Remove unnecessary executable bits from the installed radiusd.service
file. This stops systemd from logging the following message:
localhost systemd: Configuration file
/usr/lib/systemd/system/radiusd.service is marked executable. Please
remove executable permission bits. Proceeding anyway.
Move "$INCLUDE trigger.conf" chunk before module section in
"radiusd.conf.in". This makes it possible to reference "snmptrap" and
related trigger variables under "pool.trigger" in module configurations,
simplifying them.
Resolves: Bug#1155961
Don't remove backslash from unkown escape sequences in pairparsevalue,
adhering to behavior common to most other programs dealing with
backslash escape sequences.
Resolves: Bug#1173526
Remove attribute description from clients.conf(5) source as it is
outdated, lists just a few attributes and wasn't updated for more than a
year. Refer to clients.conf file itself, instead.
Remove references to non-existent naslist and clients manpages as they
are confusing.
Resolves: bug#1147464
Add support for -D option to radclient. The option allows overriding the
main dictionary directory location. This fixes the inability to fully
override dictionary locations introduced with
"freeradius-fix-dhcp-dictionary-loading.patch".
Related: Bug#1146939
This fixes the following Coverity issues:
Error: DEADCODE (CWE-561):
freeradius-server-3.0.4/src/main/conffile.c:1002: assignment: Assigning: "type" &= "255".
freeradius-server-3.0.4/src/main/conffile.c:1041: between: When switching on "type", the value of "type" must be between 0 and 255.
freeradius-server-3.0.4/src/main/conffile.c:1167: dead_error_condition: The switch value "type" cannot be "16385".
freeradius-server-3.0.4/src/main/conffile.c:1167: dead_error_line: Execution cannot reach this statement: "case 16385:".
Error: DEADCODE (CWE-561):
freeradius-server-3.0.4/src/main/conffile.c:1002: assignment: Assigning: "type" &= "255".
freeradius-server-3.0.4/src/main/conffile.c:1041: between: When switching on "type", the value of "type" must be between 0 and 255.
freeradius-server-3.0.4/src/main/conffile.c:1168: dead_error_condition: The switch value "type" cannot be "32769".
freeradius-server-3.0.4/src/main/conffile.c:1168: dead_error_begin: Execution cannot reach this statement: "case 32769:".
Resolves: Bug#1120234
This fixes the following Coverity issue:
Error: RETURN_LOCAL (CWE-562):
freeradius-server-3.0.4/src/modules/rlm_unix/rlm_unix.c:87: local_ptr_identity_local: "getgrnam_r(name, &my_group, group_buffer, group_size, &grp)" stores "&my_group" (address of local variable "my_group") into "grp".
freeradius-server-3.0.4/src/modules/rlm_unix/rlm_unix.c:99: return_local_addr_alias: Returning pointer "grp" which points to local variable "my_group".
Resolves: Bug#1120234
rlm_ippool; bad config file attribute and fails to send reply attributes
- resolves: bug#1055567 (fedora 1056227)
bad mysql sql syntax
- change CFLAGS -imacros to -include to address gcc/gdb bug 1004526
where gdb will not display source information, only <command-line>
This is a roll-up of all upstream bugs fixes found in 3.0.0
See upstream ChangeLog for details (in freeradius-doc subpackage)
fixes bugs 1053020 1044747 1048474 1043036
remove radeapclient man page,
upstream no longer supports radeapclient, use eapol_test instead
- resolves: bug#1031061
rlm_eap_leap memory corruption, see freeradius-rlm_leap.patch
- move man pages for utils into utils subpackage from doc subpackage
- fix HAVE_EC_CRYPTO test to include f20
- add new directory /var/run/radiusd/tmp
update mods-available/eap so tls-common.verify.tmpdir to point to it
resolves: bug#700870 freeradius not compiled with --with-udpfromto
resolves: bug#753764 shadow password expiration does not work
resolves: bug#712803 radtest script is not working with eap-md5 option
resolves: bug#690756 errors in raddb/sql/postgresql/admin.sql template
Fix configure typo which caused lt_dladvise_* functions to be skipped.
run autogen.sh because HAVE_LT_DLADVISE_INIT isn't in src/main/autogen.h
Implemented by: freeradius-lt-dladvise.patch
Add radmin command "stats detail <file>" to see what is going on inside of
a detail file reader.
