net-misc/rsync: Rev bump to fix CVE-2017-16548

Bug: https://bugs.gentoo.org/636714
Package-Manager: Portage-2.3.13, Repoman-2.3.4

2 files changed, 106 insertions, 0 deletions

diff --git a/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch
new file mode 100644
index 000000000000..d06607cf772c
--- /dev/null
+++ b/net-misc/rsync/files/rsync-3.1.2-CVE-2017-16548.patch
@@ -0,0 +1,17 @@
+X-Git-Url: https://git.samba.org/rsync.git/?p=rsync.git;a=blobdiff_plain;f=xattrs.c;h=4867e6f5b8ad2934d43b06f3b99b7b3690a6dc7a;hp=68305d7559b34f5cc2f196b74429b82fa6ff49dd;hb=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hpb=bc112b0e7feece62ce98708092306639a8a53cce
+
+diff --git a/xattrs.c b/xattrs.c
+index 68305d7..4867e6f 100644
+--- a/xattrs.c
++++ b/xattrs.c
+@@ -824,6 +824,10 @@ void receive_xattr(int f, struct file_struct *file)
+ 			out_of_memory("receive_xattr");
+ 		name = ptr + dget_len + extra_len;
+ 		read_buf(f, name, name_len);
++		if (name_len < 1 || name[name_len-1] != '\0') {
++			rprintf(FERROR, "Invalid xattr name received (missing trailing \\0).\n");
++			exit_cleanup(RERR_FILEIO);
++		}
+ 		if (dget_len == datum_len)
+ 			read_buf(f, ptr, dget_len);
+ 		else {
diff --git a/net-misc/rsync/rsync-3.1.2-r1.ebuild b/net-misc/rsync/rsync-3.1.2-r1.ebuild
new file mode 100644
index 000000000000..d74d49690719
--- /dev/null
+++ b/net-misc/rsync/rsync-3.1.2-r1.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit eutils flag-o-matic prefix systemd
+
+DESCRIPTION="File transfer program to keep remote files into sync"
+HOMEPAGE="https://rsync.samba.org/"
+SRC_URI="https://rsync.samba.org/ftp/rsync/src/${P}.tar.gz"
+[[ "${PV}" = *_pre* ]] && SRC_URI="https://rsync.samba.org/ftp/rsync/src-previews/${P/_/}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+if [[ ${PV} != *_pre ]] ; then
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+IUSE="acl examples iconv ipv6 static stunnel xattr"
+
+LIB_DEPEND="acl? ( virtual/acl[static-libs(+)] )
+	xattr? ( kernel_linux? ( sys-apps/attr[static-libs(+)] ) )
+	>=dev-libs/popt-1.5[static-libs(+)]"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	iconv? ( virtual/libiconv )"
+DEPEND="${RDEPEND}
+	static? ( ${LIB_DEPEND} )"
+
+PATCHES=( "${FILESDIR}"/${PN}-3.1.2-CVE-2017-16548.patch )
+
+S=${WORKDIR}/${P/_/}
+
+src_configure() {
+	use static && append-ldflags -static
+	econf \
+		--without-included-popt \
+		$(use_enable acl acl-support) \
+		$(use_enable xattr xattr-support) \
+		$(use_enable ipv6) \
+		$(use_enable iconv) \
+		--with-rsyncd-conf="${EPREFIX}"/etc/rsyncd.conf
+	touch proto.h-tstamp #421625
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	newconfd "${FILESDIR}"/rsyncd.conf.d rsyncd
+	newinitd "${FILESDIR}"/rsyncd.init.d-r1 rsyncd
+	dodoc NEWS OLDNEWS README TODO tech_report.tex
+	insinto /etc
+	newins "${FILESDIR}"/rsyncd.conf-3.0.9-r1 rsyncd.conf
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/rsyncd.logrotate rsyncd
+
+	insinto /etc/xinetd.d
+	newins "${FILESDIR}"/rsyncd.xinetd-3.0.9-r1 rsyncd
+
+	# Install stunnel helpers
+	if use stunnel ; then
+		emake DESTDIR="${D}" install-ssl-client
+		emake DESTDIR="${D}" install-ssl-daemon
+	fi
+
+	# Install the useful contrib scripts
+	if use examples ; then
+		exeinto /usr/share/rsync
+		doexe support/*
+		rm -f "${ED}"/usr/share/rsync/{Makefile*,*.c}
+	fi
+
+	eprefixify "${ED}"/etc/{,xinetd.d}/rsyncd*
+
+	systemd_dounit "${FILESDIR}/rsyncd.service"
+}
+
+pkg_postinst() {
+	if egrep -qis '^[[:space:]]use chroot[[:space:]]*=[[:space:]]*(no|0|false)' \
+		"${EROOT}"/etc/rsyncd.conf "${EROOT}"/etc/rsync/rsyncd.conf ; then
+		ewarn "You have disabled chroot support in your rsyncd.conf.  This"
+		ewarn "is a security risk which you should fix.  Please check your"
+		ewarn "/etc/rsyncd.conf file and fix the setting 'use chroot'."
+	fi
+	if use stunnel ; then
+		einfo "Please install \">=net-misc/stunnel-4\" in order to use stunnel feature."
+		einfo
+		einfo "You maybe have to update the certificates configured in"
+		einfo "${EROOT}/etc/stunnel/rsync.conf"
+	fi
+}