From 39d4d1b0e5da4c570b2c9a9e25a7fa03a92dbf90 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 26 Jul 2017 08:45:30 +0000 Subject: [PATCH 001/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index e111738..c633d25 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -796,6 +796,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jul 26 2017 Fedora Release Engineering - 3.0.15-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Tue Jul 18 2017 Nikolai Kondrashov - 3.0.15-1 - Upgrade to upstream v3.0.15 release. See upstream ChangeLog for details (in freeradius-doc subpackage). From 07a5b04f1f513b7415aae4f5aedf828e91e1ca33 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 2 Aug 2017 20:47:27 +0000 Subject: [PATCH 002/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index c633d25..124e9ad 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -796,6 +796,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Aug 02 2017 Fedora Release Engineering - 3.0.15-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Wed Jul 26 2017 Fedora Release Engineering - 3.0.15-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From 24ec0cc88b3ba7d4b0a6626bb94db5c98967c86c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sat, 19 Aug 2017 09:38:16 -0400 Subject: [PATCH 003/126] Python 2 binary package renamed to python2-freeradius --- freeradius.spec | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 124e9ad..10a5afd 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -131,13 +131,17 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. -%package python +%package -n python2-freeradius +%{?python_provide:%python_provide python2-freeradius} +# Remove before F30 +Provides: %{name}-python%{?_isa} = %{version}-%{release} +Obsoletes: %{name}-python < %{version}-%{release} Summary: Python support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: python-devel -%description python +%description -n python2-freeradius This plugin provides the Python support for the FreeRADIUS server project. %package mysql @@ -690,7 +694,7 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so -%files python +%files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* /etc/raddb/mods-config/python/radiusd.py* @@ -796,6 +800,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 3.0.15-4 +- Python 2 binary package renamed to python2-freeradius + See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 + * Wed Aug 02 2017 Fedora Release Engineering - 3.0.15-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild From 5821452012ac1527825444b66c7aef41f0b55b6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 20 Aug 2017 09:27:35 -0400 Subject: [PATCH 004/126] Add Provides for the old name without %_isa --- freeradius.spec | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 10a5afd..f05fa6e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -132,14 +132,15 @@ BuildRequires: perl(ExtUtils::Embed) This plugin provides the Perl support for the FreeRADIUS server project. %package -n python2-freeradius -%{?python_provide:%python_provide python2-freeradius} -# Remove before F30 -Provides: %{name}-python%{?_isa} = %{version}-%{release} -Obsoletes: %{name}-python < %{version}-%{release} Summary: Python support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: python-devel +%{?python_provide:%python_provide python2-freeradius} +# Remove before F30 +Provides: %{name}-python = %{version}-%{release} +Provides: %{name}-python%{?_isa} = %{version}-%{release} +Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius This plugin provides the Python support for the FreeRADIUS server project. @@ -800,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek - 3.0.15-5 +- Add Provides for the old name without %%_isa + * Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek - 3.0.15-4 - Python 2 binary package renamed to python2-freeradius See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3 From 30bf3e1e02f2f455717c62877feee8b6b753a6cd Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Thu, 26 Oct 2017 21:52:31 +0300 Subject: [PATCH 005/126] Use mariadb-connector-c-devel instead of mysql/mariadb-devel --- freeradius.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index f05fa6e..85fd783 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -149,7 +149,7 @@ This plugin provides the Python support for the FreeRADIUS server project. Summary: MySQL support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -BuildRequires: mysql-devel +BuildRequires: mariadb-connector-c-devel %description mysql This plugin provides the MySQL support for the FreeRADIUS server project. @@ -211,7 +211,7 @@ This plugin provides the REST support for the FreeRADIUS server project. --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-sql-postgresql-lib-dir=%{_libdir} \ --with-rlm-sql_mysql-include-dir=/usr/include/mysql \ - --with-mysql-lib-dir=%{_libdir}/mysql \ + --with-mysql-lib-dir=%{_libdir}/mariadb \ --with-unixodbc-lib-dir=%{_libdir} \ --with-rlm-dbm-lib-dir=%{_libdir} \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ @@ -801,6 +801,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Oct 26 2017 Nikolai Kondrashov - 3.0.15-6 +- Use mariadb-connector-c-devel instead of mysql-devel or mariadb-devel + Resolves: Bug#1493904 Use mariadb-connector-c-devel instead of mysql-devel + or mariadb-devel + * Sun Aug 20 2017 Zbigniew Jędrzejewski-Szmek - 3.0.15-5 - Add Provides for the old name without %%_isa From 36a71aa388e82098b2b11509fec7500f3cc45de3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sun, 10 Dec 2017 20:50:33 +0100 Subject: [PATCH 006/126] Rebuilt for libjson-c.so.3 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 85fd783..43f588f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sun Dec 10 2017 Björn Esser - 3.0.15-7 +- Rebuilt for libjson-c.so.3 + * Thu Oct 26 2017 Nikolai Kondrashov - 3.0.15-6 - Use mariadb-connector-c-devel instead of mysql-devel or mariadb-devel Resolves: Bug#1493904 Use mariadb-connector-c-devel instead of mysql-devel From ac797ee71bfc39aac2e9bbc00a779918be9bfb97 Mon Sep 17 00:00:00 2001 From: Iryna Shcherbina Date: Fri, 5 Jan 2018 21:05:05 +0100 Subject: [PATCH 007/126] Update Python 2 dependency declarations to new packaging standards --- freeradius.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 43f588f..ea79b43 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 7%{?dist} +Release: 8%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -135,7 +135,7 @@ This plugin provides the Perl support for the FreeRADIUS server project. Summary: Python support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -BuildRequires: python-devel +BuildRequires: python2-devel %{?python_provide:%python_provide python2-freeradius} # Remove before F30 Provides: %{name}-python = %{version}-%{release} @@ -801,6 +801,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jan 05 2018 Iryna Shcherbina - 3.0.15-8 +- Update Python 2 dependency declarations to new packaging standards + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + * Sun Dec 10 2017 Björn Esser - 3.0.15-7 - Rebuilt for libjson-c.so.3 From 074601dd0215872a42ac8f0fc3b9b629a8d69dd7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 20 Jan 2018 23:06:43 +0100 Subject: [PATCH 008/126] Rebuilt for switch to libxcrypt --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index ea79b43..abaf2ae 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 8%{?dist} +Release: 9%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sat Jan 20 2018 Björn Esser - 3.0.15-9 +- Rebuilt for switch to libxcrypt + * Fri Jan 05 2018 Iryna Shcherbina - 3.0.15-8 - Update Python 2 dependency declarations to new packaging standards (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) From ab996217ec90df590158ed95a09f957fc1afcc22 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 7 Feb 2018 10:09:48 +0000 Subject: [PATCH 009/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index abaf2ae..b9bc1e1 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 9%{?dist} +Release: 10%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Feb 07 2018 Fedora Release Engineering - 3.0.15-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Sat Jan 20 2018 Björn Esser - 3.0.15-9 - Rebuilt for switch to libxcrypt From 83d0428a1e2b32bdbfad099f304555055dbf4973 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Fri, 9 Feb 2018 09:04:33 +0100 Subject: [PATCH 010/126] Escape macros in %changelog Reference: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Y2ZUKK2B7T2IKXPMODNF6HB2O5T5TS6H/ Signed-off-by: Igor Gnatenko --- freeradius.spec | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index b9bc1e1..57715cd 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Feb 09 2018 Igor Gnatenko - 3.0.15-11 +- Escape macros in %%changelog + * Wed Feb 07 2018 Fedora Release Engineering - 3.0.15-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild @@ -906,8 +909,8 @@ exit 0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Mon Jan 16 2017 Nikolai Kondrashov - 3.0.11-5 -- Move tmpfiles.d config to %{_tmpfilesdir} -- Install license files as %license +- Move tmpfiles.d config to %%{_tmpfilesdir} +- Install license files as %%license * Thu Jan 12 2017 Igor Gnatenko - 3.0.11-4 - Rebuild for readline 7.x @@ -1163,7 +1166,7 @@ exit 0 See raddb/sites-available/dhcp, src_ipaddr and src_interface. * DHCP capabilitiies are now compiled in by default. It runs as a DHCP server ONLY when manually enabled. - * Added one letter expansions: %G - request minute and %I request + * Added one letter expansions: %%G - request minute and %%I request ID. * Added script to convert ISC DHCP lease files to SQL pools. See scripts/isc2ippool.pl @@ -1208,10 +1211,10 @@ exit 0 identities changing. Bug reported by Microsoft EAP team. * Use home server src_ipaddr when sending Status-Server packets * Decrypt encrypted ERX attributes in CoA packets. - * Fix registration of internal xlat's so %{mschap:...} doesn't + * Fix registration of internal xlat's so %%{mschap:...} doesn't disappear after a HUP. * Can now reference tagged attributes in expansions. - e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work. + e.g. %%{Tunnel-Type:1} and %%{Tunnel-Type:1[0]} now work. * Correct calculation of Message-Authenticator for CoA and Disconnect replies. Patch from Jouni Malinen * Install rad_counter, for managing rlm_counter files. @@ -1284,7 +1287,7 @@ exit 0 * Added support for elliptical curve cryptography. See ecdh_curve in raddb/eap.conf. * Added support for 802.1X MIBs in checkrad - * Added support for %{rand:...}, which generates a uniformly + * Added support for %%{rand:...}, which generates a uniformly distributed number between 0 and the number you specify. * Created "man" pages for all installed commands, and documented options for all commands. Patch from John Dennis. @@ -1300,7 +1303,7 @@ exit 0 * Fix "failed to insert event" * Allow virtual servers to be reloaded on HUP. It no longer complains about duplicate virtual servers. - * Fix %{string:...} expansion + * Fix %%{string:...} expansion * Fix "server closed socket" loop in radmin * Set ownership of control socket when starting up * Always allow root to connect to control socket, even if From b7902fd74a13b25f1d510f448517eebbdd76b551 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Tue, 6 Mar 2018 15:15:03 +0100 Subject: [PATCH 011/126] Rebuilt for libjson-c.so.4 (json-c v0.13.1) --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 57715cd..0cb9dde 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 11%{?dist} +Release: 12%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Mar 06 2018 Björn Esser - 3.0.15-12 +- Rebuilt for libjson-c.so.4 (json-c v0.13.1) + * Fri Feb 09 2018 Igor Gnatenko - 3.0.15-11 - Escape macros in %%changelog From bcef4f467cb14b94910e6fdcc4d2d4349aa5f282 Mon Sep 17 00:00:00 2001 From: Susant Sahani Date: Mon, 4 Jun 2018 16:26:35 +0530 Subject: [PATCH 012/126] Adds tests according to the CI Adds tests according to the CI justification Adds tests according to the CI wiki specifically the standard test interface in the spec. The playbook includes Tier1 level test cases that have been tested in the following contexts and is passing reliably: Classic. Test logs are stored in the artifacts directory. The following steps are used to execute the tests using the standard test interface: Test enveronment Make sure you have installed packages from the spec ``` ansible-2.4.1.0-2.fc28.noarch python2-dnf-2.7.5-1.fc28.noarch libselinux-python-2.7-2.fc28.x86_64 standard-test-roles-2.5-1.fc28.noarch Run tests for Classic Snip of the example test run for Classic tests: ``` ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Test :: Test :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 16:21:19 ] :: [ LOG ] :: Starting radius auth tests ... :: [ 16:21:19 ] :: [ LOG ] :: Starting radius auth tests ... :: [ 16:21:19 ] :: [ BEGIN ] :: Running '/usr/bin/python3 /usr/bin/freeradius-tests.py' test_radius_plaintext_auth (__main__.RadiousTests) ... Sent Access-Request Id 17 from 0.0.0.0:49711 to 127.0.0.1:1812 length 79 User-Name = "fedora-ci" User-Password = "password" NAS-IP-Address = 192.168.225.189 NAS-Port = 100 Message-Authenticator = 0x00 Cleartext-Password = "password" Received Access-Accept Id 17 from 127.0.0.1:1812 to 0.0.0.0:0 length 38 Reply-Message = "Hello, fedora-ci" ok ---------------------------------------------------------------------- Ran 1 test in 1.214s OK :: [ 16:21:20 ] :: [ PASS ] :: Command '/usr/bin/python3 /usr/bin/freeradius-tests.py' (Expected 0, got 0) :: [ 16:21:20 ] :: [ PASS ] :: Command '/usr/bin/python3 /usr/bin/freeradius-tests.py' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 1s --- tests/auth-tests/Makefile | 36 +++++++++++++++ tests/auth-tests/PURPOSE | 3 ++ tests/auth-tests/authorize | 2 + tests/auth-tests/clients.conf | 6 +++ tests/auth-tests/freeradius-tests.py | 68 ++++++++++++++++++++++++++++ tests/auth-tests/runtest.sh | 49 ++++++++++++++++++++ tests/tests.yml | 12 +++++ 7 files changed, 176 insertions(+) create mode 100644 tests/auth-tests/Makefile create mode 100644 tests/auth-tests/PURPOSE create mode 100644 tests/auth-tests/authorize create mode 100644 tests/auth-tests/clients.conf create mode 100755 tests/auth-tests/freeradius-tests.py create mode 100755 tests/auth-tests/runtest.sh create mode 100644 tests/tests.yml diff --git a/tests/auth-tests/Makefile b/tests/auth-tests/Makefile new file mode 100644 index 0000000..afb1a73 --- /dev/null +++ b/tests/auth-tests/Makefile @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/freeradius +# Description: Test if freeradius authentication workd ok +# Author: Susant Sahani +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +export TEST=/CoreOS/freeradius +export TESTVERSION=1.0 +BUILT_FILES= +FILES=$(METADATA) runtest.sh Makefile PURPOSE +.PHONY: all install download clean +run: $(FILES) build + ./runtest.sh +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh +clean: + rm -f *~ $(BUILT_FILES) +include /usr/share/rhts/lib/rhts-make.include +$(METADATA): Makefile + @echo "Owner: Susant Sahani" > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test if the ABI hasn't changed" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: freeradius" >> $(METADATA) + @echo "Requires: freeradius" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -Fedora 28" >> $(METADATA) + rhts-lint $(METADATA) diff --git a/tests/auth-tests/PURPOSE b/tests/auth-tests/PURPOSE new file mode 100644 index 0000000..d4569c9 --- /dev/null +++ b/tests/auth-tests/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/freeradius +Description: tests for freeradius +Author: Susant Sahani diff --git a/tests/auth-tests/authorize b/tests/auth-tests/authorize new file mode 100644 index 0000000..e3600f6 --- /dev/null +++ b/tests/auth-tests/authorize @@ -0,0 +1,2 @@ +fedora-ci Cleartext-Password := "password" + Reply-Message = "Hello, %{User-Name}" diff --git a/tests/auth-tests/clients.conf b/tests/auth-tests/clients.conf new file mode 100644 index 0000000..00efb82 --- /dev/null +++ b/tests/auth-tests/clients.conf @@ -0,0 +1,6 @@ +client localhost { + ipaddr = 127.0.0.1 + secret = testing123 + require_message_authenticator = no + nastype = other +} diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py new file mode 100755 index 0000000..da5afe1 --- /dev/null +++ b/tests/auth-tests/freeradius-tests.py @@ -0,0 +1,68 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# Description: Tests for freeradius +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +import errno +import os +import sys +import time +import unittest +import subprocess +import signal +import shutil +import psutil +import socket + +RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid' + +def setUpModule(): + """Initialize the environment, and perform sanity checks on it.""" + + if shutil.which('radiusd') is None: + raise OSError(errno.ENOENT, 'radiusd not found') + + if shutil.which('radtest') is None: + raise OSError(errno.ENOENT, 'radtest not found') + + if subprocess.call(['systemctl', 'is-active', '--quiet', + 'radiusd.service']) == 0: + raise unittest.SkipTest('radiusd.service is already active') + +def tearDownModule(): + pass + +class GenericUtilities(): + """Provide a set of utility functions start stop daemons. write config files etc """ + + def StartRadiusServer(self): + """Start radiusd""" + subprocess.check_output(['systemctl', 'start', 'radiusd']) + + def StopRadiusServer(self): + """stop radiusd""" + subprocess.check_output(['systemctl', 'stop', 'radiusd']) + +class RadiousTests(unittest.TestCase, GenericUtilities): + + def setUp(self): + self.StartRadiusServer() + + def tearDown(self): + self.StopRadiusServer() + + def test_radius_plaintext_auth(self): + time.sleep(1) + output=subprocess.check_output(['radtest', 'fedora-ci', 'password', '127.0.0.1', '100', 'testing123']).rstrip().decode('utf-8') + print(output) + + self.assertRegex(output, "Received Access-Accept") + self.assertRegex(output, "Reply-Message = \"Hello, fedora-ci\"") + +if __name__ == '__main__': + unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, + verbosity=3)) diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh new file mode 100755 index 0000000..7be8432 --- /dev/null +++ b/tests/auth-tests/runtest.sh @@ -0,0 +1,49 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# runtest.sh of freeradius +# Description: RADIUS server +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="freeradius" + +RADIUS_CLIENT_CONF="/etc/raddb/clients.conf" +RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "systemctl stop firewalld" 0,5 + rlRun "systemctl stop radiusd.service" + rlRun "setenforce 0" + rlFileBackup "$RADIUS_CLIENT_CONF" + rlFileBackup "$RADIUD_PALIN_TEXT_AUTH_FILE" + + rlRun "cp freeradius-tests.py /usr/bin/" + rlRun "cp clients.conf $RADIUS_CLIENT_CONF" + rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE" + rlRun "systemctl daemon-reload" + rlPhaseEnd + + rlPhaseStartTest + rlLog "Starting radius auth tests ..." + rlRun "/usr/bin/python3 /usr/bin/freeradius-tests.py" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm /usr/bin/freeradius-tests.py" + rlRun "systemctl start firewalld" 0,5 + rlRun "setenforce 1" + rlFileRestore + rlLog "freeradius tests done" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + +rlGetTestState diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..f070a4d --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,12 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - auth-tests + required_packages: + - python3 + - systemd + - freeradius + - freeradius-utils From 97844b72f66a054f7886f1a650d3f37330d52918 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 29 Jun 2018 21:46:43 +0200 Subject: [PATCH 013/126] Perl 5.28 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 0cb9dde..3b00e53 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -801,6 +801,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jun 29 2018 Jitka Plesnikova - 3.0.15-13 +- Perl 5.28 rebuild + * Tue Mar 06 2018 Björn Esser - 3.0.15-12 - Rebuilt for libjson-c.so.4 (json-c v0.13.1) From 65540fe64517317dabc8dd211b9bc421f0ef6199 Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 00:52:45 -0500 Subject: [PATCH 014/126] Remove needless use of %defattr --- freeradius.