From 0fbe1b7db0185c7be3f1cc43d31579d6663661e6 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 25 Jun 2021 16:41:02 +0200 Subject: [PATCH 1/5] Fix python3 not being correctly linked Since Python 3.8, there is a new way to link against libpython. https://docs.python.org/3/whatsnew/3.8.html#debug-build-uses-the-same-abi-as-release-build Signed-off-by: Antonio Torres --- freeradius.spec | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 2ea27bb..5de6397 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 11%{?dist} +Release: 12%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -214,9 +214,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # Hack: rlm_python3 as stable; prevents building other unstable modules. sed 's/rlm_python/rlm_python3/g' src/modules/stable -i -# python3-config is broken: -# https://bugzilla.redhat.com/show_bug.cgi?id=1772988 -export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" +%global build_ldflags %{build_ldflags} $(python3-config --embed --libs) +export PY3_LIB_DIR="$(python3-config --configdir)" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" # In order for the above hack to stick, do a fake configure so @@ -839,6 +838,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +Fri Jun 25 2021 Antonio Torres - 3.0.21-12 +- Fix python3 not being correctly linked + * Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 - Disable automatic bootstrap From 2649cfb18df4960705cb6f56ae8dc0ebac80579b Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 25 Jun 2021 16:44:17 +0200 Subject: [PATCH 2/5] Fix typo in spec file changelog Signed-off-by: Antonio Torres --- freeradius.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 5de6397..27af2d9 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -838,7 +838,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog -Fri Jun 25 2021 Antonio Torres - 3.0.21-12 +* Fri Jun 25 2021 Antonio Torres - 3.0.21-12 - Fix python3 not being correctly linked * Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 From daf64df5b197efb153fb45c30b26499e13cd1a8e Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 15 Jul 2021 12:54:32 +0200 Subject: [PATCH 3/5] Fix coredump not being able to be enabled If resource hard limit is set to zero, then it cannot be raised again, and this causes coredump to not being able to be enabled. Signed-off-by: Antonio Torres --- ...radius-Fix-resource-hard-limit-error.patch | 32 +++++++++++++++++++ freeradius.spec | 7 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 freeradius-Fix-resource-hard-limit-error.patch diff --git a/freeradius-Fix-resource-hard-limit-error.patch b/freeradius-Fix-resource-hard-limit-error.patch new file mode 100644 index 0000000..800c06c --- /dev/null +++ b/freeradius-Fix-resource-hard-limit-error.patch @@ -0,0 +1,32 @@ +commit 1ce4508c92493cf03ea1b3c42e83540b387884fa +Author: Antonio Torres +Date: Fri Jul 2 07:12:48 2021 -0400 +Subject: [PATCH] debug: don't set resource hard limit to zero + + Setting the resource hard limit to zero is irreversible, meaning if it + is set to zero then there is no way to set it higher. This means + enabling core dump is not possible, since setting a new resource limit + for RLIMIT_CORE would fail. By only setting the soft limit to zero, we + can disable and enable core dumps without failures. + + This fix is present in both main and 3.0.x upstream branches. + + Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572 + Signed-off-by: Antonio Torres antorres@redhat.com +--- + src/lib/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib/debug.c b/src/lib/debug.c +index 576bcb2a65..6330c9cb66 100644 +--- a/src/lib/debug.c ++++ b/src/lib/debug.c +@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps) + struct rlimit no_core; + + no_core.rlim_cur = 0; +- no_core.rlim_max = 0; ++ no_core.rlim_max = core_limits.rlim_max; + + if (setrlimit(RLIMIT_CORE, &no_core) < 0) { + fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno)); diff --git a/freeradius.spec b/freeradius.spec index 27af2d9..ebf34b9 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-Fix-resource-hard-limit-error.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -206,6 +207,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -838,6 +840,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jul 15 2021 Antonio Torres - 3.0.21-13 +- Fix coredump not being able to be enabled + * Fri Jun 25 2021 Antonio Torres - 3.0.21-12 - Fix python3 not being correctly linked From 8e37012f3ace1fb82aa902de7441a3f18df8fc13 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 19 Oct 2021 18:41:01 +0200 Subject: [PATCH 4/5] ldap: allow to connect on partially open handle The LDAP library returns a partially open connection. Setting the 'retry' flag to true during the module inst creation and the pool start to 0 allows to connect even if the connection is not completely opened yet. Upstream commit: https://github.com/FreeRADIUS/freeradius-server/commit/21d95b268b4cf56e75064898d83123825d673818 Related: #1983063 Signed-off-by: Antonio Torres --- ...