Make sure that supplementary groups are removed from a server processcvs/branch-2.3

after changing uid and gid. (Ethan Benson)

Bump version to 2.3.4pre1

5 files changed, 139 insertions, 672 deletions

diff --git a/NEWS b/NEWS
index 2d4b85cb..fc78e160 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,6 @@
-rsync 2.3.3 (26 Jan 2002)
+rsync 2.3.4 (not released yet)
 
   SECURITY FIXES:
 
-    * Signedness security patch from Sebastian Krahmer
-      <krahmer@suse.de> -- in some cases we were not sufficiently
-      careful about reading integers from the network.
+    * Make sure that supplementary groups are removed from a server
+      process after changing uid and gid. (Ethan Benson)
diff --git a/OLDNEWS b/OLDNEWS
index d02ca242..2d4b85cb 100644
--- a/OLDNEWS
+++ b/OLDNEWS
@@ -1,148 +1,7 @@
-rsync 2.5.1 (2002-01-03)
+rsync 2.3.3 (26 Jan 2002)
 
-  BUG FIXES: 
-   
-    * Fix for segfault in --daemon mode configuration parser.  (Paul
-      Mackerras)
+  SECURITY FIXES:
 
-    * Correct string<->address parsing for both IPv4 and 6.
-      (YOSHIFUJI Hideaki, SUMIKAWA Munechika and Jun-ichiro "itojun"
-      Hagino)
-
-    * Various fixes for IPv6 support.  (Dave Dykstra)
-
-    * rsync.1 typo fix.  (Matt Kraai)
-
-    * Test suite typo fixes.  (Tom Schmidt)
-
-    * rsync.1 grammar and clarity improvements.  (Edward
-      Welbourne)
-
-    * Correction to ./configure tests for inet_ntop.  (Jeff Garzik)
-
-  ENHANCEMENTS:
-
-    * --progress and -P now show estimated data transfer rate (in a
-        multiple of bytes/s) and estimated time to completion.  (Rik
-        Faith)
-   
-    * --no-detach option, required to run as a W32 service and also
-        useful when running on Unix under daemontools, AIX's SRC, or a
-        debugger.  (Max Bowsher, Jos Backus)
-
-    * Clearer error messages for some conditions.
-
-rsync 2.5.0 (2001-11-30)
-
-  ANNOUNCEMENTS
-
-    * Martin Pool <mbp@samba.org> is now a co-maintainer.
-
-  NEW FEATURES
-
-    * Support for LSB-compliant packaging <http://www.linuxbase.org/>
-
-    * Shell wildcards are allowed in "auth users" lines.
-
-    * Merged UNC rsync+ patch to support creation of standalone patch
-      sets.  By Bert J. Dempsey and Debra Weiss, updated by Jos
-      Backus.  <http://www.ils.unc.edu/i2dsi/unc_rsync+.html>
-
-    * IPv6 support based on a patch from KAME.net, on systems
-      including modern versions of Linux, Solaris, and HP-UX.  Also
-      includes IPv6 compatibility functions for old OSs by the
-      Internet Software Consortium, Paul Vixie, the OpenSSH
-      portability project, and OpenBSD.
-
-  ENHANCEMENTS
-
-    * Include/exclude cluestick: with -vv, print out whether files are
-      included or excluded and why.
-
-    * Many error messages have more friendly explanations and more
-      details.
-
-    * Manual page improvements plus scanty protocol documentation.
-
-    * When running as --daemon in the background and using a "log
-      file" rsyncd.conf directive, close the log file every time it is
-      open when going to sleep on the socket.  This allows the log
-      file to get cleaned out by another process.
-
-    * Change to using libpopt rather than getopt for processing
-      options.	This makes the code cleaner and the behaviour more
-      consistent across platforms.  popt is included and built if not
-      installed on the platform.
-
-    * More details in --version, including note about whether 64-bit
-      files, symlinks and hardlinks are supported.
-
-    * MD4 code may use less CPU cycles.
-
-    * Use mkstemp on systems where it is secure.  If we use mktemp,
-      explain that we do it in a secure way.
-
-    * --whole-file is the default when source and target are on the
-	local machine.
-
-  BUG FIXES:
-
-    * Fix for various bugs causing rsync to hang.
-
-    * Attempt to fix Large File Summit support on AIX.
-
-    * Attempt to fix error handling lockup bug.
-
-    * Give a non-0 exit code if *any* of the files we have been asked
-      to transfer fail to transfer 
-
-    * For log messages containing ridiculously long strings that might
-      overflow a buffer rsync no longer aborts, but rather prints an
-      ellipsis at the end of the string.  (Patch from Ed Santiago.)
-
-  PLATFORMS:
-
-    * Improved support for UNICOS (tested on Cray T3E and Cray SV1)
-
-    * autoconf2.52 (or later) is now required to rebuild the autoconf
-      scripts.	It is not required to simply build rsync.
-
-    * Platforms thought to work in this release:
-
-		Cray SV1 UNICOS 10.0.0.8 cc
-		Debian Linux 2.2 UltraSparc gcc
-		Debian Linux testing/unstable ARM gcc
-		FreeBSD 3.3-RELEASE i386 cc
-		FreeBSD 4.1.1-RELEASE i386 cc
-		FreeBSD 4.3-STABLE i386 cc
-		HP PA-RISC HP-UX 10.20 gcc
-		HP PA-RISC HP-UX 11.11 cc
-		IRIX 6.5 MIPS cc
-		IRIX 6.5 MIPS gcc
-		Mac OS X PPC (--disable-ipv6) cc
-		NetBSD 1.5 i386 gcc
-		NetBSD Current i386 cc
-		OpenBSD 2.5 Sparc gcc
-		OpenBSD 2.9 i386 cc
-		OpenBSD Current i386 cc
-		RedHat 6.2 i386 gcc
-		RedHat 6.2 i386 insure++
-		RedHat 7.0 i386 gcc
-		RedHat 7.1 i386 (Kernel 2.4.10) gcc
-		Slackware 8.0 i686 (Kernel 2.4.10)
-		Solaris 8 UltraSparc cc
-		Solaris 8 UltraSparc gcc
-		Solaris 8 i386 gcc
-		SuSE 7.1 i386 gcc2.95.2
-		SuSE 7.1 ppc gcc2.95.2
-		i386-pc-sco3.2v5.0.5 cc
-		i386-pc-sco3.2v5.0.5 gcc
-		powerpc-ibm-aix4.3.3.0 cc
-		i686-unknown-sysv5UnixWare7.1.0 gcc
-		i686-unknown-sysv5UnixWare7.1.0 cc
-
-  TESTING:
-
-    * The existing test.sh script by Phil Hands has been merged into a
-      test framework that works from both "make check" and the Samba
-      build farm.
+    * Signedness security patch from Sebastian Krahmer
+      <krahmer@suse.de> -- in some cases we were not sufficiently
+      careful about reading integers from the network.
diff --git a/clientserver.c b/clientserver.c
index 4c44d26e..4dda0d11 100644
--- a/clientserver.c
+++ b/clientserver.c
@@ -1,7 +1,5 @@
-/* -*- c-file-style: "linux"; -*-
-   
-   Copyright (C) 1998-2001 by Andrew Tridgell <tridge@samba.org>
-   Copyright (C) 2001 by Martin Pool <mbp@samba.org>
+/* 
+   Copyright (C) Andrew Tridgell 1998
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -18,7 +16,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
-/* the socket based protocol for setting up a connection with rsyncd */
+/* the socket based protocol for setting up a connection wit rsyncd */
 