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 3b00e53..7b59d9d 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -342,7 +342,6 @@ exit 0 %files -%defattr(-,root,root) # doc %license %{docdir}/LICENSE.gpl From 1ba1452bf601ccb19df11c93f673ae67f75b0716 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 13 Jul 2018 00:50:50 +0000 Subject: [PATCH 015/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 7b59d9d..3e4ee3a 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 13%{?dist} +Release: 14%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -800,6 +800,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jul 13 2018 Fedora Release Engineering - 3.0.15-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Fri Jun 29 2018 Jitka Plesnikova - 3.0.15-13 - Perl 5.28 rebuild From dd2702700ce3d037d2d67ad60bef4c7aca77f228 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Tue, 4 Sep 2018 15:33:36 +0300 Subject: [PATCH 016/126] Add gcc to BuildRequires --- freeradius.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 3e4ee3a..1cbffd4 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 14%{?dist} +Release: 15%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -27,6 +27,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} BuildRequires: autoconf +BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl BuildRequires: openssl-devel @@ -800,6 +801,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Sep 04 2018 Nikolai Kondrashov - 3.0.15-15 +- Add gcc to BuildRequires. + Resolves: Bug#1622470 FTBFS freeradius (rawhide) + * Fri Jul 13 2018 Fedora Release Engineering - 3.0.15-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 943006a4769f4dee28d3ce4de4c9df823f21c870 Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Wed, 5 Sep 2018 15:16:14 +0200 Subject: [PATCH 017/126] BuildRequires: s/postgresql-devel/libpq-devel/ That's because we moved libpq.so.5 into libpq package. Related: rhbz#1618698, rhbz#1623764 --- freeradius.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 1cbffd4..a6e9357 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -159,7 +159,7 @@ This plugin provides the MySQL support for the FreeRADIUS server project. Summary: Postgresql support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -BuildRequires: postgresql-devel +BuildRequires: libpq-devel %description postgresql This plugin provides the postgresql support for the FreeRADIUS server project. From 99b478f15ba4d39970d531fde98ddf5a7ea6fc29 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Fri, 7 Sep 2018 14:17:31 +0300 Subject: [PATCH 018/126] Add make to BuildRequires and Requires(post) --- freeradius.spec | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index a6e9357..35b423e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 15%{?dist} +Release: 16%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -27,6 +27,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} BuildRequires: autoconf +BuildRequires: make BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl @@ -52,6 +53,8 @@ Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) Requires(pre): shadow-utils glibc-common Requires(post): systemd-sysv Requires(post): systemd-units +# Needed for certificate generation +Requires(post): make Requires(preun): systemd-units Requires(postun): systemd-units @@ -801,6 +804,12 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Sep 07 2018 Nikolai Kondrashov - 3.0.15-16 +- Add make to BuildRequires and Requires(post) to fix build and certificate + generation on install. + Resolves: Bug#1574783 Installing freeradius without make results in an + unworkable default configuration + * Tue Sep 04 2018 Nikolai Kondrashov - 3.0.15-15 - Add gcc to BuildRequires. Resolves: Bug#1622470 FTBFS freeradius (rawhide) From e5cfc720bdf6bcc1ace1a0448864463ac3fa6268 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Fri, 14 Sep 2018 12:39:20 +0300 Subject: [PATCH 019/126] Fix a few minor manpage issues --- ...dius-Add-missing-option-descriptions.patch | 97 +++++++++++++++++++ freeradius-man-Fix-some-typos.patch | 94 ++++++++++++++++++ freeradius.spec | 8 +- 3 files changed, 198 insertions(+), 1 deletion(-) create mode 100644 freeradius-Add-missing-option-descriptions.patch create mode 100644 freeradius-man-Fix-some-typos.patch diff --git a/freeradius-Add-missing-option-descriptions.patch b/freeradius-Add-missing-option-descriptions.patch new file mode 100644 index 0000000..4138b4f --- /dev/null +++ b/freeradius-Add-missing-option-descriptions.patch @@ -0,0 +1,97 @@ +From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 12:20:11 +0300 +Subject: [PATCH] man: Add missing option descriptions + +--- + man/man8/raddebug.8 | 4 ++++ + man/man8/radiusd.8 | 7 +++++++ + man/man8/radmin.8 | 4 ++++ + 3 files changed, 15 insertions(+) + +diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8 +index 66e80e64fa..6e27e2453c 100644 +--- a/man/man8/raddebug.8 ++++ b/man/man8/raddebug.8 +@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server. + .IR condition ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-n + .IR name ] + .RB [ \-i +@@ -73,6 +75,8 @@ option is equivalent to using: + .IP "\-d \fIconfig directory\fP" + The radius configuration directory, usually /etc/raddb. See the + \fIradmin\fP manual page for more description of this option. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-n \fImname\fP" + Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP. + .IP \-I\ \fIipv6-address\fP +diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8 +index c825f22d0d..98aef5e1be 100644 +--- a/man/man8/radiusd.8 ++++ b/man/man8/radiusd.8 +@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server + .RB [ \-C ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-f ] + .RB [ \-h ] + .RB [ \-i +@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server + .IR name ] + .RB [ \-p + .IR port ] ++.RB [ \-P ] + .RB [ \-s ] + .RB [ \-t ] + .RB [ \-v ] +@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked. + .IP "\-d \fIconfig directory\fP" + Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration + files such as the \fIdictionary\fP and the \fIusers\fP files. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP \-f + Do not fork, stay running as a foreground process. + .IP \-h +@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in + \fIradiusd.conf\fP are ignored. + + This option MUST be used in conjunction with "-i". ++.IP "\-P ++Always write out PID, even with -f. + .IP \-s + Run in "single server" mode. The server normally runs with multiple + threads and/or processes, which can lower its response time to +diff --git a/man/man8/radmin.8 b/man/man8/radmin.8 +index 5ecc963d81..5bf661fa71 100644 +--- a/man/man8/radmin.8 ++++ b/man/man8/radmin.8 +@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool + .B radmin + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-e + .IR command ] + .RB [ \-E ] +@@ -34,6 +36,8 @@ The following command-line options are accepted by the program. + Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server + configuration files to find the "listen" section that defines the + control socket filename. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-e \fIcommand\fP" + Run \fIcommand\fP and exit. + .IP \-E +-- +2.18.0 + diff --git a/freeradius-man-Fix-some-typos.patch b/freeradius-man-Fix-some-typos.patch new file mode 100644 index 0000000..26d84de --- /dev/null +++ b/freeradius-man-Fix-some-typos.patch @@ -0,0 +1,94 @@ +From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 11:53:28 +0300 +Subject: [PATCH] man: Fix some typos + +--- + man/man5/radrelay.conf.5 | 2 +- + man/man5/rlm_files.5 | 2 +- + man/man5/unlang.5 | 8 ++++---- + man/man8/radrelay.8 | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5 +index 5fb38bfc4e..e3e665024b 100644 +--- a/man/man5/radrelay.conf.5 ++++ b/man/man5/radrelay.conf.5 +@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5 +index bfee5030ff..52f4734ae3 100644 +--- a/man/man5/rlm_files.5 ++++ b/man/man5/rlm_files.5 +@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that + perform per-group checks, and return per-group attributes, where the + group membership is dynamically defined by a previous module. It also + lets you do things like key off of attributes in the reply, and +-express policies like like "when I send replies containing attribute ++express policies like "when I send replies containing attribute + FOO with value BAR, do more checks, and maybe send additional + attributes". + .SH CONFIGURATION +diff --git a/man/man5/unlang.5 b/man/man5/unlang.5 +index 76db8f2d1c..12fe7855b2 100644 +--- a/man/man5/unlang.5 ++++ b/man/man5/unlang.5 +@@ -36,7 +36,7 @@ the pre-defined keywords here. + + Subject to a few limitations described below, any keyword can appear + in any context. The language consists of a series of entries, each +-one one line. Each entry begins with a keyword. Entries are ++one line. Each entry begins with a keyword. Entries are + organized into lists. Processing of the language is line by line, + from the start of the list to the end. Actions are executed + per-keyword. +@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + No statement other than "case" can appear in a "switch" block. +@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + .DS +@@ -799,7 +799,7 @@ regular expression. If no attribute matches, nothing else is done. + The value can be an attribute reference, or an attribute-specific + string. + +-When the value is an an attribute reference, it must take the form of ++When the value is an attribute reference, it must take the form of + "&Attribute-Name". The leading "&" signifies that the value is a + reference. The "Attribute-Name" is an attribute name, such as + "User-Name" or "request:User-Name". When an attribute reference is +diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8 +index fdba6995d5..99e65732a2 100644 +--- a/man/man8/radrelay.8 ++++ b/man/man8/radrelay.8 +@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +-- +2.18.0 + diff --git a/freeradius.spec b/freeradius.spec index 35b423e..78b8881 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 16%{?dist} +Release: 17%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -23,6 +23,8 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-man-Fix-some-typos.patch +Patch4: freeradius-Add-missing-option-descriptions.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -804,6 +806,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Sep 14 2018 Nikolai Kondrashov - 3.0.15-17 +- Fix a few minor manpage issues. + Resolves: Bug#1611286 Man page scan results for freeradius + * Fri Sep 07 2018 Nikolai Kondrashov - 3.0.15-16 - Add make to BuildRequires and Requires(post) to fix build and certificate generation on install. From d99a39e6972a08cb788bd366dd7ef328f81af822 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Mon, 17 Sep 2018 12:35:18 +0300 Subject: [PATCH 020/126] Actually apply patches added previously --- freeradius.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 78b8881..dc1f18d 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 17%{?dist} +Release: 18%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -203,6 +203,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -806,6 +808,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Sep 17 2018 Nikolai Kondrashov - 3.0.15-18 +- Actually apply patches added previously. + Related: Bug#1611286 Man page scan results for freeradius + * Fri Sep 14 2018 Nikolai Kondrashov - 3.0.15-17 - Fix a few minor manpage issues. Resolves: Bug#1611286 Man page scan results for freeradius From 7960729fb9a6e5c87807ad5c8f2a6f686698969a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 18 Oct 2018 16:21:59 -0400 Subject: [PATCH 021/126] Update to upstream release v3.0.17 Signed-off-by: Alexander Scheel --- .gitignore | 1 + freeradius-OpenSSL-HMAC-MD5.patch | 68 ++++++++++++++++++++++++++++ freeradius-OpenSSL-HMAC-SHA1.patch | 73 ++++++++++++++++++++++++++++++ freeradius-python2-shebangs.patch | 64 ++++++++++++++++++++++++++ freeradius.spec | 18 ++++++-- sources | 2 +- 6 files changed, 221 insertions(+), 5 deletions(-) create mode 100644 freeradius-OpenSSL-HMAC-MD5.patch create mode 100644 freeradius-OpenSSL-HMAC-SHA1.patch create mode 100644 freeradius-python2-shebangs.patch diff --git a/.gitignore b/.gitignore index 779754b..28f9f6c 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /freeradius-server-3.0.13.tar.bz2 /freeradius-server-3.0.14.tar.bz2 /freeradius-server-3.0.15.tar.bz2 +/freeradius-server-3.0.17.tar.bz2 diff --git a/freeradius-OpenSSL-HMAC-MD5.patch b/freeradius-OpenSSL-HMAC-MD5.patch new file mode 100644 index 0000000..1e54c55 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-MD5.patch @@ -0,0 +1,68 @@ +From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 09:54:46 -0400 +Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-MD5. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++- + 1 file changed, 33 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c +index 2c662ff368..1cca00fa2a 100644 +--- a/src/lib/hmacmd5.c ++++ b/src/lib/hmacmd5.c +@@ -27,10 +27,41 @@ + + RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + #include + +-/** Calculate HMAC using MD5 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's MD5 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ * ++ */ ++void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ ++#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW ++ /* Since MD5 is not allowed by FIPS, explicitly allow it. */ ++ HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); ++#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */ ++ ++ HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++#else ++/** Calculate HMAC using internal MD5 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -101,6 +132,7 @@ + * hash */ + fr_md5_final(digest, &context); /* finish up 2nd pass */ + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-OpenSSL-HMAC-SHA1.patch b/freeradius-OpenSSL-HMAC-SHA1.patch new file mode 100644 index 0000000..6c60951 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-SHA1.patch @@ -0,0 +1,73 @@ +From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 11:03:52 -0400 +Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-SHA1. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c +index c3cbd87a2c..211470ea35 100644 +--- a/src/lib/hmacsha1.c ++++ b/src/lib/hmacsha1.c +@@ -10,13 +10,19 @@ + + RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + + #ifdef HMAC_SHA1_DATA_PROBLEMS + unsigned int sha1_data_problems = 0; + #endif + +-/** Calculate HMAC using SHA1 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's SHA1 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -28,6 +34,26 @@ + void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, + uint8_t const *key, size_t key_len) + { ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++ ++#else ++ ++/** Calculate HMAC using internal SHA1 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ */ ++void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ + fr_sha1_ctx context; + uint8_t k_ipad[65]; /* inner padding - key XORd with ipad */ + uint8_t k_opad[65]; /* outer padding - key XORd with opad */ +@@ -142,6 +168,7 @@ + } + #endif + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-python2-shebangs.patch b/freeradius-python2-shebangs.patch new file mode 100644 index 0000000..86954db --- /dev/null +++ b/freeradius-python2-shebangs.patch @@ -0,0 +1,64 @@ +From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 18 Oct 2018 12:40:53 -0400 +Subject: [PATCH] Clarify shebangs to be python2 + +Signed-off-by: Alexander Scheel +--- + scripts/radtee | 2 +- + src/modules/rlm_python/example.py | 2 +- + src/modules/rlm_python/prepaid.py | 2 +- + src/modules/rlm_python/radiusd.py | 2 +- + src/modules/rlm_python/radiusd_test.py | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/scripts/radtee b/scripts/radtee +index 123769d244..78b4bcbe0b 100755 +--- a/scripts/radtee ++++ b/scripts/radtee +@@ -1,4 +1,4 @@ +-#!/usr/bin/env python ++#!/usr/bin/env python2 + from __future__ import with_statement + + # RADIUS comparison tee v1.0 +diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py +index 5950a07678..eaf456e349 100644 +--- a/src/modules/rlm_python/example.py ++++ b/src/modules/rlm_python/example.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module example file + # Miguel A.L. Paraz +diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py +index c3cbf57b8f..3b1dc2e2e8 100644 +--- a/src/modules/rlm_python/prepaid.py ++++ b/src/modules/rlm_python/prepaid.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Example Python module for prepaid usage using MySQL + +diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py +index c535bb3caf..7129923994 100644 +--- a/src/modules/rlm_python/radiusd.py ++++ b/src/modules/rlm_python/radiusd.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Definitions for RADIUS programs + # +diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py +index 13b7128b29..97b5b64f08 100644 +--- a/src/modules/rlm_python/radiusd_test.py ++++ b/src/modules/rlm_python/radiusd_test.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module test + # Miguel A.L. Paraz diff --git a/freeradius.spec b/freeradius.spec index dc1f18d..7fef406 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.15 -Release: 18%{?dist} +Version: 3.0.17 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -25,6 +25,9 @@ Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-man-Fix-some-typos.patch Patch4: freeradius-Add-missing-option-descriptions.patch +Patch5: freeradius-OpenSSL-HMAC-MD5.patch +Patch6: freeradius-OpenSSL-HMAC-SHA1.patch +Patch7: freeradius-python2-shebangs.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -205,6 +208,9 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -213,6 +219,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %configure \ --libdir=%{_libdir}/freeradius \ --disable-openssl-version-check \ + --with-openssl \ --with-udpfromto \ --with-threads \ --with-docdir=%{docdir} \ @@ -518,7 +525,6 @@ exit 0 %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail %config(missingok) /etc/raddb/mods-enabled/detail.log -%config(missingok) /etc/raddb/mods-enabled/dhcp %config(missingok) /etc/raddb/mods-enabled/digest %config(missingok) /etc/raddb/mods-enabled/dynamic_clients %config(missingok) /etc/raddb/mods-enabled/eap @@ -765,7 +771,6 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/update_radacct_group.