diff --git a/SOURCES/0001-Syslog-restored-Augeas-1.1.0-tree-compatibility-for-.patch b/SOURCES/0001-Syslog-restored-Augeas-1.1.0-tree-compatibility-for-.patch
index f994daf..18ee668 100644
--- a/SOURCES/0001-Syslog-restored-Augeas-1.1.0-tree-compatibility-for-.patch
+++ b/SOURCES/0001-Syslog-restored-Augeas-1.1.0-tree-compatibility-for-.patch
@@ -1,4 +1,4 @@
-From 0fb77ec16c1e19dbcc21eedd5b26860d12463329 Mon Sep 17 00:00:00 2001
+From 706266780350ba61d36ec387dc18e9f4764ed872 Mon Sep 17 00:00:00 2001
From: Yanis Guenane <yguenane@gmail.com>
Date: Sun, 8 Sep 2013 09:30:17 -0400
Subject: [PATCH] Syslog: restored Augeas 1.1.0 tree compatibility for UDP
@@ -13,7 +13,7 @@ used for TCP hosts.
3 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/lenses/syslog.aug b/lenses/syslog.aug
-index f8b99c4..17c0f90 100644
+index f8b99c40..17c0f903 100644
--- a/lenses/syslog.aug
+++ b/lenses/syslog.aug
@@ -66,6 +66,10 @@ module Syslog =
@@ -50,7 +50,7 @@ index f8b99c4..17c0f90 100644
(* View: users
diff --git a/lenses/tests/test_rsyslog.aug b/lenses/tests/test_rsyslog.aug
-index e696139..46b24c3 100644
+index e696139c..46b24c3c 100644
--- a/lenses/tests/test_rsyslog.aug
+++ b/lenses/tests/test_rsyslog.aug
@@ -86,7 +86,6 @@ test Rsyslog.lns get conf =
@@ -62,7 +62,7 @@ index e696139..46b24c3 100644
}
}
diff --git a/lenses/tests/test_syslog.aug b/lenses/tests/test_syslog.aug
-index 2ad1c16..329d121 100644
+index 2ad1c165..329d121e 100644
--- a/lenses/tests/test_syslog.aug
+++ b/lenses/tests/test_syslog.aug
@@ -91,11 +91,11 @@ daemon.info /var/log/cvsupd.log
@@ -96,3 +96,6 @@ index 2ad1c16..329d121 100644
set "/entry/action/hostname" "far.far.away"
= "*.* @far.far.away\n"
+--
+2.13.5
+
diff --git a/SOURCES/0002-Revert-Use-Quote-module-in-dovecot.patch b/SOURCES/0002-Revert-Use-Quote-module-in-dovecot.patch
index c83697d..be59a73 100644
--- a/SOURCES/0002-Revert-Use-Quote-module-in-dovecot.patch
+++ b/SOURCES/0002-Revert-Use-Quote-module-in-dovecot.patch
@@ -1,4 +1,4 @@
-From 0a636285f8aad3099c65e16d649c248262a54ef8 Mon Sep 17 00:00:00 2001
+From 2765da41b09cdfcf2f28653a484462ee7109116a Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 09:32:56 +0100
Subject: [PATCH] Revert "Use Quote module in dovecot"
@@ -16,7 +16,7 @@ Conflicts:
2 files changed, 6 insertions(+), 24 deletions(-)
diff --git a/lenses/dovecot.aug b/lenses/dovecot.aug
-index f7afc8f..c6376e4 100644
+index f7afc8f9..c6376e4b 100644
--- a/lenses/dovecot.aug
+++ b/lenses/dovecot.aug
