From 1314c0d82fee33213ea17cc7805bdf3a60efac78 Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Tue, 7 Jul 2015 14:48:41 +0000 Subject: main/freeradius: security fix for CVE-2015-4680 ref #4377 --- main/freeradius/APKBUILD | 12 ++++-- main/freeradius/CVE-2015-4680.patch | 79 +++++++++++++++++++++++++++++++++++++ 2 files changed, 87 insertions(+), 4 deletions(-) create mode 100644 main/freeradius/CVE-2015-4680.patch (limited to 'main/freeradius') diff --git a/main/freeradius/APKBUILD b/main/freeradius/APKBUILD index 58952a7163..633d4c600d 100644 --- a/main/freeradius/APKBUILD +++ b/main/freeradius/APKBUILD @@ -5,7 +5,7 @@ pkgname=freeradius _realname=freeradius pkgver=3.0.8 -pkgrel=6 +pkgrel=7 pkgdesc="RADIUS (Remote Authentication Dial-In User Service) server" url="http://freeradius.org/" arch="all" @@ -30,6 +30,7 @@ source="ftp://ftp.freeradius.org/pub/freeradius/$_realname-server-$pkgver.tar.gz musl-fix-headers.patch disable-cert-generation.patch freeradius-305-default-config.patch + CVE-2015-4680.patch " _builddir="$srcdir"/$_realname-server-$pkgver @@ -272,16 +273,19 @@ fc6693f3df5a0694610110287a28568a freeradius.confd e27f11a11fa167b5185d3e11de79d3bc freeradius.initd d86558365a1deea4914ed139797805b0 musl-fix-headers.patch ecd9ecfba4cf86a203de6faf8398c44a disable-cert-generation.patch -f8a7b00835f2108acc06af212cede16e freeradius-305-default-config.patch" +f8a7b00835f2108acc06af212cede16e freeradius-305-default-config.patch +3bc4cd4994c9a197daf36585487438a0 CVE-2015-4680.patch" sha256sums="c27252d7a86ba252904612d9b1f90e846f3ef1f4afee6a748f5287b730e87e3a freeradius-server-3.0.8.tar.gz 2d5b3e1af1299373182f2c8021bdf45c29db5d82b0a077b965a16ded32cb6292 freeradius.confd a5208f13420c28446b85dfc48cb9193a4651c994d15cc2c9b0bc43734c66e8f0 freeradius.initd 872aaebf86a663f819460d98924a9dc1f3e428facac6930dc98d1e442df1633f musl-fix-headers.patch 008fa3a4da7b3c01df238bf492a8ccda4077289c02c553a60ad8f4439ec136a2 disable-cert-generation.patch -02cad546ffaf3f9be531cb45b96c7fb31f83c717e40ece4ff28a73c86f921f33 freeradius-305-default-config.patch" +02cad546ffaf3f9be531cb45b96c7fb31f83c717e40ece4ff28a73c86f921f33 freeradius-305-default-config.patch +e7cbb3af9f90d741f91907898f9c0b156a2ae448cc812cbd6fd8322eb8bcea54 CVE-2015-4680.patch" sha512sums="89aabc474e95226eeb5003feef40fbe240f28aa65c40e0566a9bec08991d95fab83826f3b14f416cf4d7d832a814912521cb3c83097c1a2ce5d3e3537ee3a732 freeradius-server-3.0.8.tar.gz e248159c0a44f722e405c51c8015d9ad672e42ad0d38ca28f8a051ff911aa4d3e630b9bd4543e9d610940bc4ae50c022594e219ce341b36abe85c572acad418b freeradius.confd ba3c424d4eabb147c7aa3e31575a87ddb26b6a792d2a8714e73d8763e07854326a03a83991a7420246ca06bf0b93d0a6f23ec198f5e48647f9d25b40067e852a freeradius.initd c49e5eec7497fccde5fd09dba1ea9b846e57bc88015bd81640aa531fb5c9b449f37136f42c85fe1d7940c5963aed664b85da28442b388c9fb8cc27873df03b2d musl-fix-headers.patch 09b78c6baa992f82ab81c43aad6792536a4708d460170f0a373e242a5fafe8db10662dc7fcef99a966b828ed91fa7fe38567c961c938de9a447f1ee03aebb142 disable-cert-generation.patch -b69b899da6f80dbdb7422847536e37461315ba587a07fedc1eee28b96be7d16993b758ccd34e3a271ce2937d72c6ddff878aec61a3a4c0750deaaa959d10ed5e