native: harden rsync and SSH transport

Update rsync to 3.5.0 and Go to 1.26.6. Bound SSH handshakes, pin
host-key types, and build 16 KB-aligned hardened executables.

1 files changed, 60 insertions, 14 deletions

diff --git a/rsync/build.sh b/rsync/build.sh
index 0a7fcda..1af7fbb 100755
--- a/rsync/build.sh
+++ b/rsync/build.sh
@@ -5,9 +5,15 @@
 # nothing outside Bionic; zlib and popt come from rsync's bundled copies.
 set -eu
 
-root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
+# shellcheck source=versions
 . "$root/versions"
 
+command -v bash >/dev/null 2>&1 || {
+	echo "rsync: bash is required by the Android NDK compiler launchers" >&2
+	exit 1
+}
+
 # Locate the NDK toolchain.
 ndk=${ANDROID_NDK_HOME:-${ANDROID_NDK_ROOT:-}}
 if [ -z "$ndk" ] && [ -n "${ANDROID_HOME:-}" ]; then
@@ -34,21 +40,35 @@ fi
 work="$root/rsync/work"
 tarball="$root/rsync/rsync-${RSYNC_VERSION}.tar.gz"
 src="$work/rsync-${RSYNC_VERSION}"
+part="$tarball.part.$$"
+output=
+trap 'if [ -n "$part" ]; then rm -f "$part"; fi; if [ -n "$output" ]; then rm -f "$output"; fi' 0 1 2 3 15
 
 # Fetch and verify the pinned source tarball.
 mkdir -p "$work"
+if [ -f "$tarball" ] && ! ( cd "$root/rsync" && sha256sum -c "rsync-${RSYNC_VERSION}.tar.gz.sha256" >/dev/null 2>&1 ); then
+	echo "rsync: removing corrupt $(basename "$tarball")" >&2
+	rm -f "$tarball"
+fi
 if [ ! -f "$tarball" ]; then
 	echo "rsync: fetching $RSYNC_URL"
-	curl -fsSL "$RSYNC_URL" -o "$tarball"
+	# Download aside and rename, so an interrupted fetch leaves no truncated
+	# tarball for the next run to pick up. Verify before publishing it.
+	curl --fail --silent --show-error --location --retry 3 \
+		--connect-timeout 30 --speed-limit 1024 --speed-time 60 \
+		"$RSYNC_URL" -o "$part"
+	want=$(awk 'NR == 1 { print $1 }' "$root/rsync/rsync-${RSYNC_VERSION}.tar.gz.sha256")
+	actual=$(sha256sum "$part")
+	[ "${actual%% *}" = "$want" ] || {
+		echo "rsync: checksum failed for $(basename "$tarball")" >&2
+		exit 1
+	}
+	mv "$part" "$tarball"
+	part=
 fi
 echo "rsync: verifying sha256"
 ( cd "$root/rsync" && sha256sum -c "rsync-${RSYNC_VERSION}.tar.gz.sha256" )
 
-# No system libraries, no docs (md2man needs python3), no iconv.
-flags="--disable-md2man --disable-openssl --disable-xxhash --disable-zstd \
---disable-lz4 --disable-iconv --disable-acl-support --disable-xattr-support \
---with-included-popt --with-included-zlib"
-
 for abi in $ABIS; do
 	case "$abi" in
 	arm64-v8a)   host=aarch64-linux-android  cc="aarch64-linux-android${ANDROID_MIN_SDK}-clang" ;;
@@ -62,18 +82,44 @@ for abi in $ABIS; do
 	rm -rf "$src"
 	tar xzf "$tarball" -C "$work"
 
+	# CXX must be pinned like CC: rsync's SIMD checksum is C++, and configure
+	# otherwise falls back to the host g++, leaking a host-compiled object
+	# into the target binary (or failing where the host lacks ifunc).
 	echo "rsync: configuring $abi"
-	( cd "$src" && \
-		CC="$tc/$cc" AR="$tc/llvm-ar" RANLIB="$tc/llvm-ranlib" \
-		CFLAGS="-O2 -fPIE -ffile-prefix-map=$src=." LDFLAGS="-pie" \
-		./configure --host="$host" $flags >/dev/null )
+	( cd "$src" &&
+		# No system libraries, generated docs, iconv, ACLs, or xattrs.
+		set -- --disable-md2man --disable-openssl --disable-xxhash \
+			--disable-zstd --disable-lz4 --disable-iconv \
+			--disable-acl-support --disable-xattr-support \
+			--with-included-popt --with-included-zlib \
+			--with-nobody-user=nobody --with-nobody-group=nobody
+		# NDK r27 needs both page-size flags for 16 KB Android devices.
+		# rsync parses peer-controlled data in C. Keep the compiler defenses
+		# explicit rather than relying on whichever defaults an NDK release
+		# happens to select.
+		CC="$tc/$cc" CXX="$tc/${cc}++" AR="$tc/llvm-ar" RANLIB="$tc/llvm-ranlib" \
+			rsync_cv_HAVE_SECURE_MKSTEMP=yes \
+			CFLAGS="-O2 -fPIE -fstack-protector-strong -D_FORTIFY_SOURCE=2 -ffile-prefix-map=$src=." \
+			CXXFLAGS="-O2 -fPIE -fstack-protector-strong -D_FORTIFY_SOURCE=2 -ffile-prefix-map=$src=." \
+			LDFLAGS="-pie -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,max-page-size=16384 -Wl,-z,common-page-size=16384" \
+			./configure --host="$host" "$@" >/dev/null )
 
+	# Bundled popt leaves conditional variables unused on Android. Append the
+	# two narrow suppressions after rsync's own -Wall flags.
+	build_cflags=$(sed -n 's/^CFLAGS=//p' "$src/Makefile")
+	if [ -z "$build_cflags" ]; then
+		echo "rsync: generated Makefile has no CFLAGS" >&2
+		exit 1
+	fi
 	echo "rsync: building $abi"
-	( cd "$src" && make -s rsync )
+	( cd "$src" && make -s CFLAGS="$build_cflags -Wno-unused-variable -Wno-unused-but-set-variable" rsync )
 
 	dest="$root/app/src/main/jniLibs/$abi"
 	mkdir -p "$dest"
-	cp "$src/rsync" "$dest/libxrsync.so"
-	"$tc/llvm-strip" "$dest/libxrsync.so"
+	output="$dest/libxrsync.so.part.$$"
+	cp "$src/rsync" "$output"
+	"$tc/llvm-strip" "$output"
+	mv "$output" "$dest/libxrsync.so"
+	output=
 	echo "rsync: $abi -> jniLibs/$abi/libxrsync.so"
 done