Accepting request 234720 from network

- update to 3.0.3
	Many bugfixes
	Feature improvements
	* Everything now builds with no warnings from the C compiler,
	  clang static analyzer, or cppcheck.
	* rlm_ldap now supports defining the LDAP attribute name via
	  backticked expansion (i.e. shell command) in
	  RADIUS <-> LDAP mappings.
	* rlm_ldap now supports older style generic attributes.
	* dynamic expansions (e.g. "%{expr:1 + 2}" are now parsed
	  when the server starts.  Syntax errors in the strings
	  are caught, and a descriptive error is printed.
	* Static regular expressions (e.g. /a*b/) are now parsed
	  when the server starts.  Syntax errors in the strings
	  are caught, and a descriptive error is printed.
	* dynamic expansions are cached after being parsed.  They are
	  no longer re-parsed at run-time for every request.
	* regular expressions are now parsed and cached when the server
	  starts.
	* Added the %{rest:} expansion to rlm_rest, which will send
	  a GET request to the URL passed as the format string.
	  Any body text will be written to the expansion buffer.
	* rlm_rest now available as a debian package.
	* When an 'if' condition statically evaluates to true/false,
	  unlang does more static optimization.  For examples, see
	  src/tests/keywords/if-skip
	* All modules are marked as safe for '-C', which lets the
	  dynamic expansion checks work in more situations.
	* Added 'none' and 'custom' rlm_rest body types. 'custom'
	  allows sending of arbitrary expanded text and content-type (forwarded request 234679 from vitezslav_cizek)

OBS-URL: https://build.opensuse.org/request/show/234720
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/freeradius-server?expand=0&rev=51

freeradius-server-3.0.3.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:781488e18f7b80e241bb5dafa07fcf8f2f7fbe897b337a07367e3f73749ae729
+size 2762771

freeradius-server-CVE-2014-2015.patch

@@ -1,49 +0,0 @@
-From ff5147c9e5088c7cf5c0b6ec6bfdd3a9d2042a28 Mon Sep 17 00:00:00 2001
-From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
-Date: Thu, 13 Feb 2014 13:49:54 +0000
-Subject: [PATCH] Fix potential crash with SSHA and salts > 44bytes
-
----
- src/modules/rlm_pap/rlm_pap.c | 10 ++++++----
- 1 file changed, 6 insertions(+), 4 deletions(-)
-
-diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c
-index 689acf0..1bf6d4e 100644
---- a/src/modules/rlm_pap/rlm_pap.c
-+++ b/src/modules/rlm_pap/rlm_pap.c
-@@ -123,7 +123,7 @@ static int mod_instantiate(CONF_SECTION *conf, void *instance)
- static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length)
- {
- 
--	uint8_t buffer[64];
-+	uint8_t buffer[256];
- 
- 	if (min_length >= sizeof(buffer)) return; /* paranoia */
- 
-@@ -132,9 +132,10 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length)
- 	 */
- 	if (vp->length >= (2 * min_length)) {
- 		size_t decoded;
--		decoded = fr_hex2bin(buffer, vp->vp_strvalue, vp->length >> 1);
-+		decoded = fr_hex2bin(buffer, vp->vp_strvalue, sizeof(buffer));
- 		if (decoded == (vp->length >> 1)) {
--			RDEBUG2("Normalizing %s from hex encoding", vp->da->name);
-+			RDEBUG2("Normalizing %s from hex encoding, %zu bytes -> %zu bytes",
-+				vp->da->name, vp->length, decoded);
- 			pairmemcpy(vp, buffer, decoded);
- 			return;
- 		}
-@@ -150,7 +151,8 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length)
- 					   sizeof(buffer));
- 		if (decoded < 0) return;
- 		if (decoded >= (ssize_t) min_length) {
--			RDEBUG2("Normalizing %s from base64 encoding", vp->da->name);
-+			RDEBUG2("Normalizing %s from base64 encoding, %zu bytes -> %zu bytes",
-+				vp->da->name, vp->length, decoded);
- 			pairmemcpy(vp, buffer, decoded);
- 			return;
- 		}
--- 
-1.8.5.5
-
-

