Security fix in flist.c breaks --delete-missing-args with --files-from

[mgkeeley]

The mode validation added as part of recent security hardening in recv_file_entry() (flist.c lines 864–876) breaks the --delete-missing-args feature when used with --files-from.

Steps to reproduce

echo "path/to/deleted/file.txt" | rsync --delete --delete-missing-args \
  --files-from=- ./ user@remote:dest/

Where path/to/deleted/file.txt does not exist locally but exists on the remote.

Expected behaviour

The file is deleted on the remote, as documented for --delete-missing-args.

Actual behaviour

invalid file mode 00 for path/to/deleted/file.php [receiver]
rsync error: protocol incompatibility (code 2) at flist.c(874) [receiver=3.4.3]

Root cause

The sender deliberately sends mode=0 for missing-args entries — this is intentional by design, as documented in the sender code in flist.c:

} else /* (missing_args == 2) */ {
    /* Send the arg as a "missing" entry with
     * mode 0, which tells the generator to delete it. */
    memset(&st, 0, sizeof st);
}

The generator in generator.c correctly handles this case:

if (missing_args == 2 && file->mode == 0) {
    if (filter_list.head && check_filter(&filter_list, FINFO, fname, is_dir) < 0)
        return;
    if (statret == 0)
        delete_item(fname, sx.st.st_mode, del_opts);
    return;
}

However, the security validation added to recv_file_entry() rejects mode=0 before the entry ever reaches the generator:

if (!S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
 && !S_ISCHR(mode) && !S_ISBLK(mode)
 && !S_ISFIFO(mode) && !S_ISSOCK(mode)) {
    rprintf(FERROR, "invalid file mode 0%o for %s [%s]\n",
        (unsigned)mode, lastname, who_am_i());
    exit_cleanup(RERR_PROTOCOL);
}

Proposed fix

Add a missing_args == 2 exception to the mode validation:

if (!S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
 && !S_ISCHR(mode) && !S_ISBLK(mode)
 && !S_ISFIFO(mode) && !S_ISSOCK(mode)
 && !(missing_args == 2 && mode == 0)) {
    rprintf(FERROR, "invalid file mode 0%o for %s [%s]\n",
        (unsigned)mode, lastname, who_am_i());
    exit_cleanup(RERR_PROTOCOL);
}

Versions affected

3.4.3, plus security backports in 3.2.7. I haven't checked other versions.

[powerman]

Same happens in file does not exists both locally and remotely:

$ mkdir -p /tmp/rsync-{src,dst}
$ echo "existing" > /tmp/rsync-src/existing-file
$ printf '%s\n' "existing-file" "non-existing-file" | rsync -a --delete --delete-missing-args --files-from=- /tmp/rsync-{src,dst}
invalid file mode 00 for non-existing-file [Receiver]
rsync error: protocol incompatibility (code 2) at flist.c(874) [Receiver=3.4.3]
$                                                                                                  

[powerman]

Proposed patch:

mode 0 is a valid sentinel value used by --delete-missing-args to signal
that a file entry should be deleted on the receiver. Accept it through
the mode validation that was added as a security hardening in 3.4.3.

diff -uNr rsync-3.4.3.orig/flist.c rsync-3.4.3/flist.c
--- rsync-3.4.3.orig/flist.c	2026-05-20 03:01:22.000000000 +0300
+++ rsync-3.4.3/flist.c	2026-05-22 15:18:53.905106467 +0300
@@ -866,7 +866,7 @@
 		/* Reject modes whose type bits are not one of the standard
 		 * file types; otherwise garbage mode values propagate through
 		 * the file-type checks below unpredictably. */
-		if (!S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
+		if (mode && !S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
 		 && !S_ISCHR(mode) && !S_ISBLK(mode)
 		 && !S_ISFIFO(mode) && !S_ISSOCK(mode)) {
 			rprintf(FERROR, "invalid file mode 0%o for %s [%s]\n",

[cruzjuansergio044-ui]

Proposed patch:

mode 0 is a valid sentinel value used by --delete-missing-args to signal
that a file entry should be deleted on the receiver. Accept it through
the mode validation that was added as a security hardening in 3.4.3.

diff -uNr rsync-3.4.3.orig/flist.c rsync-3.4.3/flist.c
--- rsync-3.4.3.orig/flist.c	2026-05-20 03:01:22.000000000 +0300
+++ rsync-3.4.3/flist.c	2026-05-22 15:18:53.905106467 +0300
@@ -866,7 +866,7 @@
 		/* Reject modes whose type bits are not one of the standard
 		 * file types; otherwise garbage mode values propagate through
 		 * the file-type checks below unpredictably. */
-		if (!S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
+		if (mode && !S_ISREG(mode) && !S_ISDIR(mode) && !S_ISLNK(mode)
 		 && !S_ISCHR(mode) && !S_ISBLK(mode)
 		 && !S_ISFIFO(mode) && !S_ISSOCK(mode)) {
 			rprintf(FERROR, "invalid file mode 0%o for %s [%s]\n",