@@ -56,6 +56,9 @@ let value = any . (Rx.space . any)*
@@ -69,7 +69,7 @@ index f7afc8f..c6376e4 100644
(******************************************************************
diff --git a/lenses/tests/test_dovecot.aug b/lenses/tests/test_dovecot.aug
-index 33ea16f..8e8c083 100644
+index 33ea16f1..8e8c083b 100644
--- a/lenses/tests/test_dovecot.aug
+++ b/lenses/tests/test_dovecot.aug
@@ -536,7 +536,7 @@ test Dovecot.lns get mail_conf =
@@ -81,3 +81,6 @@ index 33ea16f..8e8c083 100644
{ "special_use" = "\Sent" }
}
}
+--
+2.13.5
+
diff --git a/SOURCES/0003-Revert-Jaas-add-several-improvements-to-cover-more-v.patch b/SOURCES/0003-Revert-Jaas-add-several-improvements-to-cover-more-v.patch
index 77670e2..d673b86 100644
--- a/SOURCES/0003-Revert-Jaas-add-several-improvements-to-cover-more-v.patch
+++ b/SOURCES/0003-Revert-Jaas-add-several-improvements-to-cover-more-v.patch
@@ -1,4 +1,4 @@
-From 62bb0dacd9ed721e5fdb2342a30b50f35f7ba3b3 Mon Sep 17 00:00:00 2001
+From cd586dfa4ade4ea574aae0fa6ac034c07c77b25a Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 09:47:48 +0100
Subject: [PATCH] Revert "Jaas: add several improvements to cover more valid
@@ -18,7 +18,7 @@ Conflicts:
2 files changed, 22 insertions(+), 28 deletions(-)
diff --git a/lenses/jaas.aug b/lenses/jaas.aug
-index 4f06bad..a13682e 100644
+index 4f06bad9..a13682e3 100644
--- a/lenses/jaas.aug
+++ b/lenses/jaas.aug
@@ -1,36 +1,31 @@
@@ -71,7 +71,7 @@ index 4f06bad..a13682e 100644
let filter = incl "/opt/shibboleth-idp/conf/login.config"
let xfm = transform lns filter
diff --git a/lenses/tests/test_jaas.aug b/lenses/tests/test_jaas.aug
-index 5f2bfb1..d5ede69 100644
+index 5f2bfb13..d5ede698 100644
--- a/lenses/tests/test_jaas.aug
+++ b/lenses/tests/test_jaas.aug
@@ -54,7 +54,6 @@ ShibUserPassAuth {
@@ -138,3 +138,6 @@ index 5f2bfb1..d5ede69 100644
}
- { }
}
+--
+2.13.5
+
diff --git a/SOURCES/0004-UpdateDB-autoload-etc-updatedb.conf-with-Simplevars.patch b/SOURCES/0004-UpdateDB-autoload-etc-updatedb.conf-with-Simplevars.patch
index 0a27c25..a30c599 100644
--- a/SOURCES/0004-UpdateDB-autoload-etc-updatedb.conf-with-Simplevars.patch
+++ b/SOURCES/0004-UpdateDB-autoload-etc-updatedb.conf-with-Simplevars.patch
@@ -1,4 +1,4 @@
-From 8bf9bc98456ffa456127e87721461d0aeedd090d Mon Sep 17 00:00:00 2001
+From 898ea6cd04163b38aa59b0c3d9df23cf1837d425 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 10:46:57 +0100
Subject: [PATCH] UpdateDB: autoload /etc/updatedb.conf with Simplevars
@@ -12,7 +12,7 @@ the newer, different, UpdateDB lens.
