Red Hat Bugzilla – Bug 1142669
EAP-TLS and OCSP validation causing segmentation fault + patch
Last modified: 2015-07-22 02:16:53 EDT
Created attachment 938373 [details] fixing patch Description of problem: - within EAP-TLS authentication, and - if OCSP validation is enabled, and - OCSP responder does not set the next update field freeradius crashed with segmentation fault - this issue is already registered under https://bugzilla.redhat.com/show_bug.cgi?id=890569 for older RHEL release. - bug is still present in current version of freeradius Version-Release number of selected component (if applicable): freeradius-2.1.12-4.el6_3 How reproducible: always Additional info: radiusd debug output: [wifi-devices] Request found, released from the list [wifi-devices] EAP/tls [wifi-devices] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0352], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = tablet2.example.com [tls] --> BUF-Name = Example organization Root CA [tls] --> subject = /CN=Example organization Root CA/O=Example organization/C=SK [tls] --> issuer = /CN=Example organization Root CA/O=Example organization/C=SK [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = tablet2.example.com [tls] --> BUF-Name = Example organization - Devices CA [tls] --> subject = /CN=Example organization - Devices CA [tls] --> issuer = /CN=Example organization Root CA/O=Example organization/C=SK [tls] --> verify return:1 [tls] --> Starting OCSP Request [ocsp] --> Responder URL = http://ocsp.example.com:80/ejbca/publicweb/status/ocsp [ocsp] --> Response status: successful This Update: Sep 16 17:45:06 2014 GMT Segmentation fault
Comment on attachment 938373 [details] fixing patch affected part extracted from commit https://github.com/FreeRADIUS/freeradius-server/commit/dc53285b1d660737717d88da14edf73813cabd0f
Thank you very much for the report and the patch, Michal. I'll see if we can get it into RHEL6.6.
Unfortunately, we're too late for RHEL6.6, so this fix will have to go into RHEL6.7. If you still would like to have this fixed in RHEL6.6 please contact support.
not problem at all. even if it could be included in RHEL6.7 it will be fine. just wanted to confirm that with patch above SIGSEGV not occur withing OCSP verification and radiusd is stable.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1287.html