main/freeradius: security fix for CVE-2015-4680

ref #4377
fixes #4381

(cherry picked from commit 1314c0d82fee33213ea17cc7805bdf3a60efac78)

2 files changed, 87 insertions, 4 deletions

diff --git a/main/freeradius/APKBUILD b/main/freeradius/APKBUILD
index 58952a7163..633d4c600d 100644
--- a/main/freeradius/APKBUILD
+++ b/main/freeradius/APKBUILD
@@ -5,7 +5,7 @@
 pkgname=freeradius
 _realname=freeradius
 pkgver=3.0.8
-pkgrel=6
+pkgrel=7
 pkgdesc="RADIUS (Remote Authentication Dial-In User Service) server"
 url="http://freeradius.org/"
 arch="all"
@@ -30,6 +30,7 @@ source="ftp://ftp.freeradius.org/pub/freeradius/$_realname-server-$pkgver.tar.gz
         musl-fix-headers.patch
         disable-cert-generation.patch
         freeradius-305-default-config.patch
+        CVE-2015-4680.patch
         "
 
 _builddir="$srcdir"/$_realname-server-$pkgver
@@ -272,16 +273,19 @@ fc6693f3df5a0694610110287a28568a  freeradius.confd
 e27f11a11fa167b5185d3e11de79d3bc  freeradius.initd
 d86558365a1deea4914ed139797805b0  musl-fix-headers.patch
 ecd9ecfba4cf86a203de6faf8398c44a  disable-cert-generation.patch
-f8a7b00835f2108acc06af212cede16e  freeradius-305-default-config.patch"
+f8a7b00835f2108acc06af212cede16e  freeradius-305-default-config.patch
+3bc4cd4994c9a197daf36585487438a0  CVE-2015-4680.patch"
 sha256sums="c27252d7a86ba252904612d9b1f90e846f3ef1f4afee6a748f5287b730e87e3a  freeradius-server-3.0.8.tar.gz
 2d5b3e1af1299373182f2c8021bdf45c29db5d82b0a077b965a16ded32cb6292  freeradius.confd
 a5208f13420c28446b85dfc48cb9193a4651c994d15cc2c9b0bc43734c66e8f0  freeradius.initd
 872aaebf86a663f819460d98924a9dc1f3e428facac6930dc98d1e442df1633f  musl-fix-headers.patch
 008fa3a4da7b3c01df238bf492a8ccda4077289c02c553a60ad8f4439ec136a2  disable-cert-generation.patch
-02cad546ffaf3f9be531cb45b96c7fb31f83c717e40ece4ff28a73c86f921f33  freeradius-305-default-config.patch"
+02cad546ffaf3f9be531cb45b96c7fb31f83c717e40ece4ff28a73c86f921f33  freeradius-305-default-config.patch
+e7cbb3af9f90d741f91907898f9c0b156a2ae448cc812cbd6fd8322eb8bcea54  CVE-2015-4680.patch"
 sha512sums="89aabc474e95226eeb5003feef40fbe240f28aa65c40e0566a9bec08991d95fab83826f3b14f416cf4d7d832a814912521cb3c83097c1a2ce5d3e3537ee3a732  freeradius-server-3.0.8.tar.gz
 e248159c0a44f722e405c51c8015d9ad672e42ad0d38ca28f8a051ff911aa4d3e630b9bd4543e9d610940bc4ae50c022594e219ce341b36abe85c572acad418b  freeradius.confd
 ba3c424d4eabb147c7aa3e31575a87ddb26b6a792d2a8714e73d8763e07854326a03a83991a7420246ca06bf0b93d0a6f23ec198f5e48647f9d25b40067e852a  freeradius.initd
 c49e5eec7497fccde5fd09dba1ea9b846e57bc88015bd81640aa531fb5c9b449f37136f42c85fe1d7940c5963aed664b85da28442b388c9fb8cc27873df03b2d  musl-fix-headers.patch
 09b78c6baa992f82ab81c43aad6792536a4708d460170f0a373e242a5fafe8db10662dc7fcef99a966b828ed91fa7fe38567c961c938de9a447f1ee03aebb142  disable-cert-generation.patch
-b69b899da6f80dbdb7422847536e37461315ba587a07fedc1eee28b96be7d16993b758ccd34e3a271ce2937d72c6ddff878aec61a3a4c0750deaaa959d10ed5e  freeradius-305-default-config.patch"
+b69b899da6f80dbdb7422847536e37461315ba587a07fedc1eee28b96be7d16993b758ccd34e3a271ce2937d72c6ddff878aec61a3a4c0750deaaa959d10ed5e  freeradius-305-default-config.patch
+68f00ea6353a2951c95d58fd674701c250e4de713c1bbfba80eb7247df1dc477fa2e277c9f0866ee5591e66eef4f52da70ee1794588df1f411f5e40773317fe7  CVE-2015-4680.patch"
diff --git a/main/freeradius/CVE-2015-4680.patch b/main/freeradius/CVE-2015-4680.patch
