commit: 61f33ecb79092b9b86d8a95da0950215e6194122 Author: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> AuthorDate: Tue Nov 14 22:40:01 2017 +0000 Commit: Thomas Deutschmann <whissi <AT> gentoo <DOT> org> CommitDate: Tue Nov 14 22:40:01 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=61f33ecb
net-misc/rsync: Rev bump to fix CVE-2017-16548 Bug: https://bugs.gentoo.org/636714 Package-Manager: Portage-2.3.13, Repoman-2.3.4 .../rsync/files/rsync-3.1.2-CVE-2017-16548.patch | 17 +++++ net-misc/rsync/rsync-3.1.2-r1.ebuild | 89 ++++++++++++++++++++++ 2 files changed, 106 insertions(+) diff --git a/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch new file mode 100644 index 00000000000..d06607cf772 --- /dev/null +++ b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch @@ -0,0 +1,17 @@ +X-Git-Url: https://git.samba.org/rsync.git/?p=rsync.git;a=blobdiff_plain;f=xattrs.c;h=4867e6f5b8ad2934d43b06f3b99b7b3690a6dc7a;hp=68305d7559b34f5cc2f196b74429b82fa6ff49dd;hb=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hpb=bc112b0e7feece62ce98708092306639a8a53cce + +diff --git a/xattrs.c b/xattrs.c +index 68305d7..4867e6f 100644 +--- a/xattrs.c ++++ b/xattrs.c +@@ -824,6 +824,10 @@ void receive_xattr(int f, struct file_struct *file) + out_of_memory("receive_xattr"); + name = ptr + dget_len + extra_len; + read_buf(f, name, name_len); ++ if (name_len < 1 || name[name_len-1] != '\0') { ++ rprintf(FERROR, "Invalid xattr name received (missing trailing \\0).\n"); ++ exit_cleanup(RERR_FILEIO); ++ } + if (dget_len == datum_len) + read_buf(f, ptr, dget_len); + else { diff --git a/net-misc/rsync/rsync-3.1.2-r1.ebuild b/net-misc/rsync/rsync-3.1.2-r1.ebuild new file mode 100644 index 00000000000..d74d4969071 --- /dev/null +++ b/net-misc/rsync/rsync-3.1.2-r1.ebuild @@ -0,0 +1,89 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI="6" + +inherit eutils flag-o-matic prefix systemd + +DESCRIPTION="File transfer program to keep remote files into sync" +HOMEPAGE="https://rsync.samba.org/"; +SRC_URI="https://rsync.samba.org/ftp/rsync/src/${P}.tar.gz"; +[[ "${PV}" = *_pre* ]] && SRC_URI="https://rsync.samba.org/ftp/rsync/src-previews/${P/_/}.tar.gz"; + +LICENSE="GPL-3" +SLOT="0" +if [[ ${PV} != *_pre ]] ; then +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" +fi +IUSE="acl examples iconv ipv6 static stunnel xattr" + +LIB_DEPEND="acl? ( virtual/acl[static-libs(+)] ) + xattr? ( kernel_linux? ( sys-apps/attr[static-libs(+)] ) ) + >=dev-libs/popt-1.5[static-libs(+)]" +RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} ) + iconv? ( virtual/libiconv )" +DEPEND="${RDEPEND} + static? ( ${LIB_DEPEND} )" + +PATCHES=( "${FILESDIR}"/${PN}-3.1.2-CVE-2017-16548.patch ) + +S=${WORKDIR}/${P/_/} + +src_configure() { + use static && append-ldflags -static + econf \ + --without-included-popt \ + $(use_enable acl acl-support) \ + $(use_enable xattr xattr-support) \ + $(use_enable ipv6) \ + $(use_enable iconv) \ + --with-rsyncd-conf="${EPREFIX}"/etc/rsyncd.conf + touch proto.h-tstamp #421625 +} + +src_install() { + emake DESTDIR="${D}" install + newconfd "${FILESDIR}"/rsyncd.conf.d rsyncd + newinitd "${FILESDIR}"/rsyncd.init.d-r1 rsyncd + dodoc NEWS OLDNEWS README TODO tech_report.tex + insinto /etc + newins "${FILESDIR}"/rsyncd.conf-3.0.9-r1 rsyncd.conf + + insinto /etc/logrotate.d + newins "${FILESDIR}"/rsyncd.logrotate rsyncd + + insinto /etc/xinetd.d + newins "${FILESDIR}"/rsyncd.xinetd-3.0.9-r1 rsyncd + + # Install stunnel helpers + if use stunnel ; then + emake DESTDIR="${D}" install-ssl-client + emake DESTDIR="${D}" install-ssl-daemon + fi + + # Install the useful contrib scripts + if use examples ; then + exeinto /usr/share/rsync + doexe support/* + rm -f "${ED}"/usr/share/rsync/{Makefile*,*.c} + fi + + eprefixify "${ED}"/etc/{,xinetd.d}/rsyncd* + + systemd_dounit "${FILESDIR}/rsyncd.service" +} + +pkg_postinst() { + if egrep -qis '^[[:space:]]use chroot[[:space:]]*=[[:space:]]*(no|0|false)' \ + "${EROOT}"/etc/rsyncd.conf "${EROOT}"/etc/rsync/rsyncd.conf ; then + ewarn "You have disabled chroot support in your rsyncd.conf. This" + ewarn "is a security risk which you should fix. Please check your" + ewarn "/etc/rsyncd.conf file and fix the setting 'use chroot'." + fi + if use stunnel ; then + einfo "Please install \">=net-misc/stunnel-4\" in order to use stunnel feature." + einfo + einfo "You maybe have to update the certificates configured in" + einfo "${EROOT}/etc/stunnel/rsync.conf" + fi +}
