diff --git a/.gitignore b/.gitignore index 4530dbe..2f5a9d8 100644 --- a/.gitignore +++ b/.gitignore @@ -34,15 +34,3 @@ freeradius-*.src.rpm /freeradius-server-3.0.19.tar.bz2 /freeradius-server-3.0.20.tar.bz2 /freeradius-server-3.0.21.tar.bz2 -/freeradius-server-3.0.22.tar.bz2 -/freeradius-server-3.0.23.tar.bz2 -/freeradius-server-3.0.24.tar.bz2 -/freeradius-server-3.0.25.tar.bz2 -/freeradius-server-3.2.0.tar.bz2 -/freeradius-server-3.2.1.tar.bz2 -/freeradius-server-3.2.2.tar.bz2 -/freeradius-server-3.2.3.tar.bz2 -/freeradius-server-3.2.4.tar.bz2 -/freeradius-server-3.2.5.tar.bz2 -/freeradius-server-3.2.7.tar.bz2 -/freeradius-server-3.2.8.tar.bz2 diff --git a/find_module_deps b/find_module_deps new file mode 100755 index 0000000..c114baa --- /dev/null +++ b/find_module_deps @@ -0,0 +1,385 @@ +#!/usr/bin/env python + +import exceptions +import getopt +import os +import re +import rpm +import select +import subprocess +import sys + +#------------------------------------------------------------------------------ + +def get_rlms(root): + rlm_re = re.compile(r'^rlm_') + version_re = re.compile(r'-[0-9.]+\.so$') + names = os.listdir(root) + names = [x for x in names if rlm_re.search(x)] + names = [x for x in names if not version_re.search(x)] + names.sort() + return names + +#------------------------------------------------------------------------------ + +debug = False +verbose = False + +exclude_rpms = ['glibc'] + +build = '2.0.2-1.fc8' +root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius' +libdirs = ['/lib','/usr/lib'] + +#------------------------------------------------------------------------------ + +def get_rpm_nvr_from_header(hdr): + 'Given an RPM header return the package NVR as a string' + name = hdr['name'] + version = hdr['version'] + release = hdr['release'] + + return "%s-%s-%s" % (name, version, release) + +def get_rpm_hdr_by_file_path(path): + if path is None: + return None + + hdr = None + try: + ts = rpm.ts() + mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path) + for hdr in mi: break + except Exception, e: + print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e) + hdr = None + return hdr + +def get_rpm_nvr_by_file_path(path): + if path is None: + return None + + hdr = get_rpm_hdr_by_file_path(path) + if not hdr: + print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) + nvr = get_rpm_nvr_from_header(hdr) + return nvr + +def get_rpm_name_by_file_path(path): + if path is None: + return None + + hdr = get_rpm_hdr_by_file_path(path) + if not hdr: + print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) + name = hdr['name'] + return name + +#------------------------------------------------------------------------------ + +class CmdError(exceptions.Exception): + def __init__(self, errno, msg): + self.errno = errno + self.msg = msg + + +class Command: + def __init__(self, cmd): + self.cmd = cmd + self.sub_process = None + self.bufsize = 1024 + self.stdout_buf = '' + self.stderr_buf = '' + self.stdout_lines = [] + self.stderr_lines = [] + + def run(self, stdout_callback=None, stderr_callback=None): + self.sub_process = subprocess.Popen(self.cmd, \ + stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \ + close_fds=True, shell=True) + self.stdout = self.sub_process.stdout + self.stderr = self.sub_process.stderr + + read_watch = [self.stdout, self.stderr] + while read_watch: + readable = select.select(read_watch, [], [])[0] + for fd in readable: + if fd == self.stdout: + data = os.read(fd.fileno(), self.bufsize) + if not data: + read_watch.remove(fd) + else: + self.stdout_buf += data + for line in self.burst_lines('stdout_buf'): + if stdout_callback: stdout_callback(line) + self.stdout_lines.append(line) + if fd == self.stderr: + data = os.read(fd.fileno(), self.bufsize) + if not data: + read_watch.remove(fd) + else: + self.stderr_buf += data + for line in self.burst_lines('stderr_buf'): + if stdout_callback: stderr_callback(line) + self.stderr_lines.append(line) + + self.returncode = self.sub_process.wait() + if self.returncode: + raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines))) + + return self.returncode + + def burst_lines(self, what): + buf = getattr(self, what) + start = 0 + end = buf.find('\n', start) + while end >= 0: + end += 1 # include newline + line = buf[start:end] + yield line + start = end + end = buf.find('\n', start) + buf = buf[start:] + setattr(self, what, buf) + + +#------------------------------------------------------------------------------ + +def get_so_requires(path): + requires = {} + cmd = 'ldd %s' % (path) + so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)') + + c = Command(cmd) + status = c.run() + + for line in c.stdout_lines: + line = line.strip() + match = so_re.search(line) + if match: + so_name = match.group(1) + if match.group(2).startswith('/'): + so_path = match.group(2) + else: + so_path = None + + requires[so_name] = so_path + return requires + +def get_so_needed(path): + needed = [] + cmd = 'readelf -d %s' % (path) + so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]') + + c = Command(cmd) + status = c.run() + + for line in c.stdout_lines: + line = line.strip() + match = so_re.search(line) + if match: + so_name = match.group(1) + needed.append(so_name) + return needed + +def format_size(size): + if size > 1000000000: + return '%.1f GB' % (size/1000000000.0) + if size > 1000000: + return '%.1f MB' % (size/1000000.0) + if size > 1000: + return '%.1f KB' % (size/1000.0) + return '%d' % (size) +#------------------------------------------------------------------------------ + +class RPM_Prop: + def __init__(self, path=None, name=None): + self.name = name + self.paths = {} + self.rpm_hdr = None + self.used_by = {} + if path: + self.register_path(path) + if not self.rpm_hdr: + self.rpm_hdr = get_rpm_hdr_by_file_path(path) + if self.rpm_hdr: + if not self.name: + self.name = self.rpm_hdr[rpm.RPMTAG_NAME] + self.size = self.rpm_hdr[rpm.RPMTAG_SIZE] + + def __str__(self): + return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys())) + + def register_path(self, path, name=None): + if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) + return self.paths.setdefault(path, path) + +class RPM_Collection: + def __init__(self): + self.names = {} + self.paths = {} + + def __str__(self): + text = '' + names = self.get_names() + for name in names: + text += "%s: %s\n" % (name, self.names[name]) + return text + + def register_path(self, path): + if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) + rpm_prop = self.paths.get(path) + if not rpm_prop: + rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path)) + self.names.setdefault(rpm_prop.name, rpm_prop) + return rpm_prop + + def get_names(self): + names = self.names.keys() + names.sort() + return names + + def get_name(self, name): + return self.names.get(name) + +class SO_File: + def __init__(self, name=None, path=None): + self.name = name + self.path = path + self.rpm = None + + def __str__(self): + if self.rpm: + rpm_name = self.rpm.name + else: + rpm_name = None + return "name=%s rpm=%s" % (self.name, rpm_name) + +class SO_Collection: + def __init__(self): + self.names = {} + self.paths = {} + + def __str__(self): + text = '' + names = self.get_names() + for name in names: + text += "%s: %s\n" % (name, self.names[name]) + return text + + def register_path(self, path, name=None): + if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) + so_prop = self.paths.get(path) + if not so_prop: + so_prop = self.paths.setdefault(path, SO_File(name, path=path)) + self.names.setdefault(name, so_prop) + return so_prop + + def get_names(self): + names = self.names.keys() + names.sort() + return names + +class LoadableModule: + def __init__(self, path, name=None): + if name is None: + name = os.path.basename(path) + self.name = name + self.path = path + self.rpm_names = {} + self.sos = SO_Collection() + self.get_so_requires() + + def __str__(self): + text = '%s\n' % (self.name) + text += " RPM's: %s\n" % (','.join(self.get_rpm_names())) + text += " SO's: %s\n" % (','.join(self.sos.get_names())) + return text + + def get_so_requires(self): + requires = get_so_requires(self.path) + needed = get_so_needed(self.path) + #print "%s requires=%s" % (self.name, requires) + #print "%s needed=%s" % (self.name, needed) + + for so_name, so_path in requires.items(): + if so_name not in needed: continue + if so_path: + so_prop = self.sos.register_path(so_path, so_name) + rpm_prop = rpms.register_path(so_prop.path) + rpm_prop.used_by[self.name] = 1 + self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name) + so_prop.rpm = rpm_prop + else: + so_prop = None + if verbose: print "found so='%s' %s" % (so_name, so_prop) + + def register_so(self, so): + if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so) + self.sos.setdefault(so, so) + self.names.setdefault(so.name, so) + return so + + def get_rpm_names(self): + rpm_names = self.rpm_names.keys() + rpm_names.sort() + return rpm_names + + def get_sos(self): + sos = self.sos.keys() + sos.sort(lambda a,b: cmp(a.name, b.name)) + return sos + +#------------------------------------------------------------------------------ + +#------------------------------------------------------------------------------ + +opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose']) +for o, a in opts: + if o in ['-b', '--build']: + build = a + elif o in ['-v', '--verbose']: + verbose = True + else: + print >> sys.stderr, "Unknown arg: %s" % o + sys.exit(1) + +root = root_template % build +modules = get_rlms(root) +module_paths = [os.path.join(root,x) for x in modules] +rpms = RPM_Collection() + +lms = [] +for module_path in module_paths[:]: + lm = LoadableModule(module_path) + lms.append(lm) + + +print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules)) + +for lm in lms: + rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms] + if rpm_names: + print lm.name + print ' %s' % (','.join(rpm_names)) + +print "--------------" + +rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms] +rpm_props.sort(lambda a,b: cmp(a.name, b.name)) +for rpm_prop in rpm_props: + used_by = rpm_prop.used_by.keys() + used_by.sort() + print "%s: %s" % (rpm_prop.name, ','.join(used_by)) + +print "--------------" + +rpm_props.sort(lambda a,b: cmp(a.size, b.size)) +for rpm_prop in rpm_props: + print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name) + + +print "--------------" + +for lm in lms: + print lm diff --git a/freeradius-Add-missing-option-descriptions.patch b/freeradius-Add-missing-option-descriptions.patch new file mode 100644 index 0000000..4138b4f --- /dev/null +++ b/freeradius-Add-missing-option-descriptions.patch @@ -0,0 +1,97 @@ +From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 12:20:11 +0300 +Subject: [PATCH] man: Add missing option descriptions + +--- + man/man8/raddebug.8 | 4 ++++ + man/man8/radiusd.8 | 7 +++++++ + man/man8/radmin.8 | 4 ++++ + 3 files changed, 15 insertions(+) + +diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8 +index 66e80e64fa..6e27e2453c 100644 +--- a/man/man8/raddebug.8 ++++ b/man/man8/raddebug.8 +@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server. + .IR condition ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-n + .IR name ] + .RB [ \-i +@@ -73,6 +75,8 @@ option is equivalent to using: + .IP "\-d \fIconfig directory\fP" + The radius configuration directory, usually /etc/raddb. See the + \fIradmin\fP manual page for more description of this option. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-n \fImname\fP" + Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP. + .IP \-I\ \fIipv6-address\fP +diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8 +index c825f22d0d..98aef5e1be 100644 +--- a/man/man8/radiusd.8 ++++ b/man/man8/radiusd.8 +@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server + .RB [ \-C ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-f ] + .RB [ \-h ] + .RB [ \-i +@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server + .IR name ] + .RB [ \-p + .IR port ] ++.RB [ \-P ] + .RB [ \-s ] + .RB [ \-t ] + .RB [ \-v ] +@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked. + .IP "\-d \fIconfig directory\fP" + Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration + files such as the \fIdictionary\fP and the \fIusers\fP files. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP \-f + Do not fork, stay running as a foreground process. + .IP \-h +@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in + \fIradiusd.conf\fP are ignored. + + This option MUST be used in conjunction with "-i". ++.IP "\-P ++Always write out PID, even with -f. + .IP \-s + Run in "single server" mode. The server normally runs with multiple + threads and/or processes, which can lower its response time to +diff --git a/man/man8/radmin.8 b/man/man8/radmin.8 +index 5ecc963d81..5bf661fa71 100644 +--- a/man/man8/radmin.8 ++++ b/man/man8/radmin.8 +@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool + .B radmin + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-e + .IR command ] + .RB [ \-E ] +@@ -34,6 +36,8 @@ The following command-line options are accepted by the program. + Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server + configuration files to find the "listen" section that defines the + control socket filename. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-e \fIcommand\fP" + Run \fIcommand\fP and exit. + .IP \-E +-- +2.18.0 + diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index 33747d0..6b2329b 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -3,27 +3,25 @@ From: Nikolai Kondrashov Date: Mon, 8 Sep 2014 12:32:13 +0300 Subject: [PATCH] Adjust configuration to fit Red Hat specifics -[antorres@redhat.com]: update patch to match 3.2.7 release - --- raddb/mods-available/eap | 4 ++-- raddb/radiusd.conf.in | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 84660d7c1e..ffcef4b406 100644 +index 2621e183c..94494b2c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -696,7 +696,7 @@ eap { - # and create the temporary directory with the - # systemd `RuntimeDirectory` unit option. +@@ -533,7 +533,7 @@ + # You should also delete all of the files + # in the directory when the server starts. # - # tmpdir = /tmp/radiusd + # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -711,7 +711,7 @@ eap { +@@ -548,7 +548,7 @@ # deleted by the server when the command # returns. # @@ -32,7 +30,6 @@ index 84660d7c1e..ffcef4b406 100644 } # OCSP Configuration - diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-Fix-resource-hard-limit-error.patch b/freeradius-Fix-resource-hard-limit-error.patch new file mode 100644 index 0000000..800c06c --- /dev/null +++ b/freeradius-Fix-resource-hard-limit-error.patch @@ -0,0 +1,32 @@ +commit 1ce4508c92493cf03ea1b3c42e83540b387884fa +Author: Antonio Torres +Date: Fri Jul 2 07:12:48 2021 -0400 +Subject: [PATCH] debug: don't set resource hard limit to zero + + Setting the resource hard limit to zero is irreversible, meaning if it + is set to zero then there is no way to set it higher. This means + enabling core dump is not possible, since setting a new resource limit + for RLIMIT_CORE would fail. By only setting the soft limit to zero, we + can disable and enable core dumps without failures. + + This fix is present in both main and 3.0.x upstream branches. + + Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572 + Signed-off-by: Antonio Torres antorres@redhat.com +--- + src/lib/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib/debug.c b/src/lib/debug.c +index 576bcb2a65..6330c9cb66 100644 +--- a/src/lib/debug.c ++++ b/src/lib/debug.c +@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps) + struct rlimit no_core; + + no_core.rlim_cur = 0; +- no_core.rlim_max = 0; ++ no_core.rlim_max = core_limits.rlim_max; + + if (setrlimit(RLIMIT_CORE, &no_core) < 0) { + fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno)); diff --git a/freeradius-OpenSSL-HMAC-MD5.patch b/freeradius-OpenSSL-HMAC-MD5.patch new file mode 100644 index 0000000..1e54c55 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-MD5.patch @@ -0,0 +1,68 @@ +From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 09:54:46 -0400 +Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-MD5. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++- + 1 file changed, 33 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c +index 2c662ff368..1cca00fa2a 100644 +--- a/src/lib/hmacmd5.c ++++ b/src/lib/hmacmd5.c +@@ -27,10 +27,41 @@ + + RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + #include + +-/** Calculate HMAC using MD5 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's MD5 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ * ++ */ ++void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ ++#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW ++ /* Since MD5 is not allowed by FIPS, explicitly allow it. */ ++ HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); ++#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */ ++ ++ HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++#else ++/** Calculate HMAC using internal MD5 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -101,6 +132,7 @@ + * hash */ + fr_md5_final(digest, &context); /* finish up 2nd pass */ + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-OpenSSL-HMAC-SHA1.patch b/freeradius-OpenSSL-HMAC-SHA1.patch new file mode 100644 index 0000000..6c60951 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-SHA1.patch @@ -0,0 +1,73 @@ +From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 11:03:52 -0400 +Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-SHA1. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c +index c3cbd87a2c..211470ea35 100644 +--- a/src/lib/hmacsha1.c ++++ b/src/lib/hmacsha1.c +@@ -10,13 +10,19 @@ + + RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + + #ifdef HMAC_SHA1_DATA_PROBLEMS + unsigned int sha1_data_problems = 0; + #endif + +-/** Calculate HMAC using SHA1 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's SHA1 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -28,6 +34,26 @@ + void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, + uint8_t const *key, size_t key_len) + { ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++ ++#else ++ ++/** Calculate HMAC using internal SHA1 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ */ ++void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ + fr_sha1_ctx context; + uint8_t k_ipad[65]; /* inner padding - key XORd with ipad */ + uint8_t k_opad[65]; /* outer padding - key XORd with opad */ +@@ -142,6 +168,7 @@ + } + #endif + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 74f3cfd..199e583 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -4,7 +4,6 @@ Date: Wed, 8 May 2019 10:16:31 -0400 Subject: [PATCH] Use system-provided crypto-policies by default Signed-off-by: Alexander Scheel -[antorres@redhat.com]: update patch to 3.2.1 state --- raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- @@ -13,21 +12,21 @@ Signed-off-by: Alexander Scheel 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 62152a6dfc..9f64963034 100644 +index 36849e10f2..b28c0f19c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -400,7 +400,7 @@ eap { - # TLS cipher suites. The format is listed - # in "man 1 ciphers". +@@ -368,7 +368,7 @@ eap { + # + # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" # - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - # Set this option to specify the allowed - # TLS signature algorithms for OpenSSL 1.1.1 and above. -@@ -1082,7 +1082,7 @@ eap { - # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is - # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used + # If enabled, OpenSSL will use server cipher list + # (possibly defined by cipher_list option above) +@@ -912,7 +912,7 @@ eap { + # Note - for OpenSSL 1.1.0 and above you may need + # to add ":@SECLEVEL=0" # - # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" + # cipher_list = "PROFILE=SYSTEM" @@ -48,23 +47,23 @@ index 576eb7739e..ffa07188e2 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index b8d0626bbe..073b2933c2 100644 +index 92f1d6330e..cd69b3905a 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls -@@ -20,7 +20,7 @@ listen { +@@ -19,7 +19,7 @@ listen { dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" + cache { enable = no - lifetime = 24 # hours diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index 137fcbc6cc..a65f8a8711 100644 +index bbc761b1c5..83cd35b851 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -292,7 +292,7 @@ listen { +@@ -215,7 +215,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -73,15 +72,15 @@ index 137fcbc6cc..a65f8a8711 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -676,7 +676,7 @@ home_server tls { +@@ -517,7 +517,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" + } - # - # Connection timeout for outgoing TLS connections. + } -- 2.21.0 diff --git a/freeradius-autogen.sh b/freeradius-autogen.sh new file mode 100755 index 0000000..9cba642 --- /dev/null +++ b/freeradius-autogen.sh @@ -0,0 +1,21 @@ +#!/bin/sh -e + +parentdir=`dirname $0` + +cd $parentdir +parentdir=`pwd` + +libtoolize -f -c +#aclocal +autoheader +autoconf + +mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`" +mysubdirs=`echo $mysubdirs` + +for F in $mysubdirs +do + echo "Configuring in $F..." + (cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir) + (cd $F && autoconf -I$parentdir) +done diff --git a/freeradius-configure-c99.patch b/freeradius-configure-c99.patch deleted file mode 100644 index cc9daff..0000000 --- a/freeradius-configure-c99.patch +++ /dev/null @@ -1,35 +0,0 @@ -The backtrace_symbols function expects a pointer to an array of void * -values, not a pointer to an array of a single element. Removing the -address operator ensures that the right type is used. - -This avoids an unconditional failure of this probe with compilers that -treat incompatible pointer types as a compilation error. - -Submitted upstream: - -diff --git a/configure b/configure -index ed01ee2bdd912f63..1e6d2284779cdd58 100755 ---- a/configure -+++ b/configure -@@ -13390,7 +13390,7 @@ main (void) - { - - void *sym[1]; -- backtrace_symbols(&sym, sizeof(sym)) -+ backtrace_symbols(sym, sizeof(sym)) - ; - return 0; - } -diff --git a/configure.ac b/configure.ac -index 76320213b51d7bb4..6a689711d6c90483 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then - #include - ]], [[ - void *sym[1]; -- backtrace_symbols(&sym, sizeof(sym)) ]])],[ -+ backtrace_symbols(sym, sizeof(sym)) ]])],[ - AC_MSG_RESULT(yes) - ac_cv_lib_execinfo_backtrace_symbols="yes" - ],[ diff --git a/freeradius-ease-openssl-version-check.patch b/freeradius-ease-openssl-version-check.patch deleted file mode 100644 index 23f1df7..0000000 --- a/freeradius-ease-openssl-version-check.patch +++ /dev/null @@ -1,35 +0,0 @@ -From: Antonio Torres -Date: Tue, 12 Sep 2023 -Subject: Ease OpenSSL version check requirement - -FreeRADIUS includes an OpenSSL version check that compares built vs linked version, -and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as -ABI changes are tracked and soname is changed accordingly, as discussed in previous -Bugzilla for this issue [1]. - -[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511 -Signed-off-by: Antonio Torres ---- - src/main/version.