[rapidcow]

Similarly without --file-from:

$ rel/v3.4.2/rsync --delete-missing-args -lnv /etc/localtime /etc/timezone .
localtime -> /usr/share/zoneinfo/America/Chicago

sent 105 bytes  received 19 bytes  248.00 bytes/sec
total size is 35  speedup is 0.28 (DRY RUN)

$ rel/v3.4.3/rsync --delete-missing-args -lnv /etc/localtime /etc/timezone .
invalid file mode 00 for timezone [Receiver]
rsync error: protocol incompatibility (code 2) at flist.c(874) [Receiver=3.4.3]

where /etc/localtime exists on my system, but /etc/timezone doesn't:

$ ls -l /etc/localtime /etc/timezone
ls: cannot access '/etc/timezone': No such file or directory
lrwxrwxrwx 1 root root 35 Mar 10 05:31 /etc/localtime -> /usr/share/zoneinfo/America/Chicago

The tricky thing is that the mode=0 path is only hit when a nonexistent file is preceded by an existent file:

: existent + nonexistent
$ rel/v3.4.3/rsync --delete-missing-args -lnv /etc/localtime /etc/timezone .
invalid file mode 00 for timezone [Receiver]
rsync error: protocol incompatibility (code 2) at flist.c(874) [Receiver=3.4.3]

: nonexistent + existent
$ rel/v3.4.3/rsync --delete-missing-args -lnv /etc/timezone /etc/localtime .
localtime -> /usr/share/zoneinfo/America/Chicago

sent 102 bytes  received 19 bytes  242.00 bytes/sec
total size is 35  speedup is 0.29 (DRY RUN)

: nonexistent + nonexistent
$ rel/v3.4.3/rsync --delete-missing-args -lnv /etc/timezone /etc/timezone .

sent 38 bytes  received 12 bytes  100.00 bytes/sec
total size is 0  speedup is 0.00 (DRY RUN)

version info...

+ uname -rms
Linux 7.0.10-artix1-1 x86_64
+ git -C rel/v3.4.2 rev-parse HEAD | git name-rev --annotate-stdin
de3cc03b03be153092f266aa1117b4706947ed07 (tags/v3.4.2^0)
+ git -C rel/v3.4.3 rev-parse HEAD | git name-rev --annotate-stdin
2c7777aaa62abeb1bca192da345e6e8c685e872a (tags/v3.4.3^0)
+ rel/v3.4.2/rsync -V
rsync  version 3.4.2  protocol version 32
Copyright (C) 1996-2026 by Andrew Tridgell, Wayne Davison, and others.
Web site: https://rsync.samba.org/
Capabilities:
    64-bit files, 64-bit inums, 64-bit timestamps, 64-bit long ints,
    socketpairs, symlinks, symtimes, hardlinks, hardlink-specials,
    hardlink-symlinks, IPv6, atimes, batchfiles, inplace, append, ACLs,
    xattrs, optional secluded-args, iconv, prealloc, stop-at, no crtimes
Optimizations:
    SIMD-roll, no asm-roll, openssl-crypto, no asm-MD5
Checksum list:
    xxh128 xxh3 xxh64 (xxhash) md5 md4 sha1 none
Compress list:
    zstd lz4 zlibx zlib none
Daemon auth list:
    sha512 sha256 sha1 md5 md4

rsync comes with ABSOLUTELY NO WARRANTY.  This is free software, and you
are welcome to redistribute it under certain conditions.  See the GNU
General Public Licence for details.
+ rel/v3.4.3/rsync -V
rsync  version 3.4.3  protocol version 32
Copyright (C) 1996-2026 by Andrew Tridgell, Wayne Davison, and others.
Web site: https://rsync.samba.org/
Capabilities:
    64-bit files, 64-bit inums, 64-bit timestamps, 64-bit long ints,
    socketpairs, symlinks, symtimes, hardlinks, hardlink-specials,
    hardlink-symlinks, IPv6, atimes, batchfiles, inplace, append, ACLs,
    xattrs, optional secluded-args, iconv, prealloc, stop-at, no crtimes
Optimizations:
    SIMD-roll, no asm-roll, openssl-crypto, no asm-MD5
Checksum list:
    xxh128 xxh3 xxh64 (xxhash) md5 md4 sha1 none
Compress list:
    zstd lz4 zlibx zlib none
Daemon auth list:
    sha512 sha256 sha1 md5 md4

rsync comes with ABSOLUTELY NO WARRANTY.  This is free software, and you
are welcome to redistribute it under certain conditions.  See the GNU
General Public Licence for details.

