netatalk.io

Netatalk 4.2.0 is available!

The Netatalk team is proud to announce the first version in the Netatalk 4.2 release series. This release is recommended for early adopters. We made range of breaking changes under the hood, so please take a backup of your shared volumes before proceeding with an upgrade!

Security and Reliability

Netatalk 4.2 is more resilient against buffer overflows, undefined behavior, memory leaks, etc.

We are now more aggressively controlling and validating the size of buffers, check for NULL pointers, free dynamically allocated memory, initialize variables before use, control filesystem access with file handlers to avoid race conditions, and so on.

For the first time ever, we pass our own Quality Gate on SonarQube.

While we haven’t seen any side effects in our testing, there is a small chance that edge cases are seeing different behavior now, for instance due to C strings being truncated instead of allowed to overflow. If you find new bugs, please report them to us!

iniparser

Netatalk 4.2 is now depending on the iniparser shared library on your system. We have completed eliminated our bundled fork/hacked version of iniparser.

As a result, iniparser is now a hard dependency for Netatalk. Among our officially supported operating systems, only Oracle Solaris is lacking a packaged iniparser library. On Solaris, you can build your own shared library from upstream tarball. The iniparser library is written in pure C and has no dependencies, so it’s trivial to build.

Since we had several local hacks to iniparser, this leads to a handful of changed behaviors:

• So far, Netatalk has relied on ini section names for volume names. However, upstream iniparser treats section names as case insensitive, and will force them to lowercase internally. Hence, you will see that by default, your volumes are now named in all lowercase. For instance, if your volume section is defined as [My AFP Volume] it will be mounted as my afp volume on a Mac.
• To get around the above, we have introduced a volume name afp.conf volume section option to customize case insensitive names for your volumes.
• We no longer support the include directive in afp.conf. This was used to dynamically load secondary ini files from within afp.conf. If there is enough demand, we can consider introducing equivalent functionality in the future.

Markdown docs

All XML documentation has been converted to Markdown. We now depend on cmark to transcode Markdown to roff man pages, and cmark-gfm for html pages (because of the Markdown tables extension).

This removes Netatalk’s dependency on DocBook XSL and the XML stack to build documentation.

Changes to afp.conf settings

A handful of afp.conf settings have been added, removed, or changed.

• appledouble has been removed – the filesystem metadata settings are now controlled solely by the ea option
• server name has been added – enables the AFP server name to be set independently of hostname
• zeroconf name has been removed – folded into server name
• volume name has been added – used for setting case sensitive volume names; see iniparser section above
• fce ignore names has been modified – now takes a comma delineated list rather than forward slash delineated

Changes to Meson build system options

Overall, the Meson build system has been cleaned up to remove autoconf-isms and obsolete flags.

• -Dwith-shadow has been removed – we always use shadow passwords now when shadow.h is detected
• -Dwith-unicode-data has been added – we no longer generate new Unicode lookup tables by default; enable with this option

pap CUPS backend

We now bundle a modified version of Thomas Kaiser’s pap backend for CUPS. It will be installed next to the other CUPS backends on your system. It enables printing from modern computers to f.e. a LocalTalk networked Apple LaserWriter.

Edit the backend (which is shell script) to configure other printer models.

Please note that the upcoming CUPS v3 is expected to do away with custom backends. CUPS v2 is recommended.

Secure tmp file handling

Temporary file handling has been standardized and made more secure. Rather than hard coding to /tmp, we are now sensitive to the standard TMPDIR env variable. Also, temporary files will be put under unique named subdirs (netatalk-[pid]) to the tmp folder.

Docker container

Several new features have been added to the Docker container.

• DROPBOX – enables guest access with read/write access to the secondary shared volume. Warning: This is highly insecure. Use only on trusted networks.
• AFP_MIMIC_MODEL – define the AFP volume icon used by macOS
• AFP_LEGACY_ICON – define the AFP volume icon used by Classic Mac OS

Additionally, the entrypoint script has been converted to POSIX shell, removing the dependency on bash.

