Update to upstream release 3.0.26

Includes fixes for CVEs 2022-41861, 2022-41860, 2022-41859, as well as
several bugfixes.

.gitignore

@@ -38,3 +38,4 @@ freeradius-*.src.rpm
 /freeradius-server-3.0.23.tar.bz2
 /freeradius-server-3.0.24.tar.bz2
 /freeradius-server-3.0.25.tar.bz2
+/freeradius-server-3.0.26.tar.bz2

freeradius-ldap-infinite-timeout-on-starttls.patch

@@ -0,0 +1,31 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Fri, 28 Jan 2022
+Subject: Use infinite timeout when using LDAP+start-TLS
+
+This will ensure that the TLS connection to the LDAP server will complete
+before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
+the process. Infinite timeout is the OpenLDAP default.
+Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/modules/rlm_ldap/ldap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index cf7a84e069..841bf888a1 100644
+--- a/src/modules/rlm_ldap/ldap.c
++++ b/src/modules/rlm_ldap/ldap.c
+@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ #ifdef LDAP_OPT_NETWORK_TIMEOUT
+-	if (inst->net_timeout) {
++	bool using_tls = inst->start_tls ||
++					 inst->port == 636 ||
++					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
++	if (inst->net_timeout && !using_tls) {
+ 		memset(&tv, 0, sizeof(tv));
+ 		tv.tv_sec = inst->net_timeout;
+ 

freeradius-no-buildtime-cert-gen.patch

@@ -27,10 +27,10 @@ index 0b2cd74de8..8c623cf95c 100644
  #
  #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index c2c599c92b..3d4403a844 100755
+index 551e7fa083..2de6498c1c 100755
 --- a/configure
 +++ b/configure
-@@ -654,6 +654,7 @@ ACLOCAL
+@@ -680,6 +680,7 @@ ACLOCAL
  RUSERS
  SNMPWALK
  SNMPGET
@@ -38,15 +38,15 @@ index c2c599c92b..3d4403a844 100755
  openssl_version_check_config
  WITH_DHCP
  modconfdir
-@@ -5586,6 +5587,7 @@ else
+@@ -7031,6 +7032,7 @@ else
  fi
  
  
 +ENABLE_REPRODUCIBLE_BUILDS=yes
  # Check whether --enable-reproducible-builds was given.
- if test "${enable_reproducible_builds+set}" = set; then :
-   enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+ if test ${enable_reproducible_builds+y}
+ then :
+@@ -7043,6 +7045,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
      ;;
    *)
      reproducible_builds=no
@@ -54,14 +54,6 @@ index c2c599c92b..3d4403a844 100755
    esac
  
  fi
-@@ -5604,6 +5607,7 @@ fi
- 
- 
- 
-+
- CHECKRAD=checkrad
- # Extract the first word of "perl", so it can be a program name with args.
- set dummy perl; ac_word=$2
 diff --git a/configure.ac b/configure.ac
 index ce4d9b0ae5..790cbf02a0 100644
 --- a/configure.ac

freeradius.spec

@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.0.25
-Release: 3%{?dist}
+Version: 3.0.26
+Release: 1%{?dist}
 License: GPLv2+ and LGPLv2+
 URL: http://www.freeradius.org/
 
@@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch
 Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
 Patch5: freeradius-bootstrap-make-permissions.patch
+Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -207,6 +208,7 @@ This plugin provides the REST support for the FreeRADIUS server project.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 %build
 # Force compile/link options, extra security for network facing daemon
@@ -458,6 +460,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/check-eap-tls
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/status
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/dhcp.relay
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/virtual.example.com
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/originate-coa
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/vmps
@@ -483,7 +486,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui
@@ -508,6 +511,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip
@@ -548,7 +552,6 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled
 %config(missingok) /etc/raddb/mods-enabled/always
 %config(missingok) /etc/raddb/mods-enabled/attr_filter
-%config(missingok) /etc/raddb/mods-enabled/cache_eap
 %config(missingok) /etc/raddb/mods-enabled/chap
 %config(missingok) /etc/raddb/mods-enabled/date
 %config(missingok) /etc/raddb/mods-enabled/detail
@@ -897,6 +900,17 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Wed Dec 07 2022 Antonio Torres <antorres@redhat.com> - 3.0.26-1
+- Update to upstream release 3.0.26.
+  Resolves: CVEs 2022-41861, 2022-41860, 2022-41859
+  Resolves: #2078488
+  Resolves: #2078486
+  Resolves: #2078484
+
+* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-4
+- Use infinite timeout when using LDAP+start-TLS
+  Related: #1983063
+
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.25-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (freeradius-server-3.0.25.tar.bz2) = 984bb65c86c541c91708370340ac6157b4d4d89a4ae7cbc690a9f17ead0e63fb20180333cdc33093877f84b6d40445495d881ae677858cbf60fcfd990fb02ba4
+SHA512 (freeradius-server-3.0.26.tar.bz2) = 348e2290d36315fef286d75079fa1429bc23aee53e668a09e938245e8e143a6f51c3cc6d76e4959461c1f5b2bb2c99513512b8fed2236b5e548bb2c4fc5ce9c8