summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas Deutschmann <whissi@gentoo.org>2017-11-14 23:40:01 +0100
committerThomas Deutschmann <whissi@gentoo.org>2017-11-14 23:40:01 +0100
commit61f33ecb79092b9b86d8a95da0950215e6194122 (patch)
tree15c21da44af7829d37650405c9d71fc6ff34b646 /net-misc/rsync
parentnet-misc/openssh: Rev bump to fix CVE-2017-15906 (diff)
downloadgentoo-61f33ecb79092b9b86d8a95da0950215e6194122.tar.gz
gentoo-61f33ecb79092b9b86d8a95da0950215e6194122.tar.bz2
gentoo-61f33ecb79092b9b86d8a95da0950215e6194122.zip
net-misc/rsync: Rev bump to fix CVE-2017-16548
Bug: https://bugs.gentoo.org/636714 Package-Manager: Portage-2.3.13, Repoman-2.3.4
Diffstat (limited to 'net-misc/rsync')
-rw-r--r--net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch17
-rw-r--r--net-misc/rsync/rsync-3.1.2-r1.ebuild89
2 files changed, 106 insertions, 0 deletions
diff --git a/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch
new file mode 100644
index 00000000000..d06607cf772
--- /dev/null
+++ b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch
@@ -0,0 +1,17 @@
+X-Git-Url: https://git.samba.org/rsync.git/?p=rsync.git;a=blobdiff_plain;f=xattrs.c;h=4867e6f5b8ad2934d43b06f3b99b7b3690a6dc7a;hp=68305d7559b34f5cc2f196b74429b82fa6ff49dd;hb=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hpb=bc112b0e7feece62ce98708092306639a8a53cce
+
+diff --git a/xattrs.c b/xattrs.c
+index 68305d7..4867e6f 100644
+--- a/xattrs.c
++++ b/xattrs.c
+@@ -824,6 +824,10 @@ void receive_xattr(int f, struct file_struct *file)
+ out_of_memory("receive_xattr");
+ name = ptr + dget_len + extra_len;
+ read_buf(f, name, name_len);
++ if (name_len < 1 || name[name_len-1] != '\0') {
++ rprintf(FERROR, "Invalid xattr name received (missing trailing \\0).\n");
++ exit_cleanup(RERR_FILEIO);
++ }
+ if (dget_len == datum_len)
+ read_buf(f, ptr, dget_len);
+ else {
diff --git a/net-misc/rsync/rsync-3.1.2-r1.ebuild b/net-misc/rsync/rsync-3.1.2-r1.ebuild
new file mode 100644
index 00000000000..d74d4969071
--- /dev/null
+++ b/net-misc/rsync/rsync-3.1.2-r1.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit eutils flag-o-matic prefix systemd
+
+DESCRIPTION="File transfer program to keep remote files into sync"
+HOMEPAGE="https://rsync.samba.org/"
+SRC_URI="https://rsync.samba.org/ftp/rsync/src/${P}.tar.gz"
+[[ "${PV}" = *_pre* ]] && SRC_URI="https://rsync.samba.org/ftp/rsync/src-previews/${P/_/}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+if [[ ${PV} != *_pre ]] ; then
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+IUSE="acl examples iconv ipv6 static stunnel xattr"
+
+LIB_DEPEND="acl? ( virtual/acl[static-libs(+)] )
+ xattr? ( kernel_linux? ( sys-apps/attr[static-libs(+)] ) )
+ >=dev-libs/popt-1.5[static-libs(+)]"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ iconv? ( virtual/libiconv )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )"
+
+PATCHES=( "${FILESDIR}"/${PN}-3.1.2-CVE-2017-16548.patch )
+
+S=${WORKDIR}/${P/_/}
+
+src_configure() {
+ use static && append-ldflags -static
+ econf \
+ --without-included-popt \
+ $(use_enable acl acl-support) \
+ $(use_enable xattr xattr-support) \
+ $(use_enable ipv6) \
+ $(use_enable iconv) \
+ --with-rsyncd-conf="${EPREFIX}"/etc/rsyncd.conf
+ touch proto.h-tstamp #421625
+}
+
+src_install() {
+ emake DESTDIR="${D}" install
+ newconfd "${FILESDIR}"/rsyncd.conf.d rsyncd
+ newinitd "${FILESDIR}"/rsyncd.init.d-r1 rsyncd
+ dodoc NEWS OLDNEWS README TODO tech_report.tex
+ insinto /etc
+ newins "${FILESDIR}"/rsyncd.conf-3.0.9-r1 rsyncd.conf
+
+ insinto /etc/logrotate.d
+ newins "${FILESDIR}"/rsyncd.logrotate rsyncd
+
+ insinto /etc/xinetd.d
+ newins "${FILESDIR}"/rsyncd.xinetd-3.0.9-r1 rsyncd
+
+ # Install stunnel helpers
+ if use stunnel ; then
+ emake DESTDIR="${D}" install-ssl-client
+ emake DESTDIR="${D}" install-ssl-daemon
+ fi
+
+ # Install the useful contrib scripts
+ if use examples ; then
+ exeinto /usr/share/rsync
+ doexe support/*
+ rm -f "${ED}"/usr/share/rsync/{Makefile*,*.c}
+ fi
+
+ eprefixify "${ED}"/etc/{,xinetd.d}/rsyncd*
+
+ systemd_dounit "${FILESDIR}/rsyncd.service"
+}
+
+pkg_postinst() {
+ if egrep -qis '^[[:space:]]use chroot[[:space:]]*=[[:space:]]*(no|0|false)' \
+ "${EROOT}"/etc/rsyncd.conf "${EROOT}"/etc/rsync/rsyncd.conf ; then
+ ewarn "You have disabled chroot support in your rsyncd.conf. This"
+ ewarn "is a security risk which you should fix. Please check your"
+ ewarn "/etc/rsyncd.conf file and fix the setting 'use chroot'."
+ fi
+ if use stunnel ; then
+ einfo "Please install \">=net-misc/stunnel-4\" in order to use stunnel feature."
+ einfo
+ einfo "You maybe have to update the certificates configured in"
+ einfo "${EROOT}/etc/stunnel/rsync.conf"
+ fi
+}