diff --git a/.gitignore b/.gitignore index 3e3bc5e4..948d3f7f 100644 --- a/.gitignore +++ b/.gitignore @@ -23,6 +23,9 @@ config.status /getgroups /gmon.out /rsync +/rsync-ssl +/stunnel-rsync +/stunnel-rsyncd.conf /shconfig /testdir /tests-dont-exist diff --git a/Makefile.in b/Makefile.in index dd0618b4..2cb50bce 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,6 +4,7 @@ prefix=@prefix@ datarootdir=@datarootdir@ exec_prefix=@exec_prefix@ +stunnel4=@STUNNEL4@ bindir=@bindir@ mandir=@mandir@ @@ -18,6 +19,7 @@ INSTALLCMD=@INSTALL@ INSTALLMAN=@INSTALL@ srcdir=@srcdir@ +MKDIR_P=@MKDIR_P@ VPATH=$(srcdir) SHELL=/bin/sh @@ -60,16 +62,30 @@ CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o trimslash. $(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) -c $< @CC_SHOBJ_FLAG@ @OBJ_RESTORE@ -all: Makefile rsync$(EXEEXT) @MAKE_MAN@ +all: Makefile rsync$(EXEEXT) rsync-ssl stunnel-rsync stunnel-rsyncd.conf @MAKE_MAN@ install: all - -mkdir -p ${DESTDIR}${bindir} + -${MKDIR_P} ${DESTDIR}${bindir} ${INSTALLCMD} ${INSTALL_STRIP} -m 755 rsync$(EXEEXT) ${DESTDIR}${bindir} - -mkdir -p ${DESTDIR}${mandir}/man1 - -mkdir -p ${DESTDIR}${mandir}/man5 + -${MKDIR_P} ${DESTDIR}${mandir}/man1 + -${MKDIR_P} ${DESTDIR}${mandir}/man5 if test -f rsync.1; then ${INSTALLMAN} -m 644 rsync.1 ${DESTDIR}${mandir}/man1; fi if test -f rsyncd.conf.5; then ${INSTALLMAN} -m 644 rsyncd.conf.5 ${DESTDIR}${mandir}/man5; fi +install-ssl-client: rsync-ssl stunnel-rsync + -${MKDIR_P} ${DESTDIR}${bindir} + ${INSTALLCMD} ${INSTALL_STRIP} -m 755 rsync-ssl ${DESTDIR}${bindir} + ${INSTALLCMD} ${INSTALL_STRIP} -m 755 stunnel-rsync ${DESTDIR}${bindir} + +install-ssl-daemon: stunnel-rsyncd.conf + -${MKDIR_P} ${DESTDIR}/etc/stunnel + ${INSTALLCMD} ${INSTALL_STRIP} -m 644 stunnel-rsyncd.conf ${DESTDIR}/etc/stunnel/rsyncd.conf + @if ! ls /etc/rsync-ssl/certs/server.* >/dev/null 2>/dev/null; then \ + echo "Note that you'll need to install the certificate used by /etc/stunnel/rsyncd.conf"; \ + fi + +install-all: install install-ssl-client install-ssl-daemon + install-strip: $(MAKE) INSTALL_STRIP='-s' install @@ -173,6 +189,17 @@ Makefile: Makefile.in config.status configure.sh config.h.in fi \ fi +rsync-ssl: $(srcdir)/rsync-ssl.in Makefile + sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/rsync-ssl.in >rsync-ssl + @chmod +x rsync-ssl + +stunnel-rsync: $(srcdir)/stunnel-rsync.in Makefile + sed 's;\@stunnel4\@;$(stunnel4);g' <$(srcdir)/stunnel-rsync.in >stunnel-rsync + @chmod +x stunnel-rsync + +stunnel-rsyncd.conf: $(srcdir)/stunnel-rsyncd.conf.in Makefile + sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/stunnel-rsyncd.conf.in >stunnel-rsyncd.conf + proto: proto.h-tstamp proto.h: proto.h-tstamp @@ -207,6 +234,7 @@ cleantests: # the source directory. distclean: clean rm -f Makefile config.h config.status + rm -f rsync-ssl stunnel-rsync stunnel-rsyncd.conf rm -f lib/dummy popt/dummy zlib/dummy rm -f $(srcdir)/Makefile $(srcdir)/config.h $(srcdir)/config.status rm -f $(srcdir)/lib/dummy $(srcdir)/popt/dummy $(srcdir)/zlib/dummy diff --git a/clientname.c b/clientname.c index 8f8460dc..d085fc78 100644 --- a/clientname.c +++ b/clientname.c @@ -41,7 +41,6 @@ char *client_addr(int fd) static int initialised; struct sockaddr_storage ss; socklen_t length = sizeof ss; - char *ssh_info, *p; if (initialised) return addr_buf; @@ -49,11 +48,14 @@ char *client_addr(int fd) initialised = 1; if (am_server) { /* daemon over --rsh mode */ + char *env_str; strlcpy(addr_buf, "0.0.0.0", sizeof addr_buf); - if ((ssh_info = getenv("SSH_CONNECTION")) != NULL - || (ssh_info = getenv("SSH_CLIENT")) != NULL - || (ssh_info = getenv("SSH2_CLIENT")) != NULL) { - strlcpy(addr_buf, ssh_info, sizeof addr_buf); + if ((env_str = getenv("SSH_CONNECTION")) != NULL + || (env_str = getenv("SSH_CLIENT")) != NULL + || (env_str = getenv("SSH2_CLIENT")) != NULL + || (env_str = getenv("REMOTE_HOST")) != NULL) { + char *p; + strlcpy(addr_buf, env_str, sizeof addr_buf); /* Truncate the value to just the IP address. */ if ((p = strchr(addr_buf, ' ')) != NULL) *p = '\0'; diff --git a/configure.ac b/configure.ac index 9c7b4113..5c66d626 100644 --- a/configure.ac +++ b/configure.ac @@ -39,6 +39,7 @@ AC_PROG_CC AC_PROG_CPP AC_PROG_EGREP AC_PROG_INSTALL +AC_PROG_MKDIR_P AC_PROG_CC_STDC AC_SUBST(SHELL) @@ -954,6 +955,9 @@ AC_SUBST(BUILD_POPT) AC_SUBST(BUILD_ZLIB) AC_SUBST(MAKE_MAN) +AC_PATH_PROG([STUNNEL], [stunnel], [stunnel], [$PATH$PATH_SEPARATOR/usr/sbin$PATH_SEPARATOR/sbin]) +AC_PATH_PROG([STUNNEL4], [stunnel4], [$STUNNEL], [$PATH$PATH_SEPARATOR/usr/sbin$PATH_SEPARATOR/sbin]) + AC_CHECK_FUNCS(_acl __acl _facl __facl) ################################################# # check for ACL support diff --git a/packaging/lsb/rsync.spec b/packaging/lsb/rsync.spec index 234666be..1c045603 100644 --- a/packaging/lsb/rsync.spec +++ b/packaging/lsb/rsync.spec @@ -1,6 +1,6 @@ Summary: A fast, versatile, remote (and local) file-copying tool Name: rsync -Version: 3.0.3 +Version: 3.1.0 %define fullversion %{version} Release: 1 %define srcdir src @@ -13,6 +13,14 @@ Prefix: %{_prefix} BuildRoot: /var/tmp/%{name}-root License: GPL +%package ssl-client +Summary: Provides rsync-ssl +Requires: stunnel >= 4 + +%package ssl-daemon +Summary: An stunnel config file to support ssl rsync daemon connections. +Requires: stunnel >= 4 + %description Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a @@ -24,12 +32,22 @@ differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use. +%description ssl-client +Provides the rsync-ssl script that makes use of stunnel 4 to open an ssl +connection to an rsync daemon (on port 874). This setup does NOT require +any local stunnel daemon to be running to connect to the remote ssl rsyncd. + +%description ssl-daemon +Provides a config file for stunnel that will (if you start your stunnel +service) cause stunnel to listen for ssl rsync-daemon connections and run +"rsync --daemon" to handle them. + %prep # Choose one -- setup source only, or setup source + rsync-patches: %setup -q -n rsync-%{fullversion} #%setup -q -b1 -n rsync-%{fullversion} -# If you you used "%setup -q -b1", choose the patches you wish to apply: +# If you you used "%setup -q -b1 ...", choose the patches you wish to apply: #patch -p1 Released 3.0.3. diff --git a/rsync-ssl.in b/rsync-ssl.in new file mode 100755 index 00000000..da58d6af --- /dev/null +++ b/rsync-ssl.in @@ -0,0 +1,12 @@ +#!/bin/bash +# This script supports using stunnel to secure an rsync daemon connection. +# Note that this requires at least version 4.x of stunnel. +case "$@" in +*rsync://*) ;; +*::*) ;; +*) + echo "You must use rsync-ssl with a daemon-style hostname." 0>&1 + exit 1 + ;; +esac +exec @bindir@/rsync --rsh=@bindir@/stunnel-rsync "${@}" diff --git a/stunnel-rsync.in b/stunnel-rsync.in new file mode 100755 index 00000000..f206b93a --- /dev/null +++ b/stunnel-rsync.in @@ -0,0 +1,52 @@ +#!/bin/bash +# This must be called as: +# +# stunnel-rsync HOSTNAME rsync --server --daemon . +# +# ... which is typically done via the rsync-ssl script, which results in something like this: +# +# rsync --rsh=stunnel-rsync -aiv HOSTNAME::module ... +# +# This SSL setup based on the files by: http://dozzie.jarowit.net/trac/wiki/RsyncSSL +# Note that this requires at least version 4.x of stunnel. + +# The current environment can override using the RSYNC_SSL_* values: +if [ x"$RSYNC_SSL_CERT" = x ]; then + cert="" +else + cert="cert = $RSYNC_SSL_CERT" +fi +if [ x"$RSYNC_SSL_CA_CERT" ]; then + cafile="" + verify=0 +else + cafile="CAfile = $RSYNC_SSL_CA_CERT" + verify=3 +fi +port=${RSYNC_SSL_PORT:-874} + +# If the user specified USER@HOSTNAME::module, then rsync passes us +# the -l USER option too, so we must be prepared to ignore it. +if [ x"$1" = x"-l" ]; then + shift 2 +fi + +hostname=$1 +shift + +if [ x"$hostname" = x -o x"$1" != x"rsync" -o x"$2" != x"--server" -o x"$3" != x"--daemon" ]; then + echo "Usage: stunnel-rsync HOSTNAME rsync --server --daemon ." 1>&2 + exit 1 +fi + +# devzero@web.de came up with this no-tmpfile calling syntax: +@stunnel4@ -fd 10 11<&0 <