diff options
author | Wayne Davison <wayned@samba.org> | 2013-06-15 14:40:52 -0700 |
---|---|---|
committer | Wayne Davison <wayned@samba.org> | 2013-06-15 16:40:10 -0700 |
commit | 70d4a945f7d1ab1aca2c3ca8535240fad4bdf06b (patch) | |
tree | ae7f7090c6f8726ebd5eb4e03d4c71c72a810c8b | |
parent | 0488a14b9930bf91719ac0f1d1c0c8770ca10646 (diff) | |
download | android_external_rsync-70d4a945f7d1ab1aca2c3ca8535240fad4bdf06b.tar.gz android_external_rsync-70d4a945f7d1ab1aca2c3ca8535240fad4bdf06b.tar.bz2 android_external_rsync-70d4a945f7d1ab1aca2c3ca8535240fad4bdf06b.zip |
Support rsync daemon over SSL via stunnel.
Added the client rsync-ssl script and various client/daemon support
files needed for talking to an rsync daemon over SSL on port 874 (no
tls support). This uses an elegant stunnel setup that was detailed
by dozzie (see the resources page) now that stunnel4 has improved
command-spawning support. Also incorporates some tweaks by devzero
(e.g. the nice no-tmpfile-config client-side code) and a few by me
(including logging of the actual remote IP that came in to the
stunnel process). This probably still needs a little work.
-rw-r--r-- | .gitignore | 3 | ||||
-rw-r--r-- | Makefile.in | 36 | ||||
-rw-r--r-- | clientname.c | 12 | ||||
-rw-r--r-- | configure.ac | 4 | ||||
-rw-r--r-- | packaging/lsb/rsync.spec | 38 | ||||
-rwxr-xr-x | rsync-ssl.in | 12 | ||||
-rwxr-xr-x | stunnel-rsync.in | 52 | ||||
-rw-r--r-- | stunnel-rsyncd.conf.in | 30 |
8 files changed, 171 insertions, 16 deletions
@@ -23,6 +23,9 @@ config.status /getgroups /gmon.out /rsync +/rsync-ssl +/stunnel-rsync +/stunnel-rsyncd.conf /shconfig /testdir /tests-dont-exist diff --git a/Makefile.in b/Makefile.in index dd0618b4..2cb50bce 100644 --- a/Makefile.in +++ b/Makefile.in @@ -4,6 +4,7 @@ prefix=@prefix@ datarootdir=@datarootdir@ exec_prefix=@exec_prefix@ +stunnel4=@STUNNEL4@ bindir=@bindir@ mandir=@mandir@ @@ -18,6 +19,7 @@ INSTALLCMD=@INSTALL@ INSTALLMAN=@INSTALL@ srcdir=@srcdir@ +MKDIR_P=@MKDIR_P@ VPATH=$(srcdir) SHELL=/bin/sh @@ -60,16 +62,30 @@ CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o trimslash. $(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) -c $< @CC_SHOBJ_FLAG@ @OBJ_RESTORE@ -all: Makefile rsync$(EXEEXT) @MAKE_MAN@ +all: Makefile rsync$(EXEEXT) rsync-ssl stunnel-rsync stunnel-rsyncd.conf @MAKE_MAN@ install: all - -mkdir -p ${DESTDIR}${bindir} + -${MKDIR_P} ${DESTDIR}${bindir} ${INSTALLCMD} ${INSTALL_STRIP} -m 755 rsync$(EXEEXT) ${DESTDIR}${bindir} - -mkdir -p ${DESTDIR}${mandir}/man1 - -mkdir -p ${DESTDIR}${mandir}/man5 + -${MKDIR_P} ${DESTDIR}${mandir}/man1 + -${MKDIR_P} ${DESTDIR}${mandir}/man5 if test -f rsync.1; then ${INSTALLMAN} -m 644 rsync.1 ${DESTDIR}${mandir}/man1; fi if test -f rsyncd.conf.5; then ${INSTALLMAN} -m 644 rsyncd.conf.5 ${DESTDIR}${mandir}/man5; fi +install-ssl-client: rsync-ssl stunnel-rsync + -${MKDIR_P} ${DESTDIR}${bindir} + ${INSTALLCMD} ${INSTALL_STRIP} -m 755 rsync-ssl ${DESTDIR}${bindir} + ${INSTALLCMD} ${INSTALL_STRIP} -m 755 stunnel-rsync ${DESTDIR}${bindir} + +install-ssl-daemon: stunnel-rsyncd.conf + -${MKDIR_P} ${DESTDIR}/etc/stunnel + ${INSTALLCMD} ${INSTALL_STRIP} -m 644 stunnel-rsyncd.conf ${DESTDIR}/etc/stunnel/rsyncd.conf + @if ! ls /etc/rsync-ssl/certs/server.