From patchwork Fri Jul 21 20:51:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 7009 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4R71vL0YHnz3whs for ; Fri, 21 Jul 2023 20:51:58 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature ECDSA (secp384r1)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4R71vG3xZ8z1Rm; Fri, 21 Jul 2023 20:51:54 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4R71vG3SWGz2yXN; Fri, 21 Jul 2023 20:51:54 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4R71vC2Nfvz2y1C for ; Fri, 21 Jul 2023 20:51:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4R71vB2dMKz1Rm; Fri, 21 Jul 2023 20:51:50 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1689972710; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JOtRp6BkmzrqTAJHdelr5mxYDrO0QTaC/DsCUdclRs4=; b=g1dL50H4daP3CtgnRLPpHA81cHz3/XcTrCwAuK2uU7VqQ3zKjMht7lf0Rj7UNlAX36zvhw TEbDdI1NhWSKAUAg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1689972710; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JOtRp6BkmzrqTAJHdelr5mxYDrO0QTaC/DsCUdclRs4=; b=rpzIEA2AObRH6XD60aWaIGb/rqbVQl8CH8+uMfQQxC8vnuMPcWd4brnwwJvCf2K59mA2WR Qo5KaRYSD7FpjvDOD7uFjYRHVK5K2zzp/ZgeseUmJ6OsX4wiNIxxM/cQyG6Ofa+o7gESCF /8cuFOijcWSt9uNhxDhM/tlRmQ+iulyJYSuGq2i9/gFYpxok6NZxNmx7yicaFD7v6NuIg5 8c9i7PXh9y/Azq3HYURhZ4zAyalSYlftglNkFiZ9G0hq8hBJeyzFzPHnopDqlso8Y4Yvwj b3zTkipUK9MECazpwqfhIOKKWEoEBrOVjeKW/XQ9rHEsKZ5ZkDWmQ08jVcjdLw== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] freeradius: Update to version 3.2.3 Date: Fri, 21 Jul 2023 22:51:39 +0200 Message-ID: <20230721205144.2143152-3-adolf.belka@ipfire.org> In-Reply-To: <20230721205144.2143152-1-adolf.belka@ipfire.org> References: <20230721205144.2143152-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from version 3.0.26 to 3.2.3 - Update of rootfile - Changelog 3.2.3 Feature Improvements Add "max_retries" for connection pools. Fixes #4908. Patch from Nick Porter. Update dictionary.ciena, dictionary.huawei, dictionary.wifialliance and dictionary.wispr; add dictionary.eleven. You can now list "eap" in the "pre-proxy" section. If the packet contains a malformed EAP message, then the request will be rejected The home server will either reject (or discard) this packet anyways, so this change can only help with large proxy scenarios. Show warnings if libldap is not using OpenSSL. Support RADIUS/1.1. See https://datatracker.ietf.org/doc/draft-dekok-radext-radiusv11/ Disabled by default, can be enabled by passing `--with-radiusv11` to the configure script. For now, this is for testing interoperability. Add extra sanity checks for malformed EAP attributes. More TLS debugging output. Clear old module instance data before HUP reload. Avoids burst memory use when e.g. using large data files with rlm_files. Patch from Nick Porter. `rlm_cache_redis` is now included in the freeradius-redis packages. Separate out python2/python3 in Debian Packages. Previously python 2 or 3 was built depending on the system default which led to confusion. We now build both freeradius-python2 and freeradius-python3 packages where possible. Bug Fixes Don't leak MD contexts with OpenSSL 3.0. Increase internal buffer size for TLS connections, which can help with high-load proxies. Send Status-Server checks for TLS connections. Give descriptive error if "update CoA" is used with "fake" packets, as it won't work. i.e. inner-tunnel and virtual home servers. Many small ASAN / LSAN fixes from Jorge Pereira. Close inbound RADIUS/TLS socket on TLS errors. When a home server sees a TLS error, it will now close the socket, so proxies do not have an open (but dead) TLS connection. Fix mutex locking issues on inbound RADIUS/TLS connections This change avoids random issues with "bad record mac". Improve REST encoding loop. Patch from Herwin Weststrate. Closes #4950. Correctly report the LDAP group a user was found in. Fixes #3084 Patch from Nick Porter. Force correct packet type when running Post-Auth-Type. Helps with #4980. Fix small leak in Client-Lost code. Patch from Terry Burton. PR #4996. Fix TCP socket statistics. Closes #4990. Use NAS-Port-Id instead of NAS-Port during SQL simultaneous-use checks. Helps with #5010. 