diff options
Diffstat (limited to 'testing')
| -rw-r--r-- | testing/freeradius3/APKBUILD | 224 | ||||
| -rw-r--r-- | testing/freeradius3/disable-cert-generation.patch | 34 | ||||
| -rw-r--r-- | testing/freeradius3/fix-potential-crash-with-SSHA-and-salts.patch | 48 | ||||
| -rw-r--r-- | testing/freeradius3/freeradius3-301-default-config.patch | 88 | ||||
| -rw-r--r-- | testing/freeradius3/freeradius3.confd | 5 | ||||
| -rw-r--r-- | testing/freeradius3/freeradius3.initd | 27 | ||||
| -rw-r--r-- | testing/freeradius3/freeradius3.pre-install | 6 |
7 files changed, 432 insertions, 0 deletions
diff --git a/testing/freeradius3/APKBUILD b/testing/freeradius3/APKBUILD new file mode 100644 index 000000000..1f2e602c6 --- /dev/null +++ b/testing/freeradius3/APKBUILD @@ -0,0 +1,224 @@ +# Contributor: Natanael Copa <ncopa@alpinelinux.org> +# Maintainer: Leonardo Arena <rnalrd@alpinelinux.org> +pkgname=freeradius3 +_realname=freeradius +pkgver=3.0.1 +pkgrel=0 +pkgdesc="RADIUS (Remote Authentication Dial-In User Service) server" +url="http://freeradius.org/" +arch="all" +license="GPL" +depends="freeradius3-lib" +makedepends="openssl-dev mysql-dev postgresql-dev gdbm-dev readline-dev + bash libtool autoconf automake perl-dev python-dev openldap-dev + unixodbc-dev linux-pam-dev sqlite-dev talloc-dev libpcap-dev" +pkggroups="radius" +pkgusers="radius" +install="$pkgname.pre-install" +subpackages="$pkgname-doc $pkgname-dev $pkgname-dbg $pkgname-ldap $pkgname-lib + $pkgname-mssql $pkgname-mysql $pkgname-sql $pkgname-perl + $pkgname-postgresql $pkgname-python $pkgname-radclient $pkgname-sqlite + $pkgname-unixodbc $pkgname-pam $pkgname-eap" +source="ftp://ftp.freeradius.org/pub/freeradius/$_realname-server-$pkgver.tar.gz + $pkgname.confd + $pkgname.initd + fix-potential-crash-with-SSHA-and-salts.patch + disable-cert-generation.patch + freeradius3-301-default-config.patch + " +conflict="freeradius freeradius-lib freeradius-radclient" + +_builddir="$srcdir"/$_realname-server-$pkgver + +radconfdir="/etc/raddb" +radmodsdir="$radconfdir/mods-available" +radlibdir="/usr/lib/freeradius" +radmodsconfdir="$radconfdir/mods-config" + +prepare() { + cd "$_builddir" + for i in $source; do + case $i in + *.patch) + msg "Applying $i" + patch -p1 -i "$srcdir"/$i || return 1 + ;; + esac + done + update_config_sub || return 1 +} + +build() { + cd "$_builddir" + ./configure \ + --build=$CBUILD \ + --host=$CHOST \ + --prefix=/usr \ + --sysconfdir=/etc \ + --mandir=/usr/share/man \ + --infodir=/usr/share/info \ + --localstatedir=/var \ + --datarootdir=/usr/share \ + --libdir="$radlibdir" \ + --with-logdir=/var/log/radius \ + --with-radacctdir=/var/log/radius/radacct \ + --with-system-libtool \ + --with-system-libltdl \ + --with-shared-libs \ + --with-udpfromto \ + --with-rlm_sql_sqlite \ + --with-rlm_sql_postgresql \ + --with-rlm_sql_mysql \ + --without-rlm_krb5 \ + --without-rlm_eap_tnc \ + --without-rlm_eap_ikev2 \ + --without-rlm_sql_iodbc \ + --without-rlm_sql_oracle \ + --without-rlm_yubikey \ + --without-rlm_ykclient \ + || return 1 + + make LDFLAGS="$LDFLAGS -lssl" || return 1 +} + +package() { + cd "$_builddir" + install -d -m0750 -o root -g radius "${pkgdir}"${radconfdir} || exit 1 + install -d -m0750 -o radius -g radius "$pkgdir"/var/run/radius || exit 1 + install -d -m0750 -o radius -g radius "$pkgdir"/var/log/radius || exit 1 + install -d -m0750 -o radius -g radius "$pkgdir"/var/log/radius/radacct || exit 1 + + make R="$pkgdir" install + chown -R root:radius "$pkgdir"/etc/raddb/* + rm -f "$pkgdir"/usr/sbin/rc.radiusd + install -m755 -D "$srcdir"/$pkgname.initd "$pkgdir"/etc/init.d/radiusd || exit 1 + install -m644 -D "$srcdir"/$pkgname.confd "$pkgdir"/etc/conf.d/radiusd || exit 1 + #Install misses to create this + mkdir -p "${pkgdir}"${radmodsconfdir}/sql/ippool-dhcp/postgresql + find "$pkgdir" -iname *.la -delete +} + +_mvdb() { + for dir in ippool-dhcp ippool counter main cui; do + mkdir -p "${subpkgdir}"${radmodsconfdir}/sql/$dir + mv "${pkgdir}"${radmodsconfdir}/sql/$dir/$1 \ + "${subpkgdir}"${radmodsconfdir}/sql/$dir || exit 1 + done + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_sql_${1}.so "${subpkgdir}"${radlibdir} || exit 1 +} + +eap() { + depends="freeradius3" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_eap*.so "${subpkgdir}"${radlibdir} || exit 1 + mkdir -p "${subpkgdir}"${radmodsdir} + mv "${pkgdir}"${radmodsdir}/eap "${subpkgdir}"${radmodsdir} || exit 1 +} + +ldap() { + depends="freeradius3" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_ldap* "${subpkgdir}"${radlibdir} || exit 1 +} + +lib() { + depends="" + mkdir -p "${subpkgdir}"${radlibdir} "${subpkgdir}"${radconfdir} \ + "$subpkgdir"/usr/share || exit 1 + mv "${pkgdir}"${radlibdir}/libfreeradius-*.so \ + "${subpkgdir}"${radlibdir} || exit 1 +} + +sql() { + depends="freeradius3" + mkdir -p "${subpkgdir}"${radlibdir} + for lib in sql sqlippool sql_null sqlcounter; do + mv "${pkgdir}"${radlibdir}/rlm_${lib}.so "${subpkgdir}"${radlibdir} || exit 1 + done + mkdir -p "${subpkgdir}"${radconfdir}/sites-available + mv "${pkgdir}"${radconfdir}/sites-available/buffered-sql \ + "${subpkgdir}"${radconfdir}/sites-available || exit 1 + mkdir -p "${subpkgdir}"${radmodsdir} + mv "${pkgdir}"${radmodsdir}/*sql* "${subpkgdir}"${radmodsdir} || exit 1 +} + +mysql() { + depends="freeradius3-sql" + _mvdb mysql || exit 1 +} + +mssql() { + depends="freeradius3-sql" + arch="noarch" + mkdir -p "${subpkgdir}"${radmodsconfdir}/sql/main + mv "${pkgdir}"${radmodsconfdir}/sql/main/mssql \ + "${subpkgdir}"${radmodsconfdir}/sql/main || exit 1 +} + +perl() { + depends="freeradius3 perl" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_perl* "${subpkgdir}"${radlibdir} || exit 1 + mkdir -p "$subpkgdir"/usr/bin + mv "$pkgdir"/usr/sbin/checkrad "$subpkgdir"/usr/bin/checkrad || exit 1 + mkdir -p "${subpkgdir}"${radconfdir}/mods-available + mv "${pkgdir}"${radconfdir}/mods-available/perl "${subpkgdir}"${radconfdir}/mods-available/perl || exit 1 +} + +postgresql() { + depends="freeradius3-sql" + _mvdb postgresql || exit 1 +} + +python() { + depends="freeradius3 python" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_python* "${subpkgdir}"${radlibdir} || exit 1 + for dir in $radmodsdir $radmodsconfdir; do + mkdir -p "${subpkgdir}"$dir + mv "${pkgdir}"$dir/python "${subpkgdir}"$dir || exit 1 + done +} + +radclient() { + depends="" + mkdir -p "$subpkgdir"/usr/bin + mv "$pkgdir"/usr/bin/radclient "$subpkgdir"/usr/bin/radclient || exit 1 +} + +sqlite() { + depends="freeradius3-sql" + _mvdb sqlite || exit 1 +} + +unixodbc() { + depends="freeradius3" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_sql_unixodbc.so "${subpkgdir}"${radlibdir} || exit 1 +} + +pam() { + depends="freeradius3" + mkdir -p "${subpkgdir}"${radlibdir} + mv "${pkgdir}"${radlibdir}/rlm_pam* "${subpkgdir}"${radlibdir} || exit 1 +} + +md5sums="552f375530252c4567ee11c1b23bbbe9 freeradius-server-3.0.1.tar.gz +fc6693f3df5a0694610110287a28568a freeradius3.confd +3a50b7f233e74daf3f87da63b3e9579d freeradius3.initd +4780cb9da2b16b0db51d95ce30e7c4a6 fix-potential-crash-with-SSHA-and-salts.patch +8696554123f7ee87b44f1fa5dc699dd1 disable-cert-generation.patch +53b74f75456427a27df9f3489706ae3e freeradius3-301-default-config.patch" +sha256sums="caba74385d574fe5257f9479e59a882e7adfa02c756693451fd2e99e69a0af42 freeradius-server-3.0.1.tar.gz +2d5b3e1af1299373182f2c8021bdf45c29db5d82b0a077b965a16ded32cb6292 freeradius3.confd +e173cce3b8a4c2ed4d1fdd58fff8ec21e9166f011ec052f5f4c01712493e72b3 freeradius3.initd +fc317518af37a09ac5ac7bba27b50e599bd90b2c772f75f57c00de56dbbd0f70 fix-potential-crash-with-SSHA-and-salts.patch +8d9b48a56b8638412249c05749725dbd230568d3b7c3eecc97bb46f1815f5b3d disable-cert-generation.patch +472279b7831ea85a9d0a2237af8ee0c3235d01c53c08c6152633e6699f6c7990 freeradius3-301-default-config.patch" +sha512sums="09bdce706ad839f9eba2407ad4d9770777655f33b0d40b07d80ca727b52ae49f1b6b15a5e66d088a1a5288fad46e94830552e7d6dc6e5e0833a743e862297c22 freeradius-server-3.0.1.tar.gz +e248159c0a44f722e405c51c8015d9ad672e42ad0d38ca28f8a051ff911aa4d3e630b9bd4543e9d610940bc4ae50c022594e219ce341b36abe85c572acad418b freeradius3.confd +b29bf9090a2be7af77a3e104346a23024baf78a343e7f2fd6f6ddb02c223ac66d9b77c80d02b2cb26cbef2e64cb59c46462bb54b063b862e5a3a61c72653a63d freeradius3.initd +429e50d18b5657e07ac4fcdd9d00c3936f04b7e60d9785aae4cdb8c3cecc81fc7e3fc3fc3152fea1c475cead7ecf42e81d63d69677ee912833a8c4069e3fe793 fix-potential-crash-with-SSHA-and-salts.patch +d46c94ec7245dbcdcb6fe321956b305eedf5481f2d533556c6fe127318dadc1dbe25be2bf694adef2160ea02e8fa138371300eae264e854bc658d73f1c135867 disable-cert-generation.patch +459e47b74c4340edecd544bdb5e0b0720975c2aa7697d2237044812b7d42adb2818d1846b20af77f330972f77ae10f584c8767409202f3e39b2654ee31fd96ab freeradius3-301-default-config.patch" diff --git a/testing/freeradius3/disable-cert-generation.patch b/testing/freeradius3/disable-cert-generation.patch new file mode 100644 index 000000000..771787dc3 --- /dev/null +++ b/testing/freeradius3/disable-cert-generation.patch @@ -0,0 +1,34 @@ +--- a/Makefile ++++ b/Makefile +@@ -28,7 +28,6 @@ + # Run "radiusd -C", looking for errors. + # + $(BUILD_DIR)/tests/radiusd-c: ${BUILD_DIR}/bin/radiusd | build.raddb +- @$(MAKE) -C raddb/certs + @if ! ./build/make/jlibtool --mode=execute ./build/bin/radiusd -XCMd ./raddb -n debug -D ./share > $(BUILD_DIR)/tests/radiusd.config.log 2>&1; then \ + cat $(BUILD_DIR)/tests/radiusd.config.log; \ + echo "FAIL: radiusd -C"; \ +@@ -205,13 +204,6 @@ + .PHONY: TAGS + TAGS: + etags `find src -type f -name '*.