diff --git a/.gitignore b/.gitignore
index 2a06a22..4530dbe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,16 @@ freeradius-*.src.rpm
 /freeradius-server-3.0.18.tar.bz2
 /freeradius-server-3.0.19.tar.bz2
 /freeradius-server-3.0.20.tar.bz2
+/freeradius-server-3.0.21.tar.bz2
+/freeradius-server-3.0.22.tar.bz2
+/freeradius-server-3.0.23.tar.bz2
+/freeradius-server-3.0.24.tar.bz2
+/freeradius-server-3.0.25.tar.bz2
+/freeradius-server-3.2.0.tar.bz2
+/freeradius-server-3.2.1.tar.bz2
+/freeradius-server-3.2.2.tar.bz2
+/freeradius-server-3.2.3.tar.bz2
+/freeradius-server-3.2.4.tar.bz2
+/freeradius-server-3.2.5.tar.bz2
+/freeradius-server-3.2.7.tar.bz2
+/freeradius-server-3.2.8.tar.bz2
diff --git a/find_module_deps b/find_module_deps
deleted file mode 100755
index c114baa..0000000
--- a/find_module_deps
+++ /dev/null
@@ -1,385 +0,0 @@
-#!/usr/bin/env python
-
-import exceptions
-import getopt
-import os
-import re
-import rpm
-import select
-import subprocess
-import sys
-
-#------------------------------------------------------------------------------
-
-def get_rlms(root):
-    rlm_re = re.compile(r'^rlm_')
-    version_re = re.compile(r'-[0-9.]+\.so$')
-    names = os.listdir(root)
-    names = [x for x in names if rlm_re.search(x)]
-    names = [x for x in names if not version_re.search(x)]
-    names.sort()
-    return names
-
-#------------------------------------------------------------------------------
-
-debug = False
-verbose = False
-
-exclude_rpms = ['glibc']
-
-build = '2.0.2-1.fc8'
-root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius'
-libdirs = ['/lib','/usr/lib']
-
-#------------------------------------------------------------------------------
-
-def get_rpm_nvr_from_header(hdr):
-    'Given an RPM header return the package NVR as a string'
-    name    = hdr['name']
-    version = hdr['version']
-    release = hdr['release']
-
-    return "%s-%s-%s" % (name, version, release)
-
-def get_rpm_hdr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = None
-    try:
-        ts = rpm.ts()
-        mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path)
-        for hdr in mi: break
-    except Exception, e:
-        print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e)
-        hdr = None
-    return hdr
-
-def get_rpm_nvr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    nvr = get_rpm_nvr_from_header(hdr)
-    return nvr
-
-def get_rpm_name_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    name = hdr['name']
-    return name
-
-#------------------------------------------------------------------------------
-
-class CmdError(exceptions.Exception):
-    def __init__(self, errno, msg):
-        self.errno = errno
-        self.msg = msg
-
-
-class Command:
-    def __init__(self, cmd):
-        self.cmd = cmd
-        self.sub_process = None
-        self.bufsize = 1024
-        self.stdout_buf = ''
-        self.stderr_buf = ''
-        self.stdout_lines = []
-        self.stderr_lines = []
-
-    def run(self, stdout_callback=None, stderr_callback=None):
-        self.sub_process = subprocess.Popen(self.cmd, \
-            stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \
-            close_fds=True, shell=True)
-        self.stdout = self.sub_process.stdout
-        self.stderr = self.sub_process.stderr
-
-        read_watch = [self.stdout, self.stderr]
-        while read_watch:
-            readable = select.select(read_watch, [], [])[0]
-            for fd in readable:
-                if fd == self.stdout:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stdout_buf += data
-                    for line in self.burst_lines('stdout_buf'):
-                        if stdout_callback: stdout_callback(line)
-                        self.stdout_lines.append(line)
-                if fd == self.stderr:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stderr_buf += data
-                    for line in self.burst_lines('stderr_buf'):
-                        if stdout_callback: stderr_callback(line)
-                        self.stderr_lines.append(line)
-
-        self.returncode = self.sub_process.wait()
-        if self.returncode:
-            raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines)))
-
-        return self.returncode
-
-    def burst_lines(self, what):
-        buf = getattr(self, what)
-        start = 0
-        end = buf.find('\n', start)
-        while end >= 0:
-            end += 1                # include newline
-            line = buf[start:end]
-            yield line
-            start = end
-            end = buf.find('\n', start)
-        buf = buf[start:]
-        setattr(self, what, buf)
-
-
-#------------------------------------------------------------------------------
-
-def get_so_requires(path):
-    requires = {}
-    cmd = 'ldd %s' % (path)
-    so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            if match.group(2).startswith('/'):
-                so_path = match.group(2)
-            else:
-                so_path = None
-
-            requires[so_name] = so_path
-    return requires
-
-def get_so_needed(path):
-    needed = []
-    cmd = 'readelf -d %s' % (path)
-    so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            needed.append(so_name)
-    return needed
-
-def format_size(size):
-    if size > 1000000000:
-        return '%.1f GB' % (size/1000000000.0)
-    if size > 1000000:
-        return '%.1f MB' % (size/1000000.0)
-    if size > 1000:
-        return '%.1f KB' % (size/1000.0)
-    return '%d' % (size)
-#------------------------------------------------------------------------------
-
-class RPM_Prop:
-    def __init__(self, path=None, name=None):
-        self.name = name
-        self.paths = {}
-        self.rpm_hdr = None
-        self.used_by = {}
-        if path:
-            self.register_path(path)
-            if not self.rpm_hdr:
-                self.rpm_hdr = get_rpm_hdr_by_file_path(path)
-            if self.rpm_hdr:
-                if not self.name:
-                    self.name = self.rpm_hdr[rpm.RPMTAG_NAME]
-                self.size = self.rpm_hdr[rpm.RPMTAG_SIZE]
-
-    def __str__(self):
-        return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys()))
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        return self.paths.setdefault(path, path)
-
-class RPM_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        rpm_prop = self.paths.get(path)
-        if not rpm_prop:
-            rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path))
-        self.names.setdefault(rpm_prop.name, rpm_prop)
-        return rpm_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-    def get_name(self, name):
-        return self.names.get(name)
-
-class SO_File:
-    def __init__(self, name=None, path=None):
-        self.name = name
-        self.path = path
-        self.rpm = None
-
-    def __str__(self):
-        if self.rpm:
-            rpm_name = self.rpm.name
-        else:
-            rpm_name = None
-        return "name=%s rpm=%s" % (self.name, rpm_name)
-
-class SO_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        so_prop = self.paths.get(path)
-        if not so_prop:
-            so_prop = self.paths.setdefault(path, SO_File(name, path=path))
-        self.names.setdefault(name, so_prop)
-        return so_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-class LoadableModule:
-    def __init__(self, path, name=None):
-        if name is None:
-            name = os.path.basename(path)
-        self.name = name
-        self.path = path
-        self.rpm_names = {}
-        self.sos = SO_Collection()
-        self.get_so_requires()
-
-    def __str__(self):
-        text = '%s\n' % (self.name)
-        text += "    RPM's: %s\n" % (','.join(self.get_rpm_names()))
-        text += "    SO's: %s\n" % (','.join(self.sos.get_names()))
-        return text
-
-    def get_so_requires(self):
-        requires = get_so_requires(self.path)
-        needed = get_so_needed(self.path)
-        #print "%s requires=%s" % (self.name, requires)
-        #print "%s needed=%s" % (self.name, needed)
-
-        for so_name, so_path in requires.items():
-            if so_name not in needed: continue
-            if so_path:
-                so_prop = self.sos.register_path(so_path, so_name)
-                rpm_prop = rpms.register_path(so_prop.path)
-                rpm_prop.used_by[self.name] = 1
-                self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name)
-                so_prop.rpm = rpm_prop
-            else:
-                so_prop = None
-            if verbose: print "found so='%s' %s" % (so_name, so_prop)
-
-    def register_so(self, so):
-        if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so)
-        self.sos.setdefault(so, so)
-        self.names.setdefault(so.name, so)
-        return so
-
-    def get_rpm_names(self):
-        rpm_names = self.rpm_names.keys()
-        rpm_names.sort()
-        return rpm_names
-
-    def get_sos(self):
-        sos = self.sos.keys()
-        sos.sort(lambda a,b: cmp(a.name, b.name))
-        return sos
-
-#------------------------------------------------------------------------------
-
-#------------------------------------------------------------------------------
-
-opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose'])
-for o, a in opts:
-    if o in ['-b', '--build']:
-        build = a
-    elif o in ['-v', '--verbose']:
-        verbose = True
-    else:
-        print >> sys.stderr, "Unknown arg: %s" % o
-        sys.exit(1)
-
-root = root_template % build
-modules = get_rlms(root)
-module_paths = [os.path.join(root,x) for x in modules]
-rpms = RPM_Collection()
-
-lms = []
-for module_path in module_paths[:]:
-    lm = LoadableModule(module_path)
-    lms.append(lm)
-
-
-print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules))
-
-for lm in lms:
-    rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms]
-    if rpm_names:
-        print lm.name
-        print '    %s' % (','.join(rpm_names))
-
-print "--------------"
-
-rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms]
-rpm_props.sort(lambda a,b: cmp(a.name, b.name))
-for rpm_prop in rpm_props:
-    used_by = rpm_prop.used_by.keys()
-    used_by.sort()
-    print "%s: %s" % (rpm_prop.name, ','.join(used_by))
-
-print "--------------"
-
-rpm_props.sort(lambda a,b: cmp(a.size, b.size))
-for rpm_prop in rpm_props:
-    print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name)
-
-
-print "--------------"
-
-for lm in lms:
-    print lm
diff --git a/freeradius-Add-missing-option-descriptions.patch b/freeradius-Add-missing-option-descriptions.patch
deleted file mode 100644
index 4138b4f..0000000
--- a/freeradius-Add-missing-option-descriptions.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Fri, 14 Sep 2018 12:20:11 +0300
-Subject: [PATCH] man: Add missing option descriptions
-
----
- man/man8/raddebug.8 | 4 ++++
- man/man8/radiusd.8  | 7 +++++++
- man/man8/radmin.8   | 4 ++++
- 3 files changed, 15 insertions(+)
-
-diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8
-index 66e80e64fa..6e27e2453c 100644
---- a/man/man8/raddebug.8
-+++ b/man/man8/raddebug.8
-@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server.
- .IR condition ]
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-n
- .IR name ]
- .RB [ \-i
-@@ -73,6 +75,8 @@ option is equivalent to using:
- .IP "\-d \fIconfig directory\fP"
- The radius configuration directory, usually /etc/raddb.  See the
- \fIradmin\fP manual page for more description of this option.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP "\-n \fImname\fP"
- Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP.
- .IP \-I\ \fIipv6-address\fP
-diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8
-index c825f22d0d..98aef5e1be 100644
---- a/man/man8/radiusd.8
-+++ b/man/man8/radiusd.8
-@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server
- .RB [ \-C ]
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-f ]
- .RB [ \-h ]
- .RB [ \-i
-@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server
- .IR name ]
- .RB [ \-p
- .IR port ]
-+.RB [ \-P ]
- .RB [ \-s ]
- .RB [ \-t ]
- .RB [ \-v ]
-@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked.
- .IP "\-d \fIconfig directory\fP"
- Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration
- files such as the \fIdictionary\fP and the \fIusers\fP files.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP \-f
- Do not fork, stay running as a foreground process.
- .IP \-h
-@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in
- \fIradiusd.conf\fP are ignored.
- 
- This option MUST be used in conjunction with "-i".
-+.IP "\-P
-+Always write out PID, even with -f.
- .IP \-s
- Run in "single server" mode.  The server normally runs with multiple
- threads and/or processes, which can lower its response time to
-diff --git a/man/man8/radmin.8 b/man/man8/radmin.8
-index 5ecc963d81..5bf661fa71 100644
---- a/man/man8/radmin.8
-+++ b/man/man8/radmin.8
-@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool
- .B radmin
- .RB [ \-d
- .IR config_directory ]
-+.RB [ \-D
-+.IR dictionary_directory ]
- .RB [ \-e
- .IR command ]
- .RB [ \-E ]
-@@ -34,6 +36,8 @@ The following command-line options are accepted by the program.
- Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server
- configuration files to find the "listen" section that defines the
- control socket filename.
-+.IP "\-D \fIdictionary directory\fP"
-+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
- .IP "\-e \fIcommand\fP"
- Run \fIcommand\fP and exit.
- .IP \-E
--- 
-2.18.0
-
diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
index 6b2329b..33747d0 100644
--- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
+++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
@@ -3,25 +3,27 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics
 
