diff options
Diffstat (limited to 'yocto-poky/meta/recipes-devtools/rsync')
9 files changed, 512 insertions, 0 deletions
diff --git a/yocto-poky/meta/recipes-devtools/rsync/files/acinclude.m4 b/yocto-poky/meta/recipes-devtools/rsync/files/acinclude.m4 new file mode 100644 index 000000000..735b41dec --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/files/acinclude.m4 @@ -0,0 +1,95 @@ +dnl verbatim renamed from aclocal.m4 in rsync_3.0.7 +dnl 07/06/2010 - qhe + +dnl AC_VALIDATE_CACHE_SYSTEM_TYPE[(cmd)] +dnl if the cache file is inconsistent with the current host, +dnl target and build system types, execute CMD or print a default +dnl error message. +AC_DEFUN(AC_VALIDATE_CACHE_SYSTEM_TYPE, [ + AC_REQUIRE([AC_CANONICAL_SYSTEM]) + AC_MSG_CHECKING([config.cache system type]) + if { test x"${ac_cv_host_system_type+set}" = x"set" && + test x"$ac_cv_host_system_type" != x"$host"; } || + { test x"${ac_cv_build_system_type+set}" = x"set" && + test x"$ac_cv_build_system_type" != x"$build"; } || + { test x"${ac_cv_target_system_type+set}" = x"set" && + test x"$ac_cv_target_system_type" != x"$target"; }; then + AC_MSG_RESULT([different]) + ifelse($#, 1, [$1], + [AC_MSG_ERROR(["you must remove config.cache and restart configure"])]) + else + AC_MSG_RESULT([same]) + fi + ac_cv_host_system_type="$host" + ac_cv_build_system_type="$build" + ac_cv_target_system_type="$target" +]) + +dnl Check for socklen_t: historically on BSD it is an int, and in +dnl POSIX 1g it is a type of its own, but some platforms use different +dnl types for the argument to getsockopt, getpeername, etc. So we +dnl have to test to find something that will work. + +dnl This is no good, because passing the wrong pointer on C compilers is +dnl likely to only generate a warning, not an error. We don't call this at +dnl the moment. + +AC_DEFUN([TYPE_SOCKLEN_T], +[ + AC_CHECK_TYPE([socklen_t], ,[ + AC_MSG_CHECKING([for socklen_t equivalent]) + AC_CACHE_VAL([rsync_cv_socklen_t_equiv], + [ + # Systems have either "struct sockaddr *" or + # "void *" as the second argument to getpeername + rsync_cv_socklen_t_equiv= + for arg2 in "struct sockaddr" void; do + for t in int size_t unsigned long "unsigned long"; do + AC_TRY_COMPILE([ +#include <sys/types.h> +#include <sys/socket.h> + + int getpeername (int, $arg2 *, $t *); + ],[ + $t len; + getpeername(0,0,&len); + ],[ + rsync_cv_socklen_t_equiv="$t" + break + ]) + done + done + + if test "x$rsync_cv_socklen_t_equiv" = x; then + AC_MSG_ERROR([Cannot find a type to use in place of socklen_t]) + fi + ]) + AC_MSG_RESULT($rsync_cv_socklen_t_equiv) + AC_DEFINE_UNQUOTED(socklen_t, $rsync_cv_socklen_t_equiv, + [type to use in place of socklen_t if not defined])], + [#include <sys/types.h> +#include <sys/socket.h>]) +]) + +dnl AC_HAVE_TYPE(TYPE,INCLUDES) +AC_DEFUN([AC_HAVE_TYPE], [ +AC_REQUIRE([AC_HEADER_STDC]) +cv=`echo "$1" | sed 'y%./+- %__p__%'` +AC_MSG_CHECKING(for $1) +AC_CACHE_VAL([ac_cv_type_$cv], +AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ +AC_INCLUDES_DEFAULT +$2]], +[[$1 foo;]])], +[eval "ac_cv_type_$cv=yes"], +[eval "ac_cv_type_$cv=no"]))dnl +ac_foo=`eval echo \\$ac_cv_type_$cv` +AC_MSG_RESULT($ac_foo) +if test "$ac_foo" = yes; then + ac_tr_hdr=HAVE_`echo $1 | sed 'y%abcdefghijklmnopqrstuvwxyz./- %ABCDEFGHIJKLMNOPQRSTUVWXYZ____%'` +if false; then + AC_CHECK_TYPES($1) +fi + AC_DEFINE_UNQUOTED($ac_tr_hdr, 1, [Define if you have type `$1']) +fi +]) diff --git a/yocto-poky/meta/recipes-devtools/rsync/files/rsyncd.conf b/yocto-poky/meta/recipes-devtools/rsync/files/rsyncd.conf new file mode 100644 index 000000000..845f5b33f --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/files/rsyncd.conf @@ -0,0 +1,15 @@ +# /etc/rsyncd.conf + +# Minimal configuration file for rsync daemon +# See rsync(1) and rsyncd.conf(5) man pages for help + +# This file is required by rsync --daemon +pid file = /var/run/rsyncd.pid +use chroot = yes +read only = yes + +# Simple example for enabling your own local rsync server +#[everything] +# path = / +# comment = Everything except /etc exposed +# exclude = /etc diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsync-2.6.9-fname-obo.patch b/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsync-2.6.9-fname-obo.patch new file mode 100644 index 000000000..f054452f3 --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsync-2.6.9-fname-obo.patch @@ -0,0 +1,70 @@ +Upstream-Status: Backport [ The patch is rsync-2.6.9 specific ] + +The patch is from https://issues.rpath.com/browse/RPL-1647 and is used to +address http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4091 + +Date: Tue May 10 10:07:36 2011 +0800 +Dexuan Cui <dexuan.cui@intel.com> + +diff --git a/sender.c b/sender.c +index 6fcaa65..053a8f1 100644 +--- a/sender.c ++++ b/sender.c +@@ -123,6 +123,7 @@ void successful_send(int ndx) + char fname[MAXPATHLEN]; + struct file_struct *file; + unsigned int offset; ++ size_t l = 0; + + if (ndx < 0 || ndx >= the_file_list->count) + return; +@@ -133,6 +134,20 @@ void successful_send(int ndx) + file->dir.root, "/", NULL); + } else + offset = 0; ++ ++ l = offset + 1; ++ if (file) { ++ if (file->dirname) ++ l += strlen(file->dirname); ++ if (file->basename) ++ l += strlen(file->basename); ++ } ++ ++ if (l >= sizeof(fname)) { ++ rprintf(FERROR, "Overlong pathname\n"); ++ exit_cleanup(RERR_FILESELECT); ++ } ++ + f_name(file, fname + offset); + if (remove_source_files) { + if (do_unlink(fname) == 0) { +@@ -224,6 +239,7 @@ void send_files(struct file_list *flist, int f_out, int f_in) + enum logcode log_code = log_before_transfer ? FLOG : FINFO; + int f_xfer = write_batch < 0 ? batch_fd : f_out; + int i, j; ++ size_t l = 0; + + if (verbose > 2) + rprintf(FINFO, "send_files starting\n"); +@@ -259,6 +275,20 @@ void send_files(struct file_list *flist, int f_out, int f_in) + fname[offset++] = '/'; + } else + offset = 0; ++ ++ l = offset + 1; ++ if (file) { ++ if (file->dirname) ++ l += strlen(file->dirname); ++ if (file->basename) ++ l += strlen(file->basename); ++ } ++ ++ if (l >= sizeof(fname)) { ++ rprintf(FERROR, "Overlong pathname\n"); ++ exit_cleanup(RERR_FILESELECT); ++ } ++ + fname2 = f_name(file, fname + offset); + + if (verbose > 2) diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsyncd.conf b/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsyncd.conf new file mode 100644 index 000000000..845f5b33f --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync-2.6.9/rsyncd.conf @@ -0,0 +1,15 @@ +# /etc/rsyncd.conf + +# Minimal configuration file for rsync daemon +# See rsync(1) and rsyncd.conf(5) man pages for help + +# This file is required by rsync --daemon +pid file = /var/run/rsyncd.pid +use chroot = yes +read only = yes + +# Simple example for enabling your own local rsync server +#[everything] +# path = / +# comment = Everything except /etc exposed +# exclude = /etc diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/0001-Complain-if-an-inc-recursive-path-is-not-right-for-i.patch b/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/0001-Complain-if-an-inc-recursive-path-is-not-right-for-i.patch new file mode 100644 index 000000000..5ece5420a --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/0001-Complain-if-an-inc-recursive-path-is-not-right-for-i.patch @@ -0,0 +1,135 @@ +From 962f8b90045ab331fc04c9e65f80f1a53e68243b Mon Sep 17 00:00:00 2001 +From: Wayne Davison <wayned@samba.org> +Date: Wed, 31 Dec 2014 12:41:03 -0800 +Subject: [PATCH] Complain if an inc-recursive path is not right for its dir. + This ensures that a malicious sender can't use a just-sent symlink as a + trasnfer path. + +Upstream-Status: BackPort + +Fix the CVE-2014-9512, rsync 3.1.1 allows remote attackers to write to arbitrary +files via a symlink attack on a file in the synchronization path. + +BackPort and fix this patch to make it able to apply to source code + +Signed-off-by: Roy Li <rongqing.li@windriver.com> +--- + flist.c | 22 ++++++++++++++++++++-- + io.c | 2 +- + main.c | 4 ++-- + rsync.c | 2 +- + proto.h | 2 +- + 6 files changed, 31 insertions(+), 8 deletions(-) + +diff --git a/flist.c b/flist.c +index c24672e..92e4b65 100644 +--- a/flist.c ++++ b/flist.c +@@ -2435,8 +2435,9 @@ struct file_list *send_file_list(int f, int argc, char *argv[]) + return flist; + } + +-struct file_list *recv_file_list(int f) ++struct file_list *recv_file_list(int f, int dir_ndx) + { ++ const char *good_dirname = NULL; + struct file_list *flist; + int dstart, flags; + int64 start_read; +@@ -2492,6 +2493,23 @@ struct file_list *recv_file_list(int f) + flist_expand(flist, 1); + file = recv_file_entry(f, flist, flags); + ++ if (inc_recurse) { ++ static const char empty_dir[] = "\0"; ++ const char *cur_dir = file->dirname ? file->dirname : empty_dir; ++ if (relative_paths && *cur_dir == '/') ++ cur_dir++; ++ if (cur_dir != good_dirname) { ++ const char *d = dir_ndx >= 0 ? f_name(dir_flist->files[dir_ndx], NULL) : empty_dir; ++ if (strcmp(cur_dir, d) != 0) { ++ rprintf(FERROR, ++ "ABORTING due to invalid dir prefix from sender: %s (should be: %s)\n", ++ cur_dir, d); ++ exit_cleanup(RERR_PROTOCOL); ++ } ++ good_dirname = cur_dir; ++ } ++ } ++ + if (S_ISREG(file->mode)) { + /* Already counted */ + } else if (S_ISDIR(file->mode)) { +@@ -2615,7 +2633,7 @@ void recv_additional_file_list(int f) + rprintf(FINFO, "[%s] receiving flist for dir %d\n", + who_am_i(), ndx); + } +- flist = recv_file_list(f); ++ flist = recv_file_list(f, ndx); + flist->parent_ndx = ndx; + } + } +diff --git a/io.c b/io.c +index b9a9bd0..a868fa9 100644 +--- a/io.c ++++ b/io.c +@@ -1685,7 +1685,7 @@ void wait_for_receiver(void) + rprintf(FINFO, "[%s] receiving flist for dir %d\n", + who_am_i(), ndx); + } +- flist = recv_file_list(iobuf.in_fd); ++ flist = recv_file_list(iobuf.in_fd, ndx); + flist->parent_ndx = ndx; + #ifdef SUPPORT_HARD_LINKS + if (preserve_hard_links) +diff --git a/main.c b/main.c +index e7a13f7..713b818 100644 +--- a/main.c ++++ b/main.c +@@ -1009,7 +1009,7 @@ static void do_server_recv(int f_in, int f_out, int argc, char *argv[]) + filesfrom_fd = -1; + } + +- flist = recv_file_list(f_in); ++ flist = recv_file_list(f_in, -1); + if (!flist) { + rprintf(FERROR,"server_recv: recv_file_list error\n"); + exit_cleanup(RERR_FILESELECT); +@@ -1183,7 +1183,7 @@ int client_run(int f_in, int f_out, pid_t pid, int argc, char *argv[]) + + if (write_batch && !am_server) + start_write_batch(f_in); +- flist = recv_file_list(f_in); ++ flist = recv_file_list(f_in, -1); + if (inc_recurse && file_total == 1) + recv_additional_file_list(f_in); + +diff --git a/rsync.c b/rsync.c +index 68ff6b1..c3ecc51 100644 +--- a/rsync.c ++++ b/rsync.c +@@ -364,7 +364,7 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr, + } + /* Send all the data we read for this flist to the generator. */ + start_flist_forward(ndx); +- flist = recv_file_list(f_in); ++ flist = recv_file_list(f_in, ndx); + flist->parent_ndx = ndx; + stop_flist_forward(); + } +diff --git a/proto.h b/proto.h +index 22fc539..247c558 100644 +--- a/proto.h ++++ b/proto.h +@@ -89,7 +89,7 @@ struct file_struct *make_file(const char *fname, struct file_list *flist, + void unmake_file(struct file_struct *file); + void send_extra_file_list(int f, int at_least); + struct file_list *send_file_list(int f, int argc, char *argv[]); +-struct file_list *recv_file_list(int f); ++struct file_list *recv_file_list(int f, int dir_ndx); + void recv_additional_file_list(int f); + int flist_find(struct file_list *flist, struct file_struct *f); + int flist_find_ignore_dirness(struct file_list *flist, struct file_struct *f); +-- +1.9.1 + diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/rsync.git-eac858085.patch b/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/rsync.git-eac858085.patch new file mode 100644 index 000000000..1fcac490a --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync-3.1.1/rsync.git-eac858085.patch @@ -0,0 +1,101 @@ +From eac858085e3ac94ec0ab5061d11f52652c90a869 Mon Sep 17 00:00:00 2001 +From: Wayne Davison <wayned@samba.org> +Date: Mon, 11 May 2015 12:36:20 -0700 +Subject: [PATCH 1/1] Add compat flag to allow proper seed checksum order. + Fixes the equivalent of librsync's CVE-2014-8242 issue. + +Upstream-Status: Backport + +Signed-off-by: Roy Li <rongqing.li@windriver.com> +--- + checksum.c | 17 +++++++++++++---- + compat.c | 5 +++++ + options.c | 1 + + 3 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/checksum.c b/checksum.c +index a1c2aa2..933b514 100644 +--- a/checksum.c ++++ b/checksum.c +@@ -23,6 +23,7 @@ + + extern int checksum_seed; + extern int protocol_version; ++extern int proper_seed_order; + + /* + a simple 32 bit checksum that can be upadted from either end +@@ -54,10 +55,18 @@ void get_checksum2(char *buf, int32 len, char *sum) + if (protocol_version >= 30) { + uchar seedbuf[4]; + md5_begin(&m); +- md5_update(&m, (uchar *)buf, len); +- if (checksum_seed) { +- SIVALu(seedbuf, 0, checksum_seed); +- md5_update(&m, seedbuf, 4); ++ if (proper_seed_order) { ++ if (checksum_seed) { ++ SIVALu(seedbuf, 0, checksum_seed); ++ md5_update(&m, seedbuf, 4); ++ } ++ md5_update(&m, (uchar *)buf, len); ++ } else { ++ md5_update(&m, (uchar *)buf, len); ++ if (checksum_seed) { ++ SIVALu(seedbuf, 0, checksum_seed); ++ md5_update(&m, seedbuf, 4); ++ } + } + md5_result(&m, (uchar *)sum); + } else { +diff --git a/compat.c b/compat.c +index 2454937..f89d466 100644 +--- a/compat.c ++++ b/compat.c +@@ -27,6 +27,7 @@ int inc_recurse = 0; + int compat_flags = 0; + int use_safe_inc_flist = 0; + int want_xattr_optim = 0; ++int proper_seed_order = 0; + + extern int am_server; + extern int am_sender; +@@ -78,6 +79,7 @@ int filesfrom_convert = 0; + #define CF_SYMLINK_ICONV (1<<2) + #define CF_SAFE_FLIST (1<<3) + #define CF_AVOID_XATTR_OPTIM (1<<4) ++#define CF_CHKSUM_SEED_FIX (1<<5) + + static const char *client_info; + +@@ -271,12 +273,15 @@ void setup_protocol(int f_out,int f_in) + compat_flags |= CF_SAFE_FLIST; + if (local_server || strchr(client_info, 'x') != NULL) + compat_flags |= CF_AVOID_XATTR_OPTIM; ++ if (local_server || strchr(client_info, 'C') != NULL) ++ compat_flags |= CF_CHKSUM_SEED_FIX; + write_byte(f_out, compat_flags); + } else + compat_flags = read_byte(f_in); + /* The inc_recurse var MUST be set to 0 or 1. */ + inc_recurse = compat_flags & CF_INC_RECURSE ? 1 : 0; + want_xattr_optim = protocol_version >= 31 && !(compat_flags & CF_AVOID_XATTR_OPTIM); ++ proper_seed_order = compat_flags & CF_CHKSUM_SEED_FIX ? 