GitLab

Commit db965c9b addressed TLS clients only.

When verifying DTLS clients, don't consider config blocks with CA
settings ('tls') which differ from the one used for verifying the
certificate chain.

Original issue reported and analysed by Ralf Paffrath. DTLS being
vulnerable reported by Raphael Geisser.

Addresses issue RADSECPROXY-43, CVE-2012-4523.

The change was done in radsecproxy-1.6 (2012-04-27) but wasn't
documented properly.

https://project.nordu.net/browse/RADSECPROXY-43

When verifying clients, don't consider config blocks with CA
settings ('tls') which differ from the one used for verifying the
certificate chain. Reported by Ralf Paffrath.

Reported and analysed by Ralf Paffrath.

Addresses issue RADSECPROXY-43.

Fix by Adam Osuchowski.

To: radsecproxy@uninett.no
Cc: Faidon Liambotis <paravoid@debian.org>
Date: Wed, 23 May 2012 01:50:26 +0300

groff interprets "-" as hyphens (U+2010) and not as minus signs
(U+002D). Process arguments are clearly being done with minus signs, so
escape them properly and make copy/paste work again.

To: radsecproxy@uninett.no
Cc: Faidon Liambotis <paravoid@debian.org>
Date: Wed, 23 May 2012 01:50:27 +0300

s/specifed/specified/

Patch from Ralf Paffrath <paffrath@dfn.de>.

Patch from Ralf Paffrath <paffrath@dfn.de>.

RADSECPROXY-37.

Related to RADSECPROXY-37.

TODO: Add documentation.

Related to RADSECPROXY-37.

TODO: Add documentation.

Closes RADSECPROXY-40.

This is the old number.  We used 1 minute during testing.

Closes RADSECPROXY-36.

This goes in branch dynconf2.

This reverts commit dbcc9977.

Dynamic servers has clearly never been run on UDP servers.
We should probably do something less evil than crashing here.
Closes RADSECPROXY-26.

clientwr() should treat the dynamic lookup as a failure and will not
be any happier to know that the exact error was that it didn't resolv.
The script can do whatever logging is wanted.

That said, this commit also makes the scripts exit with 10 in order to
signal failure.

Also, sleep less than 15 minutes (900s), mainly for testing.  This
number will change.

Also, die hard and explicitly if freeing an already freed config in
freeclsrvconf().

This is part of fixing RADSECPROXY-33.

Using /bin/bash isn't portable.

`-e' to /bin/echo isn't portable.  The BSD's lacks it for instance.