freeradius-305-default-config.patch" +b69b899da6f80dbdb7422847536e37461315ba587a07fedc1eee28b96be7d16993b758ccd34e3a271ce2937d72c6ddff878aec61a3a4c0750deaaa959d10ed5e freeradius-305-default-config.patch +68f00ea6353a2951c95d58fd674701c250e4de713c1bbfba80eb7247df1dc477fa2e277c9f0866ee5591e66eef4f52da70ee1794588df1f411f5e40773317fe7 CVE-2015-4680.patch" diff --git a/main/freeradius/CVE-2015-4680.patch b/main/freeradius/CVE-2015-4680.patch new file mode 100644 index 0000000000..ade38c9ee7 --- /dev/null +++ b/main/freeradius/CVE-2015-4680.patch @@ -0,0 +1,79 @@ +From 874b39451702338389260edbfc52b381b20352ec Mon Sep 17 00:00:00 2001 +From: "Alan T. DeKok" +Date: Mon, 22 Jun 2015 15:27:10 -0400 +Subject: [PATCH] Set X509_V_FLAG_CRL_CHECK_ALL + +--- + raddb/mods-available/eap | 6 +++++- + src/include/tls-h | 1 + + src/main/tls.c | 12 ++++++++++++ + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap +index 165971a..10026ec 100644 +--- a/raddb/mods-available/eap ++++ b/raddb/mods-available/eap +@@ -269,9 +269,13 @@ eap { + # 1) Copy CA certificates and CRLs to same directory. + # 2) Execute 'c_rehash '. + # 'c_rehash' is OpenSSL's command. +- # 3) uncomment the line below. ++ # 3) uncomment the lines below. + # 5) Restart radiusd + # check_crl = yes ++ ++ # Check if intermediate CAs have been revoked. ++ # check_all_crl = yes ++ + ca_path = ${cadir} + + # +diff --git a/src/include/tls-h b/src/include/tls-h +index 9fdc775..a41c6f5 100644 +--- a/src/include/tls-h ++++ b/src/include/tls-h +@@ -347,6 +347,7 @@ struct fr_tls_server_conf_t { + */ + uint32_t fragment_size; + bool check_crl; ++ bool check_all_crl; + bool allow_expired_crl; + char const *check_cert_cn; + char const *cipher_list; +diff --git a/src/main/tls.c b/src/main/tls.c +index 692651f..9df48b4 100644 +--- a/src/main/tls.c ++++ b/src/main/tls.c +@@ -999,6 +999,9 @@ static CONF_PARSER tls_server_config[] = { + { "fragment_size", FR_CONF_OFFSET(PW_TYPE_INTEGER, fr_tls_server_conf_t, fragment_size), "1024" }, + { "include_length", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, include_length), "yes" }, + { "check_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_crl), "no" }, ++#ifdef X509_V_FLAG_CRL_CHECK_ALL ++ { "check_all_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_all_crl), "no" }, ++#endif + { "allow_expired_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, allow_expired_crl), NULL }, + { "check_cert_cn", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, check_cert_cn), NULL }, + { "cipher_list", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, cipher_list), NULL }, +@@ -2104,6 +2107,10 @@ static X509_STORE *init_revocation_store(fr_tls_server_conf_t *conf) + if (conf->check_crl) + X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); + #endif ++#ifdef X509_V_FLAG_CRL_CHECK_ALL ++ if (conf->check_all_crl) ++ X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK_ALL); ++#endif + return store; + } + #endif /* HAVE_OPENSSL_OCSP_H */ +@@ -2591,6 +2598,11 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client) + return NULL; + } + X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK); ++ ++#ifdef X509_V_FLAG_CRL_CHECK_ALL ++ if (conf->check_all_crl) ++ X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK_ALL); ++#endif + } + #endif + -- cgit v1.2.3