+[antorres@redhat.com]: update patch to match 3.2.7 release
+
 ---
  raddb/mods-available/eap | 4 ++--
  raddb/radiusd.conf.in    | 7 +++----
  2 files changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 2621e183c..94494b2c6 100644
+index 84660d7c1e..ffcef4b406 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -533,7 +533,7 @@
- 			#  You should also delete all of the files
- 			#  in the directory when the server starts.
+@@ -696,7 +696,7 @@ eap {
+ 			#  and create the temporary directory with the
+ 			#  systemd `RuntimeDirectory` unit option.
  			#
 -		#	tmpdir = /tmp/radiusd
 +		#	tmpdir = /var/run/radiusd/tmp
  
  			#  The command used to verify the client cert.
  			#  We recommend using the OpenSSL command-line
-@@ -548,7 +548,7 @@
+@@ -711,7 +711,7 @@ eap {
  			#  deleted by the server when the command
  			#  returns.
  			#
@@ -30,6 +32,7 @@ index 2621e183c..94494b2c6 100644
  		}
  
  		#  OCSP Configuration
+
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in
diff --git a/freeradius-OpenSSL-HMAC-MD5.patch b/freeradius-OpenSSL-HMAC-MD5.patch
deleted file mode 100644
index 1e54c55..0000000
--- a/freeradius-OpenSSL-HMAC-MD5.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Fri, 28 Sep 2018 09:54:46 -0400
-Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's
-
-If OpenSSL EVP is not found, fallback to internal implementation of
-HMAC-MD5.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++-
- 1 file changed, 33 insertions(+), 1 deletion(-)
-
-diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c
-index 2c662ff368..1cca00fa2a 100644
---- a/src/lib/hmacmd5.c
-+++ b/src/lib/hmacmd5.c
-@@ -27,10 +27,41 @@
-
- RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $")
-
-+#ifdef HAVE_OPENSSL_EVP_H
-+#include <openssl/hmac.h>
-+#include <openssl/evp.h>
-+#endif
-+
- #include <freeradius-devel/libradius.h>
- #include <freeradius-devel/md5.h>
-
--/** Calculate HMAC using MD5
-+#ifdef HAVE_OPENSSL_EVP_H
-+/** Calculate HMAC using OpenSSL's MD5 implementation
-+ *
-+ * @param digest Caller digest to be filled in.
-+ * @param text Pointer to data stream.
-+ * @param text_len length of data stream.
-+ * @param key Pointer to authentication key.
-+ * @param key_len Length of authentication key.
-+ *
-+ */
-+void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
-+		 uint8_t const *key, size_t key_len)
-+{
-+	HMAC_CTX *ctx  = HMAC_CTX_new();
-+
-+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
-+	/* Since MD5 is not allowed by FIPS, explicitly allow it. */
-+	HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-+#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */
-+
-+	HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL);
-+	HMAC_Update(ctx, text, text_len);
-+	HMAC_Final(ctx, digest, NULL);
-+	HMAC_CTX_free(ctx);
-+}
-+#else
-+/** Calculate HMAC using internal MD5 implementation
-  *
-  * @param digest Caller digest to be filled in.
-  * @param text Pointer to data stream.
-@@ -101,6 +132,7 @@
- 					      * hash */
- 	fr_md5_final(digest, &context);	  /* finish up 2nd pass */
- }
-+#endif /* HAVE_OPENSSL_EVP_H */
-
- /*
- Test Vectors (Trailing '\0' of a character string not included in test):
diff --git a/freeradius-OpenSSL-HMAC-SHA1.patch b/freeradius-OpenSSL-HMAC-SHA1.patch
deleted file mode 100644
index 6c60951..0000000
--- a/freeradius-OpenSSL-HMAC-SHA1.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Fri, 28 Sep 2018 11:03:52 -0400
-Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's
-
-If OpenSSL EVP is not found, fallback to internal implementation of
-HMAC-SHA1.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++-
- 1 file changed, 28 insertions(+), 1 deletion(-)
-
-diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c
-index c3cbd87a2c..211470ea35 100644
---- a/src/lib/hmacsha1.c
-+++ b/src/lib/hmacsha1.c
-@@ -10,13 +10,19 @@
-
- RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $")
-
-+#ifdef HAVE_OPENSSL_EVP_H
-+#include <openssl/hmac.h>
-+#include <openssl/evp.h>
-+#endif
-+
- #include <freeradius-devel/libradius.h>
-
- #ifdef HMAC_SHA1_DATA_PROBLEMS
- unsigned int sha1_data_problems = 0;
- #endif
-
--/** Calculate HMAC using SHA1
-+#ifdef HAVE_OPENSSL_EVP_H
-+/** Calculate HMAC using OpenSSL's SHA1 implementation
-  *
-  * @param digest Caller digest to be filled in.
-  * @param text Pointer to data stream.
-@@ -28,6 +34,26 @@
- void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
- 		  uint8_t const *key, size_t key_len)
- {
-+	HMAC_CTX *ctx  = HMAC_CTX_new();
-+	HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL);
-+	HMAC_Update(ctx, text, text_len);
-+	HMAC_Final(ctx, digest, NULL);
-+	HMAC_CTX_free(ctx);
-+}
-+
-+#else
-+
-+/** Calculate HMAC using internal SHA1 implementation
-+ *
-+ * @param digest Caller digest to be filled in.
-+ * @param text Pointer to data stream.
-+ * @param text_len length of data stream.
-+ * @param key Pointer to authentication key.
-+ * @param key_len Length of authentication key.
-+ */
-+void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
-+		  uint8_t const *key, size_t key_len)
-+{
- 	fr_sha1_ctx context;
- 	uint8_t k_ipad[65];    /* inner padding - key XORd with ipad */
- 	uint8_t k_opad[65];    /* outer padding - key XORd with opad */
-@@ -142,6 +168,7 @@
- 	}
- #endif
- }
-+#endif /* HAVE_OPENSSL_EVP_H */
-
- /*
- Test Vectors (Trailing '\0' of a character string not included in test):
diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch
index 199e583..74f3cfd 100644
--- a/freeradius-Use-system-crypto-policy-by-default.patch
+++ b/freeradius-Use-system-crypto-policy-by-default.patch
@@ -4,6 +4,7 @@ Date: Wed, 8 May 2019 10:16:31 -0400
 Subject: [PATCH] Use system-provided crypto-policies by default
 
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+[antorres@redhat.com]: update patch to 3.2.1 state
 ---
  raddb/mods-available/eap        | 4 ++--
  raddb/mods-available/inner-eap  | 2 +-
@@ -12,21 +13,21 @@ Signed-off-by: Alexander Scheel <ascheel@redhat.com>
