Use infinite timeout when using LDAP+start-TLS

This will ensure that the TLS connection to the LDAP server will complete
before starting FreeRADIUS, as it forces libldap to use a blocking socket during
the process. Infinite timeout is the OpenLDAP default.
Avoids this: 87ffc60006/libraries/libldap/tls2.c (L1134)

Resolves: #1983063
Signed-off-by: Antonio Torres <antorres@redhat.com>

freeradius-Fix-resource-hard-limit-error.patch

@@ -0,0 +1,32 @@
+commit 1ce4508c92493cf03ea1b3c42e83540b387884fa
+Author: Antonio Torres <antorres@redhat.com>
+Date:   Fri Jul 2 07:12:48 2021 -0400
+Subject: [PATCH] debug: don't set resource hard limit to zero
+
+    Setting the resource hard limit to zero is irreversible, meaning if it
+    is set to zero then there is no way to set it higher. This means
+    enabling core dump is not possible, since setting a new resource limit
+    for RLIMIT_CORE would fail. By only setting the soft limit to zero, we
+    can disable and enable core dumps without failures.
+
+    This fix is present in both main and 3.0.x upstream branches.
+    
+    Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572
+    Signed-off-by: Antonio Torres antorres@redhat.com
+---
+ src/lib/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lib/debug.c b/src/lib/debug.c
+index 576bcb2a65..6330c9cb66 100644
+--- a/src/lib/debug.c
++++ b/src/lib/debug.c
+@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps)
+ 		struct rlimit no_core;
+ 
+ 		no_core.rlim_cur = 0;
+-		no_core.rlim_max = 0;
++		no_core.rlim_max = core_limits.rlim_max;
+ 
+ 		if (setrlimit(RLIMIT_CORE, &no_core) < 0) {
+ 			fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno));

freeradius-ldap-allow-to-connect-on-partially-open-handle.patch

@@ -0,0 +1,49 @@
+From ab6bbcc41293ae745c1607618f88e5404b98d769 Mon Sep 17 00:00:00 2001
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 13 Oct 2021 13:29:02 +0200
+Subject: [PATCH] ldap: allow to connect on partially open handle
+
+The LDAP library returns a partially open connection. Setting the
+'retry' flag to true during the module inst creation and the pool start
+to 0 allows to connect even if the connection is not completely opened
+yet.
+
+Upstream commit: https://github.com/FreeRADIUS/freeradius-server/commit/21d95b268b4cf56e75064898d83123825d673818
+
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index f25ee9e2e0..4b6ae44afb 100644
+--- a/src/modules/rlm_ldap/ldap.c
++++ b/src/modules/rlm_ldap/ldap.c
+@@ -717,7 +717,8 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle
+ 	 *	For sanity, for when no connections are viable,
+ 	 *	and we can't make a new one.
+ 	 */
+-	num = retry ? fr_connection_pool_get_num(inst->pool) : 0;
++	num = 0;
++	if (inst->pool && retry) num = fr_connection_pool_get_num(inst->pool);
+ 	for (i = num; i >= 0; i--) {
+ #ifdef WITH_SASL
+ 		if (sasl && sasl->mech) {
+@@ -758,7 +759,7 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle
+ 			break;
+ 
+ 		case LDAP_PROC_RETRY:
+-			if (retry) {
++			if (num) {
+ 				*pconn = fr_connection_reconnect(inst->pool, *pconn);
+ 				if (*pconn) {
+ 					LDAP_DBGW_REQ("Bind with %s to %s failed: %s. Got new socket, retrying...",
+@@ -1563,7 +1564,7 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ 	status = rlm_ldap_bind(inst, NULL, &conn, conn->inst->admin_identity, conn->inst->admin_password,
+-			       &(conn->inst->admin_sasl), false);
++			       &(conn->inst->admin_sasl), true);
+ 	if (status != LDAP_PROC_SUCCESS) {
+ 		goto error;
+ 	}
+-- 
+2.31.1
+

freeradius-ldap-infinite-timeout-on-starttls.patch

@@ -0,0 +1,31 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Fri, 28 Jan 2022
+Subject: Use infinite timeout when using LDAP+start-TLS
+
+This will ensure that the TLS connection to the LDAP server will complete
+before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
+the process. Infinite timeout is the OpenLDAP default.
+Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/modules/rlm_ldap/ldap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index cf7a84e069..841bf888a1 100644
+--- a/src/modules/rlm_ldap/ldap.c
++++ b/src/modules/rlm_ldap/ldap.c
+@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ #ifdef LDAP_OPT_NETWORK_TIMEOUT
+-	if (inst->net_timeout) {
++	bool using_tls = inst->start_tls ||
++					 inst->port == 636 ||
++					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
++	if (inst->net_timeout && !using_tls) {
+ 		memset(&tv, 0, sizeof(tv));
+ 		tv.tv_sec = inst->net_timeout;
+ 

freeradius.spec

@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
 Version: 3.0.21
-Release: 11%{?dist}
+Release: 15%{?dist}
 License: GPLv2+ and LGPLv2+
 URL: http://www.freeradius.org/
 
@@ -25,6 +25,9 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch
 Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
 Patch5: freeradius-bootstrap-make-permissions.patch
+Patch6: freeradius-Fix-resource-hard-limit-error.patch
+Patch7: freeradius-ldap-allow-to-connect-on-partially-open-handle.patch
+Patch8: freeradius-ldap-infinite-timeout-on-starttls.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -206,6 +209,9 @@ This plugin provides the REST support for the FreeRADIUS server project.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1
 
 %build
 # Force compile/link options, extra security for network facing daemon
@@ -214,9 +220,8 @@ This plugin provides the REST support for the FreeRADIUS server project.
 # Hack: rlm_python3 as stable; prevents building other unstable modules.
 sed 's/rlm_python/rlm_python3/g' src/modules/stable -i
 
-# python3-config is broken:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1772988
-export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')"
+%global build_ldflags %{build_ldflags} $(python3-config --embed --libs)
+export PY3_LIB_DIR="$(python3-config --configdir)"
 export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')"
 
 # In order for the above hack to stick, do a fake configure so
@@ -839,6 +844,20 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.21-15
+- Use infinite timeout when using LDAP+start-TLS
+  Resolves: #1983063
+
+* Tue Oct 19 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-14
+- Allow to connect to partially open LDAP handle
+  Related: rhbz#1983063 
+
+* Thu Jul 15 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-13
+- Fix coredump not being able to be enabled
+
+* Fri Jun 25 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-12
+- Fix python3 not being correctly linked
+
 * Wed Mar 10 2021 Robbie Harwood <rharwood@redhat.com> - 3.0.21-11
 - Disable automatic bootstrap