 #include "rsync.h"
 
@@ -29,10 +27,6 @@ extern int rsync_port;
 char *auth_user;
 int sanitize_paths = 0;
 
-/*
- * Run a client connected to an rsyncd.  The alternative to this
- * function for remote-shell connections is do_cmd.
- */
 int start_socket_client(char *host, char *path, int argc, char *argv[])
 {
 	int fd, i;
@@ -42,30 +36,9 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 	char *p, *user=NULL;
 	extern int remote_version;
 	extern int am_sender;
-	extern char *shell_cmd;
-	extern int kludge_around_eof;
-	extern char *bind_address;
-	extern int default_af_hint;
-       
-	if (argc == 0 && !am_sender) {
-		extern int list_only;
-		list_only = 1;
-	}
 
-        /* This is just a friendliness enhancement: if the connection
-         * is to an rsyncd then there is no point specifying the -e option.
-         * Note that this is only set if the -e was explicitly specified,
-         * not if the environment variable just happens to be set.
-         * See http://lists.samba.org/pipermail/rsync/2000-September/002744.html
-         */
-        if (shell_cmd) {
-                rprintf(FERROR, "WARNING: --rsh or -e option ignored when "
-                        "connecting to rsync daemon\n");
-                /* continue */
-        }
-        
 	if (*path == '/') {
-		rprintf(FERROR,"ERROR: The remote path must start with a module name not a /\n");
+		rprintf(FERROR,"ERROR: The remote path must start with a module name\n");
 		return -1;
 	}
 
@@ -79,8 +52,7 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 	if (!user) user = getenv("USER");
 	if (!user) user = getenv("LOGNAME");
 
-	fd = open_socket_out_wrapped (host, rsync_port, bind_address,
-				      default_af_hint);
+	fd = open_socket_out(host, rsync_port);
 	if (fd == -1) {
 		exit_cleanup(RERR_SOCKETIO);
 	}
@@ -109,10 +81,6 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 	io_printf(fd,"%s\n",path);
 	if (p) *p = '/';
 
-	/* Old servers may just drop the connection here,
-	 rather than sending a proper EXIT command.  Yuck. */
-	kludge_around_eof = remote_version < 25;
-
 	while (1) {
 		if (!read_line(fd, line, sizeof(line)-1)) {
 			return -1;
@@ -124,22 +92,16 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 		}
 
 		if (strcmp(line,"@RSYNCD: OK") == 0) break;
-
-		if (strcmp(line,"@RSYNCD: EXIT") == 0) exit(0);
-
 		rprintf(FINFO,"%s\n", line);
 	}
-	kludge_around_eof = False;
 
 	for (i=0;i<sargc;i++) {
 		io_printf(fd,"%s\n", sargs[i]);
 	}
 	io_printf(fd,"\n");
 
-	if (remote_version < 23) {
-		if (remote_version == 22 || (remote_version > 17 && !am_sender))
-			io_start_multiplex_in(fd);
-	}
+	if (remote_version > 17 && !am_sender)
+		io_start_multiplex_in(fd);
 
 	return client_run(fd, fd, -1, argc, argv);
 }
@@ -152,7 +114,7 @@ static int rsync_module(int fd, int i)
 	char *argv[MAX_ARGS];
 	char **argp;
 	char line[MAXPATHLEN];
-	uid_t uid = (uid_t)-2;  /* canonically "nobody" */
+	uid_t uid = (uid_t)-2;
 	gid_t gid = (gid_t)-2;
 	char *p;
 	char *addr = client_addr(fd);
@@ -168,9 +130,9 @@ static int rsync_module(int fd, int i)
 
 	if (!allow_access(addr, host, lp_hosts_allow(i), lp_hosts_deny(i))) {
 		rprintf(FERROR,"rsync denied on module %s from %s (%s)\n",
-			name, host, addr);
+			name, client_name(fd), client_addr(fd));
 		io_printf(fd,"@ERROR: access denied to %s from %s (%s)\n",
-			  name, host, addr);
+			  name, client_name(fd), client_addr(fd));
 		return -1;
 	}
 
@@ -200,6 +162,9 @@ static int rsync_module(int fd, int i)
 
 	module_id = i;
 