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql @@ -808,6 +813,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Oct 18 2018 Alexander Scheel - 3.0.17-1 +- Update to FreeRADIUS server version 3.0.17 +- Adds OpenSSL HMAC patches from upstream (unreleased) +- Adds Python2 shebang patches from upstream (unreleased) + * Mon Sep 17 2018 Nikolai Kondrashov - 3.0.15-18 - Actually apply patches added previously. Related: Bug#1611286 Man page scan results for freeradius diff --git a/sources b/sources index 1e5a2c5..d4d7f35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.15.tar.bz2) = a2808f0b70b73f11c4c7d00edcb4a56a2ab8f73ce0ff74a9834c8b613ce5ed75ece372f852b0891f68c6a33f50c1bababb76d2eff9326a7fc29fe6b45ec9af88 +SHA512 (freeradius-server-3.0.17.tar.bz2) = f4510d8e77eb7c72a21fbfad851f13460ff4b5a35f0b7bea6102076ceb71188a63b277fb7e4fcd9c3033b396b63e1bf0e455cc03608d7ab1380d1662407cb399 From f9f4db1e4152d3ca0c5cebe42746ee1ce54090c4 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 14 Dec 2018 15:14:53 -0500 Subject: [PATCH 022/126] Add network-online.target instead of network.target in RADIUS spec file Signed-off-by: Alexander Scheel --- freeradius.spec | 6 +++++- radiusd.service | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 7fef406..17bcc25 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -813,6 +813,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Dec 14 2018 Alexander Scheel - 3.0.17-2 +- Updates radiusd.service to start after network-online.target + Resolves: bz#1637275 + * Thu Oct 18 2018 Alexander Scheel - 3.0.17-1 - Update to FreeRADIUS server version 3.0.17 - Adds OpenSSL HMAC patches from upstream (unreleased) diff --git a/radiusd.service b/radiusd.service index 67696ad..32ed926 100644 --- a/radiusd.service +++ b/radiusd.service @@ -1,6 +1,6 @@ [Unit] Description=FreeRADIUS high performance RADIUS server. -After=syslog.target network.target ipa.service dirsrv.target krb5kdc.service +After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service [Service] Type=forking From 7cb836996552350ffc85d44d6d195af3207d3a6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Mon, 14 Jan 2019 19:01:37 +0100 Subject: [PATCH 023/126] Rebuilt for libcrypt.so.2 (#1666033) --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 17bcc25..68bbf38 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -813,6 +813,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Jan 14 2019 Björn Esser - 3.0.17-3 +- Rebuilt for libcrypt.so.2 (#1666033) + * Fri Dec 14 2018 Alexander Scheel - 3.0.17-2 - Updates radiusd.service to start after network-online.target Resolves: bz#1637275 From 1992d5f7631590e7d08dc8d2baabe7e9582f8d1f Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:17:44 +0100 Subject: [PATCH 024/126] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- freeradius.spec | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 68bbf38..7c852b4 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -3,7 +3,6 @@ Name: freeradius Version: 3.0.17 Release: 3%{?dist} License: GPLv2+ and LGPLv2+ -Group: System Environment/Daemons URL: http://www.freeradius.org/ # Is elliptic curve cryptography supported? @@ -79,7 +78,6 @@ be centralized, and minimizes the amount of re-configuration which has to be done when adding or deleting new users. %package doc -Group: Documentation Summary: FreeRADIUS documentation %description doc @@ -87,7 +85,6 @@ All documentation supplied by the FreeRADIUS project is included in this package. %package utils -Group: System Environment/Daemons Summary: FreeRADIUS utilities Requires: %{name} = %{version}-%{release} Requires: libpcap >= 0.9.4 @@ -102,7 +99,6 @@ Support for RFC and VSA Attributes Additional server configuration attributes Selecting a particular configuration Authentication methods %package devel -Group: System Environment/Daemons Summary: FreeRADIUS development files Requires: %{name} = %{version}-%{release} @@ -111,7 +107,6 @@ Development headers and libraries for FreeRADIUS. %package ldap Summary: LDAP support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: openldap-devel @@ -120,7 +115,6 @@ This plugin provides the LDAP support for the FreeRADIUS server project. %package krb5 Summary: Kerberos 5 support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: krb5-devel @@ -129,7 +123,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} @@ -142,7 +135,6 @@ This plugin provides the Perl support for the FreeRADIUS server project. %package -n python2-freeradius Summary: Python support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: python2-devel %{?python_provide:%python_provide python2-freeradius} @@ -156,7 +148,6 @@ This plugin provides the Python support for the FreeRADIUS server project. %package mysql Summary: MySQL support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: mariadb-connector-c-devel @@ -165,7 +156,6 @@ This plugin provides the MySQL support for the FreeRADIUS server project. %package postgresql Summary: Postgresql support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: libpq-devel @@ -174,7 +164,6 @@ This plugin provides the postgresql support for the FreeRADIUS server project. %package sqlite Summary: SQLite support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: sqlite-devel @@ -183,7 +172,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project. %package unixODBC Summary: Unix ODBC support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: unixODBC-devel @@ -192,7 +180,6 @@ This plugin provides the unixODBC support for the FreeRADIUS server project. %package rest Summary: REST support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: libcurl-devel BuildRequires: json-c-devel From 3bfe24f9cb4eb77528fc7d2d27b0656bc6903ffc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 31 Jan 2019 20:09:46 +0000 Subject: [PATCH 025/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 7c852b4..89beccc 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -800,6 +800,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jan 31 2019 Fedora Release Engineering - 3.0.17-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Mon Jan 14 2019 Björn Esser - 3.0.17-3 - Rebuilt for libcrypt.so.2 (#1666033) From ecea0d04290e1ec622a45680d327710acf17c07c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 5 Feb 2019 11:33:54 -0500 Subject: [PATCH 026/126] Fix for bz#1672284 Signed-off-by: Alexander Scheel --- freeradius.spec | 16 +++++----------- radiusd.service | 2 ++ 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 89beccc..1f70b3c 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -319,16 +319,6 @@ getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/n getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 exit 0 -%post -%systemd_post radiusd.service -if [ $1 -eq 1 ]; then # install - # Initial installation - if [ ! -e /etc/raddb/certs/server.pem ]; then - /sbin/runuser -g radiusd -c 'umask 007; /etc/raddb/certs/bootstrap' > /dev/null 2>&1 - fi -fi -exit 0 - %preun %systemd_preun radiusd.service @@ -800,6 +790,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Feb 05 2019 Alexander Scheel - 3.0.17-5 +- Unit file generates certificates if not present. + Resolves: bz#1672284 + * Thu Jan 31 2019 Fedora Release Engineering - 3.0.17-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild diff --git a/radiusd.service b/radiusd.service index 32ed926..133788a 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,6 +6,8 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap +ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C From c374e8c2b3523f69be7ea2c0bb24d9cb27671480 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Sun, 17 Feb 2019 09:30:50 +0100 Subject: [PATCH 027/126] Rebuild for readline 8.0 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 1f70b3c..94a0d1d 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -790,6 +790,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sun Feb 17 2019 Igor Gnatenko - 3.0.17-6 +- Rebuild for readline 8.0 + * Mon Feb 05 2019 Alexander Scheel - 3.0.17-5 - Unit file generates certificates if not present. Resolves: bz#1672284 From 1180d7fadb180e5cada1f1af6f1bd65fbd90822b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 6 Mar 2019 13:07:44 -0500 Subject: [PATCH 028/126] Rebase to 3.0.18 Signed-off-by: Alexander Scheel --- .gitignore | 2 ++ ...nfiguration-to-fit-Red-Hat-specifics.patch | 18 +++++------ ...-Use-system-crypto-policy-by-default.patch | 14 ++++----- freeradius.spec | 30 +++++++++++-------- sources | 2 +- 5 files changed, 36 insertions(+), 30 deletions(-) diff --git a/.gitignore b/.gitignore index 28f9f6c..f52249f 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,5 @@ /freeradius-server-3.0.14.tar.bz2 /freeradius-server-3.0.15.tar.bz2 /freeradius-server-3.0.17.tar.bz2 +/freeradius-server-3.0.18.tar.gz +/freeradius-server-3.0.18.tar.bz2 diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index ad51053..6b2329b 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -12,24 +12,24 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 2621e183c..94494b2c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -472,7 +472,7 @@ eap { - # +@@ -533,7 +533,7 @@ # You should also delete all of the files # in the directory when the server starts. -- # tmpdir = /tmp/radiusd -+ # tmpdir = /var/run/radiusd/tmp + # +- # tmpdir = /tmp/radiusd ++ # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -486,7 +486,7 @@ eap { - # in PEM format. This file is automatically +@@ -548,7 +548,7 @@ # deleted by the server when the command # returns. -- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" -+ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" + # +- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" ++ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } - # + # OCSP Configuration diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 1664186..836a81a 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -14,15 +14,15 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 94494b2c6..9a8dc9327 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -323,7 +323,7 @@ eap { +@@ -912,7 +912,7 @@ + # Note - for OpenSSL 1.1.0 and above you may need + # to add ":@SECLEVEL=0" # - # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" - # -- cipher_list = "DEFAULT" -+ cipher_list = "PROFILE=SYSTEM" +- # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" ++ # cipher_list = "PROFILE=SYSTEM" - # If enabled, OpenSSL will use server cipher list - # (possibly defined by cipher_list option above) + # PAC lifetime in seconds (default: seven days) + # diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap index 2b4df6267..af9aa88cd 100644 --- a/raddb/mods-available/inner-eap diff --git a/freeradius.spec b/freeradius.spec index 94a0d1d..5a91232 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.17 -Release: 6%{?dist} +Version: 3.0.18 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,11 +22,11 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch -Patch3: freeradius-man-Fix-some-typos.patch -Patch4: freeradius-Add-missing-option-descriptions.patch -Patch5: freeradius-OpenSSL-HMAC-MD5.patch -Patch6: freeradius-OpenSSL-HMAC-SHA1.patch -Patch7: freeradius-python2-shebangs.patch +# Patch3: freeradius-man-Fix-some-typos.patch +# Patch4: freeradius-Add-missing-option-descriptions.patch +# Patch5: freeradius-OpenSSL-HMAC-MD5.patch +# Patch6: freeradius-OpenSSL-HMAC-SHA1.patch +# Patch7: freeradius-python2-shebangs.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -193,11 +193,11 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 +# %patch3 -p1 +# %patch4 -p1 +# %patch5 -p1 +# %patch6 -p1 +# %patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -537,6 +537,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/operator-name +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/rfc7542 # binaries @@ -790,10 +791,13 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Mar 06 2019 Alexander Scheel - 3.0.18-1 +- Rebased to 3.0.18 + * Sun Feb 17 2019 Igor Gnatenko - 3.0.17-6 - Rebuild for readline 8.0 -* Mon Feb 05 2019 Alexander Scheel - 3.0.17-5 +* Tue Feb 05 2019 Alexander Scheel - 3.0.17-5 - Unit file generates certificates if not present. Resolves: bz#1672284 diff --git a/sources b/sources index d4d7f35..05139aa 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.17.tar.bz2) = f4510d8e77eb7c72a21fbfad851f13460ff4b5a35f0b7bea6102076ceb71188a63b277fb7e4fcd9c3033b396b63e1bf0e455cc03608d7ab1380d1662407cb399 +SHA512 (freeradius-server-3.0.18.tar.bz2) = 8083f217f77894cad057fc60edd586532a48c762ffabd5180cf075d7e9cc68871fea4c4335310da6be30a6bec58d133e0eea9f39406196d45038d54284d64584 From 40d2550f5fd6629bd7822581eb7601e05be0e8cf Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 10 Apr 2019 13:51:15 -0400 Subject: [PATCH 029/126] Rebase to 3.0.19 Signed-off-by: Alexander Scheel --- .gitignore | 9 +++++++++ freeradius.spec | 16 +++++----------- sources | 2 +- 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/.gitignore b/.gitignore index f52249f..7200a45 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,11 @@ +# Ignore build artifacts and signatures +*.sig +.build*.log +freeradius-server-*/ +x86_64/ +freeradius-*.src.rpm + +# Automatically added /freeradius-server-2.1.9.tar.bz2 /freeradius-server-2.1.10.tar.bz2 /freeradius-server-2.1.11.tar.bz2 @@ -23,3 +31,4 @@ /freeradius-server-3.0.17.tar.bz2 /freeradius-server-3.0.18.tar.gz /freeradius-server-3.0.18.tar.bz2 +/freeradius-server-3.0.19.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 5a91232..f93e045 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,6 +1,6 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.18 +Version: 3.0.19 Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,11 +22,6 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch -# Patch3: freeradius-man-Fix-some-typos.patch -# Patch4: freeradius-Add-missing-option-descriptions.patch -# Patch5: freeradius-OpenSSL-HMAC-MD5.patch -# Patch6: freeradius-OpenSSL-HMAC-SHA1.patch -# Patch7: freeradius-python2-shebangs.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -193,11 +188,6 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 -# %patch3 -p1 -# %patch4 -p1 -# %patch5 -p1 -# %patch6 -p1 -# %patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -742,6 +732,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/procedure.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql @@ -791,6 +782,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 +- Rebased to 3.0.19 + * Wed Mar 06 2019 Alexander Scheel - 3.0.18-1 - Rebased to 3.0.18 diff --git a/sources b/sources index 05139aa..613a918 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.18.tar.bz2) = 8083f217f77894cad057fc60edd586532a48c762ffabd5180cf075d7e9cc68871fea4c4335310da6be30a6bec58d133e0eea9f39406196d45038d54284d64584 +SHA512 (freeradius-server-3.0.19.tar.bz2) = 9bb3401a52288de541a2272149f4341840dc1df7203583746bef46c0b1b1f2b8886931c9f6f9ce3d92951e271ab5a84a50a8587a3acd69cc20bc86f5817d28e1 From 60fac0135f58d81de6a27dee5eb1fb36e464987d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:20:13 -0400 Subject: [PATCH 030/126] Update crypto-policies patch Since introduction, more places for ciphersuites have been introduced by FreeRADIUS; update the crypto-policies patch accordingly. Signed-off-by: Alexander Scheel --- ...-Use-system-crypto-policy-by-default.patch | 40 ++++++++++++------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 836a81a..199e583 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -1,20 +1,30 @@ -From d78bf5ab1f5c8102b2b6051cfb1198488be9597d Mon Sep 17 00:00:00 2001 -From: Nikolai Kondrashov -Date: Mon, 26 Sep 2016 19:48:36 +0300 -Subject: [PATCH] Use system crypto policy by default +From a7ed62fbcc043a9ec7a4f09962a2cd2acffa019b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:16:31 -0400 +Subject: [PATCH] Use system-provided crypto-policies by default +Signed-off-by: Alexander Scheel --- - raddb/mods-available/eap | 2 +- + raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- raddb/sites-available/abfab-tls | 2 +- raddb/sites-available/tls | 4 ++-- - 4 files changed, 5 insertions(+), 5 deletions(-) + 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 94494b2c6..9a8dc9327 100644 +index 36849e10f2..b28c0f19c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -912,7 +912,7 @@ +@@ -368,7 +368,7 @@ eap { + # + # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" + # +- cipher_list = "DEFAULT" ++ cipher_list = "PROFILE=SYSTEM" + + # If enabled, OpenSSL will use server cipher list + # (possibly defined by cipher_list option above) +@@ -912,7 +912,7 @@ eap { # Note - for OpenSSL 1.1.0 and above you may need # to add ":@SECLEVEL=0" # @@ -24,10 +34,10 @@ index 94494b2c6..9a8dc9327 100644 # PAC lifetime in seconds (default: seven days) # diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap -index 2b4df6267..af9aa88cd 100644 +index 576eb7739e..ffa07188e2 100644 --- a/raddb/mods-available/inner-eap +++ b/raddb/mods-available/inner-eap -@@ -68,7 +68,7 @@ eap inner-eap { +@@ -77,7 +77,7 @@ eap inner-eap { # certificates. If so, edit this file. ca_file = ${cadir}/ca.pem @@ -37,7 +47,7 @@ index 2b4df6267..af9aa88cd 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index 5dbe143da..46b5fea78 100644 +index 92f1d6330e..cd69b3905a 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls @@ -19,7 +19,7 @@ listen { @@ -50,10 +60,10 @@ index 5dbe143da..46b5fea78 100644 cache { enable = no diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index cf1cd7a8a..7dd59cb6f 100644 +index bbc761b1c5..83cd35b851 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -197,7 +197,7 @@ listen { +@@ -215,7 +215,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -62,7 +72,7 @@ index cf1cd7a8a..7dd59cb6f 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -499,7 +499,7 @@ home_server tls { +@@ -517,7 +517,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -72,5 +82,5 @@ index cf1cd7a8a..7dd59cb6f 100644 } -- -2.13.2 +2.21.0 From ab22b18a7870e6fa476b87b7c109915e80bea3fb Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:37:04 -0400 Subject: [PATCH 031/126] Improvements to FreeRADIUS - Better crypto-policies (previous commit) - Better logrotation - Better bootstrap Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 100 +++++++++++++++++++++++++ freeradius-logrotate | 5 ++ freeradius.spec | 11 ++- radiusd.service | 2 +- 4 files changed, 116 insertions(+), 2 deletions(-) create mode 100644 freeradius-bootstrap-create-only.patch diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch new file mode 100644 index 0000000..5c3e1ac --- /dev/null +++ b/freeradius-bootstrap-create-only.patch @@ -0,0 +1,100 @@ +From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:29:08 -0400 +Subject: [PATCH] Don't clobber existing files on bootstrap + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 39 ++++++++++++--------------------------- + 1 file changed, 12 insertions(+), 27 deletions(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 0f719aafd4..be81a2d697 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -13,17 +13,6 @@ + umask 027 + cd `dirname $0` + +-make -h > /dev/null 2>&1 +- +-# +-# If we have a working "make", then use it. Otherwise, run the commands +-# manually. +-# +-if [ "$?" = "0" ]; then +- make all +- exit $? +-fi +- + # + # The following commands were created by running "make -n", and edited + # to remove the trailing backslash, and to add "exit 1" after the commands. +@@ -31,52 +20,48 @@ fi + # Don't edit the following text. Instead, edit the Makefile, and + # re-generate these commands. + # +-if [ ! -f dh ]; then ++if [ ! -e dh ]; then + openssl dhparam -out dh 2048 || exit 1 +- if [ -e /dev/urandom ] ; then +- ln -sf /dev/urandom random +- else +- date > ./random; +- fi ++ ln -sf /dev/urandom random + fi + +-if [ ! -f server.key ]; then ++if [ ! -e server.key ]; then + openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + fi + +-if [ ! -f ca.key ]; then ++if [ ! -e ca.key ]; then + openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 + fi + +-if [ ! -f index.txt ]; then ++if [ ! -e index.txt ]; then + touch index.txt + fi + +-if [ ! -f serial ]; then ++if [ ! -e serial ]; then + echo '01' > serial + fi + +-if [ ! -f server.crt ]; then ++if [ ! -e server.