What’s Changed

• Convert documentation from XML to Markdown by @rdmark in https://github.com/Netatalk/netatalk/pull/1905
• docs: Touch up documentation for web publishing by @rdmark in https://github.com/Netatalk/netatalk/pull/1917
• docs: Add notes on the po4a dependency to the documentation by @rdmark in https://github.com/Netatalk/netatalk/pull/1918
• docs: Use correct Markdown hyperlinks in manual by @rdmark in https://github.com/Netatalk/netatalk/pull/1920
• docs: Correct misspelling of uams_cleartxt.so by @rdmark in https://github.com/Netatalk/netatalk/pull/1922
• docs: Touch up text styling of manual pages by @rdmark in https://github.com/Netatalk/netatalk/pull/1924
• Avoid compiler complaints re: getpwnam() argument being NULL by @sqrmax in https://github.com/Netatalk/netatalk/pull/1926
• Remove traces of unsupported LDAP SASL auth by @rdmark in https://github.com/Netatalk/netatalk/pull/1925
• meson: Introduce with-unicode-data option to build case tables by @rdmark in https://github.com/Netatalk/netatalk/pull/1928
• Bundle Thomas Kaiser’s pap backend for CUPS by @rdmark in https://github.com/Netatalk/netatalk/pull/1930
• libatalk: Use getaddrinfo() instead of deprecated gethostbyname() by @rdmark in https://github.com/Netatalk/netatalk/pull/1934
• uams: Check account validity after calling pam_authenticate() by @rdmark in https://github.com/Netatalk/netatalk/pull/1935
• uams: Validate PAM account after root auth in DHX2 UAM by @rdmark in https://github.com/Netatalk/netatalk/pull/1937
• Avoid TOCTOU conditions by @rdmark in https://github.com/Netatalk/netatalk/pull/1936
• meson: Refactor root includes list by @rdmark in https://github.com/Netatalk/netatalk/pull/1939
• meson: Clean up obsolete header and function checks by @rdmark in https://github.com/Netatalk/netatalk/pull/1947
• docker: Remove dependence on bash in entry script by @rdmark in https://github.com/Netatalk/netatalk/pull/1941
• Link with shared iniparser library by @rdmark in https://github.com/Netatalk/netatalk/pull/1948
• GitHub CI: Build without Spotlight support on macOS by @rdmark in https://github.com/Netatalk/netatalk/pull/1949
• GitHub CI: SonarQube static analysis in own workflow, using v4 action by @rdmark in https://github.com/Netatalk/netatalk/pull/1950
• Fix pointer declaration so it is a const by @sqrmax in https://github.com/Netatalk/netatalk/pull/1951
• Improved logging for the case where charset conversion fails by @sqrmax in https://github.com/Netatalk/netatalk/pull/1952
• meson: Detect cracklib library and dictionary on macOS / Homebrew by @rdmark in https://github.com/Netatalk/netatalk/pull/1953
• Memory and thread safety in afpd and libatalk by @rdmark in https://github.com/Netatalk/netatalk/pull/1954
• libatalk: Plug another two potential memory leaks by @rdmark in https://github.com/Netatalk/netatalk/pull/1955
• libatalk: Plug yet another potential memory leak by @rdmark in https://github.com/Netatalk/netatalk/pull/1956
• Avoid TOCTOU race conditions in libatalk code by @rdmark in https://github.com/Netatalk/netatalk/pull/1938
• Make testsuite AppleDouble v2 compatible, and run it in CI by @rdmark in https://github.com/Netatalk/netatalk/pull/1958
• libatalk: Use file descriptors and exclusive access to avoid TOCTOU conditions by @rdmark in https://github.com/Netatalk/netatalk/pull/1957
• libatalk: Refactor vfs write_ea() to write directly without temp file by @rdmark in https://github.com/Netatalk/netatalk/pull/1962
• libatalk: Refactor vfs ea_open() to avoid TOCTOU race condition by @rdmark in https://github.com/Netatalk/netatalk/pull/1964
• libatalk: Refactor vfs write_ea() to avoid TOCTOU race condition (take 2) by @rdmark in https://github.com/Netatalk/netatalk/pull/1965
• Fix high severity memory safety bugs by @rdmark in https://github.com/Netatalk/netatalk/pull/1966
• Config file handling compatible with upstream iniparser by @rdmark in https://github.com/Netatalk/netatalk/pull/1968
• docs: Create a more navigation friendly local html manual by @rdmark in https://github.com/Netatalk/netatalk/pull/1969
• docs: Correct description of hostname option in afp.conf by @rdmark in https://github.com/Netatalk/netatalk/pull/1970
• libatalk: Introduce standardized interface for iniparser by @rdmark in https://github.com/Netatalk/netatalk/pull/1973
• Introduce ‘server name’ Global option in afp.conf by @rdmark in https://github.com/Netatalk/netatalk/pull/1974
• docs: Elaborate on the relationship between cnid server and cnid listen by @rdmark in https://github.com/Netatalk/netatalk/pull/1975
• Rename option to ‘volume name’ rather than the ambiguous ‘name’ by @rdmark in https://github.com/Netatalk/netatalk/pull/1976