+	if (lp_read_only(i))
+		read_only = 1;
+
 	am_root = (getuid() == 0);
 
 	if (am_root) {
@@ -207,7 +172,7 @@ static int rsync_module(int fd, int i)
 		if (!name_to_uid(p, &uid)) {
 			if (!isdigit(*p)) {
 				rprintf(FERROR,"Invalid uid %s\n", p);
-				io_printf(fd,"@ERROR: invalid uid %s\n", p);
+				io_printf(fd,"@ERROR: invalid uid\n");
 				return -1;
 			} 
 			uid = atoi(p);
@@ -217,19 +182,12 @@ static int rsync_module(int fd, int i)
 		if (!name_to_gid(p, &gid)) {
 			if (!isdigit(*p)) {
 				rprintf(FERROR,"Invalid gid %s\n", p);
-				io_printf(fd,"@ERROR: invalid gid %s\n", p);
+				io_printf(fd,"@ERROR: invalid gid\n");
 				return -1;
 			} 
 			gid = atoi(p);
 		}
 	}
-        
-        /* TODO: If we're not root, but the configuration requests
-         * that we change to some uid other than the current one, then
-         * log a warning. */
-
-        /* TODO: Perhaps take a list of gids, and make them into the
-         * supplementary groups. */
 
 	p = lp_include_from(i);
 	add_exclude_file(p, 1, 1);
@@ -243,36 +201,24 @@ static int rsync_module(int fd, int i)
 	p = lp_exclude(i);
 	add_exclude_line(p);
 
-	log_init();
+	log_open();
 
 	if (use_chroot) {
-		/*
-		 * XXX: The 'use chroot' flag is a fairly reliable
-		 * source of confusion, because it fails under two
-		 * important circumstances: running as non-root,
-		 * running on Win32 (or possibly others).  On the
-		 * other hand, if you are running as root, then it
-		 * might be better to always use chroot.
-		 *
-		 * So, perhaps if we can't chroot we should just issue
-		 * a warning, unless a "require chroot" flag is set,
-		 * in which case we fail.
-		 */
 		if (chroot(lp_path(i))) {
-			rsyserr(FERROR, errno, "chroot %s failed", lp_path(i));
+			rprintf(FERROR,"chroot %s failed\n", lp_path(i));
 			io_printf(fd,"@ERROR: chroot failed\n");
 			return -1;
 		}
 
 		if (!push_dir("/", 0)) {
-                        rsyserr(FERROR, errno, "chdir %s failed\n", lp_path(i));
+			rprintf(FERROR,"chdir %s failed\n", lp_path(i));
 			io_printf(fd,"@ERROR: chdir failed\n");
 			return -1;
 		}
 
 	} else {
 		if (!push_dir(lp_path(i), 0)) {
-			rsyserr(FERROR, errno, "chdir %s failed\n", lp_path(i));
+			rprintf(FERROR,"chdir %s failed\n", lp_path(i));
 			io_printf(fd,"@ERROR: chdir failed\n");
 			return -1;
 		}
@@ -280,14 +226,25 @@ static int rsync_module(int fd, int i)
 	}
 
 	if (am_root) {
+#ifdef HAVE_SETGROUPS
+		/* Get rid of any supplementary groups this process
+		 * might have inheristed. */
+		if (setgroups(0, NULL)) {
+			rprintf(FERROR, "setgroups failed: %s\n",
+				strerror(errno));
+			io_printf(fd, "@ERROR: setgroups failed\n");
+			return -1;
+		}
+#endif
+
 		if (setgid(gid)) {
-			rsyserr(FERROR, errno, "setgid %d failed", (int) gid);
+			rprintf(FERROR,"setgid %d failed\n", gid);
 			io_printf(fd,"@ERROR: setgid failed\n");
 			return -1;
 		}
 
 		if (setuid(uid)) {
-			rsyserr(FERROR, errno, "setuid %d failed", (int) uid);
+			rprintf(FERROR,"setuid %d failed\n", uid);
 			io_printf(fd,"@ERROR: setuid failed\n");
 			return -1;
 		}
@@ -345,8 +302,7 @@ static int rsync_module(int fd, int i)
 		}
 	}
 
-        argp = argv;
-	ret = parse_arguments(&argc, (const char ***) &argp, 0);
+	ret = parse_arguments(argc, argv, 0);
 
 	if (request) {
 		if (*auth_user) {
@@ -361,27 +317,20 @@ static int rsync_module(int fd, int i)
 		free(request);
 	}
 
-#ifndef DEBUG
+#if !TRIDGE
 	/* don't allow the logs to be flooded too fast */
 	if (verbose > 1) verbose = 1;
 #endif
 
-	if (remote_version < 23) {
-		if (remote_version == 22 || (remote_version > 17 && am_sender))
-			io_start_multiplex_out(fd);
-	}
-        
-        /* For later protocol versions, we don't start multiplexing
-         * until we've configured nonblocking in start_server.  That
-         * means we're in a sticky situation now: there's no way to
-         * convey errors to the client. */
-
-        /* FIXME: Hold off on reporting option processing errors until
-         * we've set up nonblocking and multiplexed IO and can get the
-         * message back to them. */
+	argc -= optind;
+	argp = argv + optind;
+	optind = 0;
+
+	if (remote_version > 17 && am_sender)
+		io_start_multiplex_out(fd);
+
 	if (!ret) {
-                option_error();
-                exit_cleanup(RERR_UNSUPPORTED);
+		option_error();
 	}
 
 	if (lp_timeout(i)) {
@@ -400,14 +349,10 @@ static void send_listing(int fd)
 {
 	int n = lp_numservices();
 	int i;
-	extern int remote_version;
-
+	
 	for (i=0;i<n;i++)
 		if (lp_list(i))
 		    io_printf(fd, "%-15s\t%s\n", lp_name(i), lp_comment(i));
-
-	if (remote_version >= 25)
-		io_printf(fd,"@RSYNCD: EXIT\n");
 }
 
 /* this is called when a socket connection is established to a client
@@ -427,7 +372,7 @@ static int start_daemon(int fd)
 
 	set_socket_options(fd,"SO_KEEPALIVE");
 	set_socket_options(fd,lp_socket_options());
-	set_nonblocking(fd);
+	
 
 	io_printf(fd,"@RSYNCD: %d\n", PROTOCOL_VERSION);
 
@@ -487,7 +432,6 @@ int daemon_main(void)
 	extern char *config_file;
 	extern int orig_umask;
 	char *pid_file;
-	extern int no_detach;
 
 	if (is_a_socket(STDIN_FILENO)) {
 		int i;
@@ -500,24 +444,21 @@ int daemon_main(void)
 			open("/dev/null", O_RDWR);
 		}
 
