Pullup ticket #5640 - requested by sevan

net/rsync: security patch

Revisions pulled up:
- net/rsync/Makefile                                            1.105
- net/rsync/distinfo                                            1.45
- net/rsync/patches/patch-authenticate.c                        1.3
- net/rsync/patches/patch-xattrs.c                              1.1

-------------------------------------------------------------------
   Module Name:    pkgsrc
   Committed By:   spz
   Date:           Fri Nov 10 06:59:16 UTC 2017

   Modified Files:
           pkgsrc/net/rsync: Makefile distinfo
   Added Files:
           pkgsrc/net/rsync/patches: patch-authenticate.c patch-xattrs.c

   Log Message:
   patch for CVE-2017-16548, mitigation for weak checksums


   To generate a diff of this commit:
   cvs rdiff -u -r1.104 -r1.105 pkgsrc/net/rsync/Makefile
   cvs rdiff -u -r1.44 -r1.45 pkgsrc/net/rsync/distinfo
   cvs rdiff -u -r0 -r1.3 pkgsrc/net/rsync/patches/patch-authenticate.c
   cvs rdiff -u -r0 -r1.1 pkgsrc/net/rsync/patches/patch-xattrs.c

4 files changed, 54 insertions, 2 deletions

diff --git a/net/rsync/Makefile b/net/rsync/Makefile
index 25f536e8b6e..68c41da3bae 100644
--- a/net/rsync/Makefile
+++ b/net/rsync/Makefile
@@ -1,6 +1,7 @@
-# $NetBSD: Makefile,v 1.104 2017/01/19 18:52:20 agc Exp $
+# $NetBSD: Makefile,v 1.104.8.1 2017/11/12 12:27:20 spz Exp $
 
 DISTNAME=	rsync-3.1.2
+PKGREVISION=	1
 CATEGORIES=	net
 MASTER_SITES=	http://rsync.samba.org/ftp/rsync/
 MASTER_SITES+=	http://rsync.samba.org/ftp/rsync/old-versions/
@@ -18,6 +19,8 @@ CONFIGURE_ARGS+=	--with-included-popt
 CONFIGURE_ARGS+=	--with-rsyncd-conf=${PKG_SYSCONFDIR}/rsyncd.conf
 TEST_TARGET=		test
 
+USE_TOOLS+=	perl
+
 PKG_SYSCONFSUBDIR=	rsync
 
 RCD_SCRIPTS=		rsyncd
diff --git a/net/rsync/distinfo b/net/rsync/distinfo
index bcbaf548706..b45680e3c25 100644
--- a/net/rsync/distinfo
+++ b/net/rsync/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.44 2015/12/23 19:53:24 ryoon Exp $
+$NetBSD: distinfo,v 1.44.18.1 2017/11/12 12:27:20 spz Exp $
 
 SHA1 (rsync-3.1.2.tar.gz) = 0d4c7fb7fe3fc80eeff922a7c1d81df11dbb8a1a
 RMD160 (rsync-3.1.2.tar.gz) = f7d6c0c9752af8d9eb933cffc6032c1763490a04
@@ -6,3 +6,5 @@ SHA512 (rsync-3.1.2.tar.gz) = 4c55fd69f436ead0cb5a0b7c6fdfef9bb28ddb9c63534eb619
 Size (rsync-3.1.2.tar.gz) = 892724 bytes
 SHA1 (patch-Makefile.in) = df3479e93de86524a391433a3d6e6108a797835a
 SHA1 (patch-ab) = 98aa07a50314e3309b48f803d6febb1138eae1f2
+SHA1 (patch-authenticate.c) = 0612fb141cea1509b882df78f1b90fa52b1092b0
+SHA1 (patch-xattrs.c) = 9883ea79a60c786dd5a3dc74f4872621823c9377
diff --git a/net/rsync/patches/patch-authenticate.c b/net/rsync/patches/patch-authenticate.c
new file mode 100644
index 00000000000..1bf3f056d36
--- /dev/null
+++ b/net/rsync/patches/patch-authenticate.c
@@ -0,0 +1,29 @@
+$NetBSD: patch-authenticate.c,v 1.3.2.2 2017/11/12 12:27:20 spz Exp $
+
+3.1.2 is not vulnerable to CVE-2017-15994, the code is different,
+but not allowing fallback to MD4 for passwords is a good idea by now.
+Patch from
+https://git.samba.org/?p=rsync.git;a=blobdiff;f=authenticate.c;h=a106b0f60a8cb88e37080bc5e2a58ce28c66f379;hp=d60ee20b6b53a9351efbdf175f36525ead220de6;hb=9a480deec4d20277d8e20bc55515ef0640ca1e55;hpb=c252546ceeb0925eb8a4061315e3ff0a8c55b48b
+
+--- authenticate.c.orig	2015-08-24 18:54:00.000000000 +0000
++++ authenticate.c
+@@ -22,6 +22,7 @@
+ #include "itypes.h"
+ 
+ extern int read_only;
++extern int protocol_version;
+ extern char *password_file;
+ 
+ /***************************************************************************
+@@ -237,6 +238,11 @@ char *auth_server(int f_in, int f_out, i
+ 	if (!users || !*users)
+ 		return "";
+ 
++	if (protocol_version < 21) { /* Don't allow a weak checksum for the password. */
++		rprintf(FERROR, "ERROR: protocol version is too old!\n");
++		exit_cleanup(RERR_PROTOCOL);
++	}
++
+ 	gen_challenge(addr, challenge);
+ 
+ 	io_printf(f_out, "%s%s\n", leader, challenge);
diff --git a/net/rsync/patches/patch-xattrs.c b/net/rsync/patches/patch-xattrs.c
new file mode 100644
index 00000000000..bf086c5f5e7
--- /dev/null
+++ b/net/rsync/patches/patch-xattrs.c
@@ -0,0 +1,18 @@
+$NetBSD: patch-xattrs.c,v 1.1.2.2 2017/11/12 12:27:20 spz Exp $
+
+patch for CVE-2017-16548 from
+https://git.samba.org/rsync.git/?p=rsync.git;a=blobdiff;f=xattrs.c;h=4867e6f5b8ad2934d43b06f3b99b7b3690a6dc7a;hp=68305d7559b34f5cc2f196b74429b82fa6ff49dd;hb=47a63d90e71d3e19e0e96052bb8c6b9cb140ecc1;hpb=bc112b0e7feece62ce98708092306639a8a53cce
+
+--- xattrs.c.orig	2015-08-08 19:47:03.000000000 +0000
++++ xattrs.c
+@@ -696,6 +696,10 @@ void receive_xattr(int f, struct file_st
+ 			out_of_memory("receive_xattr");
+ 		name = ptr + dget_len + extra_len;
+ 		read_buf(f, name, name_len);
++		if (name_len < 1 || name[name_len-1] != '\0') {
++			rprintf(FERROR, "Invalid xattr name received (missing trailing \\0).\n");
++			exit_cleanup(RERR_FILEIO);
++		}
+ 		if (dget_len == datum_len)
+ 			read_buf(f, ptr, dget_len);
+ 		else {