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 + fi + +-if [ ! -f server.p12 ]; then ++if [ ! -e server.p12 ]; then + openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + fi + +-if [ ! -f server.pem ]; then ++if [ ! -e server.pem ]; then + openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + openssl verify -CAfile ca.pem server.pem || exit 1 + fi + +-if [ ! -f ca.der ]; then ++if [ ! -e ca.der ]; then + openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 + fi + +-if [ ! -f client.key ]; then ++if [ ! -e client.key ]; then + openssl req -new -out client.csr -keyout client.key -config ./client.cnf + fi + +-if [ ! -f client.crt ]; then ++if [ ! -e client.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf + fi +-- +2.21.0 + diff --git a/freeradius-logrotate b/freeradius-logrotate index 1c3c5b9..c962254 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -14,6 +14,7 @@ nocreate missingok compress + su radiusd radiusd } /var/log/radius/checkrad.log { @@ -22,6 +23,7 @@ create missingok compress + su radiusd radiusd } /var/log/radius/radius.log { @@ -30,6 +32,7 @@ create missingok compress + su radiusd radiusd postrotate /usr/bin/systemctl reload-or-try-restart radiusd endscript @@ -41,6 +44,7 @@ create compress missingok + su radiusd radiusd } /var/log/radius/sqltrace.sql { monthly @@ -48,4 +52,5 @@ create compress missingok + su radiusd radiusd } diff --git a/freeradius.spec b/freeradius.spec index f93e045..9efc114 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,6 +22,7 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -128,6 +129,7 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. +%if 0%{?fedora} <= 30 %package -n python2-freeradius Summary: Python support for freeradius Requires: %{name} = %{version}-%{release} @@ -140,6 +142,7 @@ Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius This plugin provides the Python support for the FreeRADIUS server project. +%endif %package mysql Summary: MySQL support for freeradius @@ -188,6 +191,7 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -782,6 +786,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 08 2019 Alexander Scheel - 3.0.19-2 +- Updated crypto-policies patch +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing +- Updated logrotate definitions to run as radiusd:radiusd + * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 diff --git a/radiusd.service b/radiusd.service index 133788a..894e8aa 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,7 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb From dc4edcad17c606f4e5943c365e9028e5fb36a77c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:41:49 -0400 Subject: [PATCH 032/126] Finish dropping python2 package on Fedora 31+ Signed-off-by: Alexander Scheel --- freeradius.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/freeradius.spec b/freeradius.spec index 9efc114..fd80eab 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -680,11 +680,13 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so +%if 0%{?fedora} <= 30 %files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* /etc/raddb/mods-config/python/radiusd.py* %{_libdir}/freeradius/rlm_python.so +%endif %files mysql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql @@ -790,6 +792,7 @@ exit 0 - Updated crypto-policies patch - Updated /etc/raddb/certs/bootstrap to only create certificates if missing - Updated logrotate definitions to run as radiusd:radiusd +- Drop python2 package on Fedora 31+ * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 From a9000f05d27a62900a414213b62954db8d4f98b7 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 12:05:51 -0400 Subject: [PATCH 033/126] Add additional After= targets to radiusd.service Signed-off-by: Alexander Scheel --- radiusd.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radiusd.service b/radiusd.service index 894e8aa..a2780bb 100644 --- a/radiusd.service +++ b/radiusd.service @@ -1,6 +1,6 @@ [Unit] Description=FreeRADIUS high performance RADIUS server. -After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service +After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service mysql.service mariadb.service postgresql.service [Service] Type=forking From 765b2552b21f7081f9a0db66d06490a7a09dba81 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 13:58:05 -0400 Subject: [PATCH 034/126] Fix certificate generation at build time Signed-off-by: Alexander Scheel --- freeradius-no-buildtime-cert-gen.patch | 104 +++++++++++++++++++++++++ freeradius.spec | 10 ++- 2 files changed, 112 insertions(+), 2 deletions(-) create mode 100644 freeradius-no-buildtime-cert-gen.patch diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch new file mode 100644 index 0000000..aa3be66 --- /dev/null +++ b/freeradius-no-buildtime-cert-gen.patch @@ -0,0 +1,104 @@ +From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 12:58:02 -0400 +Subject: [PATCH] Don't generate certificates in reproducible builds + +Signed-off-by: Alexander Scheel +--- + Make.inc.in | 5 +++++ + configure | 4 ++++ + configure.ac | 3 +++ + raddb/all.mk | 4 ++++ + 4 files changed, 16 insertions(+) + +diff --git a/Make.inc.in b/Make.inc.in +index 0b2cd74de8..8c623cf95c 100644 +--- a/Make.inc.in ++++ b/Make.inc.in +@@ -173,3 +173,8 @@ else + TESTBINDIR = ./$(BUILD_DIR)/bin + TESTBIN = ./$(BUILD_DIR)/bin + endif ++ ++# ++# With reproducible builds, do not generate certificates during installation ++# ++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ +diff --git a/configure b/configure +index c2c599c92b..3d4403a844 100755 +--- a/configure ++++ b/configure +@@ -655,6 +655,7 @@ RUSERS + SNMPWALK + SNMPGET + PERL ++ENABLE_REPRODUCIBLE_BUILDS + openssl_version_check_config + WITH_DHCP + modconfdir +@@ -5586,6 +5587,7 @@ else + fi + + ++ENABLE_REPRODUCIBLE_BUILDS=yes + # Check whether --enable-reproducible-builds was given. + if test "${enable_reproducible_builds+set}" = set; then : + enableval=$enable_reproducible_builds; case "$enableval" in +@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac + + fi +@@ -5604,6 +5607,7 @@ fi + + + ++ + CHECKRAD=checkrad + # Extract the first word of "perl", so it can be a program name with args. + set dummy perl; ac_word=$2 +diff --git a/configure.ac b/configure.ac +index a7abf0025a..35b013f4af 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) + dnl # + dnl # extra argument: --enable-reproducible-builds + dnl # ++ENABLE_REPRODUCIBLE_BUILDS=yes + AC_ARG_ENABLE(reproducible-builds, + [AS_HELP_STRING([--enable-reproducible-builds], + [ensure the build does not change each time])], +@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac ] + ) ++AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) + + + dnl ############################################################# +diff --git a/raddb/all.mk b/raddb/all.mk +index c966edd657..c8e976a499 100644 +--- a/raddb/all.mk ++++ b/raddb/all.mk +@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize + ifneq "$(LOCAL_CERT_PRODUCTS)" "" + $(LOCAL_CERT_PRODUCTS): + @echo BOOTSTRAP raddb/certs/ ++ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes" ++ @$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk ++else + @$(MAKE) -C $(R)$(raddbdir)/certs/ ++endif + + # Bootstrap is special + $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS) +-- +2.21.0 + diff --git a/freeradius.spec b/freeradius.spec index fd80eab..9d8dd32 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -23,6 +23,7 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch +Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -192,6 +193,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -199,6 +201,8 @@ This plugin provides the REST support for the FreeRADIUS server project. %configure \ --libdir=%{_libdir}/freeradius \ + --enable-reproducible-builds \ + --with-package \ --disable-openssl-version-check \ --with-openssl \ --with-udpfromto \ @@ -790,9 +794,11 @@ exit 0 %changelog * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch -- Updated /etc/raddb/certs/bootstrap to only create certificates if missing -- Updated logrotate definitions to run as radiusd:radiusd +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 +- Updated logrotate definitions to run as radiusd:radiusd: bz#1705343 - Drop python2 package on Fedora 31+ +- Add database dependencies: bz#1658697 +- Don't generate certificate during build * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 From a0af05f14f50adee997956bd612d3801ebf8c07b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 14:10:58 -0400 Subject: [PATCH 035/126] Add additional BZ reference Signed-off-by: Alexander Scheel --- freeradius.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 9d8dd32..1041435 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -794,7 +794,7 @@ exit 0 %changelog * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch -- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284 - Updated logrotate definitions to run as radiusd:radiusd: bz#1705343 - Drop python2 package on Fedora 31+ - Add database dependencies: bz#1658697 From 93f241adb12b713ee1169dcbed64f2d556eaa00b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 May 2019 14:20:20 -0400 Subject: [PATCH 036/126] Fix permissions on generated certificates Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 29 ++++++++++++++------------ freeradius.spec | 5 ++++- radiusd.service | 3 +-- 3 files changed, 21 insertions(+), 16 deletions(-) diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch index 5c3e1ac..7af7c94 100644 --- a/freeradius-bootstrap-create-only.patch +++ b/freeradius-bootstrap-create-only.patch @@ -15,7 +15,7 @@ index 0f719aafd4..be81a2d697 100755 @@ -13,17 +13,6 @@ umask 027 cd `dirname $0` - + -make -h > /dev/null 2>&1 - -# @@ -30,7 +30,7 @@ index 0f719aafd4..be81a2d697 100755 # # The following commands were created by running "make -n", and edited # to remove the trailing backslash, and to add "exit 1" after the commands. -@@ -31,52 +20,48 @@ fi +@@ -31,52 +20,51 @@ fi # Don't edit the following text. Instead, edit the Makefile, and # re-generate these commands. # @@ -44,57 +44,60 @@ index 0f719aafd4..be81a2d697 100755 - fi + ln -sf /dev/urandom random fi - + -if [ ! -f server.key ]; then +if [ ! -e server.key ]; then openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 fi - + -if [ ! -f ca.key ]; then +if [ ! -e ca.key ]; then openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 fi - + -if [ ! -f index.txt ]; then +if [ ! -e index.txt ]; then touch index.txt fi - + -if [ ! -f serial ]; then +if [ ! -e serial ]; then echo '01' > serial fi - + -if [ ! -f server.crt ]; then +if [ ! -e server.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 fi - + -if [ ! -f server.p12 ]; then +if [ ! -e server.p12 ]; then openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 fi - + -if [ ! -f server.pem ]; then +if [ ! -e server.pem ]; then openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 openssl verify -CAfile ca.pem server.pem || exit 1 fi - + -if [ ! -f ca.der ]; then +if [ ! -e ca.der ]; then openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 fi - + -if [ ! -f client.key ]; then +if [ ! -e client.key ]; then openssl req -new -out client.csr -keyout client.key -config ./client.cnf fi - + -if [ ! -f client.crt ]; then +if [ ! -e client.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf fi --- ++ ++chown root:radiusd dh ca.* client.* server.* ++chmod 644 dh ca.* client.* server.* +-- 2.21.0 diff --git a/freeradius.spec b/freeradius.spec index 1041435..9312530 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -792,6 +792,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 08 2019 Alexander Scheel - 3.0.19-3 +- Update boostrap to change ownership of all certificates to root:radiusd + * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch - Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284 diff --git a/radiusd.service b/radiusd.service index a2780bb..d073530 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,8 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only -ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C From 00f06bb8b34a58e25d65e26c02bb85b8f1881dea Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 31 May 2019 07:12:47 +0200 Subject: [PATCH 037/126] Perl 5.30 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 9312530..3556e8a 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -792,6 +792,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri May 31 2019 Jitka Plesnikova - 3.0.19-4 +- Perl 5.30 rebuild + * Wed May 08 2019 Alexander Scheel - 3.0.19-3 - Update boostrap to change ownership of all certificates to root:radiusd From f6335be9a2b5e40e03bae7899a7946a2f7e00af9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 01:01:51 +0000 Subject: [PATCH 038/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 3556e8a..7ffb6cd 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -792,6 +792,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 3.0.19-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Fri May 31 2019 Jitka Plesnikova - 3.0.19-4 - Perl 5.30 rebuild From 1ef8514cc3e4f689798027c45a9c486508cf5268 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 15 Nov 2019 15:03:30 -0500 Subject: [PATCH 039/126] Rebase to FreeRADIUS v3.0.20 Introduces the experimental rlm_python3 that is largely based off the existing python2 module. Signed-off-by: Alexander Scheel --- .gitignore | 1 + freeradius.spec | 56 ++++++++++++++++++++++++++++++++++++++++++++----- sources | 2 +- 3 files changed, 53 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 7200a45..2a06a22 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.18.tar.gz /freeradius-server-3.0.18.tar.bz2 /freeradius-server-3.0.19.tar.bz2 +/freeradius-server-3.0.20.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 7ffb6cd..7658dee 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.19 -Release: 5%{?dist} +Version: 3.0.20 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -132,7 +132,7 @@ This plugin provides the Perl support for the FreeRADIUS server project. %if 0%{?fedora} <= 30 %package -n python2-freeradius -Summary: Python support for freeradius +Summary: Python 2 support for freeradius Requires: %{name} = %{version}-%{release} BuildRequires: python2-devel %{?python_provide:%python_provide python2-freeradius} @@ -142,9 +142,18 @@ Provides: %{name}-python%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius -This plugin provides the Python support for the FreeRADIUS server project. +This plugin provides the Python 2 support for the FreeRADIUS server project. %endif +%package -n python3-freeradius +Summary: Python 3 support for freeradius +Requires: %{name} = %{version}-%{release} +BuildRequires: python3-devel +%{?python_provide:%python_provide python3-freeradius} + +%description -n python3-freeradius +This plugin provides the Python 3 support for the FreeRADIUS server project. + %package mysql Summary: MySQL support for freeradius Requires: %{name} = %{version}-%{release} @@ -199,10 +208,26 @@ This plugin provides the REST support for the FreeRADIUS server project. # Force compile/link options, extra security for network facing daemon %global _hardened_build 1 +# Hack: rlm_python3 as stable; prevents building other unstable modules. +sed 's/rlm_python/rlm_python3/g' src/modules/stable -i + +# python3-config is broken: +# https://bugzilla.redhat.com/show_bug.cgi?id=1772988 +export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" +export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" + +# Hack: rlm_python3 configure.ac script is broken because it doesn't +# respect --with-rlm-python3-include-dir. +sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac + +# In order for the above hack to stick, do a fake configure so +# we can run reconfig before cleaning up after ourselves and running +# configure for real. +./configure && make reconfig && (make clean distclean || true) + %configure \ --libdir=%{_libdir}/freeradius \ --enable-reproducible-builds \ - --with-package \ --disable-openssl-version-check \ --with-openssl \ --with-udpfromto \ @@ -215,6 +240,9 @@ This plugin provides the REST support for the FreeRADIUS server project. --with-unixodbc-lib-dir=%{_libdir} \ --with-rlm-dbm-lib-dir=%{_libdir} \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ + --with-rlm_python3 \ + --with-rlm-python3-lib-dir=$PY3_LIB_DIR \ + --with-rlm-python3-include-dir=$PY3_INC_DIR \ --without-rlm_eap_ikev2 \ --without-rlm_eap_tnc \ --without-rlm_sql_iodbc \ @@ -288,6 +316,10 @@ rm $RPM_BUILD_ROOT/%{_libdir}/freeradius/rlm_test.so # remove unsupported config files rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/experimental.conf +# Mongo will never be supported on Fedora or RHEL +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/mods-config/sql/ippool/mongo/queries.conf +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/mods-config/sql/main/mongo/queries.conf + # install doc files omitted by standard install for f in COPYRIGHT CREDITS INSTALL.rst README.rst VERSION; do cp $f $RPM_BUILD_ROOT/%{docdir} @@ -406,6 +438,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/coa +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/coa-relay %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/example %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/inner-tunnel %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/dhcp @@ -471,6 +504,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/python +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/python3 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/radutmp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/realm %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/redis @@ -692,6 +726,12 @@ exit 0 %{_libdir}/freeradius/rlm_python.so %endif +%files -n python3-freeradius +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/python3 +/etc/raddb/mods-config/python3/example.py* +/etc/raddb/mods-config/python3/radiusd.py* +%{_libdir}/freeradius/rlm_python3.so + %files mysql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf @@ -706,6 +746,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf @@ -792,6 +833,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Nov 15 2019 Alexander Scheel - 3.0.20-1 +- Rebased to 3.0.20 + Resolves: bz#1772710 +- Introduced new rlm_python3 module + * Thu Jul 25 2019 Fedora Release Engineering - 3.0.19-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 613a918..ab35246 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.19.tar.bz2) = 9bb3401a52288de541a2272149f4341840dc1df7203583746bef46c0b1b1f2b8886931c9f6f9ce3d92951e271ab5a84a50a8587a3acd69cc20bc86f5817d28e1 +SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e From ad10ca7db9500ed2595f313395b9fa5a5da1c753 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 11 Jan 2020 15:14:58 -0500 Subject: [PATCH 040/126] fixup tmpfile to not reference /var/run but /run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This prevents: /usr/lib/tmpfiles.d/radiusd.conf:1: Line references path below legacy directory /var/run/, updating /var/run/radiusd → /run/radiusd; please update the tmpfiles.d/ drop-in file accordingly. --- freeradius-tmpfiles.