freeradius-server.changes

@@ -1,3 +1,68 @@
+-------------------------------------------------------------------
+Fri May 16 13:31:41 UTC 2014 - vcizek@suse.com
+
+- update to 3.0.3
+	Many bugfixes
+	Feature improvements
+	* Everything now builds with no warnings from the C compiler,
+	  clang static analyzer, or cppcheck.
+	* rlm_ldap now supports defining the LDAP attribute name via
+	  backticked expansion (i.e. shell command) in
+	  RADIUS <-> LDAP mappings.
+	* rlm_ldap now supports older style generic attributes.
+	* dynamic expansions (e.g. "%{expr:1 + 2}" are now parsed
+	  when the server starts.  Syntax errors in the strings
+	  are caught, and a descriptive error is printed.
+	* Static regular expressions (e.g. /a*b/) are now parsed
+	  when the server starts.  Syntax errors in the strings
+	  are caught, and a descriptive error is printed.
+	* dynamic expansions are cached after being parsed.  They are
+	  no longer re-parsed at run-time for every request.
+	* regular expressions are now parsed and cached when the server
+	  starts.
+	* Added the %{rest:} expansion to rlm_rest, which will send
+	  a GET request to the URL passed as the format string.
+	  Any body text will be written to the expansion buffer.
+	* rlm_rest now available as a debian package.
+	* When an 'if' condition statically evaluates to true/false,
+	  unlang does more static optimization.  For examples, see
+	  src/tests/keywords/if-skip
+	* All modules are marked as safe for '-C', which lets the
+	  dynamic expansion checks work in more situations.
+	* Added 'none' and 'custom' rlm_rest body types. 'custom'
+	  allows sending of arbitrary expanded text and content-type
+	  headers.
+	* Added "config" section to Perl.  See mods-available/perl
+	* Added '%v' which expands to the server version - Patch
+	  from Alan Buxey.
+	* more mis-matched casts are caught in "if" conditions,
+	  and descriptive errors are printed.
+	* Support basic response validation in radclient. This allows
+	  administrators to write local test cases for their
+	  site-specific configurations.
+	* Removed radconf2xml and radmin "show client config" and
+	  "show home_server config".
+	* Forbid running with vulnerable versions of OpenSSL.
+	  See "allow_vulnerable_openssl" in the "security"
+	  subsection of "radiusd.conf"
+	* Catch underlying "heartbleed" problem, so that nothing bad
+	  happens even when using a vulnerable version of OpenSSL.
+	* Add locking API for sql_null, linelog, and detail modules,
+	  which should improve performance and work around issues
+	  on platforms with bad file locking.
+	* Allow DHCP NAKs to be delayed, via setting
+	  reply:FreeRADIUS-Response-Delay = 1
+	* Allow tag and array references anywhere attributes
+	  are allowed in "unlang".
+	* many enhancements to radsniff, including output
+	  to collectd, ipv6 support and packet loss statistics.
+	* Many dictionary updates (ZTE, Brocade, Motorola).
+	* rlm_yubikey now automatically splits passwords from OTP
+	  strings.
+	* The detail file reader is now threaded by default.
+	  This should improve performance reading the files.
+- dropped freeradius-server-CVE-2014-2015.patch (upstream)
+
 -------------------------------------------------------------------
 Fri Feb 28 09:04:08 UTC 2014 - vcizek@suse.com
 

freeradius-server.spec

@@ -23,7 +23,7 @@
 
 Name:           freeradius-server
 %define unitname radiusd
-Version:        3.0.1
+Version:        3.0.3
 Release:        0
 Summary:        Very Highly Configurable Radius Server
 License:        GPL-2.0 and LGPL-2.1
@@ -40,7 +40,6 @@ Patch8:         freeradius-server-initscript-pidfile.patch
 Patch9:         freeradius-server-radius-reload-logrotate.patch
 # PATCH-FIX-SUSE use 'su' logrotate option (bnc#677335)
 Patch12:        freeradius-server-2.1.1-logrotate_su.patch
-Patch13:        freeradius-server-CVE-2014-2015.patch
 BuildRequires:  apache2-devel
 BuildRequires:  cyrus-sasl-devel
 BuildRequires:  db-devel
@@ -225,7 +224,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project.
 %patch8 -p1
 %patch9 -p1
 %patch12 -p1
-%patch13 -p1
 