2 files changed, 1 insertion(+), 8 deletions(-)
diff --git a/lenses/simplevars.aug b/lenses/simplevars.aug
-index ad9795f..ff0602c 100644
+index ad9795f0..ff0602cc 100644
--- a/lenses/simplevars.aug
+++ b/lenses/simplevars.aug
@@ -41,6 +41,7 @@ let lns = (Util.empty | Util.comment | entry)*
@@ -24,7 +24,7 @@ index ad9795f..ff0602c 100644
. incl "/etc/zabbix/*.conf"
. incl "/etc/audit/auditd.conf"
diff --git a/lenses/updatedb.aug b/lenses/updatedb.aug
-index 40cd26f..c7309b1 100644
+index 40cd26fb..c7309b16 100644
--- a/lenses/updatedb.aug
+++ b/lenses/updatedb.aug
@@ -22,8 +22,6 @@ About: Examples
@@ -46,3 +46,6 @@ index 40cd26f..c7309b1 100644
-let filter = incl "/etc/updatedb.conf"
-
-let xfm = transform lns filter
+--
+2.13.5
+
diff --git a/SOURCES/0005-Revert-Dnsmasq-add-structure-to-address-and-server-o.patch b/SOURCES/0005-Revert-Dnsmasq-add-structure-to-address-and-server-o.patch
index 057a905..01442bc 100644
--- a/SOURCES/0005-Revert-Dnsmasq-add-structure-to-address-and-server-o.patch
+++ b/SOURCES/0005-Revert-Dnsmasq-add-structure-to-address-and-server-o.patch
@@ -1,4 +1,4 @@
-From 0bd17cf52195d54e28eb0e2d47e219615c62ebb9 Mon Sep 17 00:00:00 2001
+From 94b0373abfcb4a6474ee9bb7866fe28f9bbe876d Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 10:48:58 +0100
Subject: [PATCH] Revert "Dnsmasq: add structure to 'address' and 'server'
@@ -16,7 +16,7 @@ Conflicts:
2 files changed, 9 insertions(+), 72 deletions(-)
diff --git a/lenses/dnsmasq.aug b/lenses/dnsmasq.aug
-index f7ef907..e19aab8 100644
+index f7ef9070..e19aab83 100644
--- a/lenses/dnsmasq.aug
+++ b/lenses/dnsmasq.aug
@@ -17,42 +17,26 @@ module Dnsmasq =
@@ -72,7 +72,7 @@ index f7ef907..e19aab8 100644
let filter = incl "/etc/dnsmasq.conf"
. incl "/etc/dnsmasq.d/*"
diff --git a/lenses/tests/test_dnsmasq.aug b/lenses/tests/test_dnsmasq.aug
-index c6a63d9..0abfa6b 100644
+index c6a63d96..0abfa6bd 100644
--- a/lenses/tests/test_dnsmasq.aug
+++ b/lenses/tests/test_dnsmasq.aug
@@ -6,16 +6,6 @@ let conf = "# Configuration file for dnsmasq.
@@ -133,3 +133,6 @@ index c6a63d9..0abfa6b 100644
- { "domain" = "qux.com" }
- { "domain" = "qux.net" }
- }
+--
+2.13.5
+
diff --git a/SOURCES/0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch b/SOURCES/0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch
index 4bf007c..21d1aec 100644
--- a/SOURCES/0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch
+++ b/SOURCES/0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch
@@ -1,4 +1,4 @@
-From 0ee63c599098d6ee401bfbc994b2e7e3bfb3dd42 Mon Sep 17 00:00:00 2001
+From 1c936bb38d39b238001364e1a7ee5479bdfff053 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:01:57 +0100
Subject: [PATCH] Sshd: revert Sshd module to 1.1.0-compatible, add Sshd_140
@@ -18,7 +18,7 @@ it instead of Sshd.
