From d54c1f8696c556aa68eec2884c9c76d6de113893 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 30 Sep 2021 14:01:39 +0200 Subject: [PATCH 1/5] Update to 3.0.24 Signed-off-by: Antonio Torres --- .gitignore | 1 + ...radius-Fix-resource-hard-limit-error.patch | 32 ------------------- freeradius-no-buildtime-cert-gen.patch | 11 ++++--- freeradius.spec | 11 ++++--- sources | 2 +- 5 files changed, 15 insertions(+), 42 deletions(-) delete mode 100644 freeradius-Fix-resource-hard-limit-error.patch diff --git a/.gitignore b/.gitignore index 9c17413..6c82385 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.21.tar.bz2 /freeradius-server-3.0.22.tar.bz2 /freeradius-server-3.0.23.tar.bz2 +/freeradius-server-3.0.24.tar.bz2 diff --git a/freeradius-Fix-resource-hard-limit-error.patch b/freeradius-Fix-resource-hard-limit-error.patch deleted file mode 100644 index 800c06c..0000000 --- a/freeradius-Fix-resource-hard-limit-error.patch +++ /dev/null @@ -1,32 +0,0 @@ -commit 1ce4508c92493cf03ea1b3c42e83540b387884fa -Author: Antonio Torres -Date: Fri Jul 2 07:12:48 2021 -0400 -Subject: [PATCH] debug: don't set resource hard limit to zero - - Setting the resource hard limit to zero is irreversible, meaning if it - is set to zero then there is no way to set it higher. This means - enabling core dump is not possible, since setting a new resource limit - for RLIMIT_CORE would fail. By only setting the soft limit to zero, we - can disable and enable core dumps without failures. - - This fix is present in both main and 3.0.x upstream branches. - - Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572 - Signed-off-by: Antonio Torres antorres@redhat.com ---- - src/lib/debug.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib/debug.c b/src/lib/debug.c -index 576bcb2a65..6330c9cb66 100644 ---- a/src/lib/debug.c -+++ b/src/lib/debug.c -@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps) - struct rlimit no_core; - - no_core.rlim_cur = 0; -- no_core.rlim_max = 0; -+ no_core.rlim_max = core_limits.rlim_max; - - if (setrlimit(RLIMIT_CORE, &no_core) < 0) { - fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno)); diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index 57a59fc..4f4e3f8 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -63,10 +63,10 @@ index c2c599c92b..3d4403a844 100755 # Extract the first word of "perl", so it can be a program name with args. set dummy perl; ac_word=$2 diff --git a/configure.ac b/configure.ac -index a7abf0025a..35b013f4af 100644 +index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac +++ b/configure.ac -@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) +@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config]) dnl # dnl # extra argument: --enable-reproducible-builds dnl # @@ -74,7 +74,7 @@ index a7abf0025a..35b013f4af 100644 AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], -@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, +@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds, ;; *) reproducible_builds=no @@ -83,8 +83,9 @@ index a7abf0025a..35b013f4af 100644 ) +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) - - dnl ############################################################# + dnl # + dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer + diff --git a/raddb/all.mk b/raddb/all.mk index c966edd657..c8e976a499 100644 --- a/raddb/all.mk diff --git a/freeradius.spec b/freeradius.spec index a81c0b8..bddac3b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.23 -Release: 6%{?dist} +Version: 3.0.24 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,7 +25,6 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch -Patch6: freeradius-Fix-resource-hard-limit-error.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -208,7 +207,6 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 -%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -438,6 +436,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/cui %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool @@ -896,6 +895,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Sep 30 2021 Antonio Torres - 3.0.24-1 +- Update to 3.0.24. + Resolves: bz#2009036 + * Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/sources b/sources index f9c98bb..847685f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.23.tar.bz2) = 2369378a448035706fac77b4eddd28b950fbb587edefb5be6cf579043435cdec911b4a5326cfeabd05c28bb964e53027bcd1cd8a6a56013836f041a10326ef1a +SHA512 (freeradius-server-3.0.24.tar.bz2) = 12da42aa406d97ff15b423b7b279b7cc9dd4c317296b1b0fa019fb21988d9501507b58ad2d6753db4846651f06a6a67be8097cb0b564a65b1b1454777e090997 From dbbf39a840221584ef02ff62b5e124e48a60d670 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 8 Oct 2021 12:15:37 +0200 Subject: [PATCH 2/5] Update to 3.0.25 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 6c82385..4a7e0f9 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.22.tar.bz2 /freeradius-server-3.0.23.tar.bz2 /freeradius-server-3.0.24.tar.bz2 +/freeradius-server-3.0.25.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index bddac3b..688b779 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,6 +1,6 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.24 +Version: 3.0.25 Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -895,6 +895,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Oct 08 2021 Antonio Torres - 3.0.25-1 +- Update to 3.0.25. + Resolves: bz#2011984 + * Thu Sep 30 2021 Antonio Torres - 3.0.24-1 - Update to 3.0.24. Resolves: bz#2009036 diff --git a/sources b/sources index 847685f..b73c6d2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.24.tar.bz2) = 12da42aa406d97ff15b423b7b279b7cc9dd4c317296b1b0fa019fb21988d9501507b58ad2d6753db4846651f06a6a67be8097cb0b564a65b1b1454777e090997 +SHA512 (freeradius-server-3.0.25.tar.bz2) = 984bb65c86c541c91708370340ac6157b4d4d89a4ae7cbc690a9f17ead0e63fb20180333cdc33093877f84b6d40445495d881ae677858cbf60fcfd990fb02ba4 From 6f18207173dc0b719b527a358f7540d85c451fcb Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 14 Oct 2021 12:32:20 +0200 Subject: [PATCH 3/5] Fix file conflict in SQL files Resolves: bz#2014014 Signed-off-by: Antonio Torres --- freeradius.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 688b779..2ff0f28 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -436,7 +436,6 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/cui %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool @@ -759,6 +758,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf @@ -832,6 +832,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf @@ -860,6 +861,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf @@ -895,6 +897,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Oct 14 2021 Antonio Torres - 3.0.25-2 +- Fix file conflict in SQL files + Resolves: bz#2014014 + * Fri Oct 08 2021 Antonio Torres - 3.0.25-1 - Update to 3.0.25. Resolves: bz#2011984 From f1f7df739c4e20d6bbce0e1edabd6e3d32a92906 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 22 Apr 2022 15:21:56 +0200 Subject: [PATCH 4/5] Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 Related: #1983063 Signed-off-by: Antonio Torres --- ...us-ldap-infinite-timeout-on-starttls.patch | 31 +++++++++++++++++++ freeradius.spec | 4 ++- 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 freeradius-ldap-infinite-timeout-on-starttls.patch diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius.spec b/freeradius.spec index 2ff0f28..6971815 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -207,6 +208,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon From 73a6ad724fee67e6db99b8b9ea6de2ec4dbe5799 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 22 Apr 2022 15:26:12 +0200 Subject: [PATCH 5/5] Update changelog Signed-off-by: Antonio Torres --- freeradius.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/freeradius.spec b/freeradius.spec index 6971815..6fe9796 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -899,6 +899,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Apr 22 2022 Antonio Torres - 3.0.25-3 +- Use infinite timeout when using LDAP+start-TLS + Resolves: #1983063 + * Thu Oct 14 2021 Antonio Torres - 3.0.25-2 - Fix file conflict in SQL files Resolves: bz#2014014