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/main/version.c b/src/main/version.c -index c190337c1d..fee2150eb2 100644 ---- a/src/main/version.c -+++ b/src/main/version.c -@@ -79,11 +79,11 @@ int ssl_check_consistency(void) - */ - if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) { - mismatch: -- ERROR("libssl version mismatch. built: %lx linked: %lx", -+ DEBUG2("libssl version mismatch. built: %lx linked: %lx", - (unsigned long) ssl_built, - (unsigned long) ssl_linked); - -- return -1; -+ return 0; - } - - /* diff --git a/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch b/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch new file mode 100644 index 0000000..41755ee --- /dev/null +++ b/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch @@ -0,0 +1,49 @@ +From ab6bbcc41293ae745c1607618f88e5404b98d769 Mon Sep 17 00:00:00 2001 +From: Antonio Torres +Date: Wed, 13 Oct 2021 13:29:02 +0200 +Subject: [PATCH] ldap: allow to connect on partially open handle + +The LDAP library returns a partially open connection. Setting the +'retry' flag to true during the module inst creation and the pool start +to 0 allows to connect even if the connection is not completely opened +yet. + +Upstream commit: https://github.com/FreeRADIUS/freeradius-server/commit/21d95b268b4cf56e75064898d83123825d673818 + +Signed-off-by: Antonio Torres +--- +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index f25ee9e2e0..4b6ae44afb 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -717,7 +717,8 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle + * For sanity, for when no connections are viable, + * and we can't make a new one. + */ +- num = retry ? fr_connection_pool_get_num(inst->pool) : 0; ++ num = 0; ++ if (inst->pool && retry) num = fr_connection_pool_get_num(inst->pool); + for (i = num; i >= 0; i--) { + #ifdef WITH_SASL + if (sasl && sasl->mech) { +@@ -758,7 +759,7 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle + break; + + case LDAP_PROC_RETRY: +- if (retry) { ++ if (num) { + *pconn = fr_connection_reconnect(inst->pool, *pconn); + if (*pconn) { + LDAP_DBGW_REQ("Bind with %s to %s failed: %s. Got new socket, retrying...", +@@ -1563,7 +1564,7 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + status = rlm_ldap_bind(inst, NULL, &conn, conn->inst->admin_identity, conn->inst->admin_password, +- &(conn->inst->admin_sasl), false); ++ &(conn->inst->admin_sasl), true); + if (status != LDAP_PROC_SUCCESS) { + goto error; + } +-- +2.31.1 + diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch deleted file mode 100644 index 40df134..0000000 --- a/freeradius-ldap-infinite-timeout-on-starttls.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Antonio Torres -Date: Fri, 28 Jan 2022 -Subject: Use infinite timeout when using LDAP+start-TLS - -This will ensure that the TLS connection to the LDAP server will complete -before starting FreeRADIUS, as it forces libldap to use a blocking socket during -the process. Infinite timeout is the OpenLDAP default. -Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 - -Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 -Signed-off-by: Antonio Torres ---- - src/modules/rlm_ldap/ldap.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c -index cf7a84e069..841bf888a1 100644 ---- a/src/modules/rlm_ldap/ldap.c -+++ b/src/modules/rlm_ldap/ldap.c -@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) - } - - #ifdef LDAP_OPT_NETWORK_TIMEOUT -- if (inst->net_timeout) { -+ bool using_tls = inst->start_tls || -+ inst->port == 636 || -+ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; -+ if (inst->net_timeout && !using_tls) { - memset(&tv, 0, sizeof(tv)); - tv.tv_sec = inst->net_timeout; - diff --git a/freeradius-logrotate b/freeradius-logrotate index 1a2ec6f..c962254 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -34,7 +34,7 @@ compress su radiusd radiusd postrotate - /usr/bin/systemctl try-reload-or-restart radiusd + /usr/bin/systemctl reload-or-try-restart radiusd endscript } diff --git a/freeradius-man-Fix-some-typos.patch b/freeradius-man-Fix-some-typos.patch new file mode 100644 index 0000000..26d84de --- /dev/null +++ b/freeradius-man-Fix-some-typos.patch @@ -0,0 +1,94 @@ +From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 11:53:28 +0300 +Subject: [PATCH] man: Fix some typos + +--- + man/man5/radrelay.conf.5 | 2 +- + man/man5/rlm_files.5 | 2 +- + man/man5/unlang.5 | 8 ++++---- + man/man8/radrelay.8 | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5 +index 5fb38bfc4e..e3e665024b 100644 +--- a/man/man5/radrelay.conf.5 ++++ b/man/man5/radrelay.conf.5 +@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5 +index bfee5030ff..52f4734ae3 100644 +--- a/man/man5/rlm_files.5 ++++ b/man/man5/rlm_files.5 +@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that + perform per-group checks, and return per-group attributes, where the + group membership is dynamically defined by a previous module. It also + lets you do things like key off of attributes in the reply, and +-express policies like like "when I send replies containing attribute ++express policies like "when I send replies containing attribute + FOO with value BAR, do more checks, and maybe send additional + attributes". + .SH CONFIGURATION +diff --git a/man/man5/unlang.5 b/man/man5/unlang.5 +index 76db8f2d1c..12fe7855b2 100644 +--- a/man/man5/unlang.5 ++++ b/man/man5/unlang.5 +@@ -36,7 +36,7 @@ the pre-defined keywords here. + + Subject to a few limitations described below, any keyword can appear + in any context. The language consists of a series of entries, each +-one one line. Each entry begins with a keyword. Entries are ++one line. Each entry begins with a keyword. Entries are + organized into lists. Processing of the language is line by line, + from the start of the list to the end. Actions are executed + per-keyword. +@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + No statement other than "case" can appear in a "switch" block. +@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + .DS +@@ -799,7 +799,7 @@ regular expression. If no attribute matches, nothing else is done. + The value can be an attribute reference, or an attribute-specific + string. + +-When the value is an an attribute reference, it must take the form of ++When the value is an attribute reference, it must take the form of + "&Attribute-Name". The