From b910c465d3adfa3c9258a6519b1afd77dd4db22f Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 22 Apr 2022 15:28:38 +0200 Subject: [PATCH 1/2] Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 Related: #1983063 Signed-off-by: Antonio Torres --- ...us-ldap-infinite-timeout-on-starttls.patch | 31 +++++++++++++++++++ freeradius.spec | 8 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 freeradius-ldap-infinite-timeout-on-starttls.patch diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius.spec b/freeradius.spec index 75112a4..15bf545 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -207,6 +208,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -897,6 +899,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Apr 22 2022 Antonio Torres - 3.0.25-4 +- Use infinite timeout when using LDAP+start-TLS + Related: #1983063 + * Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From d0092f4925cf2fb39d777bafd737655a4eab61c9 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 7 Dec 2022 20:42:30 +0100 Subject: [PATCH 2/2] Update to upstream release 3.0.26 Includes fixes for CVEs 2022-41861, 2022-41860, 2022-41859, as well as several bugfixes. --- .gitignore | 1 + freeradius-no-buildtime-cert-gen.patch | 20 ++++++-------------- freeradius.spec | 16 ++++++++++++---- sources | 2 +- 4 files changed, 20 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index 4a7e0f9..dd4516b 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.23.tar.bz2 /freeradius-server-3.0.24.tar.bz2 /freeradius-server-3.0.25.tar.bz2 +/freeradius-server-3.0.26.tar.bz2 diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index e285c75..c88eedb 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -27,10 +27,10 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index c2c599c92b..3d4403a844 100755 +index 551e7fa083..2de6498c1c 100755 --- a/configure +++ b/configure -@@ -654,6 +654,7 @@ ACLOCAL +@@ -680,6 +680,7 @@ ACLOCAL RUSERS SNMPWALK SNMPGET @@ -38,15 +38,15 @@ index c2c599c92b..3d4403a844 100755 openssl_version_check_config WITH_DHCP modconfdir -@@ -5586,6 +5587,7 @@ else +@@ -7031,6 +7032,7 @@ else fi +ENABLE_REPRODUCIBLE_BUILDS=yes # Check whether --enable-reproducible-builds was given. - if test "${enable_reproducible_builds+set}" = set; then : - enableval=$enable_reproducible_builds; case "$enableval" in -@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + if test ${enable_reproducible_builds+y} + then : +@@ -7043,6 +7045,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -54,14 +54,6 @@ index c2c599c92b..3d4403a844 100755 esac fi -@@ -5604,6 +5607,7 @@ fi - - - -+ - CHECKRAD=checkrad - # Extract the first word of "perl", so it can be a program name with args. - set dummy perl; ac_word=$2 diff --git a/configure.ac b/configure.ac index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac diff --git a/freeradius.spec b/freeradius.spec index 15bf545..076ec3f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.25 -Release: 4%{?dist} +Version: 3.0.26 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -460,6 +460,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/check-eap-tls %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/status %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/dhcp.relay +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/virtual.example.com %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/originate-coa %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/vmps @@ -485,7 +486,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui @@ -510,6 +511,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip @@ -550,7 +552,6 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled %config(missingok) /etc/raddb/mods-enabled/always %config(missingok) /etc/raddb/mods-enabled/attr_filter -%config(missingok) /etc/raddb/mods-enabled/cache_eap %config(missingok) /etc/raddb/mods-enabled/chap %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail @@ -899,6 +900,13 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Dec 07 2022 Antonio Torres - 3.0.26-1 +- Update to upstream release 3.0.26. + Resolves: CVEs 2022-41861, 2022-41860, 2022-41859 + Resolves: #2078488 + Resolves: #2078486 + Resolves: #2078484 + * Fri Apr 22 2022 Antonio Torres - 3.0.25-4 - Use infinite timeout when using LDAP+start-TLS Related: #1983063 diff --git a/sources b/sources index b73c6d2..1802f12 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.25.tar.bz2) = 984bb65c86c541c91708370340ac6157b4d4d89a4ae7cbc690a9f17ead0e63fb20180333cdc33093877f84b6d40445495d881ae677858cbf60fcfd990fb02ba4 +SHA512 (freeradius-server-3.0.26.tar.bz2) = 348e2290d36315fef286d75079fa1429bc23aee53e668a09e938245e8e143a6f51c3cc6d76e4959461c1f5b2bb2c99513512b8fed2236b5e548bb2c4fc5ce9c8