create mode 100644 lenses/tests/test_sshd_140.aug
diff --git a/lenses/sshd.aug b/lenses/sshd.aug
-index 55f6c4f..785102e 100644
+index 55f6c4f7..785102ec 100644
--- a/lenses/sshd.aug
+++ b/lenses/sshd.aug
@@ -70,55 +70,41 @@ module Sshd =
@@ -115,7 +115,7 @@ index 55f6c4f..785102e 100644
diff --git a/lenses/sshd_140.aug b/lenses/sshd_140.aug
new file mode 100644
-index 0000000..8a7f176
+index 00000000..8a7f176f
--- /dev/null
+++ b/lenses/sshd_140.aug
@@ -0,0 +1,141 @@
@@ -261,7 +261,7 @@ index 0000000..8a7f176
+(* mode: caml *)
+(* End: *)
diff --git a/lenses/tests/test_sshd.aug b/lenses/tests/test_sshd.aug
-index 5954e16..788a12f 100644
+index 5954e16f..788a12f0 100644
--- a/lenses/tests/test_sshd.aug
+++ b/lenses/tests/test_sshd.aug
@@ -1,4 +1,3 @@
@@ -333,7 +333,7 @@ index 5954e16..788a12f 100644
(* mode: caml *)
diff --git a/lenses/tests/test_sshd_140.aug b/lenses/tests/test_sshd_140.aug
new file mode 100644
-index 0000000..056c53f
+index 00000000..056c53f9
--- /dev/null
+++ b/lenses/tests/test_sshd_140.aug
@@ -0,0 +1,136 @@
@@ -474,7 +474,7 @@ index 0000000..056c53f
+(* mode: caml *)
+(* End: *)
diff --git a/tests/Makefile.am b/tests/Makefile.am
-index b456354..387ac7d 100644
+index b4563540..387ac7d2 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -189,6 +189,7 @@ lens_tests = \
@@ -485,3 +485,6 @@ index b456354..387ac7d 100644
lens-sssd.sh \
lens-stunnel.sh \
lens-subversion.sh \
+--
+2.13.5
+
diff --git a/SOURCES/0007-Dhcpd-revert-Dhcpd-module-to-1.1.0-compatible-add-Dh.patch b/SOURCES/0007-Dhcpd-revert-Dhcpd-module-to-1.1.0-compatible-add-Dh.patch
index 81176fd..78e8d95 100644
--- a/SOURCES/0007-Dhcpd-revert-Dhcpd-module-to-1.1.0-compatible-add-Dh.patch
+++ b/SOURCES/0007-Dhcpd-revert-Dhcpd-module-to-1.1.0-compatible-add-Dh.patch
@@ -1,4 +1,4 @@
-From 8cd5f1fc7917039f946098fd2c576f95df00a68f Mon Sep 17 00:00:00 2001
+From c93dc5ca4c87f38772c98e3134ddc6662a98bc02 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:09:09 +0100
Subject: [PATCH] Dhcpd: revert Dhcpd module to 1.1.0-compatible, add Dhcpd_140
@@ -18,7 +18,7 @@ it instead of Dhcpd.
create mode 100644 lenses/tests/test_dhcpd_140.aug
diff --git a/lenses/dhcpd.aug b/lenses/dhcpd.aug
-index f84a409..21a5ce6 100644
+index f84a409c..21a5ce60 100644
--- a/lenses/dhcpd.aug
+++ b/lenses/dhcpd.aug
@@ -65,12 +65,12 @@ let eos = comment?