leading "&" signifies that the value is a + reference. The "Attribute-Name" is an attribute name, such as + "User-Name" or "request:User-Name". When an attribute reference is +diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8 +index fdba6995d5..99e65732a2 100644 +--- a/man/man8/radrelay.8 ++++ b/man/man8/radrelay.8 +@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +-- +2.18.0 + diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index 6846827..aa3be66 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -3,52 +3,48 @@ From: Alexander Scheel Date: Wed, 8 May 2019 12:58:02 -0400 Subject: [PATCH] Don't generate certificates in reproducible builds -[antorres@redhat.com]: updated to match upstream release 3.2.7 - Signed-off-by: Alexander Scheel --- Make.inc.in | 5 +++++ - configure | 3 +++ + configure | 4 ++++ configure.ac | 3 +++ raddb/all.mk | 4 ++++ - 4 files changed, 15 insertions(+) + 4 files changed, 16 insertions(+) diff --git a/Make.inc.in b/Make.inc.in index 0b2cd74de8..8c623cf95c 100644 --- a/Make.inc.in +++ b/Make.inc.in -@@ -174,6 +174,10 @@ else +@@ -173,3 +173,8 @@ else + TESTBINDIR = ./$(BUILD_DIR)/bin TESTBIN = ./$(BUILD_DIR)/bin endif - ++ +# +# With reproducible builds, do not generate certificates during installation +# +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ - - # - # For creating documentation via doc/all.mk diff --git a/configure b/configure -index f1dfa97c44..ba5c53768d 100755 +index c2c599c92b..3d4403a844 100755 --- a/configure +++ b/configure -@@ -681,6 +681,7 @@ ACLOCAL - LAST - RUSERS +@@ -655,6 +655,7 @@ RUSERS SNMPWALK -+ENABLE_REPRODUCIBLE_BUILDS SNMPGET + PERL ++ENABLE_REPRODUCIBLE_BUILDS openssl_version_check_config - WITH_RADLAST -@@ -7001,6 +7002,7 @@ fi + WITH_DHCP + modconfdir +@@ -5586,6 +5587,7 @@ else + fi - # Check whether --enable-reproducible-builds was given. +ENABLE_REPRODUCIBLE_BUILDS=yes - if test ${enable_reproducible_builds+y} - then : + # Check whether --enable-reproducible-builds was given. + if test "${enable_reproducible_builds+set}" = set; then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -56,12 +52,19 @@ index f1dfa97c44..ba5c53768d 100755 esac fi - +@@ -5604,6 +5607,7 @@ fi + + + ++ + CHECKRAD=checkrad + # Extract the first word of "perl", so it can be a program name with args. + set dummy perl; ac_word=$2 diff --git a/configure.ac b/configure.ac -index ce4d9b0ae5..790cbf02a0 100644 +index a7abf0025a..35b013f4af 100644 --- a/configure.ac +++ b/configure.ac -@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config]) +@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) dnl # dnl # extra argument: --enable-reproducible-builds dnl # @@ -69,7 +72,7 @@ index ce4d9b0ae5..790cbf02a0 100644 AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], -@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds, +@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, ;; *) reproducible_builds=no @@ -78,10 +81,6 @@ index ce4d9b0ae5..790cbf02a0 100644 ) +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) - dnl # - dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer - - dnl ############################################################# diff --git a/raddb/all.mk b/raddb/all.mk diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch deleted file mode 100644 index 58d3282..0000000 --- a/freeradius-no-sqlippool-tool.patch +++ /dev/null @@ -1,28 +0,0 @@ -From: Antonio Torres -Date: Wed, 5 Mar 2025 -Subject: Remove sqlippool tool - -This script relies on a Perl package, perl-Net-IP, that won't be available. -Remove it from build script and let the user pull it manually instead, as it's -just a helper script for SQL module users. - ---- -diff --git a/scripts/all.mk b/scripts/all.mk -index a6e90aa3eb..517adb8590 100644 ---- a/scripts/all.mk -+++ b/scripts/all.mk -@@ -1,5 +1,5 @@ - install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \ -- $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool -+ $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt - - $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd - @mkdir -p $(dir $@) -@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay - $(R)$(bindir)/radcrypt: scripts/cryptpasswd - @mkdir -p $(dir $@) - @$(INSTALL) -m 755 $< $@ -- --$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool -- @mkdir -p $(dir $@) -- @$(INSTALL) -m 755 $< $@ diff --git a/freeradius-openssl-no-engine.patch b/freeradius-openssl-no-engine.patch deleted file mode 100644 index b03ae2b..0000000 --- a/freeradius-openssl-no-engine.patch +++ /dev/null @@ -1,54 +0,0 @@ -diff --git a/configure b/configure -index 1e6d228..40a26f5 100755 ---- a/configure -+++ b/configure -@@ -10518,7 +10518,7 @@ smart_prefix= - printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h - - -- for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h -+ for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h - do : - as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh` - ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" -diff --git a/configure.ac b/configure.ac -index 6a68971..4a95148 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then - openssl/rand.h \ - openssl/sha.h \ - openssl/ssl.h \ -- openssl/ocsp.h \ -- openssl/engine.h, -+ openssl/ocsp.h, - [ OPENSSL_CPPFLAGS="$smart_include" ], - [ - AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL)]) -diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in -index 4774482..21d5cea 100644 ---- a/src/include/autoconf.h.in -+++ b/src/include/autoconf.h.in -@@ -285,9 +285,6 @@ - /* Define to 1 if you have the header file. */ - #undef HAVE_OPENSSL_CRYPTO_H - --/* Define to 1 if you have the header file. */ --#undef HAVE_OPENSSL_ENGINE_H -- - /* Define to 1 if you have the header file. */ - #undef HAVE_OPENSSL_ERR_H - -diff --git a/src/include/tls-h b/src/include/tls-h -index 506fb19..514e03a 100644 ---- a/src/include/tls-h -+++ b/src/include/tls-h -@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$") - # define OPENSSL_NO_KRB5 - #endif - #include --#ifdef HAVE_OPENSSL_ENGINE_H -+#ifndef OPENSSL_NO_ENGINE - # include - #endif - #include diff --git a/freeradius-python2-shebangs.patch b/freeradius-python2-shebangs.patch new file mode 100644 index 0000000..86954db --- /dev/null +++ b/freeradius-python2-shebangs.patch @@ -0,0 +1,64 @@ +From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 18 Oct 2018 12:40:53 -0400 +Subject: [PATCH] Clarify shebangs to be python2 + +Signed-off-by: Alexander Scheel +--- + scripts/radtee | 2 +- + src/modules/rlm_python/example.py | 2 +- + src/modules/rlm_python/prepaid.py | 2 +- + src/modules/rlm_python/radiusd.py | 2 +- + src/modules/rlm_python/radiusd_test.py | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/scripts/radtee b/scripts/radtee +index 123769d244..78b4bcbe0b 100755 +--- a/scripts/radtee ++++ b/scripts/radtee +@@ -1,4 +1,4 @@ +-#!/usr/bin/env python ++#!/usr/bin/env python2 + from __future__ import with_statement + + # RADIUS comparison tee v1.0 +diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py +index 5950a07678..eaf456e349 100644 +--- a/src/modules/rlm_python/example.py ++++ b/src/modules/rlm_python/example.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module example file + # Miguel A.L. Paraz +diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py +index c3cbf57b8f..3b1dc2e2e8 100644 +--- a/src/modules/rlm_python/prepaid.py ++++ b/src/modules/rlm_python/prepaid.