 %build
 modified="$(sed -n '/^----/n;s/ - .*$//;p;q' "%{_sourcedir}/%{name}.changes")"
@@ -262,9 +260,9 @@ export LDFLAGS="-pie"
   --without-rlm_redis \
   --without-rlm_rediswho \
   --without-rlm_sql_oracle \
-  --without-rlm_securid
+  --without-rlm_securid \
-# no parallel build possible
+  --disable-silent-rules
-make
+make %{?_smp_mflags}
 
 %install
 mkdir -p %{buildroot}%{_localstatedir}/lib/radiusd
@@ -318,6 +316,7 @@ rm -f %{buildroot}%{_defaultdocdir}/%{name}/Makefile
 rm -f %{buildroot}%{_defaultdocdir}/%{name}/examples/Makefile
 rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/main/mssql
 rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/ippool/oracle
+rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle
 rm -rf %{buildroot}%{_sysconfdir}/raddb/mods-config/sql/main/oracle
 
 %pre
@@ -374,7 +373,7 @@ rm -rf %{buildroot}
 # doc
 %doc suse/README.SuSE
 %doc COPYRIGHT CREDITS LICENSE doc/ChangeLog
-# SuSE
+# SUSE
 %config %{_sysconfdir}/pam.d/radiusd
 %config %{_sysconfdir}/logrotate.d/radiusd
 %if %{with_sysvinit}
@@ -401,6 +400,7 @@ rm -rf %{buildroot}
 %{_sysconfdir}/raddb/certs/Makefile
 %{_sysconfdir}/raddb/certs/README
 %{_sysconfdir}/raddb/certs/xpextensions
+%{_sysconfdir}/raddb/panic.gdb
 %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/certs/*.cnf
 %attr(750,root,radiusd) %{_sysconfdir}/raddb/certs/bootstrap
 %{_tmpfilesdir}/%{unitname}.conf
@@ -422,6 +422,11 @@ rm -rf %{buildroot}
 %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool
 %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp
 %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/main
+#%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle/queries.conf
+#%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/oracle/schema.sql
+%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/sql/ippool-dhcp/sqlite/schema.sql
+%dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/mods-config/unbound
+%attr(640,root,radiusd) %{_sysconfdir}/raddb/mods-config/unbound/default.conf
 
 # sites-available
 %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/sites-available
@@ -512,6 +517,8 @@ rm -rf %{buildroot}
 %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/utf8
 %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/yubikey
+%attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/unbound
+%attr(640,root,radiusd) %config(noreplace) %{_sysconfdir}/raddb/mods-available/unpack
 
 # mods-enabled
 # symlink: %{_sysconfdir}/raddb/mods-enabled/xxx -> ../mods-available/xxx
@@ -545,6 +552,7 @@ rm -rf %{buildroot}
 %config(missingok) %{_sysconfdir}/raddb/mods-enabled/sradutmp
 %config(missingok) %{_sysconfdir}/raddb/mods-enabled/unix
 %config(missingok) %{_sysconfdir}/raddb/mods-enabled/utf8
+%config(missingok) %{_sysconfdir}/raddb/mods-enabled/unpack
 
 # policy
 %dir %attr(750,root,radiusd) %{_sysconfdir}/raddb/policy.d
@@ -620,6 +628,7 @@ rm -rf %{buildroot}
 %{_libdir}/freeradius/rlm_radutmp.so
 %{_libdir}/freeradius/rlm_realm.so
 %{_libdir}/freeradius/rlm_replicate.so
+%{_libdir}/freeradius/rlm_rest.so
 %{_libdir}/freeradius/rlm_soh.so
 %{_libdir}/freeradius/rlm_sometimes.so
 %{_libdir}/freeradius/rlm_sql.so
@@ -631,6 +640,7 @@ rm -rf %{buildroot}
 %{_libdir}/freeradius/rlm_wimax.so
 %{_libdir}/freeradius/rlm_yubikey.so
 %{_libdir}/freeradius/rlm_sql_unixodbc.so
+%{_libdir}/freeradius/rlm_unpack.so
 
 %files utils
 %defattr(-,root,root)