3.2.2 Feature Improvements The "configure" process now gives a much clearer report when it's finished. Patches by Matthew Newton. Fallback to "uname -n" on missing "hostname". Fixes #4771. Export thread details in radmin "stats threads". Fixes #4770. Improve queries for processing radacct into periodic usage data Fix from Nick Porter. Update dictionary.juniper. Add dictionary.calix. Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be "octets". Update documentation for robust-proxy-accounting, and be more aggressive about sending packets. Add per-module README.md files in the source. Add default Visual Studio configuration for developers. Postgres can now automatically use alternate queries for errors other than duplicate keys. %{listen:TLS-PSK-Identity} is now set when using PSK and psk_query This helps the server track the identity of the client which is connecting. Include thread stats in Status-Server attributes. Fixes #4870. Mark rlm_unbound stable and add to packages. Patches by Nick Porter. Remove broken/unsupported Dockerfiles for centos8 and debian9. Ensure Docker containers have stable uid/gid. Patches from Terry Burton. Bug Fixes Preliminary support for non-blocking TLS sockets. Helps with #3501. Fix support for partial certificate chains after adding reload support. Fixes #4753. Fix handling of debug_condition. Clean up home server states, and re-sync with the dictionaries. Correct certificate order when creating TLS-* attributes Fixes #4785. Update use of isalpha() etc. so broken configurations have less impact on the server. Outgoing TLS sockets now set SNI correctly from the "hostname" configuration item. Support Apple Homebrew on the M1. Fixes #4754. Better error messages when %{listen:TLS-...} is used. Getting statistics via Status-Server can now be done within a virtual server. Fixes #4868. Make TTLS+MS-CHAP work with TLS 1.3. Fixes #4878. Fix md5 xlat memory leak when using OpenSSL 3. Fix by Terry Burton. 3.2.1 Feature Improvements Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries,. Add simultaneous-use queries for MS SQL. Add radmin command for "stats pool " Which prints out statistics about the connection pools. Client statistics now shows "conflicts", to count conflicting packets. New optional "lightweight accounting-on/off" strategy. When refreshing queries.conf you should also add the new nasreload table and corresponding GRANTs to your DB schema. Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with Eduroam. Suggested by Stefan Winter. Allow auth+acct for TCP sockets, too. Add rlm_cache_redis. See raddb/mods-available/cache for details. Allow radmin to look up home servers by name, too. Ensure that dynamic clients don't create loops on duplicates Reported by Sam Yee. Removed rlm_sqlhpwippool. There was no documentation, no configuration, and the module was ~15 years old with no one using it. Marked rlm_python3 as stable. Add sigalgs_list. See raddb/mods-available/eap. Patch from Boris Lytochkin. For rlm_linelog, when opening files in /dev, look at "permissions" to see whether to open them r/w. More flexibility for dynamic home servers. See doc/configuration/dynamic_home_servers.md and raddb/home_servers/README.md. Allow setting of application_name for PostgreSQL. See mods-available/sql. Bug Fixes Correct test for open sessions in radacct for MS SQL. The linelog module now opens /dev/stdout in "write-only" mode if the permissions are set to "u+w" (0002). Various fixes to rlm_unbound from Nick Porter. PEAP now correctly runs Post-Auth-Type Accept. Create "TLS-Cert-*" for outbound Radsec, instead of TLS-Client-Cert-* Fixes #4698. See sites-available/tls, and fix_cert_order. Minor updates and fixes to CI, Dockerfiles and packaging. Fix rlm_python3 build with python >= 3.10. Fixes #4441. 