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius-tmpfiles.conf b/freeradius-tmpfiles.conf index ead7a2f..8f20796 100644 --- a/freeradius-tmpfiles.conf +++ b/freeradius-tmpfiles.conf @@ -1 +1 @@ -D /var/run/radiusd 0710 radiusd radiusd - +D /run/radiusd 0710 radiusd radiusd - From f8c5aa19ae6c5ba2ab1d3d4a0635fe0294c59be1 Mon Sep 17 00:00:00 2001 From: Paul Wouters Date: Sat, 11 Jan 2020 15:16:42 -0500 Subject: [PATCH 041/126] - fixup tmpfile to use /run instead of /var/run --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 7658dee..34b89c9 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.20 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -833,6 +833,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sat Jan 11 2020 Paul Wouters - 3.0.20-2 +- fixup tmpfile to use /run instead of /var/run + * Fri Nov 15 2019 Alexander Scheel - 3.0.20-1 - Rebased to 3.0.20 Resolves: bz#1772710 From 6bde0db76cf58b93dcb58e2bbe8f545763976ecf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jan 2020 18:59:20 +0000 Subject: [PATCH 042/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 34b89c9..cec0221 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.20 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -833,6 +833,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jan 28 2020 Fedora Release Engineering - 3.0.20-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Sat Jan 11 2020 Paul Wouters - 3.0.20-2 - fixup tmpfile to use /run instead of /var/run From c66b0018603c6369533bbb9d1a9e6029a53dc082 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 1 Apr 2020 13:21:27 -0400 Subject: [PATCH 043/126] Rebase to FreeRADIUS v3.0.31 Signed-off-by: Alexander Scheel --- .gitignore | 1 + freeradius.spec | 22 ++++++++++++---------- sources | 2 +- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 2a06a22..2f5a9d8 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.18.tar.bz2 /freeradius-server-3.0.19.tar.bz2 /freeradius-server-3.0.20.tar.bz2 +/freeradius-server-3.0.21.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index cec0221..7a0df49 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.20 -Release: 3%{?dist} +Version: 3.0.21 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,8 +22,6 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch -Patch3: freeradius-bootstrap-create-only.patch -Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -201,8 +199,6 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 -%patch3 -p1 -%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -216,10 +212,6 @@ sed 's/rlm_python/rlm_python3/g' src/modules/stable -i export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" -# Hack: rlm_python3 configure.ac script is broken because it doesn't -# respect --with-rlm-python3-include-dir. -sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac - # In order for the above hack to stick, do a fake configure so # we can run reconfig before cleaning up after ourselves and running # configure for real. @@ -280,6 +272,7 @@ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key @@ -298,6 +291,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle +rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids @@ -756,6 +750,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax @@ -789,6 +784,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf @@ -818,6 +814,8 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -833,6 +831,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Apr 01 2020 Alexander Scheel - 3.0.31-1 +- Rebased to 3.0.31 + Resolves: bz#1816745 + * Tue Jan 28 2020 Fedora Release Engineering - 3.0.20-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild diff --git a/sources b/sources index ab35246..a895a5a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e +SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729 From f9610e3357ad63aa28567f0bf8dca1b43d741a0f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 1 Apr 2020 13:34:47 -0400 Subject: [PATCH 044/126] Correction: FreeRADIUS v3.0.21! Signed-off-by: Alexander Scheel --- freeradius.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 7a0df49..768e522 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -831,8 +831,8 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog -* Wed Apr 01 2020 Alexander Scheel - 3.0.31-1 -- Rebased to 3.0.31 +* Wed Apr 01 2020 Alexander Scheel - 3.0.21-1 +- Rebased to 3.0.21 Resolves: bz#1816745 * Tue Jan 28 2020 Fedora Release Engineering - 3.0.20-3 From 2b4b411c94b99b9bc859dbfd7fcd7384c63586a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Wed, 22 Apr 2020 00:31:13 +0200 Subject: [PATCH 045/126] Rebuild (json-c) --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 768e522..a7c3fb1 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -831,6 +831,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Apr 21 2020 Björn Esser - 3.0.21-2 +- Rebuild (json-c) + * Wed Apr 01 2020 Alexander Scheel - 3.0.21-1 - Rebased to 3.0.21 Resolves: bz#1816745 From c30f7f08dfa3491357d0d594e894be434ba4333b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 13 May 2020 10:02:47 -0400 Subject: [PATCH 046/126] Fix certificate generation Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 60 ++++++++++---------------- freeradius.spec | 10 ++++- 2 files changed, 32 insertions(+), 38 deletions(-) diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch index 7af7c94..17cab04 100644 --- a/freeradius-bootstrap-create-only.patch +++ b/freeradius-bootstrap-create-only.patch @@ -1,36 +1,18 @@ -From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001 +From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001 From: Alexander Scheel -Date: Wed, 8 May 2019 10:29:08 -0400 +Date: Wed, 13 May 2020 10:01:47 -0400 Subject: [PATCH] Don't clobber existing files on bootstrap Signed-off-by: Alexander Scheel --- - raddb/certs/bootstrap | 39 ++++++++++++--------------------------- - 1 file changed, 12 insertions(+), 27 deletions(-) + raddb/certs/bootstrap | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap -index 0f719aafd4..be81a2d697 100755 +index ede09bc..e555491 100755 --- a/raddb/certs/bootstrap +++ b/raddb/certs/bootstrap -@@ -13,17 +13,6 @@ - umask 027 - cd `dirname $0` - --make -h > /dev/null 2>&1 -- --# --# If we have a working "make", then use it. Otherwise, run the commands --# manually. --# --if [ "$?" = "0" ]; then -- make all -- exit $? --fi -- - # - # The following commands were created by running "make -n", and edited - # to remove the trailing backslash, and to add "exit 1" after the commands. -@@ -31,52 +20,51 @@ fi +@@ -20,56 +20,55 @@ cd `dirname $0` # Don't edit the following text. Instead, edit the Makefile, and # re-generate these commands. # @@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755 - fi + ln -sf /dev/urandom random fi - + -if [ ! -f server.key ]; then +if [ ! -e server.key ]; then openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + chmod g+r server.key fi - + -if [ ! -f ca.key ]; then +if [ ! -e ca.key ]; then openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 fi - + -if [ ! -f index.txt ]; then +if [ ! -e index.txt ]; then touch index.txt fi - + -if [ ! -f serial ]; then +if [ ! -e serial ]; then echo '01' > serial fi - + -if [ ! -f server.crt ]; then +if [ ! -e server.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 fi - + -if [ ! -f server.p12 ]; then +if [ ! -e server.p12 ]; then openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + chmod g+r server.p12 fi - + -if [ ! -f server.pem ]; then +if [ ! -e server.pem ]; then openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 openssl verify -CAfile ca.pem server.pem || exit 1 + chmod g+r server.pem fi - + -if [ ! -f ca.der ]; then +if [ ! -e ca.der ]; then openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 fi - + -if [ ! -f client.key ]; then +if [ ! -e client.key ]; then openssl req -new -out client.csr -keyout client.key -config ./client.cnf + chmod g+r client.key fi - + -if [ ! -f client.crt ]; then +if [ ! -e client.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf fi + +chown root:radiusd dh ca.* client.* server.* -+chmod 644 dh ca.* client.* server.* --- -2.21.0 ++chmod 640 dh ca.* client.* server.* +-- +2.26.2 diff --git a/freeradius.spec b/freeradius.spec index a7c3fb1..48dc106 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,6 +22,8 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch +Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -199,6 +201,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -831,6 +835,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 13 2020 Alexander Scheel - 3.0.21-3 +- Fix certificate generation + Resolves: bz#1835249 + * Tue Apr 21 2020 Björn Esser - 3.0.21-2 - Rebuild (json-c) From 08b8e233972840c0882527b071967a0aec5c8195 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 23 Jun 2020 12:11:05 +0200 Subject: [PATCH 047/126] Perl 5.32 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 48dc106..85ba1d5 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -835,6 +835,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 23 2020 Jitka Plesnikova - 3.0.21-4 +- Perl 5.32 rebuild + * Wed May 13 2020 Alexander Scheel - 3.0.21-3 - Fix certificate generation Resolves: bz#1835249 From bbe674aeb2db70049f51330deb6236a101c7c546 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Tue, 7 Jul 2020 16:40:16 +0000 Subject: [PATCH 048/126] Minor conditional tweak for ELN Signed-off-by: Troy Dawson tdawson@redhat.com --- freeradius.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 85ba1d5..cd6e3c2 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -130,7 +130,7 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. -%if 0%{?fedora} <= 30 +%if 0%{?fedora} <= 30 && 0%{?rhel} < 9 %package -n python2-freeradius Summary: Python 2 support for freeradius Requires: %{name} = %{version}-%{release} @@ -716,7 +716,7 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so -%if 0%{?fedora} <= 30 +%if 0%{?fedora} <= 30 && 0%{?rhel} < 9 %files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* From 6b72fc1f5059526ae6a20098340cd17d5c78fcca Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Tue, 7 Jul 2020 19:17:35 +0000 Subject: [PATCH 049/126] no python2 for rhel8 --- freeradius.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index cd6e3c2..47442b4 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -130,7 +130,7 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. -%if 0%{?fedora} <= 30 && 0%{?rhel} < 9 +%if 0%{?fedora} <= 30 && 0%{?rhel} < 8 %package -n python2-freeradius Summary: Python 2 support for freeradius Requires: %{name} = %{version}-%{release} @@ -716,7 +716,7 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so -%if 0%{?fedora} <= 30 && 0%{?rhel} < 9 +%if 0%{?fedora} <= 30 && 0%{?rhel} < 8 %files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* From 1139a33473742a22a7cee30aacf96481893b9682 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 27 Jul 2020 17:49:44 +0000 Subject: [PATCH 050/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 47442b4..2b0e0f7 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -835,6 +835,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Jul 27 2020 Fedora Release Engineering - 3.0.21-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jun 23 2020 Jitka Plesnikova - 3.0.21-4 - Perl 5.32 rebuild From 527b1c3a1dcd1bc9b5769edf65afc08ab51b8a6d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 4 Aug 2020 10:22:02 -0400 Subject: [PATCH 051/126] Re-fix permissions issues Since make is present on certain systems (and has the better certificate generation logic), we should Require: make and add the relevant chmod statements to bootstrap after executing make. Signed-off-by: Alexander Scheel --- freeradius-bootstrap-make-permissions.patch | 29 +++++++++++++++++++++ freeradius.spec | 11 +++++--- 2 files changed, 37 insertions(+), 3 deletions(-) create mode 100644 freeradius-bootstrap-make-permissions.patch diff --git a/freeradius-bootstrap-make-permissions.patch b/freeradius-bootstrap-make-permissions.patch new file mode 100644 index 0000000..3548fa6 --- /dev/null +++ b/freeradius-bootstrap-make-permissions.patch @@ -0,0 +1,29 @@ +From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 4 Aug 2020 10:08:15 -0400 +Subject: [PATCH] Fix permissions after generating certificates with make + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 336a2bd..9920ecf 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1 + # + if [ "$?" = "0" ]; then + make all +- exit $? ++ ret=$? ++ chown root:radiusd dh ca.* client.* server.* ++ chmod 640 dh ca.* client.* server.* ++ exit $ret + fi + + # +-- +2.26.2 + diff --git a/freeradius.spec b/freeradius.spec index 2b0e0f7..51a9d66 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -54,8 +54,9 @@ Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) Requires(pre): shadow-utils glibc-common Requires(post): systemd-sysv Requires(post): systemd-units -# Needed for certificate generation -Requires(post): make +# Needed for certificate generation as upstream bootstrap script isn't +# compatible with Makefile equivalent. +Requires: make Requires(preun): systemd-units Requires(postun): systemd-units @@ -835,6 +836,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Aug 04 2020 Alexander Scheel - 3.0.21-6 +- Fix certificate permissions after make-based generation + Resolves: bz#1835249 + * Mon Jul 27 2020 Fedora Release Engineering - 3.0.21-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From e260f8f12f1dea17ee3beeaa607c98509f7e97d7 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 4 Aug 2020 11:08:13 -0400 Subject: [PATCH 052/126] Apply patch this time Signed-off-by: Alexander Scheel --- freeradius.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 51a9d66..ccbe5e9 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -24,6 +24,7 @@ Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch +Patch5: freeradius-bootstrap-make-permissions.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -836,6 +837,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Aug 04 2020 Alexander Scheel - 3.0.21-7 +- Fix certificate permissions after make-based generation + Resolves: bz#1835249 + * Tue Aug 04 2020 Alexander Scheel - 3.0.21-6 - Fix certificate permissions after make-based generation Resolves: bz#1835249 From 2898c9222beb70cb2dc4d5db7f5a37f6988530bc Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 4 Aug 2020 11:13:29 -0400 Subject: [PATCH 053/126] Again, apply patch Signed-off-by: Alexander Scheel --- freeradius.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/freeradius.spec b/freeradius.spec index ccbe5e9..fc9091e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -205,6 +205,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 %build # Force compile/link options, extra security for network facing daemon From e2ccd9913fac41fcd0d51d4478068677f21d778e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 05:55:34 +0000 Subject: [PATCH 054/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index fc9091e..aad6906 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 7%{?dist} +Release: 8%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -838,6 +838,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 3.0.21-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Aug 04 2020 Alexander Scheel - 3.0.21-7 - Fix certificate permissions after make-based generation Resolves: bz#1835249 From 8f248db2e6739c6c401812c544cd4e08ecdd522a Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 8 Feb 2021 09:25:27 +0100 Subject: [PATCH 055/126] rebuild for libpq ABI fix Related: rhbz#1908268 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index aad6906..075c618 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 8%{?dist} +Release: 9%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -838,6 +838,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Feb 08 2021 Pavel Raiskup - 3.0.21-9 +- rebuild for libpq ABI fix rhbz#1908268 + * Tue Jan 26 2021 Fedora Release Engineering - 3.0.21-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From f4c10d8cdd0dd98289e0a1b3dcc4f320d81cb497 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:46 +0100 Subject: [PATCH 056/126] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- freeradius.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 075c618..0683237 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 9%{?dist} +Release: 10%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -838,6 +838,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.21-10 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Feb 08 2021 Pavel Raiskup - 3.0.21-9 - rebuild for libpq ABI fix rhbz#1908268 From 4e468ec265cb349c4611c0bf3b6b6e6f7cf3fc11 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 10 Mar 2021 20:40:09 +0000 Subject: [PATCH 057/126] General package cleanup; no code changes --- find_module_deps | 385 ------------------ ...dius-Add-missing-option-descriptions.patch | 97 ----- freeradius-OpenSSL-HMAC-MD5.patch | 68 ---- freeradius-OpenSSL-HMAC-SHA1.patch | 73 ---- freeradius-autogen.sh | 21 - freeradius-man-Fix-some-typos.patch | 94 ----- freeradius-python2-shebangs.patch | 64 --- freeradius-radiusd-init | 113 ----- freeradius.spec | 3 +- 9 files changed, 2 insertions(+), 916 deletions(-) delete mode 100755 find_module_deps delete mode 100644 freeradius-Add-missing-option-descriptions.patch delete mode 100644 freeradius-OpenSSL-HMAC-MD5.patch delete mode 100644 freeradius-OpenSSL-HMAC-SHA1.patch delete mode 100755 freeradius-autogen.sh delete mode 100644 freeradius-man-Fix-some-typos.patch delete mode 100644 freeradius-python2-shebangs.patch delete mode 100644 freeradius-radiusd-init diff --git a/find_module_deps b/find_module_deps deleted file mode 100755 index c114baa..0000000 --- a/find_module_deps +++ /dev/null @@ -1,385 +0,0 @@ -#!/usr/bin/env python - -import exceptions -import getopt -import os -import re -import rpm -import select -import subprocess -import sys - -#------------------------------------------------------------------------------ - -def get_rlms(root): - rlm_re = re.compile(r'^rlm_') - version_re = re.compile(r'-[0-9.]