  4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 36849e10f2..b28c0f19c6 100644
+index 62152a6dfc..9f64963034 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -368,7 +368,7 @@ eap {
- 		#
- 		#  For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
+@@ -400,7 +400,7 @@ eap {
+ 		#  TLS cipher suites.  The format is listed
+ 		#  in "man 1 ciphers".
  		#
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
  
- 		#  If enabled, OpenSSL will use server cipher list
- 		#  (possibly defined by cipher_list option above)
-@@ -912,7 +912,7 @@ eap {
- 		#  Note - for OpenSSL 1.1.0 and above you may need
- 		#  to add ":@SECLEVEL=0"
+ 		#  Set this option to specify the allowed
+ 		#  TLS signature algorithms for OpenSSL 1.1.1 and above.
+@@ -1082,7 +1082,7 @@ eap {
+ 		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+ 		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
  		#
 -	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
 +	#	cipher_list = "PROFILE=SYSTEM"
@@ -47,23 +48,23 @@ index 576eb7739e..ffa07188e2 100644
  		#  You may want to set a very small fragment size.
  		#  The TLS data here needs to go inside of the
 diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
-index 92f1d6330e..cd69b3905a 100644
+index b8d0626bbe..073b2933c2 100644
 --- a/raddb/sites-available/abfab-tls
 +++ b/raddb/sites-available/abfab-tls
-@@ -19,7 +19,7 @@ listen {
+@@ -20,7 +20,7 @@ listen {
  		dh_file = ${certdir}/dh
  		fragment_size = 8192
  		ca_path = ${cadir}
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 
  		cache {
  			enable = no
+ 			lifetime = 24 # hours
 diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
-index bbc761b1c5..83cd35b851 100644
+index 137fcbc6cc..a65f8a8711 100644
 --- a/raddb/sites-available/tls
 +++ b/raddb/sites-available/tls
-@@ -215,7 +215,7 @@ listen {
+@@ -292,7 +292,7 @@ listen {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
@@ -72,15 +73,15 @@ index bbc761b1c5..83cd35b851 100644
  
  		# If enabled, OpenSSL will use server cipher list
  		# (possibly defined by cipher_list option above)
-@@ -517,7 +517,7 @@ home_server tls {
+@@ -676,7 +676,7 @@ home_server tls {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 	}
  
- }
+ 		#
+ 		#  Connection timeout for outgoing TLS connections.
 -- 
 2.21.0
 
diff --git a/freeradius-autogen.sh b/freeradius-autogen.sh
deleted file mode 100755
index 9cba642..0000000
--- a/freeradius-autogen.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh -e
-
-parentdir=`dirname $0`
-
-cd $parentdir
-parentdir=`pwd`
-
-libtoolize -f -c
-#aclocal
-autoheader
-autoconf
-
-mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`"
-mysubdirs=`echo $mysubdirs`
-
-for F in $mysubdirs
-do
-	echo "Configuring in $F..."
-	(cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir)
-	(cd $F && autoconf -I$parentdir)
-done
diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch
index 7af7c94..17cab04 100644
--- a/freeradius-bootstrap-create-only.patch
+++ b/freeradius-bootstrap-create-only.patch
@@ -1,36 +1,18 @@
-From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
+From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 8 May 2019 10:29:08 -0400
+Date: Wed, 13 May 2020 10:01:47 -0400
 Subject: [PATCH] Don't clobber existing files on bootstrap
 
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
- raddb/certs/bootstrap | 39 ++++++++++++---------------------------
- 1 file changed, 12 insertions(+), 27 deletions(-)
+ raddb/certs/bootstrap | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
 
 diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
-index 0f719aafd4..be81a2d697 100755
+index ede09bc..e555491 100755
 --- a/raddb/certs/bootstrap
 +++ b/raddb/certs/bootstrap
-@@ -13,17 +13,6 @@
- umask 027
- cd `dirname $0`
-
--make -h > /dev/null 2>&1
--
--#
--#  If we have a working "make", then use it.  Otherwise, run the commands
--#  manually.
--#
--if [ "$?" = "0" ]; then
--  make all
--  exit $?
--fi
--
- #
- #  The following commands were created by running "make -n", and edited
- #  to remove the trailing backslash, and to add "exit 1" after the commands.
-@@ -31,52 +20,51 @@ fi
+@@ -20,56 +20,55 @@ cd `dirname $0`
  #  Don't edit the following text.  Instead, edit the Makefile, and
  #  re-generate these commands.
  #
@@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755
 -  fi
 +  ln -sf /dev/urandom random
  fi
-
+ 
 -if [ ! -f server.key ]; then
 +if [ ! -e server.key ]; then
    openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+   chmod g+r server.key
  fi
-
+ 
 -if [ ! -f ca.key ]; then
 +if [ ! -e ca.key ]; then
    openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
  fi
-
+ 
 -if [ ! -f index.txt ]; then
 +if [ ! -e index.txt ]; then
    touch index.txt
  fi
-
+ 
 -if [ ! -f serial ]; then
 +if [ ! -e serial ]; then
    echo '01' > serial
  fi
-
+ 
 -if [ ! -f server.crt ]; then
 +if [ ! -e server.crt ]; then
    openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
  fi
-
+ 
 -if [ ! -f server.p12 ]; then
 +if [ ! -e server.p12 ]; then
    openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   chmod g+r server.p12
  fi
-
+ 
 -if [ ! -f server.pem ]; then
 +if [ ! -e server.pem ]; then
    openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
    openssl verify -CAfile ca.pem server.pem || exit 1
+   chmod g+r server.pem
  fi
-
+ 
 -if [ ! -f ca.der ]; then
 +if [ ! -e ca.der ]; then
    openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
  fi
-
+ 
 -if [ ! -f client.key ]; then
 +if [ ! -e client.key ]; then
    openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+   chmod g+r client.key
  fi
-
+ 
 -if [ ! -f client.crt ]; then
 +if [ ! -e client.crt ]; then
    openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
  fi
 +
 +chown root:radiusd dh ca.* client.* server.*
-+chmod 644 dh ca.* client.* server.*
---
-2.21.0
++chmod 640 dh ca.* client.* server.*
+-- 
+2.26.2
 