@@ -327,7 +327,7 @@ index f84a409..21a5ce6 100644
let lns = (lns_staging)*
diff --git a/lenses/dhcpd_140.aug b/lenses/dhcpd_140.aug
new file mode 100644
-index 0000000..c907299
+index 00000000..c9072990
--- /dev/null
+++ b/lenses/dhcpd_140.aug
@@ -0,0 +1,512 @@
@@ -844,7 +844,7 @@ index 0000000..c907299
+let rec lns_staging = stmt_entry|all_block lns_staging
+let lns = (lns_staging)*
diff --git a/lenses/tests/test_dhcpd.aug b/lenses/tests/test_dhcpd.aug
-index 0af337c..9663029 100644
+index 0af337c2..96630296 100644
--- a/lenses/tests/test_dhcpd.aug
+++ b/lenses/tests/test_dhcpd.aug
@@ -28,9 +28,6 @@ max-lease-time 7200;
@@ -1123,7 +1123,7 @@ index 0af337c..9663029 100644
- { "class" = "testing class with spaces and quotes and ()" }
diff --git a/lenses/tests/test_dhcpd_140.aug b/lenses/tests/test_dhcpd_140.aug
new file mode 100644
-index 0000000..9d6fdc8
+index 00000000..9d6fdc88
--- /dev/null
+++ b/lenses/tests/test_dhcpd_140.aug
@@ -0,0 +1,606 @@
@@ -1734,7 +1734,7 @@ index 0000000..9d6fdc8
+test Dhcpd_140.lns get "class \"testing class with spaces and quotes and ()\" {}" =
+ { "class" = "testing class with spaces and quotes and ()" }
diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 387ac7d..315cac9 100644
+index 387ac7d2..315cac9c 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -58,6 +58,7 @@ lens_tests = \
@@ -1745,3 +1745,6 @@ index 387ac7d..315cac9 100644
lens-dns_zone.sh \
lens-dnsmasq.sh \
lens-dovecot.sh \
+--
+2.13.5
+
diff --git a/SOURCES/0008-Slapd-revert-Slapd-module-to-1.1.0-compatible-add-Sl.patch b/SOURCES/0008-Slapd-revert-Slapd-module-to-1.1.0-compatible-add-Sl.patch
index 5056639..82aa24b 100644
--- a/SOURCES/0008-Slapd-revert-Slapd-module-to-1.1.0-compatible-add-Sl.patch
+++ b/SOURCES/0008-Slapd-revert-Slapd-module-to-1.1.0-compatible-add-Sl.patch
@@ -1,4 +1,4 @@
-From 945ff8cc4b9e544c7a06c4a977c9d9c2f49821cc Mon Sep 17 00:00:00 2001
+From faf60bc7b1cb727482a17de9a2483998763978c0 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 12 Jun 2015 11:14:32 +0100
Subject: [PATCH] Slapd: revert Slapd module to 1.1.0-compatible, add Slapd_140
@@ -18,7 +18,7 @@ it instead of Slapd.
create mode 100644 lenses/tests/test_slapd_140.aug
diff --git a/lenses/slapd.aug b/lenses/slapd.aug
-index e119565..afe074b 100644
+index e1195655..afe074b1 100644
--- a/lenses/slapd.aug
+++ b/lenses/slapd.aug
@@ -18,6 +18,7 @@ let sep = del /[ \t\n]+/ " "
@@ -74,7 +74,7 @@ index e119565..afe074b 100644
* LENS
diff --git a/lenses/slapd_140.aug b/lenses/slapd_140.aug
new file mode 100644
-index 0000000..8d1cd07
+index 00000000..8d1cd074
--- /dev/null
+++ b/lenses/slapd_140.aug
@@ -0,0 +1,158 @@
@@ -237,7 +237,7 @@ index 0000000..8d1cd07
+
+let lns = (comment|empty|global|access)* . (database)*
diff --git a/lenses/tests/test_slapd.aug b/lenses/tests/test_slapd.aug
-index a4bbb4e..e477342 100644
+index a4bbb4e9..e477342a 100644
--- a/lenses/tests/test_slapd.aug
+++ b/lenses/tests/test_slapd.aug
@@ -48,47 +48,18 @@ test Slapd.lns get conf =
@@ -303,7 +303,7 @@ index a4bbb4e..e477342 100644
+ { "what" = "none" } } } }
diff --git a/lenses/tests/test_slapd_140.aug b/lenses/tests/test_slapd_140.aug
new file mode 100644
-index 0000000..0118f03
+index 00000000..0118f030
--- /dev/null