-to-connect-on-partially-open-handle.patch | 49 +++++++++++++++++++ freeradius.spec | 10 +++- 2 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 freeradius-ldap-allow-to-connect-on-partially-open-handle.patch diff --git a/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch b/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch new file mode 100644 index 0000000..41755ee --- /dev/null +++ b/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch @@ -0,0 +1,49 @@ +From ab6bbcc41293ae745c1607618f88e5404b98d769 Mon Sep 17 00:00:00 2001 +From: Antonio Torres +Date: Wed, 13 Oct 2021 13:29:02 +0200 +Subject: [PATCH] ldap: allow to connect on partially open handle + +The LDAP library returns a partially open connection. Setting the +'retry' flag to true during the module inst creation and the pool start +to 0 allows to connect even if the connection is not completely opened +yet. + +Upstream commit: https://github.com/FreeRADIUS/freeradius-server/commit/21d95b268b4cf56e75064898d83123825d673818 + +Signed-off-by: Antonio Torres +--- +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index f25ee9e2e0..4b6ae44afb 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -717,7 +717,8 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle + * For sanity, for when no connections are viable, + * and we can't make a new one. + */ +- num = retry ? fr_connection_pool_get_num(inst->pool) : 0; ++ num = 0; ++ if (inst->pool && retry) num = fr_connection_pool_get_num(inst->pool); + for (i = num; i >= 0; i--) { + #ifdef WITH_SASL + if (sasl && sasl->mech) { +@@ -758,7 +759,7 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle + break; + + case LDAP_PROC_RETRY: +- if (retry) { ++ if (num) { + *pconn = fr_connection_reconnect(inst->pool, *pconn); + if (*pconn) { + LDAP_DBGW_REQ("Bind with %s to %s failed: %s. Got new socket, retrying...", +@@ -1563,7 +1564,7 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + status = rlm_ldap_bind(inst, NULL, &conn, conn->inst->admin_identity, conn->inst->admin_password, +- &(conn->inst->admin_sasl), false); ++ &(conn->inst->admin_sasl), true); + if (status != LDAP_PROC_SUCCESS) { + goto error; + } +-- +2.31.1 + diff --git a/freeradius.spec b/freeradius.spec index ebf34b9..4c27b57 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 13%{?dist} +Release: 14%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -26,6 +26,7 @@ Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-Fix-resource-hard-limit-error.patch +Patch7: freeradius-ldap-allow-to-connect-on-partially-open-handle.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -208,6 +209,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch4 -p1 %patch5 -p1 %patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -840,7 +842,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog -* Fri Jul 15 2021 Antonio Torres - 3.0.21-13 +* Tue Oct 19 2021 Antonio Torres - 3.0.21-14 +- Allow to connect to partially open LDAP handle + Related: rhbz#1983063 + +* Thu Jul 15 2021 Antonio Torres - 3.0.21-13 - Fix coredump not being able to be enabled * Fri Jun 25 2021 Antonio Torres - 3.0.21-12 From db99eee16a9f78b8404d29773489af5283bfafcc Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 22 Apr 2022 15:16:47 +0200 Subject: [PATCH 5/5] Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 Resolves: #1983063 Signed-off-by: Antonio Torres --- ...us-ldap-infinite-timeout-on-starttls.patch | 31 +++++++++++++++++++ freeradius.spec | 8 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 freeradius-ldap-infinite-timeout-on-starttls.patch diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius.spec b/freeradius.spec index 4c27b57..f4ce157 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 14%{?dist} +Release: 15%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -27,6 +27,7 @@ Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-Fix-resource-hard-limit-error.patch Patch7: freeradius-ldap-allow-to-connect-on-partially-open-handle.patch +Patch8: freeradius-ldap-infinite-timeout-on-starttls.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -210,6 +211,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -842,6 +844,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Apr 22 2022 Antonio Torres - 3.0.21-15 +- Use infinite timeout when using LDAP+start-TLS + Resolves: #1983063 + * Tue Oct 19 2021 Antonio Torres - 3.0.21-14 - Allow to connect to partially open LDAP handle Related: rhbz#1983063