Added documentation for CoA. See raddb/sites-available/coa
Add sub-option support for Option 82. See dictionary.dhcp
Add "server" field to default SQL NAS table, and documented it.
Bug fixes
Reset "received ping" counter for Status-Server checks. In some corner
cases it was not getting reset.
Handle large VMPS attributes.
Count accounting responses from a home server in SNMP / statistics code.
Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
radmin packet counter statistics are now unsigned, for numbers
2^31..2^32. After that they roll over to zero.
Be more careful about expanding data in PAP and MS-CHAP modules. This
prevents login failures when passwords contain '{'.
Clean up zombie children if there were many "exec" modules being run for
one packet, all with "wait = no".
re-open log file after HUP. Closes bug #63.
Fix "no response to proxied packet" complaint for Coa / Disconnect packets.
It shouldn't ignore replies to packets it sent.
Calculate IPv6 netmasks correctly. Closes bug #69.
Fix SQL module to re-open sockets if they unexpectedly close.
Track scope for IPv6 addresses. This lets us use link-local addresses
properly. Closes bug #70.
Updated Makefiles to no longer use the shell for recursing into subdirs.
"make -j 2" should now work.
Updated raddb/sql/mysql/ippool.conf to use "= NULL". Closes bug #75.
Updated Makefiles so that "make reconfig" no longer uses the shell for
recursing into subdirs, and re-builds all "configure" files.
Used above method to regenerate all configure scripts. Closes bug #34.
"". This means the same as it being NULL.
Fixed regex realm example. Create Realm attribute with value of realm from
User-Name, not from regex. Closes bug #40.
If processing a DHCP Discover returns "fail / reject", ignore the packet
rather than sending a NAK.
Allow '%' to be escaped in sqlcounter module.
Fix typo internal hash table.
For PEAP and TTLS, the tunneled reply is added to the reply, rather than
integrated via the operators. This allows multiple VSAs to be added,
where they would previously be discarded.
Make request number unsigned. This changes nothing other than the debug
output when the server receives more than 2^31 packets.
Don't block when reading child output in 'exec wait'. This means that
blocked children get killed, instead of blocking the server.
Enabled building without any proxy functionality
radclient now prefers IPv4, to match the default server config.
Print useful error when a realm regex is invalid
relaxed rules for preprocess module "with_cisco_vsa_hack". The attributes
can now be integer, ipaddr, etc. (i.e. non-string)
Allow rlm_ldap to build if ldap_set_rebind_proc() has only
2 arguments.
Update configure script for rlm_python to avoid dynamic linking problems on
some platforms.
Work-around for bug #35
Do suid to "user" when running in debug mode as root
Make "allow_core_dumps" work in more situations.
In detail file reader, treat bad records as EOF. This allows it to continue
working when the disk is full.
Fix Oracle default accounting queries to work when there are no gigawords
attributes. Other databases already had the fix.
Fix rlm_sql to show when it opens and closes sockets. It already says when
it cannot connect, so it should say when it can connect.
"chmod -x" for a few C source files.
Pull update spec files, etc. from RedHat into the redhat/ directory.
Allow spaces when parsing integer values. This helps people who put "too
much" into an SQL value field.
certificates running radiusd in debug mode to generate inital temporary
certificates is no longer necessary, the /etc/raddb/certs/bootstrap is
invoked on initial rpm install (not upgrade) if there is no existing
/etc/raddb/certs/server.pem file
- resolves: bug #528493 use sha1 algorithm instead of md5 during cert
generation the certificate configuration
(/etc/raddb/certs/{ca,server,client}.cnf) files were modifed to use
sha1 instead of md5 and the validity reduced from 1 year to 2 months
sub-packages
- also include the LGPL library license file in addition to the GPL license
file
- fix BuildRequires for perl so it's compatible with both Fedora, RHEL5 and
RHEL6
- remove freeradius-libs subpackage, move libfreeradius-eap and
libfreeradius-radius into the main package
- fix subpackage requires, change from freeradius-libs to main package
- fix description of the devel subpackage, remove referene to non-shipped
libs
- remove execute permissions on src files included in debuginfo
- pcap wire analysis support is enabled and available in utils subpackage
- Resolves bug #523053 radtest manpage in wrong package
- update to latest upstream release: 2.1.7
