[pkgsrc/pkgsrc-2017Q3]: pkgsrc/net/rsync Pullup ticket #5640 - requested by s...

[spz <spz%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/489d723ed3fb
branches:  pkgsrc-2017Q3
changeset: 408598:489d723ed3fb
user:      spz <spz%pkgsrc.org@localhost>
date:      Sun Nov 12 12:27:20 2017 +0000

description:
Pullup ticket #5640 - requested by sevan
net/rsync: security patch

Revisions pulled up:
- net/rsync/Makefile                                            1.105
- net/rsync/distinfo                                            1.45
- net/rsync/patches/patch-authenticate.c                        1.3
- net/rsync/patches/patch-xattrs.c                              1.1

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   spz
   Date:           Fri Nov 10 06:59:16 UTC 2017

   Modified Files:
           pkgsrc/net/rsync: Makefile distinfo
   Added Files:
           pkgsrc/net/rsync/patches: patch-authenticate.c patch-xattrs.c

   Log Message:
   patch for CVE-2017-16548, mitigation for weak checksums


   To generate a diff of this commit:
   cvs rdiff -u -r1.104 -r1.105 pkgsrc/net/rsync/Makefile
   cvs rdiff -u -r1.44 -r1.45 pkgsrc/net/rsync/distinfo
   cvs rdiff -u -r0 -r1.3 pkgsrc/net/rsync/patches/patch-authenticate.c
   cvs rdiff -u -r0 -r1.1 pkgsrc/net/rsync/patches/patch-xattrs.c

diffstat:

 net/rsync/Makefile                     |   5 ++++-
 net/rsync/distinfo                     |   4 +++-
 net/rsync/patches/patch-authenticate.c |  29 +++++++++++++++++++++++++++++
 net/rsync/patches/patch-xattrs.c       |  18 ++++++++++++++++++
 4 files changed, 54 insertions(+), 2 deletions(-)

diffs (91 lines):

diff -r bb6af9cf343c -r 489d723ed3fb net/rsync/Makefile
--- a/net/rsync/Makefile        Sun Nov 12 12:22:27 2017 +0000
+++ b/net/rsync/Makefile        Sun Nov 12 12:27:20 2017 +0000
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.104 2017/01/19 18:52:20 agc Exp $
+# $NetBSD: Makefile,v 1.104.8.1 2017/11/12 12:27:20 spz Exp $
 
 DISTNAME=      rsync-3.1.2
+PKGREVISION=   1
 CATEGORIES=    net
 MASTER_SITES=  http://rsync.samba.org/ftp/rsync/
 MASTER_SITES+= http://rsync.samba.org/ftp/rsync/old-versions/
@@ -18,6 +19,8 @@
 CONFIGURE_ARGS+=       --with-rsyncd-conf=${PKG_SYSCONFDIR}/rsyncd.conf
 TEST_TARGET=           test
 
+USE_TOOLS+=    perl
+
 PKG_SYSCONFSUBDIR=     rsync
 
 RCD_SCRIPTS=           rsyncd
diff -r bb6af9cf343c -r 489d723ed3fb net/rsync/distinfo
--- a/net/rsync/distinfo        Sun Nov 12 12:22:27 2017 +0000
+++ b/net/rsync/distinfo        Sun Nov 12 12:27:20 2017 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.44 2015/12/23 19:53:24 ryoon Exp $
+$NetBSD: distinfo,v 1.44.18.1 2017/11/12 12:27:20 spz Exp $
 
 SHA1 (rsync-3.1.2.tar.gz) = 0d4c7fb7fe3fc80eeff922a7c1d81df11dbb8a1a
 RMD160 (rsync-3.1.2.tar.gz) = f7d6c0c9752af8d9eb933cffc6032c1763490a04
@@ -6,3 +6,5 @@
 Size (rsync-3.1.2.tar.gz) = 892724 bytes
 SHA1 (patch-Makefile.in) = df3479e93de86524a391433a3d6e6108a797835a
 SHA1 (patch-ab) = 98aa07a50314e3309b48f803d6febb1138eae1f2
+SHA1 (patch-authenticate.c) = 0612fb141cea1509b882df78f1b90fa52b1092b0
+SHA1 (patch-xattrs.c) = 9883ea79a60c786dd5a3dc74f4872621823c9377
diff -r bb6af9cf343c -r 489d723ed3fb net/rsync/patches/patch-authenticate.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/net/rsync/patches/patch-authenticate.c    Sun Nov 12 12:27:20 2017 +0000
@@ -0,0 +1,29 @@
+$NetBSD: patch-authenticate.c,v 1.3.2.2 2017/11/12 12:27:20 spz Exp $
+
+3.1.2 is not vulnerable to CVE-2017-15994, the code is different,
+but not allowing fallback to MD4 for passwords is a good idea by now.
+Patch from
+https://git.samba.org/?p=rsync.git;a=blobdiff;f=authenticate.c;h=a106b0f60a8cb88e37080bc5e2a58ce28c66f379;hp=d60ee20b6b53a9351efbdf175f36525ead220de6;hb=9a480deec4d20277d8e20bc55515ef0640ca1e55;hpb=c252546ceeb0925eb8a4061315e3ff0a8c55b48b
+
+--- authenticate.c.orig        2015-08-24 18:54:00.000000000 +0000
++++ authenticate.c
+@@ -22,6 +22,7 @@
+ #include "itypes.h"
+ 
+ extern int read_only;
++extern int protocol_version;
+ extern char *password_file;
+ 
+ /***************************************************************************
+@@ -237,6 +238,11 @@ char *auth_server(int f_in, int f_out, i
+       if (!users || !*users)
+               return "";
+ 
++      if (protocol_version < 21) { /* Don't allow a weak checksum for the password. */
++              rprintf(FERROR, "ERROR: protocol version is too old!\n");
++              exit_cleanup(RERR_PROTOCOL);
++      }
++
+       gen_challenge(addr, challenge);
+ 
+       io_printf(f_out, "%s%s\n", leader, challenge);
diff -r bb6af9cf343c -r 489d723ed3fb net/rsync/patches/patch-xattrs.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/net/rsync/patches/patch-xattrs.c  Sun Nov 12 12:27:20 2017 +0000
@@ -0,0 +1,18 @@
+$NetBSD: patch-xattrs.c,v 1.1.2.2 2017/11/12 12:27:20 spz Exp $
+
+patch for CVE-2017-16548 from
+https://git.samba.org/rsync.git/?p=rsync.git;a=blobdiff;f=xattrs.c;h=4867e6f5b8ad2934d43b06f3b99b7b3690a6dc7a;hp=68305d7559b34f5cc2f196b74429b82fa6ff49dd;hb=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hpb=bc112b0e7feece62ce98708092306639a8a53cce
+
+--- xattrs.c.orig      2015-08-08 19:47:03.000000000 +0000
++++ xattrs.c
+@@ -696,6 +696,10 @@ void receive_xattr(int f, struct file_st
+                       out_of_memory("receive_xattr");
+               name = ptr + dget_len + extra_len;
+               read_buf(f, name, name_len);
++              if (name_len < 1 || name[name_len-1] != '\0') {
++                      rprintf(FERROR, "Invalid xattr name received (missing trailing \\0).\n");
++                      exit_cleanup(RERR_FILEIO);
++              }
+               if (dget_len == datum_len)
+                       read_buf(f, ptr, dget_len);
+               else {