* >/dev/null 2>/dev/null; then \ + echo "Note that you'll need to install the certificate used by /etc/stunnel/rsyncd.conf"; \ + fi + +install-all: install install-ssl-client install-ssl-daemon + install-strip: $(MAKE) INSTALL_STRIP='-s' install @@ -173,6 +189,17 @@ Makefile: Makefile.in config.status configure.sh config.h.in fi \ fi +rsync-ssl: $(srcdir)/rsync-ssl.in Makefile + sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/rsync-ssl.in >rsync-ssl + @chmod +x rsync-ssl + +stunnel-rsync: $(srcdir)/stunnel-rsync.in Makefile + sed 's;\@stunnel4\@;$(stunnel4);g' <$(srcdir)/stunnel-rsync.in >stunnel-rsync + @chmod +x stunnel-rsync + +stunnel-rsyncd.conf: $(srcdir)/stunnel-rsyncd.conf.in Makefile + sed 's;\@bindir\@;$(bindir);g' <$(srcdir)/stunnel-rsyncd.conf.in >stunnel-rsyncd.conf + proto: proto.h-tstamp proto.h: proto.h-tstamp @@ -207,6 +234,7 @@ cleantests: # the source directory. distclean: clean rm -f Makefile config.h config.status + rm -f rsync-ssl stunnel-rsync stunnel-rsyncd.conf rm -f lib/dummy popt/dummy zlib/dummy rm -f $(srcdir)/Makefile $(srcdir)/config.h $(srcdir)/config.status rm -f $(srcdir)/lib/dummy $(srcdir)/popt/dummy $(srcdir)/zlib/dummy diff --git a/clientname.c b/clientname.c index 8f8460dc..d085fc78 100644 --- a/clientname.c +++ b/clientname.c @@ -41,7 +41,6 @@ char *client_addr(int fd) static int initialised; struct sockaddr_storage ss; socklen_t length = sizeof ss; - char *ssh_info, *p; if (initialised) return addr_buf; @@ -49,11 +48,14 @@ char *client_addr(int fd) initialised = 1; if (am_server) { /* daemon over --rsh mode */ + char *env_str; strlcpy(addr_buf, "0.0.0.0", sizeof addr_buf); - if ((ssh_info = getenv("SSH_CONNECTION")) != NULL - || (ssh_info = getenv("SSH_CLIENT")) != NULL - || (ssh_info = getenv("SSH2_CLIENT")) != NULL) { - strlcpy(addr_buf, ssh_info, sizeof addr_buf); + if ((env_str = getenv("SSH_CONNECTION")) != NULL + || (env_str = getenv("SSH_CLIENT")) != NULL + || (env_str = getenv("SSH2_CLIENT")) != NULL + || (env_str = getenv("REMOTE_HOST")) != NULL) { + char *p; + strlcpy(addr_buf, env_str, sizeof addr_buf); /* Truncate the value to just the IP address. */ if ((p = strchr(addr_buf, ' ')) != NULL) *p = '\0'; diff --git a/configure.ac b/configure.ac index 9c7b4113..5c66d626 100644 --- a/configure.ac +++ b/configure.ac @@ -39,6 +39,7 @@ AC_PROG_CC AC_PROG_CPP AC_PROG_EGREP AC_PROG_INSTALL +AC_PROG_MKDIR_P AC_PROG_CC_STDC AC_SUBST(SHELL) @@ -954,6 +955,9 @@ AC_SUBST(BUILD_POPT) AC_SUBST(BUILD_ZLIB) AC_SUBST(MAKE_MAN) +AC_PATH_PROG([STUNNEL], [stunnel], [stunnel], [$PATH$PATH_SEPARATOR/usr/sbin$PATH_SEPARATOR/sbin]) +AC_PATH_PROG([STUNNEL4], [stunnel4], [$STUNNEL], [$PATH$PATH_SEPARATOR/usr/sbin$PATH_SEPARATOR/sbin]) + AC_CHECK_FUNCS(_acl __acl _facl __facl) ################################################# # check for ACL support diff --git a/packaging/lsb/rsync.spec b/packaging/lsb/rsync.spec index 234666be..1c045603 100644 --- a/packaging/lsb/rsync.spec +++ b/packaging/lsb/rsync.spec @@ -1,6 +1,6 @@ Summary: A fast, versatile, remote (and local) file-copying tool Name: rsync -Version: 3.0.3 +Version: 3.1.0 %define fullversion %{version} Release: 1 %define srcdir src @@ -13,6 +13,14 @@ Prefix: %{_prefix} BuildRoot: /var/tmp/%{name}-root License: GPL +%package ssl-client +Summary: Provides rsync-ssl +Requires: stunnel >= 4 + +%package ssl-daemon +Summary: An stunnel config file to support ssl rsync daemon connections. +Requires: stunnel >= 4 + %description Rsync is a fast and extraordinarily versatile file copying tool. It can copy locally, to/from another host over any remote shell, or to/from a @@ -24,12 +32,22 @@ differences between the source files and the existing files in the destination. Rsync is widely used for backups and mirroring and as an improved copy command for everyday use. +%description ssl-client +Provides the rsync-ssl script that makes use of stunnel 4 to open an ssl +connection to an rsync daemon (on port 874). This setup does NOT require +any local stunnel daemon to be running to connect to the remote ssl rsyncd. + +%description ssl-daemon +Provides a config file for stunnel that will (if you start your stunnel +service) cause stunnel to listen for ssl rsync-daemon connections and run +"rsync --daemon" to handle them. + %prep # Choose one -- setup source only, or setup source + rsync-patches: %setup -q -n rsync-%{fullversion} #%setup -q -b1 -n rsync-%{fullversion} -# If you you used "%setup -q -b1", choose the patches you wish to apply: +# If you you used "%setup -q -b1 ...", choose the patches you wish to apply: #patch -p1 <patches/acls.diff #patch -p1 <patches/xattrs.diff #patch -p1 <patches/remote-option.diff @@ -47,13 +65,11 @@ make %install rm -rf $RPM_BUILD_ROOT -%makeinstall +make install install-ssl-client install-ssl-daemon -mkdir -p $RPM_BUILD_ROOT/etc/xinetd.d +mkdir -p $RPM_BUILD_ROOT/etc/xinetd.d $RPM_BUILD_ROOT/etc/rsync-ssl/certs install -m 644 packaging/lsb/rsync.xinetd $RPM_BUILD_ROOT/etc/xinetd.d/rsync -#install -p -m 755 support/rsyncdb $RPM_BUILD_ROOT/usr/bin/rsyncdb - %clean rm -rf $RPM_BUILD_ROOT @@ -61,10 +77,18 @@ rm -rf $RPM_BUILD_ROOT %defattr(-,root,root) %doc COPYING NEWS OLDNEWS README support/ tech_report.tex %config(noreplace) /etc/xinetd.d/rsync -%{_prefix}/bin/rsync* +%{_prefix}/bin/rsync %{_mandir}/man1/rsync.1* %{_mandir}/man5/rsyncd.conf.5* +%files ssl-client +%{_prefix}/bin/rsync-ssl +%{_prefix}/bin/stunnel-rsync + +%files ssl-daemon +%config(noreplace) /etc/stunnel/rsyncd.conf +%dir /etc/rsync-ssl/certs + %changelog * Sun Jun 29 2008 Wayne Davison <wayned@samba.org> Released 3.0.3. diff --git a/rsync-ssl.in b/rsync-ssl.in new file mode 100755 index 00000000..da58d6af --- /dev/null +++ b/rsync-ssl.in @@ -0,0 +1,12 @@ +#!