+++ b/lenses/tests/test_slapd_140.aug
@@ -0,0 +1,94 @@
@@ -402,7 +402,7 @@ index 0000000..0118f03
+ { "control" = "stop" } } }
+
diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 315cac9..65d8993 100644
+index 315cac9c..65d8993e 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -182,6 +182,7 @@ lens_tests = \
@@ -413,3 +413,6 @@ index 315cac9..65d8993 100644
lens-smbusers.sh \
lens-solaris_system.sh \
lens-soma.sh \
+--
+2.13.5
+
diff --git a/SOURCES/0009-Rhsm-new-lens-to-parse-subscription-manager-s-rhsm.c.patch b/SOURCES/0009-Rhsm-new-lens-to-parse-subscription-manager-s-rhsm.c.patch
index 1de97f4..f35e21c 100644
--- a/SOURCES/0009-Rhsm-new-lens-to-parse-subscription-manager-s-rhsm.c.patch
+++ b/SOURCES/0009-Rhsm-new-lens-to-parse-subscription-manager-s-rhsm.c.patch
@@ -1,4 +1,4 @@
-From 73ad666d797eb8b1957a0fd4126bb916be4081f0 Mon Sep 17 00:00:00 2001
+From a90c028eae871422588037ea1a21aff080f77fd2 Mon Sep 17 00:00:00 2001
From: Dominic Cleal <dcleal@redhat.com>
Date: Fri, 3 Jul 2015 12:05:30 +0100
Subject: [PATCH] Rhsm: new lens to parse subscription-manager's rhsm.conf
@@ -17,7 +17,7 @@ Conflicts:
create mode 100644 lenses/tests/test_rhsm.aug
diff --git a/doc/naturaldocs/conf/lenses/Menu.txt b/doc/naturaldocs/conf/lenses/Menu.txt
-index c245446..e74cd13 100644
+index c245446b..e74cd13a 100644
--- a/doc/naturaldocs/conf/lenses/Menu.txt
+++ b/doc/naturaldocs/conf/lenses/Menu.txt
@@ -151,6 +151,7 @@ Group: Specific Modules {
@@ -38,7 +38,7 @@ index c245446..e74cd13 100644
File: Test_Simplelines (tests/test_simplelines.aug)
diff --git a/lenses/rhsm.aug b/lenses/rhsm.aug
new file mode 100644
-index 0000000..56cc82e
+index 00000000..56cc82ea
--- /dev/null
+++ b/lenses/rhsm.aug
@@ -0,0 +1,42 @@
@@ -86,7 +86,7 @@ index 0000000..56cc82e
+let xfm = transform lns filter
diff --git a/lenses/tests/test_rhsm.aug b/lenses/tests/test_rhsm.aug
new file mode 100644
-index 0000000..219a5be
+index 00000000..219a5be7
--- /dev/null
+++ b/lenses/tests/test_rhsm.aug
@@ -0,0 +1,151 @@
@@ -242,7 +242,7 @@ index 0000000..219a5be
+ { "autoAttachInterval" = "1440" }
+ }
diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 65d8993..4d2b260 100644
+index 65d8993e..4d2b2605 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -167,6 +167,7 @@ lens_tests = \
@@ -254,5 +254,5 @@ index 65d8993..4d2b260 100644
lens-rsyncd.sh \
lens-rsyslog.sh \
--
-2.1.0
+2.13.5
diff --git a/SOURCES/0010-src-pathx.c-parse_name-correctly-handle-trailing-whi.patch b/SOURCES/0010-src-pathx.c-parse_name-correctly-handle-trailing-whi.patch
new file mode 100644
index 0000000..051b999
--- /dev/null
+++ b/SOURCES/0010-src-pathx.c-parse_name-correctly-handle-trailing-whi.patch
@@ -0,0 +1,162 @@
+From 419ab04ebea64ab23aa5e97a62e3499438d4e680 Mon Sep 17 00:00:00 2001
+From: David Lutterkort <lutter@watzmann.net>
+Date: Fri, 4 Aug 2017 17:13:52 -0700
+Subject: [PATCH] * src/pathx.c (parse_name): correctly handle trailing
+ whitespace in names
+
+When a name ended in whitespace, we incorrectly assumed it was always ok to
+trim that whitespace. That is not true if that whitespace is escaped,
+i.e. if the path expression is something like '/x\ '. In that case, the
+name really needs to be literally 'x ', i.e., we can not trim that
+whitespace.