[ch]' -print` > $@ +- +-# +-# Make test certificates. +-# +-.PHONY: certs +-certs: +- @cd raddb/certs && $(MAKE) + + ###################################################################### + # +--- a/raddb/all.mk ++++ b/raddb/all.mk +@@ -114,7 +114,6 @@ + + $(LOCAL_CERT_PRODUCTS): + @echo BOOTSTRAP raddb/certs/ +- @$(MAKE) -C $(R)$(raddbdir)/certs/ + + # Bootstrap is special + $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS) diff --git a/testing/freeradius3/fix-potential-crash-with-SSHA-and-salts.patch b/testing/freeradius3/fix-potential-crash-with-SSHA-and-salts.patch new file mode 100644 index 000000000..29c1a27f2 --- /dev/null +++ b/testing/freeradius3/fix-potential-crash-with-SSHA-and-salts.patch @@ -0,0 +1,48 @@ +From ff5147c9e5088c7cf5c0b6ec6bfdd3a9d2042a28 Mon Sep 17 00:00:00 2001 +From: Arran Cudbard-Bell <a.cudbardb@freeradius.org> +Date: Thu, 13 Feb 2014 13:49:54 +0000 +Subject: [PATCH] Fix potential crash with SSHA and salts > 44bytes + +--- + src/modules/rlm_pap/rlm_pap.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c +index 689acf0..1bf6d4e 100644 +--- a/src/modules/rlm_pap/rlm_pap.c ++++ b/src/modules/rlm_pap/rlm_pap.c +@@ -123,7 +123,7 @@ static int mod_instantiate(CONF_SECTION *conf, void *instance) + static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) + { + +- uint8_t buffer[64]; ++ uint8_t buffer[256]; + + if (min_length >= sizeof(buffer)) return; /* paranoia */ + +@@ -132,9 +132,10 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) + */ + if (vp->length >= (2 * min_length)) { + size_t decoded; +- decoded = fr_hex2bin(buffer, vp->vp_strvalue, vp->length >> 1); ++ decoded = fr_hex2bin(buffer, vp->vp_strvalue, sizeof(buffer)); + if (decoded == (vp->length >> 1)) { +- RDEBUG2("Normalizing %s from hex encoding", vp->da->name); ++ RDEBUG2("Normalizing %s from hex encoding, %zu bytes -> %zu bytes", ++ vp->da->name, vp->length, decoded); + pairmemcpy(vp, buffer, decoded); + return; + } +@@ -150,7 +151,8 @@ static void normify(REQUEST *request, VALUE_PAIR *vp, size_t min_length) + sizeof(buffer)); + if (decoded < 0) return; + if (decoded >= (ssize_t) min_length) { +- RDEBUG2("Normalizing %s from base64 encoding", vp->da->name); ++ RDEBUG2("Normalizing %s from base64 encoding, %zu bytes -> %zu bytes", ++ vp->da->name, vp->length, decoded); + pairmemcpy(vp, buffer, decoded); + return; + } +-- +1.8.5.5 + diff --git a/testing/freeradius3/freeradius3-301-default-config.patch b/testing/freeradius3/freeradius3-301-default-config.patch new file mode 100644 index 000000000..630887932 --- /dev/null +++ b/testing/freeradius3/freeradius3-301-default-config.patch @@ -0,0 +1,88 @@ +--- a/raddb/radiusd.conf.in ++++ b/raddb/radiusd.conf.in +@@ -376,8 +376,8 @@ + # member. This can allow for some finer-grained access + # controls. + # +-# user = radius +-# group = radius ++ user = radius ++ group = radius + + # Core dumps are a bad thing. This should only be set to + # 'yes' if you're debugging a problem with the server. +--- a/raddb/sites-available/default ++++ b/raddb/sites-available/default +@@ -314,9 +314,9 @@ + # for the many packets that go back and forth to set up TTLS + # or PEAP. The load on those servers will therefore be reduced. + # +- eap { +- ok = return +- } ++# eap { ++# ok = return ++# } + + # + # Pull crypt'd passwords from /etc/passwd or /etc/shadow, +@@ -457,7 +457,7 @@ + + # + # Allow EAP authentication. +- eap ++# eap + + # + # The older configurations sent a number of attributes in +@@ -748,7 +748,7 @@ + # Insert EAP-Failure message if the request was + # rejected by policy instead of because of an + # authentication failure +- eap ++# eap + + # Remove reply message if the response contains an EAP-Message + remove_reply_message_if_eap +@@ -817,7 +817,7 @@ + # hidden inside of the EAP packet, and the end server will + # reject the EAP request. + # +- eap ++# eap + + # + # If the server tries to proxy a request and fails, then the +--- a/raddb/sites-available/inner-tunnel ++++ b/raddb/sites-available/inner-tunnel +@@ -116,9 +116,9 @@ + # for the many packets that go back and forth to set up TTLS + # or PEAP. The load on those servers will therefore be reduced. + # +- eap { +- ok = return +- } ++# eap { ++# ok = return ++# } + + # + # Read the 'users' file +@@ -227,7 +227,7 @@ + + # + # Allow EAP authentication. +- eap ++# eap + } + + ###################################################################### +@@ -380,7 +380,7 @@ + # hidden inside of the EAP packet, and the end server will + # reject the EAP request. + # +- eap ++# eap + + # + # If the server tries to proxy a request and fails, then the diff --git a/testing/freeradius3/freeradius3.confd b/testing/freeradius3/freeradius3.confd new file mode 100644 index 000000000..9811289ba --- /dev/null +++ b/testing/freeradius3/freeradius3.confd @@ -0,0 +1,5 @@ +# Config file for /etc/init.d/radiusd + +# see man pages for radiusd run `radiusd -h` +# for valid cmdline options +#RADIUSD_OPTS="" diff --git a/testing/freeradius3/freeradius3.initd b/testing/freeradius3/freeradius3.initd new file mode 100644 index 000000000..251f34ff0 --- /dev/null +++ b/testing/freeradius3/freeradius3.initd @@ -0,0 +1,27 @@ +#!/sbin/runscript + +extra_started_commands="reload" +run_dir="/var/run/radiusd" +command="/usr/sbin/radiusd" +command_args="$RADIUSD_OPTS" +pidfile="$run_dir/radiusd.pid" +name="Freeradius" +conf="/etc/raddb/radiusd.conf" +user="$(grep -v '#' $conf | grep 'user =' | awk -F " = " '{ print $2 }')" +group="$(grep -v '#' $conf |grep 'group =' | awk -F " = " '{ print $2 }')" + +depend() { + need net + after firewall + use dns +} + +start_pre() { + checkpath --directory --owner ${user}:${group} --mode 0775 ${run_dir} +} + +reload () { + ebegin "Reloading $name" + kill -HUP `cat $pidfile` + eend $? +} diff --git a/testing/freeradius3/freeradius3.pre-install b/testing/freeradius3/freeradius3.pre-install new file mode 100644 index 000000000..30ff04814 --- /dev/null +++ b/testing/freeradius3/freeradius3.pre-install @@ -0,0 +1,6 @@ +#!/bin/sh + +addgroup radius 2>/dev/null +adduser -S -G radius -h /var/log/radius -s /sbin/nologin -D radius 2>/dev/null +exit 0 + |