+\.so$') - names = os.listdir(root) - names = [x for x in names if rlm_re.search(x)] - names = [x for x in names if not version_re.search(x)] - names.sort() - return names - -#------------------------------------------------------------------------------ - -debug = False -verbose = False - -exclude_rpms = ['glibc'] - -build = '2.0.2-1.fc8' -root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius' -libdirs = ['/lib','/usr/lib'] - -#------------------------------------------------------------------------------ - -def get_rpm_nvr_from_header(hdr): - 'Given an RPM header return the package NVR as a string' - name = hdr['name'] - version = hdr['version'] - release = hdr['release'] - - return "%s-%s-%s" % (name, version, release) - -def get_rpm_hdr_by_file_path(path): - if path is None: - return None - - hdr = None - try: - ts = rpm.ts() - mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path) - for hdr in mi: break - except Exception, e: - print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e) - hdr = None - return hdr - -def get_rpm_nvr_by_file_path(path): - if path is None: - return None - - hdr = get_rpm_hdr_by_file_path(path) - if not hdr: - print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) - nvr = get_rpm_nvr_from_header(hdr) - return nvr - -def get_rpm_name_by_file_path(path): - if path is None: - return None - - hdr = get_rpm_hdr_by_file_path(path) - if not hdr: - print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) - name = hdr['name'] - return name - -#------------------------------------------------------------------------------ - -class CmdError(exceptions.Exception): - def __init__(self, errno, msg): - self.errno = errno - self.msg = msg - - -class Command: - def __init__(self, cmd): - self.cmd = cmd - self.sub_process = None - self.bufsize = 1024 - self.stdout_buf = '' - self.stderr_buf = '' - self.stdout_lines = [] - self.stderr_lines = [] - - def run(self, stdout_callback=None, stderr_callback=None): - self.sub_process = subprocess.Popen(self.cmd, \ - stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \ - close_fds=True, shell=True) - self.stdout = self.sub_process.stdout - self.stderr = self.sub_process.stderr - - read_watch = [self.stdout, self.stderr] - while read_watch: - readable = select.select(read_watch, [], [])[0] - for fd in readable: - if fd == self.stdout: - data = os.read(fd.fileno(), self.bufsize) - if not data: - read_watch.remove(fd) - else: - self.stdout_buf += data - for line in self.burst_lines('stdout_buf'): - if stdout_callback: stdout_callback(line) - self.stdout_lines.append(line) - if fd == self.stderr: - data = os.read(fd.fileno(), self.bufsize) - if not data: - read_watch.remove(fd) - else: - self.stderr_buf += data - for line in self.burst_lines('stderr_buf'): - if stdout_callback: stderr_callback(line) - self.stderr_lines.append(line) - - self.returncode = self.sub_process.wait() - if self.returncode: - raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines))) - - return self.returncode - - def burst_lines(self, what): - buf = getattr(self, what) - start = 0 - end = buf.find('\n', start) - while end >= 0: - end += 1 # include newline - line = buf[start:end] - yield line - start = end - end = buf.find('\n', start) - buf = buf[start:] - setattr(self, what, buf) - - -#------------------------------------------------------------------------------ - -def get_so_requires(path): - requires = {} - cmd = 'ldd %s' % (path) - so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)') - - c = Command(cmd) - status = c.run() - - for line in c.stdout_lines: - line = line.strip() - match = so_re.search(line) - if match: - so_name = match.group(1) - if match.group(2).startswith('/'): - so_path = match.group(2) - else: - so_path = None - - requires[so_name] = so_path - return requires - -def get_so_needed(path): - needed = [] - cmd = 'readelf -d %s' % (path) - so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]') - - c = Command(cmd) - status = c.run() - - for line in c.stdout_lines: - line = line.strip() - match = so_re.search(line) - if match: - so_name = match.group(1) - needed.append(so_name) - return needed - -def format_size(size): - if size > 1000000000: - return '%.1f GB' % (size/1000000000.0) - if size > 1000000: - return '%.1f MB' % (size/1000000.0) - if size > 1000: - return '%.1f KB' % (size/1000.0) - return '%d' % (size) -#------------------------------------------------------------------------------ - -class RPM_Prop: - def __init__(self, path=None, name=None): - self.name = name - self.paths = {} - self.rpm_hdr = None - self.used_by = {} - if path: - self.register_path(path) - if not self.rpm_hdr: - self.rpm_hdr = get_rpm_hdr_by_file_path(path) - if self.rpm_hdr: - if not self.name: - self.name = self.rpm_hdr[rpm.RPMTAG_NAME] - self.size = self.rpm_hdr[rpm.RPMTAG_SIZE] - - def __str__(self): - return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys())) - - def register_path(self, path, name=None): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - return self.paths.setdefault(path, path) - -class RPM_Collection: - def __init__(self): - self.names = {} - self.paths = {} - - def __str__(self): - text = '' - names = self.get_names() - for name in names: - text += "%s: %s\n" % (name, self.names[name]) - return text - - def register_path(self, path): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - rpm_prop = self.paths.get(path) - if not rpm_prop: - rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path)) - self.names.setdefault(rpm_prop.name, rpm_prop) - return rpm_prop - - def get_names(self): - names = self.names.keys() - names.sort() - return names - - def get_name(self, name): - return self.names.get(name) - -class SO_File: - def __init__(self, name=None, path=None): - self.name = name - self.path = path - self.rpm = None - - def __str__(self): - if self.rpm: - rpm_name = self.rpm.name - else: - rpm_name = None - return "name=%s rpm=%s" % (self.name, rpm_name) - -class SO_Collection: - def __init__(self): - self.names = {} - self.paths = {} - - def __str__(self): - text = '' - names = self.get_names() - for name in names: - text += "%s: %s\n" % (name, self.names[name]) - return text - - def register_path(self, path, name=None): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - so_prop = self.paths.get(path) - if not so_prop: - so_prop = self.paths.setdefault(path, SO_File(name, path=path)) - self.names.setdefault(name, so_prop) - return so_prop - - def get_names(self): - names = self.names.keys() - names.sort() - return names - -class LoadableModule: - def __init__(self, path, name=None): - if name is None: - name = os.path.basename(path) - self.name = name - self.path = path - self.rpm_names = {} - self.sos = SO_Collection() - self.get_so_requires() - - def __str__(self): - text = '%s\n' % (self.name) - text += " RPM's: %s\n" % (','.join(self.get_rpm_names())) - text += " SO's: %s\n" % (','.join(self.sos.get_names())) - return text - - def get_so_requires(self): - requires = get_so_requires(self.path) - needed = get_so_needed(self.path) - #print "%s requires=%s" % (self.name, requires) - #print "%s needed=%s" % (self.name, needed) - - for so_name, so_path in requires.items(): - if so_name not in needed: continue - if so_path: - so_prop = self.sos.register_path(so_path, so_name) - rpm_prop = rpms.register_path(so_prop.path) - rpm_prop.used_by[self.name] = 1 - self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name) - so_prop.rpm = rpm_prop - else: - so_prop = None - if verbose: print "found so='%s' %s" % (so_name, so_prop) - - def register_so(self, so): - if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so) - self.sos.setdefault(so, so) - self.names.setdefault(so.name, so) - return so - - def get_rpm_names(self): - rpm_names = self.rpm_names.keys() - rpm_names.sort() - return rpm_names - - def get_sos(self): - sos = self.sos.keys() - sos.sort(lambda a,b: cmp(a.name, b.name)) - return sos - -#------------------------------------------------------------------------------ - -#------------------------------------------------------------------------------ - -opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose']) -for o, a in opts: - if o in ['-b', '--build']: - build = a - elif o in ['-v', '--verbose']: - verbose = True - else: - print >> sys.stderr, "Unknown arg: %s" % o - sys.exit(1) - -root = root_template % build -modules = get_rlms(root) -module_paths = [os.path.join(root,x) for x in modules] -rpms = RPM_Collection() - -lms = [] -for module_path in module_paths[:]: - lm = LoadableModule(module_path) - lms.append(lm) - - -print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules)) - -for lm in lms: - rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms] - if rpm_names: - print lm.name - print ' %s' % (','.join(rpm_names)) - -print "--------------" - -rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms] -rpm_props.sort(lambda a,b: cmp(a.name, b.name)) -for rpm_prop in rpm_props: - used_by = rpm_prop.used_by.keys() - used_by.sort() - print "%s: %s" % (rpm_prop.name, ','.join(used_by)) - -print "--------------" - -rpm_props.sort(lambda a,b: cmp(a.size, b.size)) -for rpm_prop in rpm_props: - print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name) - - -print "--------------" - -for lm in lms: - print lm diff --git a/freeradius-Add-missing-option-descriptions.patch b/freeradius-Add-missing-option-descriptions.patch deleted file mode 100644 index 4138b4f..0000000 --- a/freeradius-Add-missing-option-descriptions.patch +++ /dev/null @@ -1,97 +0,0 @@ -From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001 -From: Nikolai Kondrashov -Date: Fri, 14 Sep 2018 12:20:11 +0300 -Subject: [PATCH] man: Add missing option descriptions - ---- - man/man8/raddebug.8 | 4 ++++ - man/man8/radiusd.8 | 7 +++++++ - man/man8/radmin.8 | 4 ++++ - 3 files changed, 15 insertions(+) - -diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8 -index 66e80e64fa..6e27e2453c 100644 ---- a/man/man8/raddebug.8 -+++ b/man/man8/raddebug.8 -@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server. - .IR condition ] - .RB [ \-d - .IR config_directory ] -+.RB [ \-D -+.IR dictionary_directory ] - .RB [ \-n - .IR name ] - .RB [ \-i -@@ -73,6 +75,8 @@ option is equivalent to using: - .IP "\-d \fIconfig directory\fP" - The radius configuration directory, usually /etc/raddb. See the - \fIradmin\fP manual page for more description of this option. -+.IP "\-D \fIdictionary directory\fP" -+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. - .IP "\-n \fImname\fP" - Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP. - .IP \-I\ \fIipv6-address\fP -diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8 -index c825f22d0d..98aef5e1be 100644 ---- a/man/man8/radiusd.8 -+++ b/man/man8/radiusd.8 -@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server - .RB [ \-C ] - .RB [ \-d - .IR config_directory ] -+.RB [ \-D -+.IR dictionary_directory ] - .RB [ \-f ] - .RB [ \-h ] - .RB [ \-i -@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server - .IR name ] - .RB [ \-p - .IR port ] -+.RB [ \-P ] - .RB [ \-s ] - .RB [ \-t ] - .RB [ \-v ] -@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked. - .IP "\-d \fIconfig directory\fP" - Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration - files such as the \fIdictionary\fP and the \fIusers\fP files. -+.IP "\-D \fIdictionary directory\fP" -+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. - .IP \-f - Do not fork, stay running as a foreground process. - .IP \-h -@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in - \fIradiusd.conf\fP are ignored. - - This option MUST be used in conjunction with "-i". -+.IP "\-P -+Always write out PID, even with -f. - .IP \-s - Run in "single server" mode. The server normally runs with multiple - threads and/or processes, which can lower its response time to -diff --git a/man/man8/radmin.8 b/man/man8/radmin.8 -index 5ecc963d81..5bf661fa71 100644 ---- a/man/man8/radmin.8 -+++ b/man/man8/radmin.8 -@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool - .B radmin - .RB [ \-d - .IR config_directory ] -+.RB [ \-D -+.IR dictionary_directory ] - .RB [ \-e - .IR command ] - .RB [ \-E ] -@@ -34,6 +36,8 @@ The following command-line options are accepted by the program. - Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server - configuration files to find the "listen" section that defines the - control socket filename. -+.IP "\-D \fIdictionary directory\fP" -+Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. - .IP "\-e \fIcommand\fP" - Run \fIcommand\fP and exit. - .IP \-E --- -2.18.0 - diff --git a/freeradius-OpenSSL-HMAC-MD5.patch b/freeradius-OpenSSL-HMAC-MD5.patch deleted file mode 100644 index 1e54c55..0000000 --- a/freeradius-OpenSSL-HMAC-MD5.patch +++ /dev/null @@ -1,68 +0,0 @@ -From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Sep 2018 09:54:46 -0400 -Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's - -If OpenSSL EVP is not found, fallback to internal implementation of -HMAC-MD5. - -Signed-off-by: Alexander Scheel ---- - src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++- - 1 file changed, 33 insertions(+), 1 deletion(-) - -diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c -index 2c662ff368..1cca00fa2a 100644 ---- a/src/lib/hmacmd5.c -+++ b/src/lib/hmacmd5.c -@@ -27,10 +27,41 @@ - - RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $") - -+#ifdef HAVE_OPENSSL_EVP_H -+#include -+#include -+#endif -+ - #include - #include - --/** Calculate HMAC using MD5 -+#ifdef HAVE_OPENSSL_EVP_H -+/** Calculate HMAC using OpenSSL's MD5 implementation -+ * -+ * @param digest Caller digest to be filled in. -+ * @param text Pointer to data stream. -+ * @param text_len length of data stream. -+ * @param key Pointer to authentication key. -+ * @param key_len Length of authentication key. -+ * -+ */ -+void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len, -+ uint8_t const *key, size_t key_len) -+{ -+ HMAC_CTX *ctx = HMAC_CTX_new(); -+ -+#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW -+ /* Since MD5 is not allowed by FIPS, explicitly allow it. */ -+ HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); -+#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */ -+ -+ HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL); -+ HMAC_Update(ctx, text, text_len); -+ HMAC_Final(ctx, digest, NULL); -+ HMAC_CTX_free(ctx); -+} -+#else -+/** Calculate HMAC using internal MD5 implementation - * - * @param digest Caller digest to be filled in. - * @param text Pointer to data stream. -@@ -101,6 +132,7 @@ - * hash */ - fr_md5_final(digest, &context); /* finish up 2nd pass */ - } -+#endif /* HAVE_OPENSSL_EVP_H */ - - /* - Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-OpenSSL-HMAC-SHA1.patch b/freeradius-OpenSSL-HMAC-SHA1.patch deleted file mode 100644 index 6c60951..0000000 --- a/freeradius-OpenSSL-HMAC-SHA1.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Sep 2018 11:03:52 -0400 -Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's - -If OpenSSL EVP is not found, fallback to internal implementation of -HMAC-SHA1. - -Signed-off-by: Alexander Scheel ---- - src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++- - 1 file changed, 28 insertions(+), 1 deletion(-) - -diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c -index c3cbd87a2c..211470ea35 100644 ---- a/src/lib/hmacsha1.c -+++ b/src/lib/hmacsha1.c -@@ -10,13 +10,19 @@ - - RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $") - -+#ifdef HAVE_OPENSSL_EVP_H -+#include -+#include -+#endif -+ - #include - - #ifdef HMAC_SHA1_DATA_PROBLEMS - unsigned int sha1_data_problems = 0; - #endif - --/** Calculate HMAC using SHA1 -+#ifdef HAVE_OPENSSL_EVP_H -+/** Calculate HMAC using OpenSSL's SHA1 implementation - * - * @param digest Caller digest to be filled in. - * @param text Pointer to data stream. -@@ -28,6 +34,26 @@ - void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, - uint8_t const *key, size_t key_len) - { -+ HMAC_CTX *ctx = HMAC_CTX_new(); -+ HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL); -+ HMAC_Update(ctx, text, text_len); -+ HMAC_Final(ctx, digest, NULL); -+ HMAC_CTX_free(ctx); -+} -+ -+#else -+ -+/** Calculate HMAC using internal SHA1 implementation -+ * -+ * @param digest Caller digest to be filled in. -+ * @param text Pointer to data stream. -+ * @param text_len length of data stream. -+ * @param key Pointer to authentication key. -+ * @param key_len Length of authentication key. -+ */ -+void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, -+ uint8_t const *key, size_t key_len) -+{ - fr_sha1_ctx context; - uint8_t k_ipad[65]; /* inner padding - key XORd with ipad */ - uint8_t k_opad[65]; /* outer padding - key XORd with opad */ -@@ -142,6 +168,7 @@ - } - #endif - } -+#endif /* HAVE_OPENSSL_EVP_H */ - - /* - Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-autogen.sh b/freeradius-autogen.sh deleted file mode 100755 index 9cba642..0000000 --- a/freeradius-autogen.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh -e - -parentdir=`dirname $0` - -cd $parentdir -parentdir=`pwd` - -libtoolize -f -c -#aclocal -autoheader -autoconf - -mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`" -mysubdirs=`echo $mysubdirs` - -for F in $mysubdirs -do - echo "Configuring in $F..." - (cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir) - (cd $F && autoconf -I$parentdir) -done diff --git a/freeradius-man-Fix-some-typos.patch b/freeradius-man-Fix-some-typos.patch deleted file mode 100644 index 26d84de..0000000 --- a/freeradius-man-Fix-some-typos.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001 -From: Nikolai Kondrashov -Date: Fri, 14 Sep 2018 11:53:28 +0300 -Subject: [PATCH] man: Fix some typos - ---- - man/man5/radrelay.conf.5 | 2 +- - man/man5/rlm_files.5 | 2 +- - man/man5/unlang.5 | 8 ++++---- - man/man8/radrelay.8 | 2 +- - 4 files changed, 7 insertions(+), 7 deletions(-) - -diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5 -index 5fb38bfc4e..e3e665024b 100644 ---- a/man/man5/radrelay.conf.5 -+++ b/man/man5/radrelay.conf.5 -@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one - backup server. When the primary goes down, most NASes detect that and - switch to the backup server. - --That will cause your accounting packets to go the the backup server - -+That will cause your accounting packets to go to the backup server - - and some NASes don't even switch back to the primary server when it - comes back up. - -diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5 -index bfee5030ff..52f4734ae3 100644 ---- a/man/man5/rlm_files.5 -+++ b/man/man5/rlm_files.5 -@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that - perform per-group checks, and return per-group attributes, where the - group membership is dynamically defined by a previous module. It also - lets you do things like key off of attributes in the reply, and --express policies like like "when I send replies containing attribute -+express policies like "when I send replies containing attribute - FOO with value BAR, do more checks, and maybe send additional - attributes". - .SH CONFIGURATION -diff --git a/man/man5/unlang.5 b/man/man5/unlang.5 -index 76db8f2d1c..12fe7855b2 100644 ---- a/man/man5/unlang.5 -+++ b/man/man5/unlang.5 -@@ -36,7 +36,7 @@ the pre-defined keywords here. - - Subject to a few limitations described below, any keyword can appear - in any context. The language consists of a series of entries, each --one one line. Each entry begins with a keyword. Entries are -+one line. Each entry begins with a keyword. Entries are - organized into lists. Processing of the language is line by line, - from the start of the list to the end. Actions are executed - per-keyword. -@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below. The match is - then performed on the string returned from the expansion. If the - argument is an attribute reference (e.g. &User-Name), then the match - is performed on the value of that attribute. Otherwise, the argument --is taken to be a literal string, and and matching is done via simple -+is taken to be a literal string, and matching is done via simple - comparison. - - No statement other than "case" can appear in a "switch" block. -@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below. The match is - then performed on the string returned from the expansion. If the - argument is an attribute reference (e.g. &User-Name), then the match - is performed on the value of that attribute. Otherwise, the argument --is taken to be a literal string, and and matching is done via simple -+is taken to be a literal string, and matching is done via simple - comparison. - - .DS -@@ -799,7 +799,7 @@ regular expression. If no attribute matches, nothing else is done. - The value can be an attribute reference, or an attribute-specific - string. - --When the value is an an attribute reference, it must take the form of -+When the value is an attribute reference, it must take the form of - "&Attribute-Name". The leading "&" signifies that the value is a - reference. The "Attribute-Name" is an attribute name, such as - "User-Name" or "request:User-Name". When an attribute reference is -diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8 -index fdba6995d5..99e65732a2 100644 ---- a/man/man8/radrelay.8 -+++ b/man/man8/radrelay.8 -@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one - backup server. When the primary goes down, most NASes detect that and - switch to the backup server. - --That will cause your accounting packets to go the the backup server - -+That will cause your accounting packets to go to the backup server - - and some NASes don't even switch back to the primary server when it - comes back up. - --- -2.18.0 - diff --git a/freeradius-python2-shebangs.patch b/freeradius-python2-shebangs.patch deleted file mode 100644 index 86954db..0000000 --- a/freeradius-python2-shebangs.patch +++ /dev/null @@ -1,64 +0,0 @@ -From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 18 Oct 2018 12:40:53 -0400 -Subject: [PATCH] Clarify shebangs to be python2 - -Signed-off-by: Alexander Scheel ---- - scripts/radtee | 2 +- - src/modules/rlm_python/example.py | 2 +- - src/modules/rlm_python/prepaid.py | 2 +- - src/modules/rlm_python/radiusd.py | 2 +- - src/modules/rlm_python/radiusd_test.py | 2 +- - 5 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/scripts/radtee b/scripts/radtee -index 123769d244..78b4bcbe0b 100755 ---- a/scripts/radtee -+++ b/scripts/radtee -@@ -1,4 +1,4 @@ --#!