+
+The incorrect behavior led to turning '/x\ ' first into 'x\' and then,
+because we assume that '\' is always followed by a character inside the
+string, when we removed the escaping '\', we would read beyond the end of
+the intermediate string result; if we were lucky, that would lead to a
+crash, otherwise we'd continue with junk.
+
+We now make sure that escaped whitespace at the end of a string does not
+get stripped, avoiding all these headaches.
+
+Fixes RHBZ https://bugzilla.redhat.com/show_bug.cgi?id=1475621
+---
+ src/pathx.c | 27 +++++++++++++++++++------
+ tests/test-xpath.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 80 insertions(+), 6 deletions(-)
+
+diff --git a/src/pathx.c b/src/pathx.c
+index 8d8dbbbe..a726a032 100644
+--- a/src/pathx.c
++++ b/src/pathx.c
+@@ -1643,6 +1643,16 @@ int pathx_escape_name(const char *in, char **out) {
+ return 0;
+ }
+
++/* Return true if POS is preceded by an odd number of backslashes, i.e., if
++ * POS is escaped. Stop the search when we get to START */
++static bool backslash_escaped(const char *pos, const char *start) {
++ bool result=false;
++ while (pos-- > start && *pos == '\\') {
++ result = !result;
++ }
++ return result;
++}
++
+ /*
+ * NameNoWS ::= [^][|/\= \t\n] | \\.
+ * NameWS ::= [^][|/\=] | \\.
+@@ -1652,11 +1662,14 @@ static char *parse_name(struct state *state) {
+ const char *s = state->pos;
+ char *result;
+
++ /* Advance state->pos until it points to the first character that is
++ * not part of a name. */
+ while (*state->pos != '\0' && strchr(name_follow, *state->pos) == NULL) {
+- /* This is a hack: since we allow spaces in names, we need to avoid
+- * gobbling up stuff that is in follow(Name), e.g. 'or' so that
+- * things like [name1 or name2] still work.
+- */
++ /* Since we allow spaces in names, we need to avoid gobbling up
++ * stuff that is in follow(Name), e.g. 'or' so that things like
++ * [name1 or name2] still work. In other words, we'll parse 'x frob
++ * y' as one name, but for 'x or y', we consider 'x' a name in its
++ * own right. */
+ if (STREQLEN(state->pos, " or ", strlen(" or ")) ||
+ STREQLEN(state->pos, " and ", strlen(" and ")))
+ break;
+@@ -1671,10 +1684,12 @@ static char *parse_name(struct state *state) {
+ state->pos += 1;
+ }
+
+- /* Strip trailing white space */
++ /* Strip trailing white space. Make sure we respect escaped whitespace
++ * and don't strip it as in "x\\ " */
+ if (state->pos > s) {
+ state->pos -= 1;
+- while (isspace(*state->pos) && state->pos >= s)
++ while (isspace(*state->pos) && state->pos > s
++ && !backslash_escaped(state->pos, s))
+ state->pos -= 1;
+ state->pos += 1;
+ }
+diff --git a/tests/test-xpath.c b/tests/test-xpath.c
+index 335e7bf8..dbba29e0 100644
+--- a/tests/test-xpath.c
++++ b/tests/test-xpath.c
+@@ -331,6 +331,62 @@ static int test_wrong_regexp_flag(struct augeas *aug) {
+ return -1;
+ }
+
++static int test_trailing_ws_in_name(struct augeas *aug) {
++ int r;
++
++ printf("%-30s ... ", "trailing_ws_in_name");
++
++ /* We used to incorrectly lop escaped whitespace off the end of a