diff --git a/freeradius-bootstrap-make-permissions.patch b/freeradius-bootstrap-make-permissions.patch
new file mode 100644
index 0000000..3548fa6
--- /dev/null
+++ b/freeradius-bootstrap-make-permissions.patch
@@ -0,0 +1,29 @@
+From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 4 Aug 2020 10:08:15 -0400
+Subject: [PATCH] Fix permissions after generating certificates with make
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index 336a2bd..9920ecf 100755
+--- a/raddb/certs/bootstrap
++++ b/raddb/certs/bootstrap
+@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1
+ #
+ if [ "$?" = "0" ]; then
+   make all
+-  exit $?
++  ret=$?
++  chown root:radiusd dh ca.* client.* server.*
++  chmod 640 dh ca.* client.* server.*
++  exit $ret
+ fi
+ 
+ #
+-- 
+2.26.2
+
diff --git a/freeradius-configure-c99.patch b/freeradius-configure-c99.patch
new file mode 100644
index 0000000..cc9daff
--- /dev/null
+++ b/freeradius-configure-c99.patch
@@ -0,0 +1,35 @@
+The backtrace_symbols function expects a pointer to an array of void *
+values, not a pointer to an array of a single element. Removing the
+address operator ensures that the right type is used.
+
+This avoids an unconditional failure of this probe with compilers that
+treat incompatible pointer types as a compilation error.
+
+Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
+
+diff --git a/configure b/configure
+index ed01ee2bdd912f63..1e6d2284779cdd58 100755
+--- a/configure
++++ b/configure
+@@ -13390,7 +13390,7 @@ main (void)
+ {
+ 
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym))
++        backtrace_symbols(sym, sizeof(sym))
+   ;
+   return 0;
+ }
+diff --git a/configure.ac b/configure.ac
+index 76320213b51d7bb4..6a689711d6c90483 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+         #include <execinfo.h>
+       ]], [[
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
++        backtrace_symbols(sym, sizeof(sym)) ]])],[
+         AC_MSG_RESULT(yes)
+         ac_cv_lib_execinfo_backtrace_symbols="yes"
+       ],[
diff --git a/freeradius-ease-openssl-version-check.patch b/freeradius-ease-openssl-version-check.patch
new file mode 100644
index 0000000..23f1df7
--- /dev/null
+++ b/freeradius-ease-openssl-version-check.patch
@@ -0,0 +1,35 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Tue, 12 Sep 2023
+Subject: Ease OpenSSL version check requirement
+
+FreeRADIUS includes an OpenSSL version check that compares built vs linked version,
+and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as 
+ABI changes are tracked and soname is changed accordingly, as discussed in previous 
+Bugzilla for this issue [1].
+
+[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/main/version.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/version.c b/src/main/version.c
+index c190337c1d..fee2150eb2 100644
+--- a/src/main/version.c
++++ b/src/main/version.c
+@@ -79,11 +79,11 @@ int ssl_check_consistency(void)
+ 	 */
+ 	if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) {
+ 	mismatch:
+-		ERROR("libssl version mismatch.  built: %lx linked: %lx",
++		DEBUG2("libssl version mismatch.  built: %lx linked: %lx",
+ 		      (unsigned long) ssl_built,
+ 		      (unsigned long) ssl_linked);
+ 
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	/*
diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch
new file mode 100644
index 0000000..40df134
--- /dev/null
+++ b/freeradius-ldap-infinite-timeout-on-starttls.patch
@@ -0,0 +1,31 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Fri, 28 Jan 2022
+Subject: Use infinite timeout when using LDAP+start-TLS
+
+This will ensure that the TLS connection to the LDAP server will complete
+before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
+the process. Infinite timeout is the OpenLDAP default.
+Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/modules/rlm_ldap/ldap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index cf7a84e069..841bf888a1 100644
+--- a/src/modules/rlm_ldap/ldap.c
++++ b/src/modules/rlm_ldap/ldap.c
+@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ #ifdef LDAP_OPT_NETWORK_TIMEOUT
+-	if (inst->net_timeout) {
++	bool using_tls = inst->start_tls ||
++					 inst->port == 636 ||
++					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
++	if (inst->net_timeout && !using_tls) {
+ 		memset(&tv, 0, sizeof(tv));
+ 		tv.tv_sec = inst->net_timeout;
+ 
diff --git a/freeradius-logrotate b/freeradius-logrotate
index c962254..1a2ec6f 100644
--- a/freeradius-logrotate
+++ b/freeradius-logrotate
@@ -34,7 +34,7 @@
 	compress
 	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl reload-or-try-restart radiusd
+		/usr/bin/systemctl try-reload-or-restart radiusd
 	endscript
 }
 
diff --git a/freeradius-man-Fix-some-typos.patch b/freeradius-man-Fix-some-typos.patch
deleted file mode 100644
index 26d84de..0000000
--- a/freeradius-man-Fix-some-typos.patch
+++ /dev/null
@@ -1,94 +0,0 @@
-From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Fri, 14 Sep 2018 11:53:28 +0300
-Subject: [PATCH] man: Fix some typos
-
----
- man/man5/radrelay.conf.5 | 2 +-
- man/man5/rlm_files.5     | 2 +-
- man/man5/unlang.5        | 8 ++++----
- man/man8/radrelay.8      | 2 +-
- 4 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5
-index 5fb38bfc4e..e3e665024b 100644
---- a/man/man5/radrelay.conf.5
-+++ b/man/man5/radrelay.conf.5
-@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one
- backup server. When the primary goes down, most NASes detect that and
- switch to the backup server.
- 
--That will cause your accounting packets to go the the backup server -
-+That will cause your accounting packets to go to the backup server -
- and some NASes don't even switch back to the primary server when it
- comes back up.
- 
-diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5
-index bfee5030ff..52f4734ae3 100644
---- a/man/man5/rlm_files.5
-+++ b/man/man5/rlm_files.5
-@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that
- perform per-group checks, and return per-group attributes, where the
- group membership is dynamically defined by a previous module.  It also
- lets you do things like key off of attributes in the reply, and
--express policies like like "when I send replies containing attribute
-+express policies like "when I send replies containing attribute
- FOO with value BAR, do more checks, and maybe send additional
- attributes".
- .SH CONFIGURATION
-diff --git a/man/man5/unlang.5 b/man/man5/unlang.5
-index 76db8f2d1c..12fe7855b2 100644
---- a/man/man5/unlang.5
-+++ b/man/man5/unlang.5
-@@ -36,7 +36,7 @@ the pre-defined keywords here.
- 
- Subject to a few limitations described below, any keyword can appear
- in any context.  The language consists of a series of entries, each
--one one line.  Each entry begins with a keyword.  Entries are
-+one line.  Each entry begins with a keyword.  Entries are
- organized into lists.  Processing of the language is line by line,
- from the start of the list to the end.  Actions are executed
- per-keyword.
-@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below.  The match is
- then performed on the string returned from the expansion.  If the
- argument is an attribute reference (e.g. &User-Name), then the match
- is performed on the value of that attribute.  Otherwise, the argument
--is taken to be a literal string, and and matching is done via simple
-+is taken to be a literal string, and matching is done via simple
- comparison.
- 
- No statement other than "case" can appear in a "switch" block.
-@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below.  The match is
- then performed on the string returned from the expansion.  If the
- argument is an attribute reference (e.g. &User-Name), then the match
- is performed on the value of that attribute.  Otherwise, the argument
--is taken to be a literal string, and and matching is done via simple
-+is taken to be a literal string, and matching is done via simple
- comparison.
- 
- .DS
-@@ -799,7 +799,7 @@ regular expression.  If no attribute matches, nothing else is done.
- The value can be an attribute reference, or an attribute-specific
- string.
- 
--When the value is an an attribute reference, it must take the form of
-+When the value is an attribute reference, it must take the form of
- "&Attribute-Name".  The leading "&" signifies that the value is a
- reference.  The "Attribute-Name" is an attribute name, such as
- "User-Name" or "request:User-Name".  When an attribute reference is
-diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8
-index fdba6995d5..99e65732a2 100644
---- a/man/man8/radrelay.8
-+++ b/man/man8/radrelay.8
-@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one
- backup server. When the primary goes down, most NASes detect that and
- switch to the backup server.
- 
--That will cause your accounting packets to go the the backup server -
-+That will cause your accounting packets to go to the backup server -
- and some NASes don't even switch back to the primary server when it
- comes back up.
- 
--- 
-2.18.0
-
diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch
index aa3be66..6846827 100644
--- a/freeradius-no-buildtime-cert-gen.patch
+++ b/freeradius-no-buildtime-cert-gen.patch
@@ -3,48 +3,52 @@ From: Alexander Scheel <ascheel@redhat.com>
 Date: Wed, 8 May 2019 12:58:02 -0400
 Subject: [PATCH] Don't generate certificates in reproducible builds
 