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Example Python module for prepaid usage using MySQL + +diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py +index c535bb3caf..7129923994 100644 +--- a/src/modules/rlm_python/radiusd.py ++++ b/src/modules/rlm_python/radiusd.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Definitions for RADIUS programs + # +diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py +index 13b7128b29..97b5b64f08 100644 +--- a/src/modules/rlm_python/radiusd_test.py ++++ b/src/modules/rlm_python/radiusd_test.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module test + # Miguel A.L. Paraz diff --git a/freeradius-radiusd-init b/freeradius-radiusd-init new file mode 100644 index 0000000..977a51f --- /dev/null +++ b/freeradius-radiusd-init @@ -0,0 +1,113 @@ +#!/bin/sh +# +# radiusd Start/Stop the FreeRADIUS daemon +# +# chkconfig: - 88 10 +# description: Extensible, configurable, high performance RADIUS server. + +### BEGIN INIT INFO +# Provides: radiusd +# Required-Start: $network +# Required-Stop: +# Default-Start: +# Default-Stop: +# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc +# Should-Stop: +# Short-Description: FreeRADIUS server +# Description: Extensible, configurable, high performance RADIUS server. +### END INIT INFO + +# Source function library. +. /etc/rc.d/init.d/functions + +prog=radiusd + +[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog + +exec=${exec:=/usr/sbin/$prog} +config_dir=${config_dir:=/etc/raddb} +config=${config:=$config_dir/radiusd.conf} +pidfile=${pidfile:=/var/run/$prog/$prog.pid} +lockfile=${lockfile:=/var/lock/subsys/radiusd} + +start() { + [ -x $exec ] || exit 5 + [ -f $config ] || exit 6 + echo -n $"Starting $prog: " + daemon --pidfile $pidfile $exec -d $config_dir + retval=$? + echo + [ $retval -eq 0 ] && touch $lockfile + return $retval +} + +stop() { + echo -n $"Stopping $prog: " + killproc -p $pidfile $prog + retval=$? + echo + [ $retval -eq 0 ] && rm -f $lockfile + return $retval +} + +restart() { + stop + start +} + +reload() { + # radiusd may not be capable of a 100% configuration reload depending + # on which loadable modules are in use, if sending the server a + # HUP is not sufficient then use restart here instead. However, we + # prefer by default to use HUP since it's what is usually desired. + # + # restart + + kill -HUP `pidofproc -p $pidfile $prog` +} + +force_reload() { + restart +} + +rh_status() { + # run checks to determine if the service is running or use generic status + status -p $pidfile $prog +} + +rh_status_q() { + rh_status >/dev/null 2>&1 +} + + +case "$1" in + start) + rh_status_q && exit 0 + $1 + ;; + stop) + rh_status_q || exit 0 + $1 + ;; + restart) + $1 + ;; + reload) + rh_status_q || exit 7 + $1 + ;; + force-reload) + force_reload + ;; + status) + rh_status + ;; + condrestart|try-restart) + rh_status_q || exit 0 + restart + ;; + *) + echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}" + exit 2 +esac +exit $? diff --git a/freeradius.spec b/freeradius.spec index 7b65a15..2df2001 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,8 +1,8 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.8 -Release: 2%{?dist} -License: GPL-2.0-or-later AND LGPL-2.0-or-later +Version: 3.0.21 +Release: 10%{?dist} +License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ # Is elliptic curve cryptography supported? @@ -14,23 +14,19 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2 +Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf Source104: freeradius-tmpfiles.conf -Source105: freeradius.sysusers Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch -Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch -Patch7: freeradius-ease-openssl-version-check.patch -Patch8: freeradius-configure-c99.patch -Patch9: freeradius-openssl-no-engine.patch -Patch10: freeradius-no-sqlippool-tool.patch +Patch6: freeradius-Fix-resource-hard-limit-error.patch +Patch7: freeradius-ldap-allow-to-connect-on-partially-open-handle.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -48,9 +44,7 @@ BuildRequires: readline-devel BuildRequires: libpcap-devel BuildRequires: systemd-units BuildRequires: libtalloc-devel -BuildRequires: chrpath -BuildRequires: systemd-rpm-macros -BuildRequires: libxcrypt-devel +BuildRequires: pcre-devel %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -60,7 +54,7 @@ BuildRequires: ykclient-devel # Require OpenSSL version we built with, or newer, to avoid startup failures # due to runtime OpenSSL version checks. Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) -Requires(pre): glibc-common +Requires(pre): shadow-utils glibc-common Requires(post): systemd-sysv Requires(post): systemd-units # Needed for certificate generation as upstream bootstrap script isn't @@ -131,6 +125,7 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius Requires: %{name} = %{version}-%{release} +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} BuildRequires: perl-devel BuildRequires: perl-generators @@ -204,39 +199,34 @@ BuildRequires: json-c-devel %description rest This plugin provides the REST support for the FreeRADIUS server project. - -%package kafka -Summary: Kafka producer support for FreeRADIUS -Requires: %{name} = %{version}-%{release} -Requires: librdkafka -BuildRequires: librdkafka-devel - -%description kafka -This plugin provides Kafka producer support for the FreeRADIUS server project. - %prep %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' # mistakenly includes the backup files, especially problematic for raddb config files. -%patch -P1 -p1 -%patch -P2 -p1 -%patch -P3 -p1 -%patch -P4 -p1 -%patch -P5 -p1 -%patch -P6 -p1 -%patch -P7 -p1 -%patch -P8 -p1 -%patch -P9 -p1 -%patch -P10 -p1 +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon %global _hardened_build 1 +# Hack: rlm_python3 as stable; prevents building other unstable modules. +sed 's/rlm_python/rlm_python3/g' src/modules/stable -i + %global build_ldflags %{build_ldflags} $(python3-config --embed --libs) export PY3_LIB_DIR="$(python3-config --configdir)" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" +# In order for the above hack to stick, do a fake configure so +# we can run reconfig before cleaning up after ourselves and running +# configure for real. +./configure && make reconfig && (make clean distclean || true) + %configure \ --libdir=%{_libdir}/freeradius \ --enable-reproducible-builds \ @@ -255,7 +245,6 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v --with-rlm_python3 \ --with-rlm-python3-lib-dir=$PY3_LIB_DIR \ --with-rlm-python3-include-dir=$PY3_INC_DIR \ - --without-rlm_python \ --without-rlm_eap_ikev2 \ --without-rlm_eap_tnc \ --without-rlm_sql_iodbc \ @@ -267,8 +256,7 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v --without-rlm_rediswho \ --without-rlm_cache_memcached -# Build fast, but get better errors if we fail -make %{?