new file mode 100644
index 0000000000..ade38c9ee7
--- /dev/null
+++ b/main/freeradius/CVE-2015-4680.patch
@@ -0,0 +1,79 @@
+From 874b39451702338389260edbfc52b381b20352ec Mon Sep 17 00:00:00 2001
+From: "Alan T. DeKok" <aland@freeradius.org>
+Date: Mon, 22 Jun 2015 15:27:10 -0400
+Subject: [PATCH] Set X509_V_FLAG_CRL_CHECK_ALL
+
+---
+ raddb/mods-available/eap |  6 +++++-
+ src/include/tls-h        |  1 +
+ src/main/tls.c           | 12 ++++++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
+index 165971a..10026ec 100644
+--- a/raddb/mods-available/eap
++++ b/raddb/mods-available/eap
+@@ -269,9 +269,13 @@ eap {
+                #  1) Copy CA certificates and CRLs to same directory.
+                #  2) Execute 'c_rehash <CA certs&CRLs Directory>'.
+                #    'c_rehash' is OpenSSL's command.
+-               #  3) uncomment the line below.
++               #  3) uncomment the lines below.
+                #  5) Restart radiusd
+        #       check_crl = yes
++
++               # Check if intermediate CAs have been revoked.
++       #       check_all_crl = yes
++
+                ca_path = ${cadir}
+ 
+                #
+diff --git a/src/include/tls-h b/src/include/tls-h
+index 9fdc775..a41c6f5 100644
+--- a/src/include/tls-h
++++ b/src/include/tls-h
+@@ -347,6 +347,7 @@ struct fr_tls_server_conf_t {
+         */
+        uint32_t        fragment_size;
+        bool            check_crl;
++       bool            check_all_crl;
+        bool            allow_expired_crl;
+        char const      *check_cert_cn;
+        char const      *cipher_list;
+diff --git a/src/main/tls.c b/src/main/tls.c
+index 692651f..9df48b4 100644
+--- a/src/main/tls.c
++++ b/src/main/tls.c
+@@ -999,6 +999,9 @@ static CONF_PARSER tls_server_config[] = {
+        { "fragment_size", FR_CONF_OFFSET(PW_TYPE_INTEGER, fr_tls_server_conf_t, fragment_size), "1024" },
+        { "include_length", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, include_length), "yes" },
+        { "check_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_crl), "no" },
++#ifdef X509_V_FLAG_CRL_CHECK_ALL
++       { "check_all_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_all_crl), "no" },
++#endif
+        { "allow_expired_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, allow_expired_crl), NULL },
+        { "check_cert_cn", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, check_cert_cn), NULL },
+        { "cipher_list", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, cipher_list), NULL },
+@@ -2104,6 +2107,10 @@ static X509_STORE *init_revocation_store(fr_tls_server_conf_t *conf)
+        if (conf->check_crl)
+                X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK);
+ #endif
++#ifdef X509_V_FLAG_CRL_CHECK_ALL
++       if (conf->check_all_crl)
++               X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK_ALL);
++#endif
+        return store;
+ }
+ #endif /* HAVE_OPENSSL_OCSP_H */
+@@ -2591,6 +2598,11 @@ SSL_CTX *tls_init_ctx(fr_tls_server_conf_t *conf, int client)
+                        return NULL;
+                }
+                X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK);
++
++#ifdef X509_V_FLAG_CRL_CHECK_ALL
++               if (conf->check_all_crl)
++                       X509_STORE_set_flags(certstore, X509_V_FLAG_CRL_CHECK_ALL);
++#endif
+        }
+ #endif
+