+		set_nonblocking(STDIN_FILENO);
+
 		return start_daemon(STDIN_FILENO);
 	}
 
-	if (!no_detach)
-	    become_daemon();
+	become_daemon();
 
 	if (!lp_load(config_file, 1)) {
+		fprintf(stderr,"failed to load config file %s\n", config_file);
 		exit_cleanup(RERR_SYNTAX);
 	}
 
-	log_init();
+	log_open();
 
-	rprintf(FINFO, "rsyncd version %s starting, listening on port %d\n",
-		RSYNC_VERSION,
-                rsync_port);
-        /* TODO: If listening on a particular address, then show that
-         * address too.  In fact, why not just do inet_ntop on the
-         * local address??? */
+	rprintf(FINFO,"rsyncd version %s starting\n",VERSION);
 
 	if (((pid_file = lp_pid_file()) != NULL) && (*pid_file != '\0')) {
 		char pidbuf[16];
@@ -527,10 +468,10 @@ int daemon_main(void)
 		if ((fd = do_open(lp_pid_file(), O_WRONLY|O_CREAT|O_TRUNC,
 					0666 & ~orig_umask)) == -1) {
 		    cleanup_set_pid(0);
-		    rsyserr(FLOG, errno, "failed to create pid file %s", pid_file);
+		    fprintf(stderr,"failed to create pid file %s\n", pid_file);
 		    exit_cleanup(RERR_FILEIO);
 		}
-		snprintf(pidbuf, sizeof(pidbuf), "%d\n", pid);
+		slprintf(pidbuf, sizeof(pidbuf), "%d\n", pid);
 		write(fd, pidbuf, strlen(pidbuf));
 		close(fd);
 	}
diff --git a/configure.in b/configure.in
index 829d0aad..c1ae3c0d 100644
--- a/configure.in
+++ b/configure.in
@@ -1,225 +1,20 @@
 dnl Process this file with autoconf to produce a configure script.
-
-AC_INIT()
-AC_CONFIG_SRCDIR([byteorder.h])
+AC_INIT(byteorder.h)
 AC_CONFIG_HEADER(config.h)
-AC_PREREQ(2.52)
-
-RSYNC_VERSION=2.5.2pre3
-AC_SUBST(RSYNC_VERSION)
-AC_MSG_NOTICE([Configuring rsync $RSYNC_VERSION])
-
-AC_DEFINE_UNQUOTED(RSYNC_VERSION, ["$RSYNC_VERSION"], [rsync release version])
 
-LDFLAGS=${LDFLAGS-""}
+# compile with optimisation and without debugging by default
+CFLAGS=${CFLAGS-"-O"}
 
-AC_CANONICAL_TARGET([])
+AC_CANONICAL_SYSTEM
+AC_VALIDATE_CACHE_SYSTEM_TYPE
 
 dnl Checks for programs.
 AC_PROG_CC
-AC_PROG_CPP
 AC_PROG_INSTALL
-AC_PROG_CC_STDC
 AC_SUBST(SHELL)
 
