Commit Graph

21 Commits

Author SHA1 Message Date
Kai Kang
601c080499 freeradius: check existence of openssl's commands in bootstrap
It calls openssl's commands 'dhparam' and 'pkcs12' in script bootstrap.
These commands are configurable based on configure options 'no-dh' and
'no-des', and may not be provided by openssl. So check existence of
these commands. If not, abort running of script bootstrap.

1. https://github.com/openssl/openssl/blob/master/apps/build.info#L37
2. https://github.com/openssl/openssl/blob/master/apps/build.info#L22

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c8ceefc5c3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-25 14:55:17 -07:00
Mingli Yu
f282f0829a freeradius: Upgrade to 3.0.21
Drop one patch at the issue is already fixed in new version
(307678b268 Fix rlm_python3 build)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ece4e7d4f0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-07 09:37:36 -07:00
Hongxu Jia
c0ccc8b901 freeradius: fix build failure with autoconf 2.71
While using autoconf 2.71, the AM_MISSING_PROG caused unexpected error:
...
configure.ac: error: required file 'missing' not found
...

Since these tools were explicitly added by autotools bbclass,
remove the testing to workaround the error with autoconf 2.7

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2021-02-07 20:38:39 -08:00
Mingli Yu
52f5141109 freeradius: fix the occasional verification failure
Fixes:
  # cd /etc/raddb/certs
  # ./bootstrap
[snip]
chmod g+r ca.key
openssl pkcs12 -in server.p12 -out server.pem -passin pass:'whatever' -passout pass:'whatever'
chmod g+r server.pem
C = FR, ST = Radius, O = Example Inc., CN = Example Server Certificate, emailAddress = admin@example.org
error 7 at 0 depth lookup: certificate signature failure
140066667427072:error:04067084:rsa routines:rsa_ossl_public_decrypt:data too large for modulus:../openssl-1.1.1g/crypto/rsa/rsa_ossl.c:553:
140066667427072:error:0D0C5006:asn1 encoding routines:ASN1_item_verify:EVP lib:../openssl-1.1.1g/crypto/asn1/a_verify.c:170:
error server.pem: verification failed
make: *** [Makefile:107: server.vrfy] Error 2

It seems the ca.pem mismatchs server.pem which results in failing to
execute "openssl verify -CAfile ca.pem server.pem", so add the logic
to check the file to avoid inconsistency.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-08-05 10:02:11 -07:00
Mingli Yu
0d7522b7df freeradius: fix the existed certificate error
Fixes the occasional error:
 # cd /etc/raddb/certs
 # ./bootstrap
[snip]
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key 'whatever' -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
Using configuration from ./client.cnf
Check that the request matches the signature
Signature ok
ERROR:There is already a certificate for /C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org
The matching entry has the following details
Type          :Valid
Expires on    :200908024833Z
Serial Number :02
File name     :unknown
Subject Name  :/C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org
make: *** [Makefile:128: client.crt] Error 1

Add the check to fix the above error and it does the same for server.crt.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-07-13 09:01:58 -07:00
Changqing Li
43a8ae23dc freeradius: don't download LFS content by default
fix error:
Fetcher failure: Repository
git://github.com/FreeRADIUS/freeradius-server.git has LFS content,
install git-lfs on host to download (or set lfs=0 to ignore it)

upstream has file .lfsconfig to make it not download lfs files by
default, so we also don't download it by default

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-03-26 20:36:03 -07:00
Yi Zhao
502084cc99 freeradius: upgrade 3.0.19 -> 3.0.20
* Drop backported patch:
  0001-su-to-radiusd-user-group-when-rotating-logs.patch

* Disable python2 module build and add PACKAGECONFIG for python3 module
  build

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-02-06 07:20:03 -08:00
Khem Raj
66454b26ff meta-networking: Remove using python2
This change makes the parsing go though, we still might have build
issues, which will be reported in world builds seprately

Signed-off-by: Khem Raj <raj.khem@gmail.com>
2020-01-22 09:56:34 -08:00
Yi Zhao
fb87b445df freeradius: set CLEANBROKEN
Fixed make clean error:
  NOTE: make clean
  Makefile:36: *** Missing 'Make.inc' Run './configure [options]' and retry.  Stop.
  ERROR: oe_runmake failed

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-11-01 17:22:53 -07:00
Trevor Gamblin
9ab4e11fd4 freeradius: fix PIDFile path in radiusd.service file
radiusd.service references a legacy path for its PIDFile, which
results in a warning at boot:

systemd[1]: /lib/systemd/system/radiusd.service:7: PIDFile= references a path
below legacy directory /var/run/, updating /var/run/radiusd/radiusd.pid →
/run/radiusd/radiusd.pid; please update the unit file accordingly.