/usr/bin/env python -+#!/usr/bin/env python2 - from __future__ import with_statement - - # RADIUS comparison tee v1.0 -diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py -index 5950a07678..eaf456e349 100644 ---- a/src/modules/rlm_python/example.py -+++ b/src/modules/rlm_python/example.py -@@ -1,4 +1,4 @@ --#! /usr/bin/env python -+#! /usr/bin/env python2 - # - # Python module example file - # Miguel A.L. Paraz -diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py -index c3cbf57b8f..3b1dc2e2e8 100644 ---- a/src/modules/rlm_python/prepaid.py -+++ b/src/modules/rlm_python/prepaid.py -@@ -1,4 +1,4 @@ --#! /usr/bin/env python -+#! /usr/bin/env python2 - # - # Example Python module for prepaid usage using MySQL - -diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py -index c535bb3caf..7129923994 100644 ---- a/src/modules/rlm_python/radiusd.py -+++ b/src/modules/rlm_python/radiusd.py -@@ -1,4 +1,4 @@ --#! /usr/bin/env python -+#! /usr/bin/env python2 - # - # Definitions for RADIUS programs - # -diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py -index 13b7128b29..97b5b64f08 100644 ---- a/src/modules/rlm_python/radiusd_test.py -+++ b/src/modules/rlm_python/radiusd_test.py -@@ -1,4 +1,4 @@ --#! /usr/bin/env python -+#! /usr/bin/env python2 - # - # Python module test - # Miguel A.L. Paraz diff --git a/freeradius-radiusd-init b/freeradius-radiusd-init deleted file mode 100644 index 977a51f..0000000 --- a/freeradius-radiusd-init +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/sh -# -# radiusd Start/Stop the FreeRADIUS daemon -# -# chkconfig: - 88 10 -# description: Extensible, configurable, high performance RADIUS server. - -### BEGIN INIT INFO -# Provides: radiusd -# Required-Start: $network -# Required-Stop: -# Default-Start: -# Default-Stop: -# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc -# Should-Stop: -# Short-Description: FreeRADIUS server -# Description: Extensible, configurable, high performance RADIUS server. -### END INIT INFO - -# Source function library. -. /etc/rc.d/init.d/functions - -prog=radiusd - -[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -exec=${exec:=/usr/sbin/$prog} -config_dir=${config_dir:=/etc/raddb} -config=${config:=$config_dir/radiusd.conf} -pidfile=${pidfile:=/var/run/$prog/$prog.pid} -lockfile=${lockfile:=/var/lock/subsys/radiusd} - -start() { - [ -x $exec ] || exit 5 - [ -f $config ] || exit 6 - echo -n $"Starting $prog: " - daemon --pidfile $pidfile $exec -d $config_dir - retval=$? - echo - [ $retval -eq 0 ] && touch $lockfile - return $retval -} - -stop() { - echo -n $"Stopping $prog: " - killproc -p $pidfile $prog - retval=$? - echo - [ $retval -eq 0 ] && rm -f $lockfile - return $retval -} - -restart() { - stop - start -} - -reload() { - # radiusd may not be capable of a 100% configuration reload depending - # on which loadable modules are in use, if sending the server a - # HUP is not sufficient then use restart here instead. However, we - # prefer by default to use HUP since it's what is usually desired. - # - # restart - - kill -HUP `pidofproc -p $pidfile $prog` -} - -force_reload() { - restart -} - -rh_status() { - # run checks to determine if the service is running or use generic status - status -p $pidfile $prog -} - -rh_status_q() { - rh_status >/dev/null 2>&1 -} - - -case "$1" in - start) - rh_status_q && exit 0 - $1 - ;; - stop) - rh_status_q || exit 0 - $1 - ;; - restart) - $1 - ;; - reload) - rh_status_q || exit 7 - $1 - ;; - force-reload) - force_reload - ;; - status) - rh_status - ;; - condrestart|try-restart) - rh_status_q || exit 0 - restart - ;; - *) - echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}" - exit 2 -esac -exit $? diff --git a/freeradius.spec b/freeradius.spec index 0683237..1f8e899 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -253,7 +253,8 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v --without-rlm_rediswho \ --without-rlm_cache_memcached -make +# Build fast, but get better errors if we fail +make %{?_smp_mflags} || make -j1 %install mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/lib/radiusd From cabc34e05a2d5cacbdb859372d6f1b0017aa87fc Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Wed, 10 Mar 2021 22:21:12 +0000 Subject: [PATCH 058/126] Disable automatic bootstrap --- freeradius.spec | 5 ++++- radiusd.service | 1 - 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 1f8e899..2ea27bb 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 10%{?dist} +Release: 11%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -839,6 +839,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 +- Disable automatic bootstrap + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.21-10 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. diff --git a/radiusd.service b/radiusd.service index d073530..f545280 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,7 +6,6 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C From 8c954761a5bcb2fd2b024c9dccbd1c24ed673226 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 21 May 2021 23:11:33 +0200 Subject: [PATCH 059/126] Perl 5.34 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 2ea27bb..6408776 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 11%{?dist} +Release: 12%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -839,6 +839,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri May 21 2021 Jitka Plesnikova - 3.0.21-12 +- Perl 5.34 rebuild + * Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 - Disable automatic bootstrap From eaa7823ffae1a5d861146e497de1007066bb5f72 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 4 Jun 2021 17:12:24 +0200 Subject: [PATCH 060/126] Update to 3.0.22 Update to 3.0.22. This includes adaptation of patches and addition of new files present in the release. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1961190 Signed-off-by: Antonio Torres --- .gitignore | 1 + ...-Use-system-crypto-policy-by-default.patch | 18 +++--- freeradius-no-buildtime-cert-gen.patch | 12 ++-- freeradius.spec | 55 +++++++++++++++++-- sources | 2 +- 5 files changed, 69 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index 2f5a9d8..3b6e003 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.19.tar.bz2 /freeradius-server-3.0.20.tar.bz2 /freeradius-server-3.0.21.tar.bz2 +/freeradius-server-3.0.22.tar.bz2 diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 199e583..fc2501b 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -15,18 +15,18 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 36849e10f2..b28c0f19c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -368,7 +368,7 @@ eap { - # - # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" +@@ -370,7 +370,7 @@ eap { + # TLS cipher suites. The format is listed + # in "man 1 ciphers". # - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -912,7 +912,7 @@ eap { - # Note - for OpenSSL 1.1.0 and above you may need - # to add ":@SECLEVEL=0" +@@ -1008,7 +1008,7 @@ eap { + # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is + # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used # - # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" + # cipher_list = "PROFILE=SYSTEM" @@ -47,18 +47,18 @@ index 576eb7739e..ffa07188e2 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index 92f1d6330e..cd69b3905a 100644 +index b8d0626bbe..073b2933c2 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls -@@ -19,7 +19,7 @@ listen { +@@ -20,7 +20,7 @@ listen { dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - cache { enable = no + lifetime = 24 # hours diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls index bbc761b1c5..83cd35b851 100644 --- a/raddb/sites-available/tls diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index aa3be66..57a59fc 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -15,23 +15,25 @@ diff --git a/Make.inc.in b/Make.inc.in index 0b2cd74de8..8c623cf95c 100644 --- a/Make.inc.in +++ b/Make.inc.in -@@ -173,3 +173,8 @@ else - TESTBINDIR = ./$(BUILD_DIR)/bin +@@ -174,6 +174,10 @@ else TESTBIN = ./$(BUILD_DIR)/bin endif -+ + +# +# With reproducible builds, do not generate certificates during installation +# +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ + + # + # For creating documentation via doc/all.mk diff --git a/configure b/configure index c2c599c92b..3d4403a844 100755 --- a/configure +++ b/configure -@@ -655,6 +655,7 @@ RUSERS +@@ -654,6 +654,7 @@ ACLOCAL + RUSERS SNMPWALK SNMPGET - PERL +ENABLE_REPRODUCIBLE_BUILDS openssl_version_check_config WITH_DHCP diff --git a/freeradius.spec b/freeradius.spec index 6408776..5ae0d95 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.21 -Release: 12%{?dist} +Version: 3.0.22 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -410,7 +410,7 @@ exit 0 %dir %attr(770,root,radiusd) /etc/raddb/certs %config(noreplace) /etc/raddb/certs/Makefile %config(noreplace) /etc/raddb/certs/passwords.mk -/etc/raddb/certs/README +/etc/raddb/certs/README.md %config(noreplace) /etc/raddb/certs/xpextensions %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf %attr(750,root,radiusd) /etc/raddb/certs/bootstrap @@ -435,6 +435,7 @@ exit 0 # sites-available %dir %attr(750,root,radiusd) /etc/raddb/sites-available /etc/raddb/sites-available/README +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting @@ -480,6 +481,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients @@ -517,9 +521,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8 @@ -613,7 +619,6 @@ exit 0 %{_libdir}/freeradius/rlm_eap.so %{_libdir}/freeradius/rlm_eap_fast.so %{_libdir}/freeradius/rlm_eap_gtc.so -%{_libdir}/freeradius/rlm_eap_leap.so %{_libdir}/freeradius/rlm_eap_md5.so %{_libdir}/freeradius/rlm_eap_mschapv2.so %{_libdir}/freeradius/rlm_eap_peap.so @@ -644,7 +649,9 @@ exit 0 %{_libdir}/freeradius/rlm_sql.so %{_libdir}/freeradius/rlm_sqlcounter.so %{_libdir}/freeradius/rlm_sqlippool.so +%{_libdir}/freeradius/rlm_sql_map.so %{_libdir}/freeradius/rlm_sql_null.so +%{_libdir}/freeradius/rlm_totp.so %{_libdir}/freeradius/rlm_unix.so %{_libdir}/freeradius/rlm_unpack.so %{_libdir}/freeradius/rlm_utf8.so @@ -677,6 +684,7 @@ exit 0 %doc %{_mandir}/man8/radiusd.8.gz %doc %{_mandir}/man8/radmin.8.gz %doc %{_mandir}/man8/radrelay.8.gz +%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz # MIB files %{_datadir}/snmp/mibs/*RADIUS*.mib @@ -745,14 +753,49 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql + %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql @@ -839,6 +882,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jun 4 2021 Antonio Torres - 3.0.22-1 +- Rebased to 3.0.22 + Resolves: bz#1961190 + * Fri May 21 2021 Jitka Plesnikova - 3.0.21-12 - Perl 5.34 rebuild diff --git a/sources b/sources index a895a5a..2390e88 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729 +SHA512 (freeradius-server-3.0.22.tar.bz2) = eaded3e67b7016997ffb7f84366f654d6e40117e6588d10be21ebb86cb796cba8b6a138c8fbf01634d63898b0dd116666d41c78a0fc01d76b0415f16b45b4a6f From c2fdf85d806c904a244530bb43264cd944d0b1e7 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 7 Jun 2021 14:32:44 +0200 Subject: [PATCH 061/126] Disable broken RPATH usage in binaries Since Fedora 35, broken RPATH usage is detected in packages, causing a build failure: https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild With this changes rpath usage is deleted in conflicting files. Signed-off-by: Antonio Torres --- freeradius.spec | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/freeradius.spec b/freeradius.spec index 5ae0d95..17d3b4c 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -43,6 +43,7 @@ BuildRequires: libpcap-devel BuildRequires: systemd-units BuildRequires: libtalloc-devel BuildRequires: pcre-devel +BuildRequires: chrpath %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -278,6 +279,10 @@ install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ +# remove rpath where needed +chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/rlm_sql_postgresql.so +chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/rlm_sql_unixodbc.so + # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl From a8e0c3d9ed1c60dcd4b04d4bc25a64d32503dcd4 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 7 Jun 2021 16:23:20 +0200 Subject: [PATCH 062/126] Rebuilt for Python 3.10 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 17d3b4c..cae2c84 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.22 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -887,6 +887,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Jun 07 2021 Python Maint - 3.0.22-2 +- Rebuilt for Python 3.10 + * Fri Jun 4 2021 Antonio Torres - 3.0.22-1 - Rebased to 3.0.22 Resolves: bz#1961190 From 0bee016e7902c07013885353f70702900b32f759 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 8 Jun 2021 16:14:57 +0200 Subject: [PATCH 063/126] Remove broken RPATH usage from all conflicting files Since Fedora 35, broken RPATH usage is detected and causes builds to fail: https://fedoraproject.org/wiki/Changes/Broken_RPATH_will_fail_rpmbuild This commit extends the list of files to remove the RPATH usage from. Signed-off-by: Antonio Torres --- freeradius.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index cae2c84..b1e514e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -280,8 +280,9 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ # remove rpath where needed -chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/rlm_sql_postgresql.so -chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/rlm_sql_unixodbc.so +chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so +chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radiusd +chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radmin # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt From 63ee79a9bacb590fe421f4e2d27f39f804cf70cc Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 8 Jun 2021 16:17:41 +0200 Subject: [PATCH 064/126] Remove unused import from tests Tests imported the psutil module, which is not needed for execution. Signed-off-by: Antonio Torres --- tests/auth-tests/freeradius-tests.py | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py index da5afe1..d646188 100755 --- a/tests/auth-tests/freeradius-tests.py +++ b/tests/auth-tests/freeradius-tests.py @@ -15,7 +15,6 @@ import unittest import subprocess import signal import shutil -import psutil import socket RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid' From 15d6daaa28f08bff6b8f7d968dc08f0a50667cfe Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 8 Jun 2021 16:19:12 +0200 Subject: [PATCH 065/126] Ignore badfuncs check from rpminspect FreeRADIUS source code contains some legacy code that uses deprecated functions detected by rpminspect's badfuncs check. Since this causes build failures, disable this check until the problem is fixed upstream. Signed-off-by: Antonio Torres --- rpminspect.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..0c3bdf7 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,3 @@ +--- +inspections: + badfuncs: off From 3b6878a0e076b6ef8a4efe204807fabe67abe72d Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 8 Jun 2021 16:27:43 +0200 Subject: [PATCH 066/126] Bump release number Signed-off-by: Antonio Torres --- freeradius.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index b1e514e..dee7325 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.22 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ From d2c4303d251bb50a7f7366025eab495d59d88102 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 25 Jun 2021 17:10:33 +0200 Subject: [PATCH 067/126] Fix python3 not being correctly linked Since Python 3.8, there is a new way to link against libpython. https://docs.python.org/3/whatsnew/3.8.html#debug-build-uses-the-same-abi-as-release-build Signed-off-by: Antonio Torres --- freeradius.spec | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index dee7325..58a9641 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.22 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -215,9 +215,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # Hack: rlm_python3 as stable; prevents building other unstable modules. sed 's/rlm_python/rlm_python3/g' src/modules/stable -i -# python3-config is broken: -# https://bugzilla.redhat.com/show_bug.cgi?id=1772988 -export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" +%global build_ldflags %{build_ldflags} $(python3-config --embed --libs) +export PY3_LIB_DIR="$(python3-config --configdir)" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" # In order for the above hack to stick, do a fake configure so @@ -888,6 +887,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jun 25 2021 Antonio Torres - 3.0.22-4 +- Fix python3 not being correctly linked + * Mon Jun 07 2021 Python Maint - 3.0.22-2 - Rebuilt for Python 3.10 From 1d17d3a57ad8e1580cdae04e9a584cc6d20e26c3 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 29 Jun 2021 12:19:11 +0200 Subject: [PATCH 068/126] Fix binaries not being correctly linked after RPATH removal Signed-off-by: Antonio Torres --- freeradius.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 58a9641..0d6f0ac 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.22 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -283,6 +283,10 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radiusd chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radmin +# update ld with freeradius libs +mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d +echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf + # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl @@ -381,6 +385,7 @@ exit 0 # system %config(noreplace) %{_sysconfdir}/pam.d/radiusd %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd +%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %{_unitdir}/radiusd.service %{_tmpfilesdir}/radiusd.conf %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd @@ -887,6 +892,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 29 2021 Antonio Torres - 3.0.22-5 +- Fix binaries not being correctly linked after RPATH removal + * Fri Jun 25 2021 Antonio Torres - 3.0.22-4 - Fix python3 not being correctly linked From c54625805cf1939416c7b222cefe4f9e555b1f2c Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 29 Jun 2021 13:40:12 +0200 Subject: [PATCH 069/126] Rebase to 3.0.23 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 10 ++++++++-- sources | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3b6e003..9c17413 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.20.tar.bz2 /freeradius-server-3.0.21.tar.bz2 /freeradius-server-3.0.22.tar.bz2 +/freeradius-server-3.0.23.