-AC_DEFINE([_GNU_SOURCE], 1,
-          [Define _GNU_SOURCE so that we get all necessary prototypes])
-
-if test "$xac_cv_prog_cc_stdc" = xno
-then
-	AC_MSG_WARN([rsync requires an ANSI C compiler and you don't seem to have one])
-fi
-
-# We must decide this before testing the compiler.
-
-# Please allow this to default to yes, so that your users have more
-# chance of getting a useful stack trace if problems occur.
-
-AC_MSG_CHECKING([whether to include debugging symbols])
-AC_ARG_ENABLE(debug,
-	AC_HELP_STRING([--enable-debug],
-		[including debugging symbols and features (default yes)]),
-		[], [])
-
-if test x"$enable_debug" = x"no"
-then
-    AC_MSG_RESULT(no)
-    CFLAGS=${CFLAGS-"-O"}
-else
-    AC_MSG_RESULT([yes])
-    # leave CFLAGS alone; AC_PROG_CC will try to include -g if it can
-    dnl AC_DEFINE(DEBUG, 1, [Define to turn on debugging code that may slow normal operation])
-    dnl CFLAGS=${CFLAGS-"-g"}
-fi
-
-
-
-
-AC_ARG_ENABLE(profile,
-	AC_HELP_STRING([--enable-profile],	
-		[turn on CPU profiling (default no)],
-		[], []))
-if test x"$enable_profile" = xyes
-then
-	CFLAGS="$CFLAGS -pg"
-fi
-
-
-# This is needed for our included version of popt.  Kind of silly, but
-# I don't want our version too far out of sync.
-CFLAGS="$CFLAGS -DHAVE_CONFIG_H"
-
-# If GCC, turn on warnings.
-if test "x$GCC" = "xyes"
-then
-	CFLAGS="$CFLAGS -Wall -W"
-fi
-
-AC_ARG_WITH(included-popt,
-        [  --with-included-popt    use bundled popt library, not from system])
-
-AC_ARG_WITH(rsync-path,
-	[  --with-rsync-path=PATH  set default --rsync-path to PATH (default: \"rsync\")],
-	[ RSYNC_PATH="$with_rsync_path" ],
-	[ RSYNC_PATH="rsync" ])
-AC_DEFINE_UNQUOTED(RSYNC_PATH, "$RSYNC_PATH", [ ])
-
 AC_CHECK_PROG(HAVE_REMSH, remsh, 1, 0)
-AC_DEFINE_UNQUOTED(HAVE_REMSH, $HAVE_REMSH, [ ])
-
-
-# arrgh. libc in the current debian stable screws up the largefile
-# stuff, getting byte range locking wrong
-AC_CACHE_CHECK([for broken largefile support],rsync_cv_HAVE_BROKEN_LARGEFILE,[
-AC_TRY_RUN([
-#define _FILE_OFFSET_BITS 64
-#include <stdio.h>
-#include <fcntl.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-
-int main(void) 
-{
-	struct flock lock;
-        int status;
-	int fd = open("conftest.dat", O_CREAT|O_RDWR, 0600);
-	lock.l_type = F_WRLCK;
-	lock.l_whence = SEEK_SET;
-	lock.l_start = 0;
-	lock.l_len = 1;
-	lock.l_pid = 0;
-	
-	fcntl(fd,F_SETLK,&lock);
-	if (fork() == 0) {
-		lock.l_start = 1;		
-		exit(fcntl(fd,F_SETLK,&lock) == 0);
-        }
-        wait(&status);
-	unlink("conftest.dat");
-	exit(WEXITSTATUS(status));
-}
-],
-rsync_cv_HAVE_BROKEN_LARGEFILE=yes,rsync_cv_HAVE_BROKEN_LARGEFILE=no,rsync_cv_HAVE_BROKEN_LARGEFILE=cross)])
-if test x"$rsync_cv_HAVE_BROKEN_LARGEFILE" != x"yes"; then
-   AC_SYS_LARGEFILE
-fi
-
-ipv6type=unknown
-ipv6lib=none
-ipv6trylibc=yes
-
-AC_ARG_ENABLE(ipv6, 
-	AC_HELP_STRING([--disable-ipv6], [don't even try to use IPv6]))
-
-if test "x$enable_ipv6" != xno
-then
-	AC_MSG_CHECKING([ipv6 stack type])
-	for i in inria kame linux-glibc linux-inet6 toshiba v6d zeta; do
-		case $i in
-		inria)
-			# http://www.kame.net/
-			AC_EGREP_CPP(yes, [
-#include <netinet/in.h>
-#ifdef IPV6_INRIA_VERSION
-yes
-#endif],
-				[ipv6type=$i;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])
-				])
-			;;
-		kame)
-			# http://www.kame.net/
-			AC_EGREP_CPP(yes, [
-#include <netinet/in.h>
-#ifdef __KAME__
-yes
-#endif],
-				[ipv6type=$i; 
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		linux-glibc)
-			# http://www.v6.linux.or.jp/
-			AC_EGREP_CPP(yes, [
-#include <features.h>
-#if defined(__GLIBC__) && __GLIBC__ >= 2 && __GLIBC_MINOR__ >= 1
-yes
-#endif],
-				[ipv6type=$i;
-AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		linux-inet6)
-			# http://www.v6.linux.or.jp/
-			if test -d /usr/inet6 -o -f /usr/inet6/lib/libinet6.a; then
-				ipv6type=$i
-				ipv6lib=inet6
-				ipv6libdir=/usr/inet6/lib
-				ipv6trylibc=yes;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])
-				CFLAGS="-I/usr/inet6/include $CFLAGS"
-			fi
-			;;
-		toshiba)
-			AC_EGREP_CPP(yes, [
-#include <sys/param.h>
-#ifdef _TOSHIBA_INET6
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=inet6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		v6d)
-			AC_EGREP_CPP(yes, [
-#include </usr/local/v6/include/sys/v6config.h>
-#ifdef __V6D__
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=v6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		zeta)
-			AC_EGREP_CPP(yes, [
-#include <sys/param.h>
-#ifdef _ZETA_MINAMI_INET6
-yes
-#endif],
-				[ipv6type=$i;
-				ipv6lib=inet6;
-				ipv6libdir=/usr/local/v6/lib;
-				AC_DEFINE(INET6, 1, [true if you have IPv6])])
-			;;
-		esac
-		if test "$ipv6type" != "unknown"; then
-			break
-		fi
-	done
-	AC_MSG_RESULT($ipv6type)
-
-	AC_SEARCH_LIBS(getaddrinfo, inet6)
-fi
+AC_DEFINE_UNQUOTED(HAVE_REMSH, $HAVE_REMSH)
 
 AC_C_BIGENDIAN
 AC_HEADER_DIRENT
@@ -228,9 +23,7 @@ AC_HEADER_SYS_WAIT
 AC_CHECK_HEADERS(sys/fcntl.h sys/select.h fcntl.h sys/time.h sys/unistd.h unistd.h utime.h grp.h)
 AC_CHECK_HEADERS(compat.h sys/param.h ctype.h sys/wait.h sys/ioctl.h)
 AC_CHECK_HEADERS(sys/filio.h string.h stdlib.h sys/socket.h sys/mode.h)
-AC_CHECK_HEADERS(glob.h alloca.h mcheck.h sys/sysctl.h arpa/inet.h arpa/nameser.h)
-AC_CHECK_HEADERS(netdb.h)
-AC_CHECK_HEADERS(malloc.h)
+AC_CHECK_HEADERS(glob.h)
 
 AC_CHECK_SIZEOF(int)
 AC_CHECK_SIZEOF(long)
@@ -245,112 +38,22 @@ AC_TYPE_OFF_T
 AC_TYPE_SIZE_T
 AC_TYPE_PID_T
 AC_TYPE_GETGROUPS
-AC_CHECK_MEMBERS([struct stat.st_rdev])
-
-AC_CHECK_TYPE([ino_t], [unsigned])
-TYPE_SOCKLEN_T
+AC_STRUCT_ST_RDEV
+AC_CHECK_TYPE(ino_t,unsigned)
 