+[antorres@redhat.com]: updated to match upstream release 3.2.7
+
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
  Make.inc.in  | 5 +++++
- configure    | 4 ++++
+ configure    | 3 +++
  configure.ac | 3 +++
  raddb/all.mk | 4 ++++
- 4 files changed, 16 insertions(+)
+ 4 files changed, 15 insertions(+)
 
 diff --git a/Make.inc.in b/Make.inc.in
 index 0b2cd74de8..8c623cf95c 100644
 --- a/Make.inc.in
 +++ b/Make.inc.in
-@@ -173,3 +173,8 @@ else
- 	TESTBINDIR = ./$(BUILD_DIR)/bin
+@@ -174,6 +174,10 @@ else
  	TESTBIN    = ./$(BUILD_DIR)/bin
  endif
-+
+ 
 +#
 +#  With reproducible builds, do not generate certificates during installation
 +#
 +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@
+ 
+ #
+ #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index c2c599c92b..3d4403a844 100755
+index f1dfa97c44..ba5c53768d 100755
 --- a/configure
 +++ b/configure
-@@ -655,6 +655,7 @@ RUSERS
+@@ -681,6 +681,7 @@ ACLOCAL
+ LAST
+ RUSERS
  SNMPWALK
- SNMPGET
- PERL
 +ENABLE_REPRODUCIBLE_BUILDS
+ SNMPGET
  openssl_version_check_config
- WITH_DHCP
- modconfdir
-@@ -5586,6 +5587,7 @@ else
- fi
+ WITH_RADLAST
+@@ -7001,6 +7002,7 @@ fi
  
  
-+ENABLE_REPRODUCIBLE_BUILDS=yes
  # Check whether --enable-reproducible-builds was given.
- if test "${enable_reproducible_builds+set}" = set; then :
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ if test ${enable_reproducible_builds+y}
+ then :
    enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
      ;;
    *)
      reproducible_builds=no
@@ -52,19 +56,12 @@ index c2c599c92b..3d4403a844 100755
    esac
  
  fi
-@@ -5604,6 +5607,7 @@ fi
- 
- 
- 
-+
- CHECKRAD=checkrad
- # Extract the first word of "perl", so it can be a program name with args.
- set dummy perl; ac_word=$2
+
 diff --git a/configure.ac b/configure.ac
-index a7abf0025a..35b013f4af 100644
+index ce4d9b0ae5..790cbf02a0 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config])
+@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config])
  dnl #
  dnl #  extra argument: --enable-reproducible-builds
  dnl #
@@ -72,7 +69,7 @@ index a7abf0025a..35b013f4af 100644
  AC_ARG_ENABLE(reproducible-builds,
  [AS_HELP_STRING([--enable-reproducible-builds],
                  [ensure the build does not change each time])],
-@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds,
+@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds,
      ;;
    *)
      reproducible_builds=no
@@ -81,6 +78,10 @@ index a7abf0025a..35b013f4af 100644
  )
 +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS)
  
+ dnl #
+ dnl #  Enable the -fsanitize=fuzzer and link in the address sanitizer
+
+ 
  
