBYWCYbs4xgC9IK
-LWkjPKuGXvkGVfZi0nCGdPTOoB1CqCXUvKHXm52FCHg12uJMrBQEivodBoCTbtl0
-fSjULQcfrovUEb4d/rDAX7EgJbFS+1jDnodaFHsmNToo3CqfkMBdhLkxG3XExwjy
-OOR34wZssjTLsLlWH/RPucWD25RDy1vdPBska9QvvO7W0p+aOtFbnttkTh5cqs45
-rHg/sDEiaLA=
-=OrsS
------END PGP SIGNATURE-----

SOURCES/nbdkit-1.32.5.tar.gz.sig

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAmO0P9URHHJpY2hAYW5u
+ZXhpYS5vcmcACgkQkXOPc+G3aKBj/w/+MahWvHpk6oOoif9pvshQ5ZXWWH8+4DCZ
+fMPQPRuU3j64tj2kUrp87zChVPkQv27v+RuQcs5OuhfB/nvCIJiK6dSMq6KQmIv2
+b3LieGAuIlhr89YIGQRi7j+R8iWiQgm+dT6BNeu3n7kbpEbJPPUHhz2YNlw1x/LJ
+mfSEh+0HXKKz7HsCDwUCenq/pCPyD4p9x0UB0xqDT7PLg3qGwpHCMTuslrX3alOu
+EYl+NDr9q266IQYGUh1zpSkobLNLvHI+TFyYEvytDnU4MylyslOdDIsA89E/y29r
+rSMl9edDjhQ/h51In1Q8rKmlXFrcwDeRUywybn09m1gu++bxls5W1LFAZvp/YBa+
+nWYv3o58epJSbhEL6NO5fl88Ea5JJYqhB+I1ezud/nJ3Uu/t9C7m69Mt96U5NhQ5
+9irjO1Przz/3ft9+t7hW2u3MFNrEA/u1+e/Jnyr4+g8ZYmM1V7hQWqGwjO09zUZT
+5xR41WHxG3ZbuUOv5r5Xt7Xvp1tiiWxiyEWOBydQwsnV9yZR/G2m3eWFE5H315r+
+qGQXbr41mnsUAG6G8VXsNwK8cu3YQkZBHm4et4wFmvI6C1n2I7jhQBoXkdi9BKj9
+Rh/h3DDmYB2Ud6G/ApWwfRFhSPM/apuUYfuYlXPKteFhtPjfbNSlHkm4hr1lFbK/
++X9eYoD9410=
+=qSZX
+-----END PGP SIGNATURE-----

SOURCES/nbdkit-find-provides

@@ -0,0 +1,23 @@
+#!/bin/bash -
+
+# Generate RPM provides automatically for nbdkit packages and filters.
+# Copyright (C) 2009-2022 Red Hat Inc.
+
+# To test:
+# find /usr/lib64/nbdkit/plugins | ./nbdkit-find-provides VER REL
+# find /usr/lib64/nbdkit/filters | ./nbdkit-find-provides VER REL
+
+ver="$1"
+rel="$2"
+
+function process_file
+{
+    if [[ $1 =~ /plugins/nbdkit-.*-plugin ]] ||
+       [[ $1 =~ /filters/nbdkit-.*-filter ]]; then
+        echo "Provides:" "$(basename $1 .so)" "=" "$ver-$rel"
+    fi
+}
+
+while read line; do
+    process_file "$line"
+done

SOURCES/nbdkit.attr

@@ -0,0 +1,3 @@
+%__nbdkit_provides %{_rpmconfigdir}/nbdkit-find-provides %{version} %{release}
+%__nbdkit_path     %{_libdir}/nbdkit/(plugins|filters)/nbdkit-.*-(plugin|filter)(\.so)?$
+%__nbdkit_flags    exeonly