From 7bb34ef7fcebcd4e816f701b47b507c7915ebb01 Mon Sep 17 00:00:00 2001
From: Hauke Mehrtens <hauke@hauke-m.de>
Date: Mon, 5 Jun 2017 19:57:52 +0200
Subject: [PATCH] freeradius3: fix CVE-2017-9148

This takes the fix for CVE-2017-9148 from Debian.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 net/freeradius3/Makefile                      |  2 +-
 .../patches/001-fix-cert-expiry.patch         |  2 +-
 ...-disable-session-cache-CVE-2017-9148.patch | 47 +++++++++++++++++++
 3 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch

diff --git a/net/freeradius3/Makefile b/net/freeradius3/Makefile
index 48c083536..20d1dc5e2 100644
--- a/net/freeradius3/Makefile
+++ b/net/freeradius3/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=freeradius3
 PKG_VERSION:=release_3_0_11
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/FreeRADIUS/freeradius-server/archive
diff --git a/net/freeradius3/patches/001-fix-cert-expiry.patch b/net/freeradius3/patches/001-fix-cert-expiry.patch
index b30b01279..578bbbc0e 100644
--- a/net/freeradius3/patches/001-fix-cert-expiry.patch
+++ b/net/freeradius3/patches/001-fix-cert-expiry.patch
@@ -22,7 +22,7 @@
  preserve		= no
 --- a/raddb/certs/server.cnf
 +++ b/raddb/certs/server.cnf
-@@ -14,7 +14,7 @@ private_key		= $dir/ca.key
+@@ -14,7 +14,7 @@ private_key		= $dir/server.key
  RANDFILE		= $dir/.rand
  name_opt		= ca_default
  cert_opt		= ca_default
diff --git a/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
new file mode 100644
index 000000000..458eeba21
--- /dev/null
+++ b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch
@@ -0,0 +1,47 @@
+Description: disable session caching in the server (as opposed to in the
+ config, which would be way harder to get right) to address
+ https://security-tracker.debian.org/tracker/CVE-2017-9148
+Author: Michael Stapelberg <stapelberg@debian.org>
+Forwarded: not-needed
+Last-Update: 2017-05-30
+
+---
+
+--- a/src/main/tls.c
++++ b/src/main/tls.c
+@@ -369,7 +369,7 @@ tls_session_t *tls_new_session(TALLOC_CT
+ 	 *
+ 	 *	FIXME: Also do it every N sessions?
+ 	 */
+-	if (conf->session_cache_enable &&
++	if (/*conf->session_cache_enable*/0 &&
+ 	    ((conf->session_last_flushed + ((int)conf->session_timeout * 1800)) <= request->timestamp)){
+ 		RDEBUG2("Flushing SSL sessions (of #%ld)", SSL_CTX_sess_number(conf->ctx));
+ 
+@@ -463,7 +463,7 @@ tls_session_t *tls_new_session(TALLOC_CT
+ 		state->mtu = vp->vp_integer;
+ 	}
+ 
+-	if (conf->session_cache_enable) state->allow_session_resumption = true; /* otherwise it's false */
++	if (/*conf->session_cache_enable*/0) state->allow_session_resumption = true; /* otherwise it's false */
+ 
+ 	return state;
+ }
+@@ -2675,7 +2675,7 @@ post_ca:
+ 	/*
+ 	 *	Callbacks, etc. for session resumption.
+ 	 */
+-	if (conf->session_cache_enable) {
++	if (/*conf->session_cache_enable*/0) {
+ 		/*
+ 		 *	Cache sessions on disk if requested.
+ 		 */
+@@ -2745,7 +2745,7 @@ post_ca:
+ 	/*
+ 	 *	Setup session caching
+ 	 */
+-	if (conf->session_cache_enable) {
++	if (/*conf->session_cache_enable*/0) {
+ 		/*
+ 		 *	Create a unique context Id per EAP-TLS configuration.
+ 		 */