 AC_CACHE_CHECK([for errno in errno.h],rsync_cv_errno, [
     AC_TRY_COMPILE([#include <errno.h>],[int i = errno],
 	rsync_cv_errno=yes,rsync_cv_have_errno_decl=no)])
 if test x"$rsync_cv_errno" = x"yes"; then
-   AC_DEFINE(HAVE_ERRNO_DECL, 1, [ ])
-fi
-
-# The following test taken from the cvs sources
-# If we can't find connect, try looking in -lsocket, -lnsl, and -linet.
-# These need checks to be before checks for any other functions that
-#    might be in the same libraries.
-# The Irix 5 libc.so has connect and gethostbyname, but Irix 5 also has
-# libsocket.so which has a bad implementation of gethostbyname (it
-# only looks in /etc/hosts), so we only look for -lsocket if we need
-# it.
-AC_CHECK_FUNCS(connect)
-if test x"$ac_cv_func_connect" = x"no"; then
-    case "$LIBS" in
-    *-lnsl*) ;;
-    *) AC_CHECK_LIB(nsl_s, printf) ;;
-    esac
-    case "$LIBS" in
-    *-lnsl*) ;;
-    *) AC_CHECK_LIB(nsl, printf) ;;
-    esac
-    case "$LIBS" in
-    *-lsocket*) ;;
-    *) AC_CHECK_LIB(socket, connect) ;;
-    esac
-    case "$LIBS" in
-    *-linet*) ;;
-    *) AC_CHECK_LIB(inet, connect) ;;
-    esac
-    dnl We can't just call AC_CHECK_FUNCS(connect) here, because the value
-    dnl has been cached.
-    if test x"$ac_cv_lib_socket_connect" = x"yes" || 
-       test x"$ac_cv_lib_inet_connect" = x"yes"; then
-        # ac_cv_func_connect=yes
-        # don't!  it would cause AC_CHECK_FUNC to succeed next time configure is run
-        AC_DEFINE(HAVE_CONNECT, 1, [ ])
-    fi
-fi
-
-AC_CHECK_LIB(resolv, inet_ntop)
-
-dnl AC_MSG_NOTICE([Looking in libraries: $LIBS])
-
-AC_CHECK_FUNCS(inet_ntop, , AC_LIBOBJ(lib/inet_ntop)) 
-AC_CHECK_FUNCS(inet_pton, , AC_LIBOBJ(lib/inet_pton))
-
-AC_CHECK_FUNCS(getaddrinfo, , AC_LIBOBJ(lib/getaddrinfo)) 
-AC_CHECK_FUNCS(getnameinfo, , AC_LIBOBJ(lib/getnameinfo))
-
-AC_CHECK_MEMBER([struct sockaddr.sa_len], 
-		[ AC_DEFINE(HAVE_SOCKADDR_LEN) ],
-		[],
-		[
-#include <sys/types.h>
-#include <sys/socket.h>
-])
-
-AC_MSG_CHECKING(struct sockaddr_storage)
-AC_TRY_COMPILE([#include <sys/types.h>
-#include <sys/socket.h>],
-[struct sockaddr_storage x;],
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_SOCKADDR_STORAGE, 1, 
-		[Define if you have strct sockaddr_storage.] ),
-	AC_MSG_RESULT(no))
-
-# if we can't find strcasecmp, look in -lresolv (for Unixware at least)
-#
-AC_CHECK_FUNCS(strcasecmp)
-if test x"$ac_cv_func_strcasecmp" = x"no"; then
-    AC_CHECK_LIB(resolv, strcasecmp)
+   AC_DEFINE(HAVE_ERRNO_DECL)
 fi
 
-dnl At the moment we don't test for a broken memcmp(), because all we
-dnl need to do is test for equality, not comparison, and it seems that
-dnl every platform has a memcmp that can do at least that.  
-dnl AC_FUNC_MEMCMP
-
+AC_FUNC_MEMCMP
 AC_FUNC_UTIME_NULL
 AC_CHECK_FUNCS(waitpid wait4 getcwd strdup strerror chown chmod mknod)
 AC_CHECK_FUNCS(fchmod fstat strchr readlink link utime utimes strftime)
-AC_CHECK_FUNCS(memmove lchown vsnprintf snprintf asprintf setsid glob strpbrk)
-AC_CHECK_FUNCS(strlcat strlcpy mtrace mallinfo)
-
-AC_CACHE_CHECK([for working socketpair],rsync_cv_HAVE_SOCKETPAIR,[
-AC_TRY_RUN([
-#include <sys/types.h>
-#include <sys/socket.h>
-
-main() {
-       int fd[2];
-       exit((socketpair(AF_UNIX, SOCK_STREAM, 0, fd) != -1) ? 0 : 1);
-}],
-rsync_cv_HAVE_SOCKETPAIR=yes,rsync_cv_HAVE_SOCKETPAIR=no,rsync_cv_HAVE_SOCKETPAIR=cross)])
-if test x"$rsync_cv_HAVE_SOCKETPAIR" = x"yes"; then
-    AC_DEFINE(HAVE_SOCKETPAIR, 1, [ ])
-fi
+AC_CHECK_FUNCS(memmove lchown vsnprintf snprintf setsid glob strpbrk)
+AC_CHECK_FUNCS(strlcat strlcpy inet_aton setgroups)
 
 AC_CACHE_CHECK([for working fnmatch],rsync_cv_HAVE_FNMATCH,[
 AC_TRY_RUN([#include <fnmatch.h>
@@ -358,22 +61,23 @@ main() { exit((fnmatch("*.o", "x.o", FNM_PATHNAME) == 0 &&
                fnmatch("a/b/*", "a/b/c/d", FNM_PATHNAME) != 0) ? 0: 1); }],
 rsync_cv_HAVE_FNMATCH=yes,rsync_cv_HAVE_FNMATCH=no,rsync_cv_HAVE_FNMATCH=cross)])
 if test x"$rsync_cv_HAVE_FNMATCH" = x"yes"; then
-    AC_DEFINE(HAVE_FNMATCH, 1, [ ])
-fi
-
-if test x"$with_included_popt" != x"yes"
-then
-    AC_CHECK_LIB(popt, poptGetContext, , [with_included_popt=yes])
+    AC_DEFINE(HAVE_FNMATCH)
 fi
 
-AC_MSG_CHECKING([whether to use included libpopt])
-if test x"$with_included_popt" = x"yes"
-then
-    AC_MSG_RESULT($srcdir/popt)
-    BUILD_POPT='$(popt_OBJS)'
-    CFLAGS="$CFLAGS -I$srcdir/popt"
-else
-    AC_MSG_RESULT(no)
+# sometimes getopt_long cannot parse same arguments twice
+# e.g. on certain versions of CygWin32
+AC_CACHE_CHECK([for working getopt_long],rsync_cv_HAVE_GETOPT_LONG,[
+AC_TRY_RUN([#include <getopt.h>
+main() {
+    int i, x = 0; char *argv[] = { "x", "--xx" };
+    struct option o[] = {{"xx", 0, 0, 1}, {0,0,0,0}};
+    getopt_long(2, argv, "x", o, &i) == 1 ? x++ : 0; optind = 0;
+    getopt_long(2, argv, "x", o, &i) == 1 ? x++ : 0;
+    exit(x == 2 ? 0 : 1);
+}], rsync_cv_HAVE_GETOPT_LONG=yes,rsync_cv_HAVE_GETOPT_LONG=no,
+    rsync_cv_HAVE_GETOPT_LONG=cross)])
+if test x"$rsync_cv_HAVE_GETOPT_LONG" = x"yes"; then
+    AC_DEFINE(HAVE_GETOPT_LONG)
 fi
 