3.2.0 Feature Improvements All features from 3.0.x are included in the 3.2.x releases. In addition:. Add 'reset_day' and '%%r' parameter for rlm_sqlcounter to specify which day of the month the counter should be reset. Partial backport of rlm_json from v4, providing the json_encode xlat See mods-available/json for documentation. Support for haproxy "PROXY" protocol See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/. Support for sending CoA-Request and Disconnect-Request packets in "reverse" down RadSec tunnels. Experimental for now, and undocumented. It is now possible to run a virtual server when saving / loading TLS cache attributes. See sites-available/tls-cache for more information. Removed the "cram" module. It was undocumented, and used old and insecure authentication methods. Remove the "otp" module. The "otpd" program it needs is no longer available, and the module has not been usable since at least 2015. All features from 3.0.x are included in the 3.2.x releases. 3.2.0 requires OpenSSL 1.0.2 or greater. Bug Fixes All bug fixes from 3.0.x are included in the 3.2.x releases. Signed-off-by: Adolf Belka --- config/rootfiles/packages/freeradius | 38 ++++++++++++++++++++++------ lfs/freeradius | 6 ++--- 2 files changed, 33 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/packages/freeradius b/config/rootfiles/packages/freeradius index 2e78e3787..899bfa139 100644 --- a/config/rootfiles/packages/freeradius +++ b/config/rootfiles/packages/freeradius @@ -45,6 +45,7 @@ etc/raddb #etc/raddb/mods-available/idn #etc/raddb/mods-available/inner-eap #etc/raddb/mods-available/ippool +#etc/raddb/mods-available/json #etc/raddb/mods-available/krb5 #etc/raddb/mods-available/ldap #etc/raddb/mods-available/ldap_google @@ -56,7 +57,6 @@ etc/raddb #etc/raddb/mods-available/mschap #etc/raddb/mods-available/ntlm_auth #etc/raddb/mods-available/opendirectory -#etc/raddb/mods-available/otp #etc/raddb/mods-available/pam #etc/raddb/mods-available/pap #etc/raddb/mods-available/passwd @@ -104,6 +104,11 @@ etc/raddb #etc/raddb/mods-config/preprocess #etc/raddb/mods-config/preprocess/hints #etc/raddb/mods-config/preprocess/huntgroups +#etc/raddb/mods-config/python3 +#etc/raddb/mods-config/python3/example.py +#etc/raddb/mods-config/python3/radiusd.py +#etc/raddb/mods-config/realm +#etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh #etc/raddb/mods-config/sql #etc/raddb/mods-config/sql/counter #etc/raddb/mods-config/sql/counter/mysql @@ -213,7 +218,8 @@ etc/raddb #etc/raddb/mods-config/sql/main/postgresql/schema.sql #etc/raddb/mods-config/sql/main/postgresql/setup.sql #etc/raddb/mods-config/sql/main/sqlite -#etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh +#etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl +#etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh #etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql #etc/raddb/mods-config/sql/main/sqlite/queries.conf #etc/raddb/mods-config/sql/main/sqlite/schema.sql @@ -276,6 +282,7 @@ etc/raddb #etc/raddb/radiusd.conf #etc/raddb/sites-available #etc/raddb/sites-available/README +#etc/raddb/sites-available/aws-nlb #etc/raddb/sites-available/buffered-sql #etc/raddb/sites-available/challenge #etc/raddb/sites-available/channel_bindings @@ -299,6 +306,7 @@ etc/raddb #etc/raddb/sites-available/soh #etc/raddb/sites-available/status #etc/raddb/sites-available/tls +#etc/raddb/sites-available/tls-cache #etc/raddb/sites-available/totp #etc/raddb/sites-available/virtual.example.com #etc/raddb/sites-available/vmps @@ -433,9 +441,6 @@ usr/lib/freeradius/rlm_chap.so #usr/lib/freeradius/rlm_counter.a #usr/lib/freeradius/rlm_counter.la usr/lib/freeradius/rlm_counter.so -#usr/lib/freeradius/rlm_cram.a -#usr/lib/freeradius/rlm_cram.la -usr/lib/freeradius/rlm_cram.so #usr/lib/freeradius/rlm_date.a #usr/lib/freeradius/rlm_date.la usr/lib/freeradius/rlm_date.so @@ -496,6 +501,9 @@ usr/lib/freeradius/rlm_files.so #usr/lib/freeradius/rlm_ippool.a #usr/lib/freeradius/rlm_ippool.la usr/lib/freeradius/rlm_ippool.so +#usr/lib/freeradius/rlm_json.a +#usr/lib/freeradius/rlm_json.la +usr/lib/freeradius/rlm_json.so #usr/lib/freeradius/rlm_krb5.a #usr/lib/freeradius/rlm_krb5.la