  dnl #############################################################
 diff --git a/raddb/all.mk b/raddb/all.mk
diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch
new file mode 100644
index 0000000..58d3282
--- /dev/null
+++ b/freeradius-no-sqlippool-tool.patch
@@ -0,0 +1,28 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 5 Mar 2025
+Subject: Remove sqlippool tool
+
+This script relies on a Perl package, perl-Net-IP, that won't be available.
+Remove it from build script and let the user pull it manually instead, as it's
+just a helper script for SQL module users.
+
+---
+diff --git a/scripts/all.mk b/scripts/all.mk
+index a6e90aa3eb..517adb8590 100644
+--- a/scripts/all.mk
++++ b/scripts/all.mk
+@@ -1,5 +1,5 @@
+ install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
+-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
++	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
+ 
+ $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
+ 	@mkdir -p $(dir $@)
+@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
+ $(R)$(bindir)/radcrypt: scripts/cryptpasswd
+ 	@mkdir -p $(dir $@)
+ 	@$(INSTALL) -m 755 $< $@
+-
+-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
+-	@mkdir -p $(dir $@)
+-	@$(INSTALL) -m 755 $< $@
diff --git a/freeradius-openssl-no-engine.patch b/freeradius-openssl-no-engine.patch
new file mode 100644
index 0000000..b03ae2b
--- /dev/null
+++ b/freeradius-openssl-no-engine.patch
@@ -0,0 +1,54 @@
+diff --git a/configure b/configure
+index 1e6d228..40a26f5 100755
+--- a/configure
++++ b/configure
+@@ -10518,7 +10518,7 @@ smart_prefix=
+ printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+ 
+ 
+-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
++           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
+ do :
+   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
+ ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+diff --git a/configure.ac b/configure.ac
+index 6a68971..4a95148 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
+       openssl/rand.h \
+       openssl/sha.h \
+       openssl/ssl.h \
+-      openssl/ocsp.h \
+-      openssl/engine.h,
++      openssl/ocsp.h,
+       [ OPENSSL_CPPFLAGS="$smart_include" ],
+       [
+         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
+index 4774482..21d5cea 100644
+--- a/src/include/autoconf.h.in
++++ b/src/include/autoconf.h.in
+@@ -285,9 +285,6 @@
+ /* Define to 1 if you have the <openssl/crypto.h> header file. */
+ #undef HAVE_OPENSSL_CRYPTO_H
+ 
+-/* Define to 1 if you have the <openssl/engine.h> header file. */
+-#undef HAVE_OPENSSL_ENGINE_H
+-
+ /* Define to 1 if you have the <openssl/err.h> header file. */
+ #undef HAVE_OPENSSL_ERR_H
+ 
+diff --git a/src/include/tls-h b/src/include/tls-h
+index 506fb19..514e03a 100644
+--- a/src/include/tls-h
++++ b/src/include/tls-h
+@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
+ #  define OPENSSL_NO_KRB5
+ #endif
+ #include <openssl/err.h>
+-#ifdef HAVE_OPENSSL_ENGINE_H
++#ifndef OPENSSL_NO_ENGINE
+ #  include <openssl/engine.h>
+ #endif
+ #include <openssl/ssl.h>
diff --git a/freeradius-python2-shebangs.patch b/freeradius-python2-shebangs.patch
deleted file mode 100644
index 86954db..0000000
--- a/freeradius-python2-shebangs.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Thu, 18 Oct 2018 12:40:53 -0400
-Subject: [PATCH] Clarify shebangs to be python2
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- scripts/radtee                         | 2 +-
- src/modules/rlm_python/example.py      | 2 +-
- src/modules/rlm_python/prepaid.py      | 2 +-
- src/modules/rlm_python/radiusd.py      | 2 +-
- src/modules/rlm_python/radiusd_test.py | 2 +-
- 5 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/scripts/radtee b/scripts/radtee
-index 123769d244..78b4bcbe0b 100755
---- a/scripts/radtee
-+++ b/scripts/radtee
-@@ -1,4 +1,4 @@
--#!/usr/bin/env python
-+#!/usr/bin/env python2
- from __future__ import with_statement 
- 
- # RADIUS comparison tee v1.0
-diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py
-index 5950a07678..eaf456e349 100644
---- a/src/modules/rlm_python/example.py
-+++ b/src/modules/rlm_python/example.py
-@@ -1,4 +1,4 @@
--#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Python module example file
- # Miguel A.L. Paraz <mparaz@mparaz.com>
-diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py
-index c3cbf57b8f..3b1dc2e2e8 100644
---- a/src/modules/rlm_python/prepaid.py
-+++ b/src/modules/rlm_python/prepaid.py
-@@ -1,4 +1,4 @@
--#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Example Python module for prepaid usage using MySQL
- 
-diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py
-index c535bb3caf..7129923994 100644
---- a/src/modules/rlm_python/radiusd.py
-+++ b/src/modules/rlm_python/radiusd.py
-@@ -1,4 +1,4 @@
--#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Definitions for RADIUS programs
- #
-diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py
-index 13b7128b29..97b5b64f08 100644
---- a/src/modules/rlm_python/radiusd_test.py
-+++ b/src/modules/rlm_python/radiusd_test.py
-@@ -1,4 +1,4 @@
--#! /usr/bin/env python
-+#! /usr/bin/env python2
- #
- # Python module test
- # Miguel A.L. Paraz <mparaz@mparaz.com>
diff --git a/freeradius-radiusd-init b/freeradius-radiusd-init
deleted file mode 100644
index 977a51f..0000000
--- a/freeradius-radiusd-init
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/bin/sh
-#
-# radiusd Start/Stop the FreeRADIUS daemon
-#
-# chkconfig: - 88 10
-# description: Extensible, configurable, high performance RADIUS server.
-
-### BEGIN INIT INFO
-# Provides: radiusd
-# Required-Start: $network
-# Required-Stop:
-# Default-Start:
-# Default-Stop:
-# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc
-# Should-Stop:
-# Short-Description: FreeRADIUS server
-# Description: Extensible, configurable, high performance RADIUS server.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-prog=radiusd
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-exec=${exec:=/usr/sbin/$prog}
-config_dir=${config_dir:=/etc/raddb}
-config=${config:=$config_dir/radiusd.conf}
-pidfile=${pidfile:=/var/run/$prog/$prog.pid}
-lockfile=${lockfile:=/var/lock/subsys/radiusd}
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-    daemon --pidfile $pidfile $exec -d $config_dir
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    killproc -p $pidfile $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    # radiusd may not be capable of a 100% configuration reload depending
-    # on which loadable modules are in use, if sending the server a
-    # HUP is not sufficient then use restart here instead. However, we
-    # prefer by default to use HUP since it's what is usually desired.
-    #    
-    # restart
-
-    kill -HUP `pidofproc -p $pidfile $prog`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile $prog
-}
-
-rh_status_q() {
-    rh_status >/dev/null 2>&1
-}
-
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?
diff --git a/freeradius-tmpfiles.conf b/freeradius-tmpfiles.conf
index ead7a2f..8f20796 100644
--- a/freeradius-tmpfiles.conf
+++ b/freeradius-tmpfiles.conf
@@ -1 +1 @@
-D /var/run/radiusd 0710 radiusd radiusd -
+D /run/radiusd 0710 radiusd radiusd -
diff --git a/freeradius.spec b/freeradius.spec
index 7658dee..7b65a15 100644
--- a/freeradius.spec
+++ b/freeradius.spec
@@ -1,8 +1,8 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.0.20
-Release: 1%{?dist}
-License: GPLv2+ and LGPLv2+
+Version: 3.2.8
+Release: 2%{?dist}
+License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: http://www.freeradius.org/
 
 # Is elliptic curve cryptography supported?
@@ -14,16 +14,23 @@ URL: http://www.freeradius.org/
 
 %global dist_base freeradius-server-%{version}
 
-Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
+Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
 Source104: freeradius-tmpfiles.conf
+Source105: freeradius.sysusers
 
 Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
 Patch2: freeradius-Use-system-crypto-policy-by-default.patch
 Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
+Patch5: freeradius-bootstrap-make-permissions.patch
+Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
+Patch7: freeradius-ease-openssl-version-check.patch
+Patch8: freeradius-configure-c99.patch
+Patch9: freeradius-openssl-no-engine.patch
+Patch10: freeradius-no-sqlippool-tool.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -41,7 +48,9 @@ BuildRequires: readline-devel
 BuildRequires: libpcap-devel
 BuildRequires: systemd-units
 BuildRequires: libtalloc-devel
-BuildRequires: pcre-devel
+BuildRequires: chrpath
+BuildRequires: systemd-rpm-macros
+BuildRequires: libxcrypt-devel
 
 %if ! 0%{?rhel}
 BuildRequires: libyubikey-devel
@@ -51,11 +60,12 @@ BuildRequires: ykclient-devel
 # Require OpenSSL version we built with, or newer, to avoid startup failures
 # due to runtime OpenSSL version checks.
 Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl)
-Requires(pre): shadow-utils glibc-common
+Requires(pre): glibc-common
 Requires(post): systemd-sysv
 Requires(post): systemd-units
-# Needed for certificate generation
-Requires(post): make
+# Needed for certificate generation as upstream bootstrap script isn't
+# compatible with Makefile equivalent.
+Requires: make
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 
@@ -121,7 +131,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project.
 %package perl
 Summary: Perl support for freeradius
 Requires: %{name} = %{version}-%{release}
-Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 %{?fedora:BuildRequires: perl-devel}
 BuildRequires: perl-devel
 BuildRequires: perl-generators
@@ -130,7 +139,7 @@ BuildRequires: perl(ExtUtils::Embed)
 %description perl
 This plugin provides the Perl support for the FreeRADIUS server project.
 
-%if 0%{?fedora} <= 30
+%if 0%{?fedora} <= 30 && 0%{?rhel} < 8
 %package -n python2-freeradius
 Summary: Python 2 support for freeradius
 Requires: %{name} = %{version}-%{release}
@@ -195,36 +204,39 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.
 
+
+%package kafka
+Summary: Kafka producer support for FreeRADIUS
+Requires: %{name} = %{version}-%{release}
+Requires: librdkafka
+BuildRequires: librdkafka-devel
+
+%description kafka
+This plugin provides Kafka producer support for the FreeRADIUS server project.
+
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
 # mistakenly includes the backup files, especially problematic for raddb config files.
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
 
 %build
 # Force compile/link options, extra security for network facing daemon
 %global _hardened_build 1
 
-# Hack: rlm_python3 as stable; prevents building other unstable modules.
-sed 's/rlm_python/rlm_python3/g' src/modules/stable -i
-
-# python3-config is broken:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1772988
-export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')"
+%global build_ldflags %{build_ldflags} $(python3-config --embed --libs)
+export PY3_LIB_DIR="$(python3-config --configdir)"
 export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')"
 
-# Hack: rlm_python3 configure.ac script is broken because it doesn't
-# respect --with-rlm-python3-include-dir.
-sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac
-
-# In order for the above hack to stick, do a fake configure so
-# we can run reconfig before cleaning up after ourselves and running
-# configure for real.
-./configure && make reconfig && (make clean distclean || true)
-
 %configure \
         --libdir=%{_libdir}/freeradius \
         --enable-reproducible-builds \
@@ -243,6 +255,7 @@ sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try
         --with-rlm_python3 \
         --with-rlm-python3-lib-dir=$PY3_LIB_DIR \
         --with-rlm-python3-include-dir=$PY3_INC_DIR \
+        --without-rlm_python \
         --without-rlm_eap_ikev2 \
         --without-rlm_eap_tnc \
         --without-rlm_sql_iodbc \
@@ -254,7 +267,8 @@ sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try
         --without-rlm_rediswho \
         --without-rlm_cache_memcached
 
-make
+# Build fast, but get better errors if we fail
+make %{?_smp_mflags} || make -j1
 
 %install
 mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/lib/radiusd
@@ -273,13 +287,24 @@ mkdir -p %{buildroot}%{_localstatedir}/run/
 install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/
 install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp
 install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf
+install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf
 
 # install SNMP MIB files
 mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/
 install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/
 
+# remove rpath where needed
+chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so
+for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done
+for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done
+
+# update ld with freeradius libs
+mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d
+echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
+
 # remove unneeded stuff
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt
+rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key
@@ -298,6 +323,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql
 
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle
+rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle
 rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle
 rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids
@@ -342,23 +368,23 @@ All documentation is in the freeradius-doc sub-package.
 
