Regression in stderr handling in 3.2.3 breaks BackupPc on 22.04; fix available in 3.2.4

Bug #2007837 reported by Peter Thomassen
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
rsync (Debian)
New
Unknown
rsync (Ubuntu)
Fix Released
Undecided
Unassigned
Jammy
Fix Released
Undecided
Marc Deslauriers

Bug Description

rsync 3.2.3 (packaged in Ubuntu 22.04) changes stderr handling, leading another bug in libfile-rsyncp-perl (in Ubuntu 18.04 and 20.04) to surface [1].

It practically makes using BackupPC 3 impossible with clients using rsync 3.2.3, as is packaged for 22.04. The fact that BackupPC on 20.04 can't be used to back up machines with 22.04 is rather surprising and has bitten other users [2].

It's unclear whether the bug will be fixed in 18.04's and 20.04's libfile-rsyncp-perl package (for status, see [3]).

Because of this, the rsync maintainer has included a patch in 3.2.4 that fixes this regression [4] (even though not strictly an rsync bug). As a result, rsync 3.2.3 is the only affected version, which happens to be the one packaged in 22.04.

This report is to request backporting that fix [4] to Ubuntu 22.04, so that things don't silently break in scenarios where the backup server is left at 20.04, and some backup clients happen to upgrade to 22.04.

I'm not sure what the criteria for security releases are, but as the issue causes backup denial of service and has easy mitigation, I think it would make sense to put it through the security channel.

[1]: https://github.com/WayneD/rsync/issues/95#issuecomment-699185358
[2]: https://<email address hidden>/msg32673.html
[3]: https://bugs.launchpad.net/ubuntu/+source/libfile-rsyncp-perl/+bug/2007833
[4]: https://github.com/WayneD/rsync/commit/4adfdaaf12db26c348b4d6150119b377f9b622c8

Revision history for this message
Bryce Harrington (bryce) wrote :

Thanks for the links Peter. Looking at the upstream patch, it looks straightforward enough, but can you also provide more detailed steps to reproduce this issue?

I gather this would involve setting up a 20.04 host and 22.04 clients, running Backuppc on the latter to pull data from the former. If you can provide a reproducer that'd help accelerate progress towards getting a fix prepared for backporting. Thanks ahead of time.

Changed in rsync (Ubuntu Jammy):
status: New → Incomplete
Revision history for this message
Peter Thomassen (mail-peter-thomassen) wrote :

Thank you for looking into this. The test case is described in https://github.com/backuppc/backuppc/issues/369#issuecomment-693663922 and boils down to:

> * Create temporary file on host [i.e. backup client, with rsync 3.2.3]
> * Run `/usr/share/backuppc/bin/BackupPC_dump -v -f host` manually on the server cmdline as correct user [use BackupPC v3 with buggy libfile-rsyncp-perl, as present in Ubuntu 18.04 and 20.04)
> * Wait for rsync to start dumping files (i.e. indexing is complete), then delete temporary file on host

HTH.

Revision history for this message
Paride Legovini (paride) wrote :

Thanks. According to the package versions the bug is not present in >= Kinetic, so setting the devel release task as Fix Released.

Changed in rsync (Ubuntu):
status: New → Fix Released
Changed in rsync (Ubuntu Jammy):
status: Incomplete → Triaged
tags: added: server-todo
Bryce Harrington (bryce)
summary: - 22.04: Backport request from 3.2.4 for fix of 3.2.3 regression
+ Regression in stderr handling in 3.2.3 breaks BackupPc on 22.04; fix
+ available in 3.2.4
Changed in rsync (Ubuntu Jammy):
assignee: nobody → Sergio Durigan Junior (sergiodj)
Revision history for this message
Simon Déziel (sdeziel) wrote :

I /think/ there is work being done by security to land a MRE for rsync, you might want to sync with @mdeslaur.

Revision history for this message
Sergio Durigan Junior (sergiodj) wrote :

Thanks for the heads up, Simon. I talked to Marc and he confirmed that he intends to MRE rsync, so I reassigned this bug to him.

Changed in rsync (Ubuntu Jammy):
assignee: Sergio Durigan Junior (sergiodj) → Marc Deslauriers (mdeslaur)
tags: removed: server-todo
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Yes, I plan on releasing 3.2.7 to jammy and kinetic as a security update possibly next week, so that should take care of this issue at the same time.

Revision history for this message
Peter Thomassen (mail-peter-thomassen) wrote :
Changed in rsync (Ubuntu Jammy):
status: Triaged → Fix Released
Changed in rsync (Debian):
status: Unknown → New
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.