Modify the recipe's radiusd.service file to use the correct path.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-21 04:41:24 -07:00
Yi Zhao
df6804c40e freeradius: fix CVE-2019-10143
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2019-10143

Patch from:
1f23377396

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-16 20:28:39 -07:00
Trevor Gamblin
5d23c6329e freeradius: add -latomic for armv5
freeradius fails to build for armv5:

| *** Warning: Linking the executable build/bin/local/radeapclient against the loadable module
| *** libfreeradius-server.so is not portable!
|
| *** Warning: Linking the executable build/bin/local/radeapclient against the loadable module
| *** libfreeradius-eap.so is not portable!
path -Wl,/yow-lpggp31/tgamblin/freeradius.build/tmp-glibc/work/armv5e-oe-linux-gnueabi/freeradius/3.0.19-r0/git/build/lib/local//.libs
/arm-oe-linux-gnueabi/9.2.0/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `__atomic_compare_exchange_8'
/arm-oe-linux-gnueabi/9.2.0/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `__atomic_load_8'
/arm-oe-linux-gnueabi/9.2.0/ld: build/lib/local/.libs/libfreeradius-radius.so: undefined reference to `__atomic_store_8'
| collect2: error: ld returned 1 exit status
| scripts/boiler.mk:630: recipe for target 'build/bin/local/radeapclient' failed

Explicitly link libatomic to fix the issue.

Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-10-08 12:54:16 -07:00
Changqing Li
870e66d5f7 freeradius: upgrade 3.0.17 -> 3.0.19
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-09-02 20:26:58 -07:00
Martin Jansa
b386c97414 freeradius: add runtime dependency on perl
* fixes:
  ERROR: QA Issue: /usr/bin/radcrypt contained in package freeradius-utils requires /usr/bin/perl, but no providers found in RDEPENDS_freeradius-utils? [file-rdeps]

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-08-17 01:42:54 -07:00
Changqing Li
50248bf143 freeradius: Add PACKAGECONFIG openssl/rlm-eap-fast/rlm-eap-pwd
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-02-28 09:42:11 -08:00
Changqing Li
07a8af9a1b freeradius: update radiusd.service
Update radiusd.service that not run script /etc/raddb/certs/bootstrap
before start radiusd. The script makes a set of default certificates. It
should be only used for test purpose.

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2019-02-27 18:26:55 -08:00
Changqing Li
9f47fcd337 freeradius: fix radiusd.service startup failed problem
during radiusd start up, it will check several CVEs of libssl,
if allow_vulnerable_openssl set to no and one of the CVEs is
matched, radiusd will not startup.

in tls.c, two CVEs's version number is wrong, and after upgrade openssl
to 1.1.1, one CVE matched, so startup failed. correct the version numner
to make radiusd startup successfully.

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-10-10 20:48:18 -07:00
Changqing Li
d4610b9d97 freeradius: upgrade 3.0.15 -> 3.0.17
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
2018-07-27 07:19:11 -07:00
Jackie Huang
417da61f88 freeradius: Upgrade to 3.0.15
* Upgrade to 3.0.15 to fix many CVE issues.
* There is a defect for disabling dhcp feature:
  https://github.com/FreeRADIUS/freeradius-server/issues/2039
  We don't need the dhcp feature but it's harmless
  to enable it, so enable it as the default.

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-09-12 10:37:18 -04:00
Khem Raj
58e9a52580 freeradius: Upgrade to 3.0.14
Fix a cross compile issue where it was looking for samba headers
in build host.

in src/modules/rlm_mschap/config.log

Fix

cc1: warning: include location "/usr/include/samba-4.0/" is unsafe for cross-compilation [-Wpoison-system-directories]

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28 10:28:44 -04:00
Jackie Huang
39e58a887b freeradius: add new recipe
FreeRADIUS is an Internet authentication daemon,
which implements the RADIUS protocol, as defined
in RFC 2865 (and others).

Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
2017-06-28 10:23:38 -04:00