_smp_mflags} || make -j1 +make %install mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/lib/radiusd @@ -287,21 +275,11 @@ mkdir -p %{buildroot}%{_localstatedir}/run/ install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/ install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf -install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf # install SNMP MIB files mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ -# remove rpath where needed -chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so -for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done -for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done - -# update ld with freeradius libs -mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d -echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf - # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl @@ -368,23 +346,23 @@ All documentation is in the freeradius-doc sub-package. EOF + +# Make sure our user/group is present prior to any package or subpackage installation +%pre +getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1 +getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 +exit 0 + %preun %systemd_preun radiusd.service -%post -# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017 -# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96 -if [ -x /usr/sbin/setsebool ]; then - /usr/sbin/setsebool -P radius_use_jit on || : -fi - %postun -if [ $1 -eq 0 ]; then - if [ -x /usr/sbin/setsebool ]; then - /usr/sbin/setsebool -P radius_use_jit off || : - fi -fi %systemd_postun_with_restart radiusd.service +if [ $1 -eq 0 ]; then # uninstall + getent passwd radiusd >/dev/null && /usr/sbin/userdel radiusd > /dev/null 2>&1 + getent group radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1 +fi +exit 0 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : @@ -400,10 +378,8 @@ fi # system %config(noreplace) %{_sysconfdir}/pam.d/radiusd %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd -%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %{_unitdir}/radiusd.service %{_tmpfilesdir}/radiusd.conf -%{_sysusersdir}/freeradius.conf %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd @@ -436,8 +412,7 @@ fi %dir %attr(770,root,radiusd) /etc/raddb/certs %config(noreplace) /etc/raddb/certs/Makefile %config(noreplace) /etc/raddb/certs/passwords.mk -/etc/raddb/certs/README.md -/etc/raddb/certs/realms/README.md +/etc/raddb/certs/README %config(noreplace) /etc/raddb/certs/xpextensions %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf %attr(750,root,radiusd) /etc/raddb/certs/bootstrap @@ -451,7 +426,6 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter @@ -463,8 +437,6 @@ fi # sites-available %dir %attr(750,root,radiusd) /etc/raddb/sites-available /etc/raddb/sites-available/README -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting @@ -486,11 +458,8 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache # sites-enabled # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx @@ -504,7 +473,7 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui @@ -513,9 +482,6 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients @@ -529,8 +495,6 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip @@ -538,6 +502,7 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd @@ -554,24 +519,21 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled %config(missingok) /etc/raddb/mods-enabled/always %config(missingok) /etc/raddb/mods-enabled/attr_filter +%config(missingok) /etc/raddb/mods-enabled/cache_eap %config(missingok) /etc/raddb/mods-enabled/chap %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail @@ -596,11 +558,9 @@ fi %config(missingok) /etc/raddb/mods-enabled/replicate %config(missingok) /etc/raddb/mods-enabled/soh %config(missingok) /etc/raddb/mods-enabled/sradutmp -%config(missingok) /etc/raddb/mods-enabled/totp %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 -%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit # policy %dir %attr(750,root,radiusd) /etc/raddb/policy.d @@ -618,10 +578,10 @@ fi # binaries %defattr(-,root,root) -%{_bindir}/checkrad -%{_bindir}/raddebug -%{_bindir}/radiusd -%{_bindir}/radmin +/usr/sbin/checkrad +/usr/sbin/raddebug +/usr/sbin/radiusd +/usr/sbin/radmin # dictionaries %dir %attr(755,root,root) /usr/share/freeradius @@ -646,6 +606,7 @@ fi %{_libdir}/freeradius/rlm_cache_rbtree.so %{_libdir}/freeradius/rlm_chap.so %{_libdir}/freeradius/rlm_counter.so +%{_libdir}/freeradius/rlm_cram.so %{_libdir}/freeradius/rlm_date.so %{_libdir}/freeradius/rlm_detail.so %{_libdir}/freeradius/rlm_dhcp.so @@ -654,6 +615,7 @@ fi %{_libdir}/freeradius/rlm_eap.so %{_libdir}/freeradius/rlm_eap_fast.so %{_libdir}/freeradius/rlm_eap_gtc.so +%{_libdir}/freeradius/rlm_eap_leap.so %{_libdir}/freeradius/rlm_eap_md5.so %{_libdir}/freeradius/rlm_eap_mschapv2.so %{_libdir}/freeradius/rlm_eap_peap.so @@ -668,10 +630,10 @@ fi %{_libdir}/freeradius/rlm_expr.so %{_libdir}/freeradius/rlm_files.so %{_libdir}/freeradius/rlm_ippool.so -%{_libdir}/freeradius/rlm_json.so %{_libdir}/freeradius/rlm_linelog.so %{_libdir}/freeradius/rlm_logintime.so %{_libdir}/freeradius/rlm_mschap.so +%{_libdir}/freeradius/rlm_otp.so %{_libdir}/freeradius/rlm_pam.so %{_libdir}/freeradius/rlm_pap.so %{_libdir}/freeradius/rlm_passwd.so @@ -684,17 +646,12 @@ fi %{_libdir}/freeradius/rlm_sql.so %{_libdir}/freeradius/rlm_sqlcounter.so %{_libdir}/freeradius/rlm_sqlippool.so -%{_libdir}/freeradius/rlm_sql_map.so %{_libdir}/freeradius/rlm_sql_null.so -%{_libdir}/freeradius/rlm_totp.so %{_libdir}/freeradius/rlm_unix.so %{_libdir}/freeradius/rlm_unpack.so %{_libdir}/freeradius/rlm_utf8.so %{_libdir}/freeradius/rlm_wimax.so %{_libdir}/freeradius/rlm_yubikey.so -%{_libdir}/freeradius/rlm_dpsk.so -%{_libdir}/freeradius/rlm_eap_teap.so -%{_libdir}/freeradius/rlm_proxy_rate_limit.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -715,7 +672,6 @@ fi %doc %{_mandir}/man5/rlm_passwd.5.gz %doc %{_mandir}/man5/rlm_realm.5.gz %doc %{_mandir}/man5/rlm_sql.5.gz -%doc %{_mandir}/man5/rlm_unbound.5.gz %doc %{_mandir}/man5/rlm_unix.5.gz %doc %{_mandir}/man5/unlang.5.gz %doc %{_mandir}/man5/users.5.gz @@ -723,7 +679,6 @@ fi %doc %{_mandir}/man8/radiusd.8.gz %doc %{_mandir}/man8/radmin.8.gz %doc %{_mandir}/man8/radrelay.8.gz -%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz # MIB files %{_datadir}/snmp/mibs/*RADIUS*.mib @@ -785,7 +740,6 @@ fi %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf @@ -793,49 +747,14 @@ fi %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf -%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql - %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql - -%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql @@ -859,7 +778,6 @@ fi %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf @@ -888,7 +806,6 @@ fi %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf @@ -907,9 +824,8 @@ fi %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -924,205 +840,17 @@ fi %{_libdir}/freeradius/rlm_rest.so %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest -%files kafka -%{_libdir}/freeradius/rlm_kafka.so -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf - %changelog -* Mon Jan 05 2026 Antonio Torres - 3.2.8-2 -- Enable selinux flag for JIT usage - Resolves: #2427017 +* Tue Oct 19 2021 Antonio Torres - 3.0.21-10 +- Allow to connect to partially open LDAP handle + Related: rhbz#1983063 -* Mon Nov 10 2025 Antonio Torres - 3.2.8-1 -- Update to upstream release 3.2.8 - -* Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 -- Perl 5.42 rebuild - -* Wed Jun 11 2025 Antonio Torres - 3.2.7-4 -- Update logrotate postrotate script with `systemctl try-reload-or-restart` - Resolves: rhbz#2371329 - -* Mon Jun 02 2025 Python Maint - 3.2.7-3 -- Rebuilt for Python 3.14 - -* Wed Mar 5 2025 Antonio Torres - 3.2.7-1 -- Update to upstream release 3.2.7 - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 -- Drop call to %sysusers_create_compat - -* Sat Feb 01 2025 Björn Esser - 3.2.5-6 -- Add explicit BR: libxcrypt-devel - -* Thu Jan 23 2025 Antonio Torres - 3.2.5-5 -- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin - -* Thu Jan 16 2025 Fedora Release Engineering - 3.2.5-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Nov 06 2024 Yaakov Selkowitz - 3.2.5-3 -- Drop openssl-devel-engine dependency - -* Wed Jul 17 2024 Fedora Release Engineering - 3.2.