 AC_CACHE_CHECK([for long long],rsync_cv_HAVE_LONGLONG,[
@@ -381,7 +85,7 @@ AC_TRY_RUN([#include <stdio.h>
 main() { long long x = 1000000; x *= x; exit(((x/1000000) == 1000000)? 0: 1); }],
 rsync_cv_HAVE_LONGLONG=yes,rsync_cv_HAVE_LONGLONG=no,rsync_cv_HAVE_LONGLONG=cross)])
 if test x"$rsync_cv_HAVE_LONGLONG" = x"yes"; then
-    AC_DEFINE(HAVE_LONGLONG, 1, [ ])
+    AC_DEFINE(HAVE_LONGLONG)
 fi
 
 AC_CACHE_CHECK([for off64_t],rsync_cv_HAVE_OFF64_T,[
@@ -390,7 +94,7 @@ AC_TRY_RUN([#include <stdio.h>
 main() { struct stat64 st; off64_t s; if (sizeof(off_t) == sizeof(off64_t)) exit(1); exit((lstat64("/dev/null", &st)==0)?0:1); }],
 rsync_cv_HAVE_OFF64_T=yes,rsync_cv_HAVE_OFF64_T=no,rsync_cv_HAVE_OFF64_T=cross)])
 if test x"$rsync_cv_HAVE_OFF64_T" = x"yes"; then
-    AC_DEFINE(HAVE_OFF64_T, 1, [ ])
+    AC_DEFINE(HAVE_OFF64_T)
 fi
 
 AC_CACHE_CHECK([for short ino_t],rsync_cv_HAVE_SHORT_INO_T,[
@@ -400,7 +104,7 @@ AC_TRY_RUN([#include <stdio.h>
 main() { if (sizeof(ino_t) < sizeof(unsigned int)) return 0; return 1; }],
 rsync_cv_HAVE_SHORT_INO_T=yes,rsync_cv_HAVE_SHORT_INO_T=no,rsync_cv_HAVE_SHORT_INO_T=cross)])
 if test x"$rsync_cv_HAVE_SHORT_INO_T" = x"yes"; then
-    AC_DEFINE(HAVE_SHORT_INO_T, 1, [ ])
+    AC_DEFINE(HAVE_SHORT_INO_T)
 fi
 
 AC_CACHE_CHECK([for unsigned char],rsync_cv_HAVE_UNSIGNED_CHAR,[
@@ -408,7 +112,7 @@ AC_TRY_RUN([#include <stdio.h>
 main() { char c; c=250; exit((c > 0)?0:1); }],
 rsync_cv_HAVE_UNSIGNED_CHAR=yes,rsync_cv_HAVE_UNSIGNED_CHAR=no,rsync_cv_HAVE_UNSIGNED_CHAR=cross)])
 if test x"$rsync_cv_HAVE_UNSIGNED_CHAR" = x"yes"; then
-    AC_DEFINE(HAVE_UNSIGNED_CHAR, 1, [ ])
+    AC_DEFINE(HAVE_UNSIGNED_CHAR)
 fi
 
 AC_CACHE_CHECK([for broken readdir],rsync_cv_HAVE_BROKEN_READDIR,[
@@ -419,7 +123,7 @@ if (di && di->d_name[-2] == '.' && di->d_name[-1] == 0 &&
 di->d_name[0] == 0) exit(0); exit(1);} ],
 rsync_cv_HAVE_BROKEN_READDIR=yes,rsync_cv_HAVE_BROKEN_READDIR=no,rsync_cv_HAVE_BROKEN_READDIR=cross)])
 if test x"$rsync_cv_HAVE_BROKEN_READDIR" = x"yes"; then
-    AC_DEFINE(HAVE_BROKEN_READDIR, 1, [ ])
+    AC_DEFINE(HAVE_BROKEN_READDIR)
 fi
 
 AC_CACHE_CHECK([for utimbuf],rsync_cv_HAVE_UTIMBUF,[
@@ -428,68 +132,9 @@ AC_TRY_COMPILE([#include <sys/types.h>
 [struct utimbuf tbuf;  tbuf.actime = 0; tbuf.modtime = 1; exit(utime("foo.c",&tbuf));],
 rsync_cv_HAVE_UTIMBUF=yes,rsync_cv_HAVE_UTIMBUF=no,rsync_cv_HAVE_UTIMBUF=cross)])
 if test x"$rsync_cv_HAVE_UTIMBUF" = x"yes"; then
-    AC_DEFINE(HAVE_UTIMBUF, 1, [ ])
+    AC_DEFINE(HAVE_UTIMBUF)
 fi
 