The mode validation added as part of recent security hardening in recv_file_entry() (flist.c lines 864–876) breaks the --delete-missing-args feature

To add: git blame on that line range and git bisect both point to 8112445. I am not familiar with the wire protocol, but I guess we wouldn't want to completely undo the hardening effects there... :)

bisect log...

+ ./configure >/dev/null
+ git bisect start tags/v3.4.3 tags/v3.4.2
Bisecting: 16 revisions left to test after this (roughly 4 steps)
[30656c5e358b1c6033f4caf24f3e11b29d25c9f4] syscall: add symlink-race-safe do_*_at() wrappers and harden secure_relative_open
+ git bisect run sh -c '
  make reconfigure && make rsync || exit 125
  ./rsync --delete-missing-args -ln /etc/localtime /etc/timezone .
' >/dev/null 2>&1
+ git bisect log
# bad: [2c7777aaa62abeb1bca192da345e6e8c685e872a] Preparing for release of 3.4.3 [buildall]
# good: [de3cc03b03be153092f266aa1117b4706947ed07] Preparing for release of 3.4.2 [buildall]
git bisect start 'tags/v3.4.3' 'tags/v3.4.2'
# good: [30656c5e358b1c6033f4caf24f3e11b29d25c9f4] syscall: add symlink-race-safe do_*_at() wrappers and harden secure_relative_open
git bisect good 30656c5e358b1c6033f4caf24f3e11b29d25c9f4
# bad: [8112445318a35e49813b051a533d7cec7e8c4c8c] defence-in-depth: bound wire-supplied counts and lengths
git bisect bad 8112445318a35e49813b051a533d7cec7e8c4c8c
# good: [c44c90e9460c666c965446a8c0957f0b9fa4c66a] token: harden compressed-token decoding against integer overflow
git bisect good c44c90e9460c666c965446a8c0957f0b9fa4c66a
# good: [0cf200ecbb8baaf58070d825c4fbd892b4a63b69] receiver: add parent_ndx<0 guard, mirroring 797e17f
git bisect good 0cf200ecbb8baaf58070d825c4fbd892b4a63b69
# good: [c38f20c5ffabacd0c0c483786ab224a36e14bf43] clientserver: fix hostname ACL bypass when using daemon chroot
git bisect good c38f20c5ffabacd0c0c483786ab224a36e14bf43
# first bad commit: [8112445318a35e49813b051a533d7cec7e8c4c8c] defence-in-depth: bound wire-supplied counts and lengths

[mikkorantalainen]

I hit the same bug on Ubuntu 24.04 LTS:

$ rsync --version
rsync version 3.2.7 protocol version 31

$ apt policy rsync
rsync:
Installed: 3.2.7-1ubuntu1.4
Candidate: 3.2.7-1ubuntu1.4

Update: I created a bug about this: https://bugs.launchpad.net/ubuntu/+source/rsync/+bug/2155040

[mgkeeley]

@tridge just pinging you for awareness on this issue, in case you haven't seen it yet :-)

[tridge]

fixed by #953 - please test!

[steadytao]

Tested with a --delete-missing-args --files-from case containing one present file, one missing file and one missing directory.

On current master, the transfer fails with invalid file mode 00 for ghost.txt [Receiver], exits with protocol incompatibility and leaves the missing destination entries in place. On 953, the same reproduction succeeds and deletes both missing entries.

The targeted regression test also passes on 953: python3 ./runtests.py --rsync-bin ./rsync delete-missing-args-files-from

[rapidcow]

Thank you for the prompt patch! refs/pull/953/merge (680b8494) works:

$ rsync -V | head -1
rsync  version 3.4.3-67-g680b8494  protocol version 32
$ rsync --delete-missing-args -lnv /etc/localtime /etc/timezone .
localtime -> /usr/share/zoneinfo/America/Chicago

sent 105 bytes  received 19 bytes  248.00 bytes/sec
total size is 35  speedup is 0.28 (DRY RUN)
$ touch timezone
$ rsync --delete-missing-args -lnv /etc/localtime /etc/timezone .
localtime -> /usr/share/zoneinfo/America/Chicago
deleting timezone

sent 109 bytes  received 31 bytes  280.00 bytes/sec
total size is 35  speedup is 0.25 (DRY RUN)

Cherry-picking the flist patch (08ec71e9) alone on top of v3.4.3 also works.