diff --git a/freeradius-server-3.0.3.tar.bz2 b/freeradius-server-3.0.3.tar.bz2 new file mode 100644 index 0000000..7ff079b --- /dev/null +++ b/freeradius-server-3.0.3.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:781488e18f7b80e241bb5dafa07fcf8f2f7fbe897b337a07367e3f73749ae729 +size 2762771 diff --git a/freeradius-server-3.0.3.tar.bz2.sig b/freeradius-server-3.0.3.tar.bz2.sig new file mode 100644 index 0000000..97595c3 Binary files /dev/null and b/freeradius-server-3.0.3.tar.bz2.sig differ diff --git a/freeradius-server-CVE-2014-2015.patch b/freeradius-server-CVE-2014-2015.patch deleted file mode 100644 index f105e81..0000000 --- a/freeradius-server-CVE-2014-2015.patch +++ /dev/null @@ -1,49 +0,0 @@ -From ff5147c9e5088c7cf5c0b6ec6bfdd3a9d2042a28 Mon Sep 17 00:00:00 2001 -From: Arran Cudbard-Bell -Date: Thu, 13 Feb 2014 13:49:54 +0000 -Subject: [PATCH] Fix potential crash with SSHA and salts > 44bytes - ---- - src/modules/rlm_pap/rlm_pap.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c -index 689acf0..1bf6d4e 100644 ---- a/src/modules/rlm_pap/rlm_pap.c -+++ b/src/modules/rlm_pap/rlm_pap.c -@@ -123,7 +123,7 @@ static int mod_instantiate(CONF_SECTION *conf, void *instance) - static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) - { - -- uint8_t buffer[64]; -+ uint8_t buffer[256]; - - if (min_length >= sizeof(buffer)) return; /* paranoia */ - -@@ -132,9 +132,10 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) - */ - if (vp->length >= (2 * min_length)) { - size_t decoded; -- decoded = fr_hex2bin(buffer, vp->vp_strvalue, vp->length >> 1); -+ decoded = fr_hex2bin(buffer, vp->vp_strvalue, sizeof(buffer)); - if (decoded == (vp->length >> 1)) { -- RDEBUG2("Normalizing %s from hex encoding", vp->da->name); -+ RDEBUG2("Normalizing %s from hex encoding, %zu bytes -> %zu bytes", -+ vp->da->name, vp->length, decoded); - pairmemcpy(vp, buffer, decoded); - return; - } -@@ -150,7 +151,8 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) - sizeof(buffer)); - if (decoded < 0) return; - if (decoded >= (ssize_t) min_length) { -- RDEBUG2("Normalizing %s from base64 encoding", vp->da->name); -+ RDEBUG2("Normalizing %s from base64 encoding, %zu bytes -> %zu bytes", -+ vp->da->name, vp->length, decoded); - pairmemcpy(vp, buffer, decoded); - return; - } --- -1.8.5.5 - - diff --git a/freeradius-server.changes b/freeradius-server.changes index a207bc1..082d10d 100644 --- a/freeradius-server.changes +++ b/freeradius-server.changes @@ -1,3 +1,68 @@ +------------------------------------------------------------------- +Fri May 16 13:31:41 UTC 2014 - vcizek@suse.com + +- update to 3.0.3 + Many bugfixes + Feature improvements + * Everything now builds with no warnings from the C compiler, + clang static analyzer, or cppcheck. + * rlm_ldap now supports defining the LDAP attribute name via + backticked expansion (i.e. shell command) in + RADIUS <-> LDAP mappings. + * rlm_ldap now supports older style generic attributes. + * dynamic expansions (e.g. "%{expr:1 + 2}" are now parsed + when the server starts. Syntax errors in the strings + are caught, and a descriptive error is printed. + * Static regular expressions (e.g. /a*b/) are now parsed + when the server starts. Syntax errors in the strings + are caught, and a descriptive error is printed. + * dynamic expansions are cached after being parsed. They are + no longer re-parsed at run-time for every request. + * regular expressions are now parsed and cached when the server + starts. + * Added the %{rest:} expansion to rlm_rest, which will send + a GET request to the URL passed as the format string. + Any body text will be written to the expansion buffer. + * rlm_rest now available as a debian package. + * When an 'if' condition statically evaluates to true/false, + unlang does more static optimization. For examples, see + src/tests/keywords/if-skip + * All modules are marked as safe for '-C', which lets the + dynamic expansion checks work in more situations. + * Added 'none' and 'custom' rlm_rest body types. 'custom' + allows sending of arbitrary expanded text and content-type + headers. + * Added "config" section to Perl. See mods-available/perl + * Added '%v' which expands to the server version - Patch + from Alan Buxey. + * more mis-matched casts are caught in "if" conditions, + and descriptive errors are printed. + * Support basic response validation in radclient. This allows + administrators to write local test cases for their + site-specific configurations. + * Removed radconf2xml and radmin "show client config" and + "show home_server config". + * Forbid running with vulnerable versions of OpenSSL. + See "allow_vulnerable_openssl" in the "security" + subsection of "radiusd.conf" + * Catch underlying "heartbleed" problem, so that nothing bad + happens even when using a