1 : 0; + if (am_sender) { + receiver_symlink_times = am_server + ? strchr(client_info, 'L') != NULL +diff --git a/options.c b/options.c +index 19c2b7d..4128b59 100644 +--- a/options.c ++++ b/options.c +@@ -2503,6 +2503,7 @@ void server_options(char **args, int *argc_p) + #endif + argstr[x++] = 'f'; /* flist I/O-error safety support */ + argstr[x++] = 'x'; /* xattr hardlink optimization not desired */ ++ argstr[x++] = 'C'; /* support checksum seed order fix */ + } + + if (x >= (int)sizeof argstr) { /* Not possible... */ +-- +1.9.1 + diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync.inc b/yocto-poky/meta/recipes-devtools/rsync/rsync.inc new file mode 100644 index 000000000..c65f27031 --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync.inc @@ -0,0 +1,23 @@ +SUMMARY = "File synchronization tool" +HOMEPAGE = "http://rsync.samba.org/" +BUGTRACKER = "http://rsync.samba.org/bugzilla.html" +SECTION = "console/network" + +# GPLv2+ (<< 3.0.0), GPLv3+ (>= 3.0.0) +LICENSE = "GPLv3+" +LIC_FILES_CHKSUM = "file://COPYING;md5=d32239bcb673463ab874e80d47fae504" + +# needs to add acl and attr +DEPENDS = "popt" + +SRC_URI = "http://rsync.samba.org/ftp/rsync/src/rsync-${PV}.tar.gz \ + file://rsyncd.conf" + +inherit autotools + +do_install_append() { + install -d ${D}${sysconfdir} + install -m 0644 ${WORKDIR}/rsyncd.conf ${D}${sysconfdir} +} + +EXTRA_OEMAKE='STRIP=""' diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync_2.6.9.bb b/yocto-poky/meta/recipes-devtools/rsync/rsync_2.6.9.bb new file mode 100644 index 000000000..6854c77f7 --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync_2.6.9.bb @@ -0,0 +1,28 @@ +SUMMARY = "File synchronization tool" +HOMEPAGE = "http://rsync.samba.org/" +BUGTRACKER = "http://rsync.samba.org/bugzilla.html" +SECTION = "console/network" + +# needs to add acl and attr +DEPENDS = "popt" + +SRC_URI = "http://rsync.samba.org/ftp/rsync/src/rsync-${PV}.tar.gz \ + file://rsync-2.6.9-fname-obo.patch \ + file://rsyncd.conf" + +SRC_URI[md5sum] = "996d8d8831dbca17910094e56dcb5942" +SRC_URI[sha256sum] = "ca437301becd890e73300bc69a39189ff1564baa761948ff149b3dd7bde633f9" + +inherit autotools + +do_install_append() { + install -d ${D}${sysconfdir} + install -m 0644 ${WORKDIR}/rsyncd.conf ${D}${sysconfdir} +} + +EXTRA_OEMAKE='STRIP=""' + +LICENSE = "GPLv2+" +LIC_FILES_CHKSUM = "file://COPYING;md5=6d5a9d4c4d3af25cd68fd83e8a8cb09c" + +PR = "r4" diff --git a/yocto-poky/meta/recipes-devtools/rsync/rsync_3.1.1.bb b/yocto-poky/meta/recipes-devtools/rsync/rsync_3.1.1.bb new file mode 100644 index 000000000..c74cdda94 --- /dev/null +++ b/yocto-poky/meta/recipes-devtools/rsync/rsync_3.1.1.bb @@ -0,0 +1,30 @@ +require rsync.inc + + +SRC_URI += "file://acinclude.m4 \ + file://0001-Complain-if-an-inc-recursive-path-is-not-right-for-i.patch \ + file://rsync.git-eac858085.patch \ +" + +SRC_URI[md5sum] = "43bd6676f0b404326eee2d63be3cdcfe" +SRC_URI[sha256sum] = "7de4364fcf5fe42f3bdb514417f1c40d10bbca896abe7e7f2c581c6ea08a2621" + +PACKAGECONFIG ??= "acl attr" +PACKAGECONFIG[acl] = "--enable-acl-support,--disable-acl-support,acl," +PACKAGECONFIG[attr] = "--enable-xattr-support,--disable-xattr-support,attr," + +# rsync 3.0 uses configure.sh instead of configure, and +# makefile checks the existence of configure.sh +do_configure_prepend () { + rm -f ${S}/configure ${S}/configure.sh + cp -f ${WORKDIR}/acinclude.m4 ${S}/ + + # By default, if crosscompiling, rsync disables a number of + # capabilities, hardlinking symlinks and special files (i.e. devices) + export rsync_cv_can_hardlink_special=yes + export rsync_cv_can_hardlink_symlink=yes +} + +do_configure_append () { + cp -f ${S}/configure ${S}/configure.sh +} |