freeradius3: fix CVE-2017-9148

This takes the fix for CVE-2017-9148 from Debian.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

diff --git a/net/freeradius3/Makefile b/net/freeradius3/Makefile
index 48c083536f51fc02a70488e4ddf65707d0612b18..20d1dc5e2e7d8cccbcc3b288eaed7412f51f5419 100644 (file)
--- a/net/freeradius3/Makefile
+++ b/net/freeradius3/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=freeradius3
 PKG_VERSION:=release_3_0_11
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/FreeRADIUS/freeradius-server/archive

diff --git a/net/freeradius3/patches/001-fix-cert-expiry.patch b/net/freeradius3/patches/001-fix-cert-expiry.patch
index b30b01279a2f4e4fc3c495e109c6158c3d18e47a..578bbbc0eb1e93392ac315834897c549b90d8668 100644 (file)
--- a/net/freeradius3/patches/001-fix-cert-expiry.patch
+++ b/net/freeradius3/patches/001-fix-cert-expiry.patch
@@ -22,7 +22,7 @@
  preserve              = no
 --- a/raddb/certs/server.cnf
 +++ b/raddb/certs/server.cnf
-@@ -14,7 +14,7 @@ private_key          = $dir/ca.key
+@@ -14,7 +14,7 @@ private_key          = $dir/server.key
  RANDFILE              = $dir/.rand
  name_opt              = ca_default
  cert_opt              = ca_default

diff --git a/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
new file mode 100644 (file)
index 0000000..458eeba
--- /dev/null
+++ b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
@@ -0,0 +1,47 @@
+Description: disable session caching in the server (as opposed to in the
+ config, which would be way harder to get right) to address
+ https://security-tracker.debian.org/tracker/CVE-2017-9148
+Author: Michael Stapelberg <stapelberg@debian.org>
+Forwarded: not-needed
+Last-Update: 2017-05-30
+
+---
+
+--- a/src/main/tls.c
++++ b/src/main/tls.c
+@@ -369,7 +369,7 @@ tls_session_t *tls_new_session(TALLOC_CT
+        *
+        *      FIXME: Also do it every N sessions?
+        */
+-      if (conf->session_cache_enable &&
++      if (/*conf->session_cache_enable*/0 &&
+           ((conf->session_last_flushed + ((int)conf->session_timeout * 1800)) <= request->timestamp)){
+               RDEBUG2("Flushing SSL sessions (of #%ld)", SSL_CTX_sess_number(conf->ctx));
+ 
+@@ -463,7 +463,7 @@ tls_session_t *tls_new_session(TALLOC_CT
+               state->mtu = vp->vp_integer;
+       }
+ 
+-      if (conf->session_cache_enable) state->allow_session_resumption = true; /* otherwise it's false */
++      if (/*conf->session_cache_enable*/0) state->allow_session_resumption = true; /* otherwise it's false */
+ 
+       return state;
+ }
+@@ -2675,7 +2675,7 @@ post_ca:
+       /*
+        *      Callbacks, etc. for session resumption.
+        */
+-      if (conf->session_cache_enable) {
++      if (/*conf->session_cache_enable*/0) {
+               /*
+                *      Cache sessions on disk if requested.
+                */
+@@ -2745,7 +2745,7 @@ post_ca:
+       /*
+        *      Setup session caching
+        */
+-      if (conf->session_cache_enable) {
++      if (/*conf->session_cache_enable*/0) {
+               /*
+                *      Create a unique context Id per EAP-TLS configuration.
+                */