Security¶

There were no security issues found. All past security issues and information about how to report new ones can be found in nbdkit-security(1).

Plugins¶

nbdkit-gzip-plugin and nbdkit-tar-plugin have been removed. They were deprecated in nbdkit 1.22. The functionality has been replaced by nbdkit-gzip-filter(1) and nbdkit-tar-filter(1) respectively.

nbdkit-streaming-plugin(1) has been deprecated and will be removed in nbdkit 1.30. You can use nbdcopy(1) instead.

nbdkit-curl-plugin(1) adds these features: "followlocation=false" to disable following redirects. "cookiefile" and "cookiejar" to control saving cookies.

nbdkit-ssh-plugin(1) now advertises multi-conn if the server is OpenSSH, improving performance (Eric Blake).

nbdkit-ondemand-plugin(1) has a new "wait=true" flag allowing you to choose between clients waiting for an export to become free or being immediately rejected.

nbdkit-sparse-random-plugin(1) now does not generate fully random data within each block. Using perf we observed that the plugin was spending 34% of the total time during benchmarks just doing this. You can enable the old behaviour using "random-content=true".

nbdkit-file-plugin(1) now checks if the file is read-only and exports a read-only NBD connection in this case (Eric Blake).

nbdkit-vddk-plugin(1) has been tested with VDDK 7.0.2.

Filters¶

There is a new API for use by filters to manage "contexts". Instead of the previous 1-1 relationship between filter connections and plugin connections, filters can now open more than one context into the backend from a single connection, or share contexts between connections (Eric Blake).

New nbdkit-multi-conn-filter(1) which allows you to add multi-conn support to plugins which don't support it (although the emulation is expensive), or change whether multi-conn is advertised to clients (Eric Blake).

nbdkit-cow-filter(1) now ignores flush/FUA requests (which are not useful for a temporary overlay). The filter now implements extents and efficient trimming. Fine-grained locking is used around shared structures, greatly improving parallel performance. Added support for multi-conn.

nbdkit-cache-filter(1) advertises multi-conn when possible (Eric Blake).

nbdkit-cache-filter and nbdkit-cow-filter can now handle arbitrary sized disks, instead of rounding the disk size down.

nbdkit-blocksize-filter(1) supports parallel requests (Eric Blake).

nbdkit-checkwrite-filter(1) supports multi-conn (Eric Blake).

nbdkit-ext2-filter(1) no longer supports multi-conn. The filter is single-threaded so it does not matter, but it was not safe. Fix trim, zero and flush support (Eric Blake).

nbdkit-readahead-filter(1) fixes multi-conn support (Eric Blake).

nbdkit-gzip-filter(1) and nbdkit-xz-filter(1) now both support multi-conn (Eric Blake).

Language bindings¶

nbdkit-python-plugin(3) supports the following new features: "after_fork" and "preconnect" methods. "nbdkit.shutdown()" binding.

nbdkit-rust-plugin(3) updated for newer Rust compiler versions (Alan Somers).

nbdkit-golang-plugin(3) now uses and requires golang modules. Golang ≥ 1.13 must be used.

API¶

New ".cleanup" callback for plugins and filters. This is called shortly before ".unload", but unlike ".unload" it is guaranteed that no plugin or filter code has been dlclosed (Eric Blake).

New "nbdkit_extents_full" is a helper function for filters which can be used to read all extents from a plugin covering a region.

Tests¶

Old plugins that we use for testing were rebuilt so they no longer depend on libselinux (thanks Thomas Weißschuh).

nbdkit-ssh-plugin(1) can still be built even if ssh-keygen is unavailable for testing it (thanks Thomas Weißschuh).

Improve tests/test-captive.sh to avoid crashes during testing.

Test coverage on FreeBSD has been improved, fewer tests should skip unnecessarily.

Build¶

nbdkit and plugins can now be built with -fvisibility=hidden, which allows the compiler to make some optimizations.

Add a dependency so nbdkit is relinked if the linker script (nbdkit.syms) changes (Eric Blake).

xorriso is now preferred over genisoimage or mkisofs (see https://wiki.debian.org/genisoimage).

It is now possible to compile nbdkit with clang with warnings enabled. Several warnings have been suppressed or fixed.

"MALLOC_CHECK_" and "MALLOC_PERTURB_" are only enabled when running the tests, not when running nbdkit from the build directory. This makes it easier to do benchmarks.

"nbdkit_peer_*" implemented on OpenBSD.

Internals¶

When fuzzing nbdkit we now recommend using the -t 1 flag (which disables threads). This improves the fuzz-stability of nbdkit.