Whenever we ship fixed libopenssl binaries in BB, the Freeradius daemon fails
at startup because it detects a mismatch of the build time and runtime OpenSSL
version.
Since our OpenSSL updates for BB are ABI compatible we do not need or even want
this superflous check. Removing it saves us the effort to rebuild Freeradius
after every OpenSSL version bump.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Backport upstream commit 5e698b407dcac2bc45cf03484bac4398109d25c3 to fix
missing intermediate certificate validation in Freeradius2.
Advisory:
The FreeRADIUS server relies on OpenSSL to perform certificate validation,
including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of
OpenSSL, in CRL application, limits the checks to leaf certificates,
therefore not detecting revocation of intermediate CA certificates.
An unexpired client certificate, issued by an intermediate CA with a revoked
certificate, is therefore accepted by FreeRADIUS.
Specifically sets the X509_V_FLAG_CRL_CHECK flag for leaf certificate CRL
checks, but does not use X509_V_FLAG_CRL_CHECK_ALL for CRL checks on the
complete trust chain.
The FreeRADIUS project advises that the recommended configuration is to use
self-signed CAs for all EAP-TLS methods.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Merge upstream commit 5ae2a70a135062a025d8fabc104eeae3a2c53a7a to relax the
SSL library version check at runtime.
The objective is to avoid the need for rebuilding freeradius2 whenever we push
binary updates for libopenssl. See https://dev.openwrt.org/ticket/18169 for
reference.
Please backport this change to the for-14.07 branch as well.
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
Jo-Philipp Wich