++ * name. Make sure that we really create a tree node with label 'x '
++ * with the below set, and look for it in a number of ways to ensure we
++ * are not lopping off trailing whitespace. */
++ r = aug_set(aug, "/ws\\ ", "1");
++ if (r < 0) {
++ fprintf(stderr, "failed to set '/ws ': %d\n", r);
++ goto fail;
++ }
++ /* We did not create a node with label 'ws' */
++ r = aug_get(aug, "/ws", NULL);
++ if (r != 0) {
++ fprintf(stderr, "created '/ws' instead: %d\n", r);
++ goto fail;
++ }
++
++ /* We did not create a node with label 'ws\t' (this also checks that we
++ * don't create something like 'ws\\' by dropping the last whitespace
++ * character. */
++ r = aug_get(aug, "/ws\\\t", NULL);
++ if (r != 0) {
++ fprintf(stderr, "found '/ws\\t': %d\n", r);
++ goto fail;
++ }
++
++ /* But we did create 'ws ' */
++ r = aug_get(aug, "/ws\\ ", NULL);
++ if (r != 1) {
++ fprintf(stderr, "could not find '/ws ': %d\n", r);
++ goto fail;
++ }
++
++ /* If the whitespace is preceded by an even number of '\\' chars,
++ * whitespace must be stripped */
++ r = aug_set(aug, "/nows\\\\ ", "1");
++ if (r < 0) {
++ fprintf(stderr, "set of '/nows' failed: %d\n", r);
++ goto fail;
++ }
++ r = aug_get(aug, "/nows\\\\", NULL);
++ if (r != 1) {
++ fprintf(stderr, "could not get '/nows\\'\n");
++ goto fail;
++ }
++ printf("PASS\n");
++ return 0;
++ fail:
++ printf("FAIL\n");
++ return -1;
++}
++
+ static int run_tests(struct test *tests, int argc, char **argv) {
+ char *lensdir;
+ struct augeas *aug = NULL;
+@@ -374,6 +430,9 @@ static int run_tests(struct test *tests, int argc, char **argv) {
+
+ if (test_wrong_regexp_flag(aug) < 0)
+ result = EXIT_FAILURE;
++
++ if (test_trailing_ws_in_name(aug) < 0)
++ result = EXIT_FAILURE;
+ }
+ aug_close(aug);
+
+--
+2.13.5
+
diff --git a/SPECS/augeas.spec b/SPECS/augeas.spec
index 183c86e..f11ea3e 100644
--- a/SPECS/augeas.spec
+++ b/SPECS/augeas.spec
@@ -1,6 +1,6 @@
Name: augeas
Version: 1.4.0
-Release: 2%{?dist}
+Release: 2%{?dist}.1
Summary: A library for changing configuration files
Group: System Environment/Libraries
@@ -16,6 +16,7 @@ Patch6: 0006-Sshd-revert-Sshd-module-to-1.1.0-compatible-add-Sshd.patch
Patch7: 0007-Dhcpd-revert-Dhcpd-module-to-1.1.0-compatible-add-Dh.patch
Patch8: 0008-Slapd-revert-Slapd-module-to-1.1.0-compatible-add-Sl.patch
Patch9: 0009-Rhsm-new-lens-to-parse-subscription-manager-s-rhsm.c.patch
+Patch10: 0010-src-pathx.c-parse_name-correctly-handle-trailing-whi.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -66,6 +67,7 @@ The libraries for %{name}.
%patch7 -p1
%patch8 -p1
%patch9 -p1
+%patch10 -p1
# Patches affect Makefile.am and configure.ac, so rerun autotools.
autoreconf
@@ -127,6 +129,9 @@ rm -rf $RPM_BUILD_ROOT
%{_libdir}/pkgconfig/augeas.pc
%changelog
+* Mon Sep 04 2017 Pino Toscano <ptoscanoredhat.com> - 1.4.0-2.el7_4.1
+- Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481545)
+
* Thu Jul 30 2015 Dominic Cleal <dcleal@redhat.com> - 1.4.0-2
- Rhsm: add to parse subscription-manager config (RHBZ#1141121)