/bin/bash +# This script supports using stunnel to secure an rsync daemon connection. +# Note that this requires at least version 4.x of stunnel. +case "$@" in +*rsync://*) ;; +*::*) ;; +*) + echo "You must use rsync-ssl with a daemon-style hostname." 0>&1 + exit 1 + ;; +esac +exec @bindir@/rsync --rsh=@bindir@/stunnel-rsync "${@}" diff --git a/stunnel-rsync.in b/stunnel-rsync.in new file mode 100755 index 00000000..f206b93a --- /dev/null +++ b/stunnel-rsync.in @@ -0,0 +1,52 @@ +#!/bin/bash +# This must be called as: +# +# stunnel-rsync HOSTNAME rsync --server --daemon . +# +# ... which is typically done via the rsync-ssl script, which results in something like this: +# +# rsync --rsh=stunnel-rsync -aiv HOSTNAME::module ... +# +# This SSL setup based on the files by: http://dozzie.jarowit.net/trac/wiki/RsyncSSL +# Note that this requires at least version 4.x of stunnel. + +# The current environment can override using the RSYNC_SSL_* values: +if [ x"$RSYNC_SSL_CERT" = x ]; then + cert="" +else + cert="cert = $RSYNC_SSL_CERT" +fi +if [ x"$RSYNC_SSL_CA_CERT" ]; then + cafile="" + verify=0 +else + cafile="CAfile = $RSYNC_SSL_CA_CERT" + verify=3 +fi +port=${RSYNC_SSL_PORT:-874} + +# If the user specified USER@HOSTNAME::module, then rsync passes us +# the -l USER option too, so we must be prepared to ignore it. +if [ x"$1" = x"-l" ]; then + shift 2 +fi + +hostname=$1 +shift + +if [ x"$hostname" = x -o x"$1" != x"rsync" -o x"$2" != x"--server" -o x"$3" != x"--daemon" ]; then + echo "Usage: stunnel-rsync HOSTNAME rsync --server --daemon ." 1>&2 + exit 1 +fi + +# devzero@web.de came up with this no-tmpfile calling syntax: +@stunnel4@ -fd 10 11<&0 <<EOF 10<&0 0<&11 11<&- +foreground = yes +debug = crit +connect = $hostname:$port +client = yes +TIMEOUTclose = 0 +verify = $verify +$cert +$cafile +EOF diff --git a/stunnel-rsyncd.conf.in b/stunnel-rsyncd.conf.in new file mode 100644 index 00000000..202c9ed2 --- /dev/null +++ b/stunnel-rsyncd.conf.in @@ -0,0 +1,30 @@ +# This config for stunnel will start up rsync for an incoming ssl connection. +foreground = no +#output = /var/log/stunnel-rsyncd.log +pid = /var/run/stunnel-rsyncd.pid +socket = l:TCP_NODELAY=1 +socket = r:TCP_NODELAY=1 +compression = rle +# This must be root for rsync to use chroot -- rsync will drop permissions: +setuid = root +setgid = root + +[rsync] +accept = 874 +# You can set the cert to a combo *.pem file and omit the key, if you like. +cert = /etc/rsync-ssl/certs/server.crt +key = /etc/rsync-ssl/certs/server.key +client = no + +# To allow anyone to try an ssl connection, use this: +verify = 0 +CAfile = /etc/ssl/ca-bundle.pem + +# To allow only cert-authorized clients, use something like this instead of the above: +#verify = 3 +#CAfile = /etc/rsync-ssl/certs/allowed-clients.cert.pem + +exec = @bindir@/rsync +# You can either share the same config as a normal daemon, or specify a separate config: +execargs = rsync --server --daemon +#execargs = rsync --server --daemon --config=/etc/rsync-ssl/rsyncd.conf |