• afpd: Use servername for ASP connections with hostname fallback by @rdmark in https://github.com/Netatalk/netatalk/pull/1978
• docker: New and improved env variable options by @rdmark in https://github.com/Netatalk/netatalk/pull/1977
• docker: Introduce env variable flag for enabling debug mode in entry script by @rdmark in https://github.com/Netatalk/netatalk/pull/1979
• docker: Recommended naming pattern of the testsuite Dockerfile by @rdmark in https://github.com/Netatalk/netatalk/pull/1980
• docker: Introduce dropbox mode option for guest access by @rdmark in https://github.com/Netatalk/netatalk/pull/1981
• Control metadata settings with ‘ea’ solely, removing ‘appledouble’ option by @rdmark in https://github.com/Netatalk/netatalk/pull/1983
• meson: Disable quota on NetBSD while addressing GitHub #1225 by @rdmark in https://github.com/Netatalk/netatalk/pull/1986
• webmin: Support for recently modified afp.conf options by @rdmark in https://github.com/Netatalk/netatalk/pull/1984
• bstrlib: Protect against buffer overflow, null pointer dereference by @rdmark in https://github.com/Netatalk/netatalk/pull/1987
• Remove standards.h with macros that are defined by the build system now by @rdmark in https://github.com/Netatalk/netatalk/pull/1988
• Protect against memory leaks and out of bounds array access by @rdmark in https://github.com/Netatalk/netatalk/pull/1989
• docs: Install macipgw.conf.5 man page only with appletalk by @rdmark in https://github.com/Netatalk/netatalk/pull/1991
• atalkd: Bring back freeing of allocated memory into rtmp_delzonemap loop by @rdmark in https://github.com/Netatalk/netatalk/pull/1992
• Plug a number of potential memory leaks in optarg and error handling by @rdmark in https://github.com/Netatalk/netatalk/pull/1993
• Avoid a handful of potential memory leaks by @rdmark in https://github.com/Netatalk/netatalk/pull/1994
• cnid_dbd: Use file descriptors for managing access in scanvol check dir by @rdmark in https://github.com/Netatalk/netatalk/pull/1995
• Safer memory handling and afpd and the ftw library by @rdmark in https://github.com/Netatalk/netatalk/pull/1996
• Update asip-status.in license grant and copyright year by @rdmark in https://github.com/Netatalk/netatalk/pull/1998
• afpd: Refactor FCE file skip logic, make comma the standard delineator by @rdmark in https://github.com/Netatalk/netatalk/pull/1997
• afpd: Additional buffer length sanity checks in appl.c by @rdmark in https://github.com/Netatalk/netatalk/pull/2001
• afpd: Use explicitly sized buffer for desktop file with appl data by @rdmark in https://github.com/Netatalk/netatalk/pull/2003
• afpd: In enumerate module, more precise check for buffer space by @rdmark in https://github.com/Netatalk/netatalk/pull/2004
• libatalk: Double check before freeing memory, reverting previous fix for ftw by @rdmark in https://github.com/Netatalk/netatalk/pull/2005
• afpd: Use MAXPATHLEN macro to manage limits in enumerate_loop by @rdmark in https://github.com/Netatalk/netatalk/pull/2007
• libatalk: Bail out early when actsize is 0 in ftw library by @rdmark in https://github.com/Netatalk/netatalk/pull/2008
• libatalk: In the ftw library, use manual memory allocation instead of realloc() by @rdmark in https://github.com/Netatalk/netatalk/pull/2009
• libatalk: atalk/util.h is needed for MIN/MAX macros on Solaris by @rdmark in https://github.com/Netatalk/netatalk/pull/2010
• Remove MIN/MAX macros that are already defined centrally by @rdmark in https://github.com/Netatalk/netatalk/pull/2011
• libatalk: Protect against very large entry sizes in ftw dirstream by @rdmark in https://github.com/Netatalk/netatalk/pull/2012
• libatalk: Use standard early OSX UTF8 filename length limit in ftw by @rdmark in https://github.com/Netatalk/netatalk/pull/2013
• Update uams_guest.c with accurate copyright header by @rdmark in https://github.com/Netatalk/netatalk/pull/1999
• Protect against null pointer dereference; use correct return values; division by zero by @rdmark in https://github.com/Netatalk/netatalk/pull/2014
• Thoroughly initialize variables to avoid accessing garbage data by @rdmark in https://github.com/Netatalk/netatalk/pull/2015
• Address a last handful of accessing garbage values by @rdmark in https://github.com/Netatalk/netatalk/pull/2016
• Initialize the last few variables that were once flagged as: uninitialized ok by @rdmark in https://github.com/Netatalk/netatalk/pull/2017
• Eliminate obsoleted NO_REAL_USER_NAME capability flag macro by @rdmark in https://github.com/Netatalk/netatalk/pull/2018
• docs: Clean up markdown indentation in manual and man pages by @rdmark in https://github.com/Netatalk/netatalk/pull/2020