usr/lib/freeradius/rlm_krb5.so @@ -511,9 +519,6 @@ usr/lib/freeradius/rlm_logintime.so #usr/lib/freeradius/rlm_mschap.a #usr/lib/freeradius/rlm_mschap.la usr/lib/freeradius/rlm_mschap.so -#usr/lib/freeradius/rlm_otp.a -#usr/lib/freeradius/rlm_otp.la -usr/lib/freeradius/rlm_otp.so #usr/lib/freeradius/rlm_pam.a #usr/lib/freeradius/rlm_pam.la usr/lib/freeradius/rlm_pam.so @@ -529,6 +534,9 @@ usr/lib/freeradius/rlm_perl.so #usr/lib/freeradius/rlm_preprocess.a #usr/lib/freeradius/rlm_preprocess.la usr/lib/freeradius/rlm_preprocess.so +#usr/lib/freeradius/rlm_python3.a +#usr/lib/freeradius/rlm_python3.la +usr/lib/freeradius/rlm_python3.so #usr/lib/freeradius/rlm_radutmp.a #usr/lib/freeradius/rlm_radutmp.la usr/lib/freeradius/rlm_radutmp.so @@ -567,6 +575,9 @@ usr/lib/freeradius/rlm_sqlippool.so #usr/lib/freeradius/rlm_totp.a #usr/lib/freeradius/rlm_totp.la usr/lib/freeradius/rlm_totp.so +#usr/lib/freeradius/rlm_unbound.a +#usr/lib/freeradius/rlm_unbound.la +usr/lib/freeradius/rlm_unbound.so #usr/lib/freeradius/rlm_unix.a #usr/lib/freeradius/rlm_unix.la usr/lib/freeradius/rlm_unix.so @@ -620,6 +631,13 @@ usr/sbin/radmin #usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/policy_subnet_options.adoc #usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/prepare.adoc #usr/share/doc/freeradius/antora/modules/howto/pages/protocols/dhcp/test.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/enable_proxy_protocol.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/enable_radsec.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/index.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/radsec_client.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/radsec_with_haproxy.adoc +#usr/share/doc/freeradius/antora/modules/howto/pages/protocols/proxy/radsec_with_traefik.adoc #usr/share/doc/freeradius/antora/modules/installation #usr/share/doc/freeradius/antora/modules/installation/nav.adoc #usr/share/doc/freeradius/antora/modules/installation/pages @@ -708,6 +726,7 @@ usr/sbin/radmin #usr/share/doc/freeradius/deployment/supervise-radiusd.rst #usr/share/doc/freeradius/deployment/tuning_guide #usr/share/doc/freeradius/developer +#usr/share/doc/freeradius/developer/autotools.md #usr/share/doc/freeradius/developer/coding-methods.rst #usr/share/doc/freeradius/developer/contributing.rst #usr/share/doc/freeradius/developer/module_interface.rst @@ -882,6 +901,7 @@ usr/share/freeradius #usr/share/freeradius/dictionary.bt #usr/share/freeradius/dictionary.cablelabs #usr/share/freeradius/dictionary.cabletron +#usr/share/freeradius/dictionary.calix #usr/share/freeradius/dictionary.cambium #usr/share/freeradius/dictionary.camiant #usr/share/freeradius/dictionary.centec @@ -909,6 +929,7 @@ usr/share/freeradius #usr/share/freeradius/dictionary.dlink #usr/share/freeradius/dictionary.dragonwave #usr/share/freeradius/dictionary.efficientip +#usr/share/freeradius/dictionary.eleven #usr/share/freeradius/dictionary.eltex #usr/share/freeradius/dictionary.epygi #usr/share/freeradius/dictionary.equallogic @@ -1104,6 +1125,7 @@ usr/share/freeradius #usr/share/man/man5/rlm_passwd.5 #usr/share/man/man5/rlm_realm.5 #usr/share/man/man5/rlm_sql.5 +#usr/share/man/man5/rlm_unbound.5 #usr/share/man/man5/rlm_unix.5 #usr/share/man/man5/unlang.5 #usr/share/man/man5/users.5 diff --git a/lfs/freeradius b/lfs/freeradius index f6740c280..5ce1a2528 100644 --- a/lfs/freeradius +++ b/lfs/freeradius @@ -26,7 +26,7 @@ include Config SUMMARY = RADIUS Server -VER = 3.0.26 +VER = 3.2.3 THISAPP = freeradius-server-$(VER) DL_FILE = $(THISAPP).tar.bz2 @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = freeradius -PAK_VER = 18 +PAK_VER = 19 DEPS = libtalloc samba @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = db9e092399ddf0fab1a8e935f867cc48155bd211741a30edd97647ea1bb1c531d0580c71908db71576e76f7ffa833ecd7355db92f20428f653a2cfd8d5a233b1 +$(DL_FILE)_BLAKE2 = 525204331a5b123dac7457c6adb755cbe9794dbff4a536ea665fc7d1cac97553e392b7b598741c2a9dd00c81decd00608499d6f25208e389b9f213f54977de84 install : $(TARGET)