-AC_CACHE_CHECK([if gettimeofday takes tz argument],rsync_cv_HAVE_GETTIMEOFDAY_TZ,[
-AC_TRY_RUN([
-#include <sys/time.h>
-#include <unistd.h>
-main() { struct timeval tv; exit(gettimeofday(&tv, NULL));}],
-           rsync_cv_HAVE_GETTIMEOFDAY_TZ=yes,rsync_cv_HAVE_GETTIMEOFDAY_TZ=no,rsync_cv_HAVE_GETTIMEOFDAY_TZ=cross)])
-if test x"$rsync_cv_HAVE_GETTIMEOFDAY_TZ" = x"yes"; then
-    AC_DEFINE(HAVE_GETTIMEOFDAY_TZ, 1, [ ])
-fi
-
-AC_CACHE_CHECK([for C99 vsnprintf],rsync_cv_HAVE_C99_VSNPRINTF,[
-AC_TRY_RUN([
-#include <sys/types.h>
-#include <stdarg.h>
-void foo(const char *format, ...) { 
-       va_list ap;
-       int len;
-       char buf[5];
-
-       va_start(ap, format);
-       len = vsnprintf(0, 0, format, ap);
-       va_end(ap);
-       if (len != 5) exit(1);
-
-       if (snprintf(buf, 3, "hello") != 5 || strcmp(buf, "he") != 0) exit(1);
-
-       exit(0);
-}
-main() { foo("hello"); }
-],
-rsync_cv_HAVE_C99_VSNPRINTF=yes,rsync_cv_HAVE_C99_VSNPRINTF=no,rsync_cv_HAVE_C99_VSNPRINTF=cross)])
-if test x"$rsync_cv_HAVE_C99_VSNPRINTF" = x"yes"; then
-    AC_DEFINE(HAVE_C99_VSNPRINTF, 1, [ ])
-fi
-
-
-AC_CACHE_CHECK([for secure mkstemp],rsync_cv_HAVE_SECURE_MKSTEMP,[
-AC_TRY_RUN([#include <stdlib.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-main() { 
-  struct stat st;
-  char tpl[20]="/tmp/test.XXXXXX"; 
-  int fd = mkstemp(tpl); 
-  if (fd == -1) exit(1);
-  unlink(tpl);
-  if (fstat(fd, &st) != 0) exit(1);
-  if ((st.st_mode & 0777) != 0600) exit(1);
-  exit(0);
-}],
-rsync_cv_HAVE_SECURE_MKSTEMP=yes,
-rsync_cv_HAVE_SECURE_MKSTEMP=no,
-rsync_cv_HAVE_SECURE_MKSTEMP=cross)])
-if test x"$rsync_cv_HAVE_SECURE_MKSTEMP" = x"yes"; then
-    AC_DEFINE(HAVE_SECURE_MKSTEMP, 1, [ ])
-fi
-
-
 AC_CACHE_CHECK([for broken inet_ntoa],rsync_cv_REPLACE_INET_NTOA,[
 AC_TRY_RUN([
 #include <stdio.h>
@@ -498,25 +143,53 @@ AC_TRY_RUN([
 #include <arpa/inet.h>
 main() { struct in_addr ip; ip.s_addr = 0x12345678;
 if (strcmp(inet_ntoa(ip),"18.52.86.120") &&
-    strcmp(inet_ntoa(ip),"120.86.52.18")) { exit(1); } 
-exit(0);}],
-           rsync_cv_REPLACE_INET_NTOA=no,rsync_cv_REPLACE_INET_NTOA=yes,rsync_cv_REPLACE_INET_NTOA=cross)])
+    strcmp(inet_ntoa(ip),"120.86.52.18")) { exit(0); } 
+exit(1);}],
+           rsync_cv_REPLACE_INET_NTOA=yes,rsync_cv_REPLACE_INET_NTOA=no,rsync_cv_REPLACE_INET_NTOA=cross)])
 if test x"$rsync_cv_REPLACE_INET_NTOA" = x"yes"; then
-    AC_DEFINE(REPLACE_INET_NTOA, 1, [ ])
+    AC_DEFINE(REPLACE_INET_NTOA)
 fi
 
+# The following test taken from the cvs sources
+# If we can't find connect, try looking in -lsocket, -lnsl, and -linet.
+# The Irix 5 libc.so has connect and gethostbyname, but Irix 5 also has
+# libsocket.so which has a bad implementation of gethostbyname (it
+# only looks in /etc/hosts), so we only look for -lsocket if we need
+# it.
+AC_CHECK_FUNCS(connect)
+if test x"$ac_cv_func_connect" = x"no"; then
+    case "$LIBS" in
+    *-lnsl*) ;;
+    *) AC_CHECK_LIB(nsl_s, printf) ;;
+    esac
+    case "$LIBS" in
+    *-lnsl*) ;;
+    *) AC_CHECK_LIB(nsl, printf) ;;
+    esac
+    case "$LIBS" in
+    *-lsocket*) ;;
+    *) AC_CHECK_LIB(socket, connect) ;;
+    esac
+    case "$LIBS" in
+    *-linet*) ;;
+    *) AC_CHECK_LIB(inet, connect) ;;
+    esac
+    dnl We can't just call AC_CHECK_FUNCS(connect) here, because the value
+    dnl has been cached.
+    if test x"$ac_cv_lib_socket_connect" = x"yes" || 
+       test x"$ac_cv_lib_inet_connect" = x"yes"; then
+        # ac_cv_func_connect=yes
+        # don't!  it would cause AC_CHECK_FUNC to succeed next time configure is run
+        AC_DEFINE(HAVE_CONNECT)
+    fi
+fi
 
-AC_CACHE_CHECK([for broken inet_aton],rsync_cv_REPLACE_INET_ATON,[
-AC_TRY_RUN([
-#include <stdio.h>
-#include <sys/types.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-main() { struct in_addr ip; 
-if (inet_aton("example", &ip) == 0) exit(0); exit(1);}],
-           rsync_cv_REPLACE_INET_ATON=no,rsync_cv_REPLACE_INET_ATON=yes,rsync_cv_REPLACE_INET_ATON=cross)])
-if test x"$rsync_cv_REPLACE_INET_ATON" = x"yes"; then
-    AC_DEFINE(REPLACE_INET_ATON, 1, [ ])
+# 
+# if we can't find strcasecmp, look in -lresolv (for Unixware at least)
+#
+AC_CHECK_FUNCS(strcasecmp)
+if test x"$ac_cv_func_strcasecmp" = x"no"; then
+    AC_CHECK_LIB(resolv, strcasecmp)
 fi
 
 #
@@ -548,11 +221,6 @@ fi
 AC_SUBST(OBJ_SAVE)
 AC_SUBST(OBJ_RESTORE)
 AC_SUBST(CC_SHOBJ_FLAG)
-AC_SUBST(BUILD_POPT)
 
-AC_CONFIG_FILES([Makefile lib/dummy zlib/dummy popt/dummy shconfig])
-AC_OUTPUT
 
-AC_MSG_RESULT()
-AC_MSG_RESULT([    rsync ${RSYNC_VERSION} configuration successful])
-AC_MSG_RESULT()
+AC_OUTPUT(Makefile lib/dummy zlib/dummy)
diff --git a/version.h b/version.h
index 3c2a6909..641f99b3 100644
--- a/version.h
+++ b/version.h
@@ -1 +1 @@
-#define VERSION "2.3.3"
+#define VERSION "2.3.4pre1"