• docs: Rearrange sections on the afp.conf man page for better organization by @rdmark in https://github.com/Netatalk/netatalk/pull/2021
• Update afp_util.c with named copyright holder by @rdmark in https://github.com/Netatalk/netatalk/pull/2022
• Update email address for contributor Joe Clarke by @rdmark in https://github.com/Netatalk/netatalk/pull/2023
• afpd: Register FCE file creation event when copying files by @rdmark in https://github.com/Netatalk/netatalk/pull/2027
• libatalk: Undefine _FORTIFY_SOURCE macro only when defined by @rdmark in https://github.com/Netatalk/netatalk/pull/2028
• GitHub CI: Build on DragonflyBSD without krb5 by @rdmark in https://github.com/Netatalk/netatalk/pull/2030
• Remove remnants of nested afp.conf ini file inclusion by @rdmark in https://github.com/Netatalk/netatalk/pull/2029
• libatalk: Secure global temp dir handling in libatalk util module by @rdmark in https://github.com/Netatalk/netatalk/pull/2031
• Always use at functions of the standard C library by @rdmark in https://github.com/Netatalk/netatalk/pull/2034
• meson: Clean up a multitude of obsoleted compatibility macros by @rdmark in https://github.com/Netatalk/netatalk/pull/2035
• meson: Cross-platform crypt library detection; always use shadow when available by @rdmark in https://github.com/Netatalk/netatalk/pull/2036
• GitHub CI: Don’t build with PAM on OpenBSD by @rdmark in https://github.com/Netatalk/netatalk/pull/2042
• afpd: Use getpwnam_shadow() for basic auth on OpenBSD by @rdmark in https://github.com/Netatalk/netatalk/pull/2040
• libatalk: IPv6 sockets only accept IPv6 connections on OpenBSD by @rdmark in https://github.com/Netatalk/netatalk/pull/2039
• uams: Return properly when ClearTxt shadow password has expired by @rdmark in https://github.com/Netatalk/netatalk/pull/2041
• libatalk: Use unspecified network stack by default on OpenBSD by @rdmark in https://github.com/Netatalk/netatalk/pull/2044
• afpd: Simplify getpwnam_shadow() compatibility code by @rdmark in https://github.com/Netatalk/netatalk/pull/2045
• uams: Support for OpenBSD flavor crypt_checkpass() for password validation by @rdmark in https://github.com/Netatalk/netatalk/pull/2037
• [webmin] Add RandNum UAM option to Global config. by @NJRoadfan in https://github.com/Netatalk/netatalk/pull/2047
• Use BSD extension strlcpy/strlcat/snprintf to manage buffer size by @rdmark in https://github.com/Netatalk/netatalk/pull/2048
• getzones: do not attempt to bind to the address we’re also going to send packets to by @cheesestraws in https://github.com/Netatalk/netatalk/pull/2051
• meson: Remove legacy IRIX XFS extended attributes API by @rdmark in https://github.com/Netatalk/netatalk/pull/2052
• Consolidate redundant code and headers in testsuite by @rdmark in https://github.com/Netatalk/netatalk/pull/2053
• Handle errors in f|chdir() and remove unused daemonize() params by @rdmark in https://github.com/Netatalk/netatalk/pull/2054
• Remove redundant parentheses from return statements by @rdmark in https://github.com/Netatalk/netatalk/pull/2055
• getiface.c: fix headers order for Apple by @barracuda156 in https://github.com/Netatalk/netatalk/pull/2056
• Remove redundant parentheses in function calls and if statements by @rdmark in https://github.com/Netatalk/netatalk/pull/2057
• Fix ad cp loss of FinderInfo by @NJRoadfan in https://github.com/Netatalk/netatalk/pull/2058
• Apply additional hardening to the Netatalk Metadata EA handling by @NJRoadfan in https://github.com/Netatalk/netatalk/pull/2059
• Fix for CNID error with ad mv utility by @NJRoadfan in https://github.com/Netatalk/netatalk/pull/2060
• GitHub CI: Bump vmactions runner to FreeBSD 13.5 by @rdmark in https://github.com/Netatalk/netatalk/pull/2062
• docker: Introduce test container that runs Debian Trixie by @rdmark in https://github.com/Netatalk/netatalk/pull/2061
• Improve and harden the FCE listener app by @rdmark in https://github.com/Netatalk/netatalk/pull/2063
• meson: Standardize lists of features as bar separated lower-case words by @rdmark in https://github.com/Netatalk/netatalk/pull/2064
• testsuite: Print a list of failed tests at the end of a test run by @rdmark in https://github.com/Netatalk/netatalk/pull/2065

New Contributors

• @sqrmax made their first contribution in https://github.com/Netatalk/netatalk/pull/1926
• @cheesestraws made their first contribution in https://github.com/Netatalk/netatalk/pull/2051
• @barracuda156 made their first contribution in https://github.com/Netatalk/netatalk/pull/2056

Full Changelog: https://github.com/Netatalk/netatalk/compare/netatalk-4-1-1…netatalk-4-2-0

Footnotes

Release published on 2025-03-31

Generated from GitHub Release Notes