 EOF
 
-
-# Make sure our user/group is present prior to any package or subpackage installation
-%pre
-getent group  radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1
-getent passwd radiusd >/dev/null || /usr/sbin/useradd  -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1
-exit 0
-
 %preun
 %systemd_preun radiusd.service
 
-%postun
-%systemd_postun_with_restart radiusd.service
-if [ $1 -eq 0 ]; then           # uninstall
-  getent passwd radiusd >/dev/null && /usr/sbin/userdel  radiusd > /dev/null 2>&1
-  getent group  radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1
+%post
+# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
+# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
+if [ -x /usr/sbin/setsebool ]; then
+    /usr/sbin/setsebool -P radius_use_jit on || :
 fi
-exit 0
+
+%postun
+if [ $1 -eq 0 ]; then
+    if [ -x /usr/sbin/setsebool ]; then
+        /usr/sbin/setsebool -P radius_use_jit off || :
+    fi
+fi
+%systemd_postun_with_restart radiusd.service
 
 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :
 
@@ -374,8 +400,10 @@ exit 0
 # system
 %config(noreplace) %{_sysconfdir}/pam.d/radiusd
 %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd
+%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_unitdir}/radiusd.service
 %{_tmpfilesdir}/radiusd.conf
+%{_sysusersdir}/freeradius.conf
 %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd
 %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp
 %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd
@@ -408,7 +436,8 @@ exit 0
 %dir %attr(770,root,radiusd) /etc/raddb/certs
 %config(noreplace) /etc/raddb/certs/Makefile
 %config(noreplace) /etc/raddb/certs/passwords.mk
-/etc/raddb/certs/README
+/etc/raddb/certs/README.md
+/etc/raddb/certs/realms/README.md
 %config(noreplace) /etc/raddb/certs/xpextensions
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf
 %attr(750,root,radiusd) /etc/raddb/certs/bootstrap
@@ -422,6 +451,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/*
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/*
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter
@@ -433,6 +463,8 @@ exit 0
 # sites-available
 %dir %attr(750,root,radiusd) /etc/raddb/sites-available
 /etc/raddb/sites-available/README
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting
@@ -454,8 +486,11 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache
 
 # sites-enabled
 # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx
@@ -469,7 +504,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui
@@ -478,6 +513,9 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients
@@ -491,6 +529,8 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip
@@ -498,7 +538,6 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd
@@ -515,21 +554,24 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit
 
 # mods-enabled
 # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx
 %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled
 %config(missingok) /etc/raddb/mods-enabled/always
 %config(missingok) /etc/raddb/mods-enabled/attr_filter
-%config(missingok) /etc/raddb/mods-enabled/cache_eap
 %config(missingok) /etc/raddb/mods-enabled/chap
 %config(missingok) /etc/raddb/mods-enabled/date
 %config(missingok) /etc/raddb/mods-enabled/detail
@@ -554,9 +596,11 @@ exit 0
 %config(missingok) /etc/raddb/mods-enabled/replicate
 %config(missingok) /etc/raddb/mods-enabled/soh
 %config(missingok) /etc/raddb/mods-enabled/sradutmp
+%config(missingok) /etc/raddb/mods-enabled/totp
 %config(missingok) /etc/raddb/mods-enabled/unix
 %config(missingok) /etc/raddb/mods-enabled/unpack
 %config(missingok) /etc/raddb/mods-enabled/utf8
+%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit
 
 # policy
 %dir %attr(750,root,radiusd) /etc/raddb/policy.d
@@ -574,10 +618,10 @@ exit 0
 
 # binaries
 %defattr(-,root,root)
-/usr/sbin/checkrad
-/usr/sbin/raddebug
-/usr/sbin/radiusd
-/usr/sbin/radmin
+%{_bindir}/checkrad
+%{_bindir}/raddebug
+%{_bindir}/radiusd
+%{_bindir}/radmin
 
 # dictionaries
 %dir %attr(755,root,root) /usr/share/freeradius
@@ -602,7 +646,6 @@ exit 0
 %{_libdir}/freeradius/rlm_cache_rbtree.so
 %{_libdir}/freeradius/rlm_chap.so
 %{_libdir}/freeradius/rlm_counter.so
-%{_libdir}/freeradius/rlm_cram.so
 %{_libdir}/freeradius/rlm_date.so
 %{_libdir}/freeradius/rlm_detail.so
 %{_libdir}/freeradius/rlm_dhcp.so
@@ -611,7 +654,6 @@ exit 0
 %{_libdir}/freeradius/rlm_eap.so
 %{_libdir}/freeradius/rlm_eap_fast.so
 %{_libdir}/freeradius/rlm_eap_gtc.so
-%{_libdir}/freeradius/rlm_eap_leap.so
 %{_libdir}/freeradius/rlm_eap_md5.so
 %{_libdir}/freeradius/rlm_eap_mschapv2.so
 %{_libdir}/freeradius/rlm_eap_peap.so
@@ -626,10 +668,10 @@ exit 0
 %{_libdir}/freeradius/rlm_expr.so
 %{_libdir}/freeradius/rlm_files.so
 %{_libdir}/freeradius/rlm_ippool.so
+%{_libdir}/freeradius/rlm_json.so
 %{_libdir}/freeradius/rlm_linelog.so
 %{_libdir}/freeradius/rlm_logintime.so
 %{_libdir}/freeradius/rlm_mschap.so
-%{_libdir}/freeradius/rlm_otp.so
 %{_libdir}/freeradius/rlm_pam.so
 %{_libdir}/freeradius/rlm_pap.so
 %{_libdir}/freeradius/rlm_passwd.so
@@ -642,12 +684,17 @@ exit 0
 %{_libdir}/freeradius/rlm_sql.so
 %{_libdir}/freeradius/rlm_sqlcounter.so
 %{_libdir}/freeradius/rlm_sqlippool.so
+%{_libdir}/freeradius/rlm_sql_map.so
 %{_libdir}/freeradius/rlm_sql_null.so
+%{_libdir}/freeradius/rlm_totp.so
 %{_libdir}/freeradius/rlm_unix.so
 %{_libdir}/freeradius/rlm_unpack.so
 %{_libdir}/freeradius/rlm_utf8.so
 %{_libdir}/freeradius/rlm_wimax.so
 %{_libdir}/freeradius/rlm_yubikey.so
+%{_libdir}/freeradius/rlm_dpsk.so
+%{_libdir}/freeradius/rlm_eap_teap.so
+%{_libdir}/freeradius/rlm_proxy_rate_limit.so
 
 # main man pages
 %doc %{_mandir}/man5/clients.conf.5.gz
@@ -668,6 +715,7 @@ exit 0
 %doc %{_mandir}/man5/rlm_passwd.5.gz
 %doc %{_mandir}/man5/rlm_realm.5.gz
 %doc %{_mandir}/man5/rlm_sql.5.gz
+%doc %{_mandir}/man5/rlm_unbound.5.gz
 %doc %{_mandir}/man5/rlm_unix.5.gz
 %doc %{_mandir}/man5/unlang.5.gz
 %doc %{_mandir}/man5/users.5.gz
@@ -675,6 +723,7 @@ exit 0
 %doc %{_mandir}/man8/radiusd.8.gz
 %doc %{_mandir}/man8/radmin.8.gz
 %doc %{_mandir}/man8/radrelay.8.gz
+%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz
 