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jul 09 2024 Antonio Torres - 3.2.5-1 -- Update to upstream release 3.2.5 - -* Wed Jun 12 2024 Jitka Plesnikova - 3.2.4-3 -- Perl 5.40 rebuild - -* Fri Jun 07 2024 Python Maint - 3.2.4-2 -- Rebuilt for Python 3.13 - -* Fri May 31 2024 Antonio Torres - 3.2.4-1 -- Update to upstream release 3.2.4 - -* Wed Jan 24 2024 Fedora Release Engineering - 3.2.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Fri Jan 19 2024 Fedora Release Engineering - 3.2.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Tue Dec 19 2023 Florian Weimer - 3.2.3-2 -- Fix C compatibility issue in configure script - -* Tue Oct 24 2023 Antonio Torres - 3.2.3-1 -- Update to upstream release 3.2.3 - -* Tue Sep 12 2023 Antonio Torres - 3.2.2-5 -- Ease OpenSSL version check requirement - Resolves #2238511 - -* Wed Jul 19 2023 Fedora Release Engineering - 3.2.2-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Tue Jul 11 2023 Jitka Plesnikova - 3.2.2-3 -- Perl 5.38 rebuild - -* Tue Jun 13 2023 Python Maint - 3.2.2-2 -- Rebuilt for Python 3.12 - -* Tue Mar 21 2023 Antonio Torres - 3.2.2-1 -- Update to upstream release 3.2.2 - -* Wed Mar 15 2023 Antonio Torres - 3.2.1-4 -- Migrate to SPDX license - -* Thu Jan 19 2023 Fedora Release Engineering - 3.2.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Mon Oct 17 2022 Antonio Torres - 3.2.1-2 -- Remove hack for Python3 support from specfile - -* Mon Oct 17 2022 Antonio Torres - 3.2.1-1 -- Update to 3.2.1 upstream release - Resolves #2131850 - -* Tue Sep 20 2022 Antonio Torres - 3.2.0-4 -- Remove deprecated pcre-devel dependency - Resolves #2128292 - -* Mon Sep 5 2022 Antonio Torres - 3.2.0-3 -- configure: allow building with runstatedir option - Resolves: #2123374 - -* Thu Jul 21 2022 Fedora Release Engineering - 3.2.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Tue Jul 19 2022 Antonio Torres - 3.2.0-1 -- Rebase to 3.2.0 upstream release - Related: #2077687 - -* Wed Jun 29 2022 Antonio Torres - 3.0.25-8 -- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107) - Related: #2095741 - -* Fri Jun 24 2022 Antonio Torres - 3.0.25-7 -- Dynamically allocate users using sysusers.d format - Related: #2095741 - -* Mon Jun 13 2022 Python Maint - 3.0.25-6 -- Rebuilt for Python 3.11 - -* Tue May 31 2022 Jitka Plesnikova - 3.0.25-5 -- Perl 5.36 rebuild - -* Fri Apr 22 2022 Antonio Torres - 3.0.25-4 -- Use infinite timeout when using LDAP+start-TLS - Related: #1983063 - -* Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Oct 14 2021 Antonio Torres - 3.0.25-2 -- Fix file conflict in SQL files - Resolves: bz#2014014 - -* Fri Oct 08 2021 Antonio Torres - 3.0.25-1 -- Update to 3.0.25. - Resolves: bz#2011984 - -* Thu Sep 30 2021 Antonio Torres - 3.0.24-1 -- Update to 3.0.24. - Resolves: bz#2009036 - -* Tue Sep 14 2021 Sahana Prasad - 3.0.23-7 -- Rebuilt with OpenSSL 3.0.0 - -* Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Thu Jul 15 2021 Antonio Torres - 3.0.23-5 +* Thu Jul 15 2021 Antonio Torres - 3.0.21-9 - Fix coredump not being able to be enabled -* Sat Jul 10 2021 Björn Esser - 3.0.23-4 -- Rebuild for versioned symbols in json-c - -* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 -- Fix rpath not being removed correctly - -* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 -- Remove RPATH usage from additional binaries - -* Tue Jun 29 2021 Antonio Torres - 3.0.23-1 -- Rebase to 3.0.23 - Fixes: bz#1970528 - -* Tue Jun 29 2021 Antonio Torres - 3.0.22-5 -- Fix binaries not being correctly linked after RPATH removal - -* Fri Jun 25 2021 Antonio Torres - 3.0.22-4 +* Fri Jun 25 2021 Antonio Torres - 3.0.21-8 - Fix python3 not being correctly linked - -* Mon Jun 07 2021 Python Maint - 3.0.22-2 -- Rebuilt for Python 3.10 - -* Fri Jun 4 2021 Antonio Torres - 3.0.22-1 -- Rebased to 3.0.22 - Resolves: bz#1961190 - -* Fri May 21 2021 Jitka Plesnikova - 3.0.21-12 -- Perl 5.34 rebuild - -* Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 -- Disable automatic bootstrap - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.21-10 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Mon Feb 08 2021 Pavel Raiskup - 3.0.21-9 -- rebuild for libpq ABI fix rhbz#1908268 - -* Tue Jan 26 2021 Fedora Release Engineering - 3.0.21-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + Resolves: bz#1917157 * Tue Aug 04 2020 Alexander Scheel - 3.0.21-7 - Fix certificate permissions after make-based generation diff --git a/freeradius.sysusers b/freeradius.sysusers deleted file mode 100644 index af912e0..0000000 --- a/freeradius.sysusers +++ /dev/null @@ -1,3 +0,0 @@ -#Type Name ID GECOS Home directory Shell -u radiusd 95 "radiusd user" /var/lib/radiusd /sbin/nologin -g radiusd 95 - - - diff --git a/radiusd.service b/radiusd.service index 9bfa3cd..d073530 100644 --- a/radiusd.service +++ b/radiusd.service @@ -5,7 +5,8 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv [Service] Type=forking PIDFile=/var/run/radiusd/radiusd.pid -ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd +ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C diff --git a/rpminspect.yaml b/rpminspect.yaml deleted file mode 100644 index 0c3bdf7..0000000 --- a/rpminspect.yaml +++ /dev/null @@ -1,3 +0,0 @@ ---- -inspections: - badfuncs: off diff --git a/sources b/sources index 3fdee90..a895a5a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae +SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729 diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py index d646188..da5afe1 100755 --- a/tests/auth-tests/freeradius-tests.py +++ b/tests/auth-tests/freeradius-tests.py @@ -15,6 +15,7 @@ import unittest import subprocess import signal import shutil +import psutil import socket RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid' diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh index ceaeaa7..7be8432 100755 --- a/tests/auth-tests/runtest.sh +++ b/tests/auth-tests/runtest.sh @@ -16,25 +16,6 @@ PACKAGE="freeradius" RADIUS_CLIENT_CONF="/etc/raddb/clients.conf" RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize" -generate_cert(){ - pushd /etc/raddb/certs/ - #remove certificates if exists;generate new certificates - if [[ -f /etc/raddb/certs/bootstrap ]]; then - rlLog "Destroy and create new default certificates via bootstrap script" - rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh - rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates" - else - rlLogWarning "!!! WARNING bootsrap file does not exist !!!" - rlLog "Destroy and create new default certificates via make scripts" - make destroycerts -C /etc/raddb/certs/ - #create new certificates - make -C /etc/raddb/certs/ - chown root:radiusd dh ca.* client.* server.* - chmod 640 dh ca.* client.* server.* - fi - popd -} - rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE @@ -48,7 +29,6 @@ rlJournalStart rlRun "cp clients.conf $RADIUS_CLIENT_CONF" rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE" rlRun "systemctl daemon-reload" - generate_cert rlPhaseEnd rlPhaseStartTest