vulnerable version of OpenSSL. + * Add locking API for sql_null, linelog, and detail modules, + which should improve performance and work around issues + on platforms with bad file locking. + * Allow DHCP NAKs to be delayed, via setting + reply:FreeRADIUS-Response-Delay = 1 + * Allow tag and array references anywhere attributes + are allowed in "unlang". + * many enhancements to radsniff, including output + to collectd, ipv6 support and packet loss statistics. + * Many dictionary updates (ZTE, Brocade, Motorola). + * rlm_yubikey now automatically splits passwords from OTP + strings. + * The detail file reader is now threaded by default. + This should improve performance reading the files. +- dropped freeradius-server-CVE-2014-2015.patch (upstream) + ------------------------------------------------------------------- Fri Feb 28 09:04:08 UTC 2014 - vcizek@suse.com diff --git a/freeradius-server.spec b/freeradius-server.spec index 46d1a70..28acaf4 100644 --- a/freeradius-server.spec +++ b/freeradius-server.spec @@ -23,7 +23,7 @@ Name: freeradius-server %define unitname radiusd -Version: 3.0.1 +Version: 3.0.3 Release: 0 Summary: Very Highly Configurable Radius Server License: GPL-2.0 and LGPL-2.1 @@ -40,7 +40,6 @@ Patch8: freeradius-server-initscript-pidfile.patch Patch9: freeradius-server-radius-reload-logrotate.patch # PATCH-FIX-SUSE use 'su' logrotate option (bnc#677335) Patch12: freeradius-server-2.1.1-logrotate_su.patch -Patch13: freeradius-server-CVE-2014-2015.patch BuildRequires: apache2-devel BuildRequires: cyrus-sasl-devel BuildRequires: db-devel @@ -225,7 +224,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project. %patch8 -p1 %patch9 -p1 %patch12 -p1 -%patch13 -p1 %build modified="$(sed -n '/^----/n;s/ - .*$//;p;q' "%{_sourcedir}/%{name}.changes")" @@ -262,9 +260,9 @@ export LDFLAGS="-pie" --without-rlm_redis \ --without-rlm_rediswho \ --without-rlm_sql_oracle \ - --without-rlm_securid -# no parallel build possible -make + --without-rlm_securid \ + --disable-silent-rules +make %{?_smp_mflags} %install mkdir -p %{buildroot}%{_localstatedir}/lib/radiusd @@ -318,6 +316,7 @@ rm -f %{buildroot}%{_defaultdocdir}/%{name}/Makefile rm -f %{buildroot}%{_defaultdocdir}/%{name}/examples/Makefile rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/main/mssql rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/ippool/oracle +rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/main/oracle %pre @@ -374,7 +373,7 @@ rm -rf %{buildroot} # doc %doc suse/README.SuSE %doc COPYRIGHT CREDITS LICENSE doc/ChangeLog -# SuSE +# SUSE %config %{_sysconfdir}/pam.d/radiusd %config %{_sysconfdir}/logrotate.d/radiusd %if %{with_sysvinit} @@ -401,6 +400,7 @@ rm -rf %{buildroot} %{_sysconfdir}/raddb/certs/Makefile %{_sysconfdir}/raddb/certs/README %{_sysconfdir}/raddb/certs/xpextensions +%{_sysconfdir}/raddb/panic.gdb %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/certs/*.cnf %attr(750,root,radiusd) %{_sysconfdir}/raddb/certs/bootstrap %{_tmpfilesdir}/%{unitname}.conf @@ -422,6 +422,11 @@ rm -rf %{buildroot} %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/main +#%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle/queries.conf +#%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle/schema.sql +%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/sqlite/schema.sql +%dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/unbound +%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/unbound/default.conf # sites-available %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/sites-available @@ -512,6 +517,8 @@ rm -rf %{buildroot} %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/utf8 %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/yubikey +%attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/unbound +%attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/unpack # mods-enabled # symlink: %{_sysconfdir}/raddb/mods-enabled/xxx -> ../mods-available/xxx @@ -545,6 +552,7 @@ rm -rf %{buildroot} %config(missingok) %{_sysconfdir}/raddb/mods-enabled/sradutmp %config(missingok) %{_sysconfdir}/raddb/mods-enabled/unix %config(missingok) %{_sysconfdir}/raddb/mods-enabled/utf8 +%config(missingok) %{_sysconfdir}/raddb/mods-enabled/unpack # policy %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/policy.d @@ -620,6 +628,7 @@ rm -rf %{buildroot} %{_libdir}/freeradius/rlm_radutmp.so %{_libdir}/freeradius/rlm_realm.so %{_libdir}/freeradius/rlm_replicate.so +%{_libdir}/freeradius/rlm_rest.so %{_libdir}/freeradius/rlm_soh.so %{_libdir}/freeradius/rlm_sometimes.so %{_libdir}/freeradius/rlm_sql.so @@ -631,6 +640,7 @@ rm -rf %{buildroot} %{_libdir}/freeradius/rlm_wimax.so %{_libdir}/freeradius/rlm_yubikey.so %{_libdir}/freeradius/rlm_sql_unixodbc.so +%{_libdir}/freeradius/rlm_unpack.so %files utils %defattr(-,root,root)