 # MIB files
 %{_datadir}/snmp/mibs/*RADIUS*.mib
@@ -718,7 +767,7 @@ exit 0
 
 %{_libdir}/freeradius/rlm_perl.so
 
-%if 0%{?fedora} <= 30
+%if 0%{?fedora} <= 30 && 0%{?rhel} < 8
 %files -n python2-freeradius
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python
 /etc/raddb/mods-config/python/example.py*
@@ -736,6 +785,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf
 
@@ -743,19 +793,55 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql
 
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf
+%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql
+
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql
+
+%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax
@@ -773,6 +859,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf
 
@@ -789,6 +876,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf
@@ -800,6 +888,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf
 
@@ -818,6 +907,9 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh
 
 %{_libdir}/freeradius/rlm_sql_sqlite.so
 
@@ -832,7 +924,237 @@ exit 0
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
+%files kafka
+%{_libdir}/freeradius/rlm_kafka.so
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
+
 %changelog
+* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
+- Enable selinux flag for JIT usage
+  Resolves: #2427017
+
+* Mon Nov 10 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
+- Update to upstream release 3.2.8
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.7-5
+- Perl 5.42 rebuild
+
+* Wed Jun 11 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-4
+- Update logrotate postrotate script with `systemctl try-reload-or-restart`
+  Resolves: rhbz#2371329
+
+* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.2.7-3
+- Rebuilt for Python 3.14
+
+* Wed Mar 5 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-1
+- Update to upstream release 3.2.7
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.5-7
+- Drop call to %sysusers_create_compat
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.2.5-6
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Antonio Torres <antorres@redhat.com> - 3.2.5-5
+- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Nov 06 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 3.2.5-3
+- Drop openssl-devel-engine dependency
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Antonio Torres <antorres@redhat.com> - 3.2.5-1
+- Update to upstream release 3.2.5
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.4-3
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 3.2.4-2
+- Rebuilt for Python 3.13
+
+* Fri May 31 2024 Antonio Torres <antorres@redhat.com> - 3.2.4-1
+- Update to upstream release 3.2.4
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Dec 19 2023 Florian Weimer <fweimer@redhat.com> - 3.2.3-2
+- Fix C compatibility issue in configure script
+
+* Tue Oct 24 2023 Antonio Torres <antorres@redhat.com> - 3.2.3-1
+- Update to upstream release 3.2.3
+
+* Tue Sep 12 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-5
+- Ease OpenSSL version check requirement
+  Resolves #2238511
+
+* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.2-3
+- Perl 5.38 rebuild
+
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.2.2-2
+- Rebuilt for Python 3.12
+
+* Tue Mar 21 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-1
+- Update to upstream release 3.2.2
+
+* Wed Mar 15 2023 Antonio Torres <antorres@redhat.com> - 3.2.1-4
+- Migrate to SPDX license
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-2
+- Remove hack for Python3 support from specfile
+
+* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-1
+- Update to 3.2.1 upstream release
+  Resolves #2131850
+
+* Tue Sep 20 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-4
+- Remove deprecated pcre-devel dependency
+  Resolves #2128292
+
+* Mon Sep 5 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-3
+- configure: allow building with runstatedir option
+  Resolves: #2123374
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Jul 19 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-1
+- Rebase to 3.2.0 upstream release
+  Related: #2077687
+
+* Wed Jun 29 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-8
+- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107)
+  Related: #2095741
+
+* Fri Jun 24 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-7
+- Dynamically allocate users using sysusers.d format
+  Related: #2095741
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 3.0.25-6
+- Rebuilt for Python 3.11
+
+* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.25-5
+- Perl 5.36 rebuild
+
+* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-4
+- Use infinite timeout when using LDAP+start-TLS
+  Related: #1983063
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.25-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Oct 14 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-2
+- Fix file conflict in SQL files
+  Resolves: bz#2014014 
+
+* Fri Oct 08 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-1
+- Update to 3.0.25.
+  Resolves: bz#2011984
+
+* Thu Sep 30 2021 Antonio Torres <antorres@redhat.com> - 3.0.24-1
+- Update to 3.0.24.
+  Resolves: bz#2009036
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 3.0.23-7
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.23-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Thu Jul 15 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-5
+- Fix coredump not being able to be enabled
+
+* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 3.0.23-4
+- Rebuild for versioned symbols in json-c
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
+- Fix rpath not being removed correctly
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
+- Remove RPATH usage from additional binaries
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-1
+- Rebase to 3.0.23
+  Fixes: bz#1970528
+
+* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-5
+- Fix binaries not being correctly linked after RPATH removal
+
+* Fri Jun 25 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-4
+- Fix python3 not being correctly linked
+
+* Mon Jun 07 2021 Python Maint <python-maint@redhat.com> - 3.0.22-2
+- Rebuilt for Python 3.10
+
+* Fri Jun 4 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-1
+- Rebased to 3.0.22
+  Resolves: bz#1961190
+
+* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.21-12
+- Perl 5.34 rebuild
+
+* Wed Mar 10 2021 Robbie Harwood <rharwood@redhat.com> - 3.0.21-11
+- Disable automatic bootstrap
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.21-10
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 3.0.21-9
+- rebuild for libpq ABI fix rhbz#1908268
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.21-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Tue Aug 04 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-7
+- Fix certificate permissions after make-based generation
+  Resolves: bz#1835249
+
+* Tue Aug 04 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-6
+- Fix certificate permissions after make-based generation
+  Resolves: bz#1835249
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.21-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.21-4
+- Perl 5.32 rebuild
+
+* Wed May 13 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-3
+- Fix certificate generation
+  Resolves: bz#1835249
+
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 3.0.21-2
+- Rebuild (json-c)
+
+* Wed Apr 01 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-1
+- Rebased to 3.0.21
+  Resolves: bz#1816745
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.20-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Sat Jan 11 2020 Paul Wouters <pwouters@redhat.com> - 3.0.20-2
+- fixup tmpfile to use /run instead of /var/run
+
 * Fri Nov 15 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.20-1
 - Rebased to 3.0.20
   Resolves: bz#1772710
diff --git a/freeradius.sysusers b/freeradius.sysusers
new file mode 100644
index 0000000..af912e0
--- /dev/null
+++ b/freeradius.sysusers
@@ -0,0 +1,3 @@
+#Type Name     ID  GECOS           Home directory        Shell
+u     radiusd  95  "radiusd user"  /var/lib/radiusd      /sbin/nologin
+g     radiusd  95  -               -                     -
diff --git a/radiusd.service b/radiusd.service
index d073530..9bfa3cd 100644
--- a/radiusd.service
+++ b/radiusd.service
@@ -5,8 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
-ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap
+ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..0c3bdf7
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,3 @@
+---
+inspections:
+    badfuncs: off
diff --git a/sources b/sources
index ab35246..3fdee90 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e
+SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae
diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py
index da5afe1..d646188 100755
--- a/tests/auth-tests/freeradius-tests.py
+++ b/tests/auth-tests/freeradius-tests.py
@@ -15,7 +15,6 @@ import unittest
 import subprocess
 import signal
 import shutil
-import psutil
 import socket
 
 RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid'
diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh
index 7be8432..ceaeaa7 100755
--- a/tests/auth-tests/runtest.sh
+++ b/tests/auth-tests/runtest.sh
@@ -16,6 +16,25 @@ PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"
 
+generate_cert(){
+    pushd /etc/raddb/certs/
+    #remove certificates if exists;generate new certificates
+    if [[ -f /etc/raddb/certs/bootstrap ]]; then
+        rlLog "Destroy and create new default certificates via bootstrap script"
+        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
+        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
+    else
+        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
+        rlLog "Destroy and create new default certificates via make scripts"
+        make destroycerts -C /etc/raddb/certs/
+        #create new certificates
+        make -C /etc/raddb/certs/
+        chown root:radiusd dh ca.* client.* server.*
+        chmod 640 dh ca.* client.* server.*
+    fi
+    popd
+}
+
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE
@@ -29,6 +48,7 @@ rlJournalStart
         rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
         rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
         rlRun "systemctl daemon-reload"
+        generate_cert
     rlPhaseEnd
 
     rlPhaseStartTest