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 0d6f0ac..11f155d 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.22 -Release: 5%{?dist} +Version: 3.0.23 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -467,6 +467,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge @@ -572,6 +573,7 @@ exit 0 %config(missingok) /etc/raddb/mods-enabled/replicate %config(missingok) /etc/raddb/mods-enabled/soh %config(missingok) /etc/raddb/mods-enabled/sradutmp +%config(missingok) /etc/raddb/mods-enabled/totp %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 @@ -892,6 +894,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 29 2021 Antonio Torres - 3.0.23-1 +- Rebase to 3.0.23 + Fixes: bz#1970528 + * Tue Jun 29 2021 Antonio Torres - 3.0.22-5 - Fix binaries not being correctly linked after RPATH removal diff --git a/sources b/sources index 2390e88..f9c98bb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.22.tar.bz2) = eaded3e67b7016997ffb7f84366f654d6e40117e6588d10be21ebb86cb796cba8b6a138c8fbf01634d63898b0dd116666d41c78a0fc01d76b0415f16b45b4a6f +SHA512 (freeradius-server-3.0.23.tar.bz2) = 2369378a448035706fac77b4eddd28b950fbb587edefb5be6cf579043435cdec911b4a5326cfeabd05c28bb964e53027bcd1cd8a6a56013836f041a10326ef1a From f7c2c074353ea1ce89bd9f9af9e2463a973998d4 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 29 Jun 2021 14:53:31 +0200 Subject: [PATCH 070/126] Remove RPATH usage from additional binaries Signed-off-by: Antonio Torres --- freeradius.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 11f155d..370b951 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -280,8 +280,8 @@ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ # remove rpath where needed chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so -chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radiusd -chrpath --delete $RPM_BUILD_ROOT/usr/sbin/radmin +chrpath --delete $RPM_BUILD_ROOT/usr/sbin/* || true +chrpath --delete $RPM_BUILD_ROOT/usr/bin/* || true # update ld with freeradius libs mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d @@ -894,6 +894,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Remove RPATH usage from additional binaries + * Tue Jun 29 2021 Antonio Torres - 3.0.23-1 - Rebase to 3.0.23 Fixes: bz#1970528 From 508c8f0746c6db1f0be8f394e36f42ddbdd73a3f Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 29 Jun 2021 16:26:48 +0200 Subject: [PATCH 071/126] Fix rpath not being removed correctly Signed-off-by: Antonio Torres --- freeradius.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 370b951..cbf9ae5 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -280,8 +280,8 @@ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ # remove rpath where needed chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so -chrpath --delete $RPM_BUILD_ROOT/usr/sbin/* || true -chrpath --delete $RPM_BUILD_ROOT/usr/bin/* || true +for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done +for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done # update ld with freeradius libs mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d @@ -894,6 +894,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Fix rpath not being removed correctly + * Tue Jun 29 2021 Antonio Torres - 3.0.23-2 - Remove RPATH usage from additional binaries From 58cf5cccf674e5d4844e3f19b5340f9b3638fe34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 10 Jul 2021 11:52:58 +0200 Subject: [PATCH 072/126] Rebuild for versioned symbols in json-c --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index cbf9ae5..16d10a2 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -894,6 +894,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sat Jul 10 2021 Björn Esser - 3.0.23-4 +- Rebuild for versioned symbols in json-c + * Tue Jun 29 2021 Antonio Torres - 3.0.23-2 - Fix rpath not being removed correctly From 0815a3326bed6f0bae96f3149de070e6b055efb8 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 15 Jul 2021 13:00:52 +0200 Subject: [PATCH 073/126] Fix coredump not being able to be enabled If resource hard limit is set to zero, then it cannot be raised again, and this causes coredump to not being able to be enabled. Signed-off-by: Antonio Torres --- ...radius-Fix-resource-hard-limit-error.patch | 32 +++++++++++++++++++ freeradius.spec | 7 +++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 freeradius-Fix-resource-hard-limit-error.patch diff --git a/freeradius-Fix-resource-hard-limit-error.patch b/freeradius-Fix-resource-hard-limit-error.patch new file mode 100644 index 0000000..800c06c --- /dev/null +++ b/freeradius-Fix-resource-hard-limit-error.patch @@ -0,0 +1,32 @@ +commit 1ce4508c92493cf03ea1b3c42e83540b387884fa +Author: Antonio Torres +Date: Fri Jul 2 07:12:48 2021 -0400 +Subject: [PATCH] debug: don't set resource hard limit to zero + + Setting the resource hard limit to zero is irreversible, meaning if it + is set to zero then there is no way to set it higher. This means + enabling core dump is not possible, since setting a new resource limit + for RLIMIT_CORE would fail. By only setting the soft limit to zero, we + can disable and enable core dumps without failures. + + This fix is present in both main and 3.0.x upstream branches. + + Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572 + Signed-off-by: Antonio Torres antorres@redhat.com +--- + src/lib/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/lib/debug.c b/src/lib/debug.c +index 576bcb2a65..6330c9cb66 100644 +--- a/src/lib/debug.c ++++ b/src/lib/debug.c +@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps) + struct rlimit no_core; + + no_core.rlim_cur = 0; +- no_core.rlim_max = 0; ++ no_core.rlim_max = core_limits.rlim_max; + + if (setrlimit(RLIMIT_CORE, &no_core) < 0) { + fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno)); diff --git a/freeradius.spec b/freeradius.spec index 16d10a2..b697951 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-Fix-resource-hard-limit-error.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -207,6 +208,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -894,6 +896,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jul 15 2021 Antonio Torres - 3.0.23-5 +- Fix coredump not being able to be enabled + * Sat Jul 10 2021 Björn Esser - 3.0.23-4 - Rebuild for versioned symbols in json-c From 1540d6c796ccb1b583f502ba751d331b027f8c6d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 21 Jul 2021 23:21:55 +0000 Subject: [PATCH 074/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index b697951..a81c0b8 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -896,6 +896,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Thu Jul 15 2021 Antonio Torres - 3.0.23-5 - Fix coredump not being able to be enabled From 07d21486218100d5219dc4795dfb45d6a4e42321 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:01:54 +0200 Subject: [PATCH 075/126] Rebuilt with OpenSSL 3.0.0 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index a81c0b8..e362ee8 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.23 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -896,6 +896,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Sep 14 2021 Sahana Prasad - 3.0.23-7 +- Rebuilt with OpenSSL 3.0.0 + * Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From d5a8b5f69f9290b96e3d7dd7e33cea0e9b6a54bf Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 30 Sep 2021 12:30:36 +0200 Subject: [PATCH 076/126] Update to 3.0.24 Signed-off-by: Antonio Torres --- .gitignore | 1 + ...radius-Fix-resource-hard-limit-error.patch | 32 ------------------- freeradius-no-buildtime-cert-gen.patch | 10 ++++-- freeradius.spec | 11 ++++--- sources | 2 +- 5 files changed, 16 insertions(+), 40 deletions(-) delete mode 100644 freeradius-Fix-resource-hard-limit-error.patch diff --git a/.gitignore b/.gitignore index 9c17413..6c82385 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.21.tar.bz2 /freeradius-server-3.0.22.tar.bz2 /freeradius-server-3.0.23.tar.bz2 +/freeradius-server-3.0.24.tar.bz2 diff --git a/freeradius-Fix-resource-hard-limit-error.patch b/freeradius-Fix-resource-hard-limit-error.patch deleted file mode 100644 index 800c06c..0000000 --- a/freeradius-Fix-resource-hard-limit-error.patch +++ /dev/null @@ -1,32 +0,0 @@ -commit 1ce4508c92493cf03ea1b3c42e83540b387884fa -Author: Antonio Torres -Date: Fri Jul 2 07:12:48 2021 -0400 -Subject: [PATCH] debug: don't set resource hard limit to zero - - Setting the resource hard limit to zero is irreversible, meaning if it - is set to zero then there is no way to set it higher. This means - enabling core dump is not possible, since setting a new resource limit - for RLIMIT_CORE would fail. By only setting the soft limit to zero, we - can disable and enable core dumps without failures. - - This fix is present in both main and 3.0.x upstream branches. - - Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572 - Signed-off-by: Antonio Torres antorres@redhat.com ---- - src/lib/debug.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/lib/debug.c b/src/lib/debug.c -index 576bcb2a65..6330c9cb66 100644 ---- a/src/lib/debug.c -+++ b/src/lib/debug.c -@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps) - struct rlimit no_core; - - no_core.rlim_cur = 0; -- no_core.rlim_max = 0; -+ no_core.rlim_max = core_limits.rlim_max; - - if (setrlimit(RLIMIT_CORE, &no_core) < 0) { - fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno)); diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index 57a59fc..e285c75 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -63,10 +63,10 @@ index c2c599c92b..3d4403a844 100755 # Extract the first word of "perl", so it can be a program name with args. set dummy perl; ac_word=$2 diff --git a/configure.ac b/configure.ac -index a7abf0025a..35b013f4af 100644 +index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac +++ b/configure.ac -@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) +@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config]) dnl # dnl # extra argument: --enable-reproducible-builds dnl # @@ -74,7 +74,7 @@ index a7abf0025a..35b013f4af 100644 AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], -@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, +@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds, ;; *) reproducible_builds=no @@ -83,6 +83,10 @@ index a7abf0025a..35b013f4af 100644 ) +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) + dnl # + dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer + + dnl ############################################################# diff --git a/raddb/all.mk b/raddb/all.mk diff --git a/freeradius.spec b/freeradius.spec index e362ee8..7ea6e4a 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.23 -Release: 7%{?dist} +Version: 3.0.24 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,7 +25,6 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch -Patch6: freeradius-Fix-resource-hard-limit-error.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -208,7 +207,6 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 -%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -438,6 +436,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/cui %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool @@ -896,6 +895,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Sep 30 2021 Antonio Torres - 3.0.24-1 +- Update to 3.0.24. + Resolves: bz#2009036 + * Tue Sep 14 2021 Sahana Prasad - 3.0.23-7 - Rebuilt with OpenSSL 3.0.0 diff --git a/sources b/sources index f9c98bb..847685f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.23.tar.bz2) = 2369378a448035706fac77b4eddd28b950fbb587edefb5be6cf579043435cdec911b4a5326cfeabd05c28bb964e53027bcd1cd8a6a56013836f041a10326ef1a +SHA512 (freeradius-server-3.0.24.tar.bz2) = 12da42aa406d97ff15b423b7b279b7cc9dd4c317296b1b0fa019fb21988d9501507b58ad2d6753db4846651f06a6a67be8097cb0b564a65b1b1454777e090997 From c241351c7b12428657666af520e7e7a27906d9a4 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 8 Oct 2021 11:46:20 +0200 Subject: [PATCH 077/126] Update to 3.0.25 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 6c82385..4a7e0f9 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.22.tar.bz2 /freeradius-server-3.0.23.tar.bz2 /freeradius-server-3.0.24.tar.bz2 +/freeradius-server-3.0.25.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 7ea6e4a..dbb877e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,6 +1,6 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.24 +Version: 3.0.25 Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -895,6 +895,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Oct 08 2021 Antonio Torres - 3.0.25-1 +- Update to 3.0.25. + Resolves: bz#2011984 + * Thu Sep 30 2021 Antonio Torres - 3.0.24-1 - Update to 3.0.24. Resolves: bz#2009036 diff --git a/sources b/sources index 847685f..b73c6d2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.24.tar.bz2) = 12da42aa406d97ff15b423b7b279b7cc9dd4c317296b1b0fa019fb21988d9501507b58ad2d6753db4846651f06a6a67be8097cb0b564a65b1b1454777e090997 +SHA512 (freeradius-server-3.0.25.tar.bz2) = 984bb65c86c541c91708370340ac6157b4d4d89a4ae7cbc690a9f17ead0e63fb20180333cdc33093877f84b6d40445495d881ae677858cbf60fcfd990fb02ba4 From afc023e7f11f585a2cda0e6eba99e95f2f9c0d9d Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 14 Oct 2021 12:53:53 +0200 Subject: [PATCH 078/126] Fix file conflicts in SQL files Resolves: bz#2014014 Signed-off-by: Antonio Torres --- freeradius.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index dbb877e..3356e85 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -436,7 +436,6 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/cui %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool @@ -759,6 +758,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf @@ -832,6 +832,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf @@ -860,6 +861,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf @@ -895,6 +897,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Oct 14 2021 Antonio Torres - 3.0.25-2 +- Fix file conflict in SQL files + Resolves: bz#2014014 + * Fri Oct 08 2021 Antonio Torres - 3.0.25-1 - Update to 3.0.25. Resolves: bz#2011984 From 49e8c0620e53f7c6f4dd8332e3b85f49eef825b0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 03:25:40 +0000 Subject: [PATCH 079/126] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 3356e85..75112a4 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -897,6 +897,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Oct 14 2021 Antonio Torres - 3.0.25-2 - Fix file conflict in SQL files Resolves: bz#2014014 From bb772e884bf3149b58509cbf222ddbbc0e7463a6 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 22 Apr 2022 15:39:07 +0200 Subject: [PATCH 080/126] Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 Related: #1983063 Signed-off-by: Antonio Torres --- ...us-ldap-infinite-timeout-on-starttls.patch | 31 +++++++++++++++++++ freeradius.spec | 8 ++++- 2 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 freeradius-ldap-infinite-timeout-on-starttls.patch diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius.spec b/freeradius.spec index 75112a4..15bf545 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -25,6 +25,7 @@ Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -207,6 +208,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch3 -p1 %patch4 -p1 %patch5 -p1 +%patch6 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -897,6 +899,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Apr 22 2022 Antonio Torres - 3.0.25-4 +- Use infinite timeout when using LDAP+start-TLS + Related: #1983063 + * Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From ba8509f8312bc03215e65446a8883aca8ad9d639 Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 31 May 2022 08:35:42 +0200 Subject: [PATCH 081/126] Perl 5.36 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 15bf545..d51718f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 4%{?dist} +Release: 5%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -899,6 +899,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue May 31 2022 Jitka Plesnikova - 3.0.25-5 +- Perl 5.36 rebuild + * Fri Apr 22 2022 Antonio Torres - 3.0.25-4 - Use infinite timeout when using LDAP+start-TLS Related: #1983063 From 3e1b0c3e5c93b533f90c58f973897ae111d5f205 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 13 Jun 2022 15:04:09 +0200 Subject: [PATCH 082/126] Rebuilt for Python 3.11 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index d51718f..22c40c2 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 5%{?dist} +Release: 6%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -899,6 +899,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Jun 13 2022 Python Maint - 3.0.25-6 +- Rebuilt for Python 3.11 + * Tue May 31 2022 Jitka Plesnikova - 3.0.25-5 - Perl 5.36 rebuild From a688847dcfcf6cb59095a2ac76f2cbc389b4fde7 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 24 Jun 2022 14:00:48 +0200 Subject: [PATCH 083/126] Use sysusers.d format for user and group creation Resolves: 2095741 Signed-off-by: Antonio Torres --- freeradius.spec | 19 ++++++++++--------- freeradius.sysusers | 2 ++ 2 files changed, 12 insertions(+), 9 deletions(-) create mode 100644 freeradius.sysusers diff --git a/freeradius.spec b/freeradius.spec index 22c40c2..0e47673 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 6%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -19,6 +19,7 @@ Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf Source104: freeradius-tmpfiles.conf +Source105: freeradius.sysusers Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch @@ -45,6 +46,7 @@ BuildRequires: systemd-units BuildRequires: libtalloc-devel BuildRequires: pcre-devel BuildRequires: chrpath +BuildRequires: systemd-rpm-macros %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -275,6 +277,7 @@ mkdir -p %{buildroot}%{_localstatedir}/run/ install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/ install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf +install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf # install SNMP MIB files mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ @@ -358,20 +361,13 @@ EOF # Make sure our user/group is present prior to any package or subpackage installation %pre -getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1 -getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 -exit 0 +%sysusers_create_compat %{SOURCE105} %preun %systemd_preun radiusd.service %postun %systemd_postun_with_restart radiusd.service -if [ $1 -eq 0 ]; then # uninstall - getent passwd radiusd >/dev/null && /usr/sbin/userdel radiusd > /dev/null 2>&1 - getent group radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1 -fi -exit 0 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : @@ -390,6 +386,7 @@ exit 0 %config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %{_unitdir}/radiusd.service %{_tmpfilesdir}/radiusd.conf +%{_sysusersdir}/freeradius.conf %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd @@ -899,6 +896,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jun 24 2022 Antonio Torres - 3.0.25-7 +- Dynamically allocate users using sysusers.d format + Related: #2095741 + * Mon Jun 13 2022 Python Maint - 3.0.25-6 - Rebuilt for Python 3.11 diff --git a/freeradius.sysusers b/freeradius.sysusers new file mode 100644 index 0000000..e261886 --- /dev/null +++ b/freeradius.sysusers @@ -0,0 +1,2 @@ +#Type Name ID GECOS Home directory Shell +u radiusd - "radiusd user" /var/lib/radiusd /sbin/nologin From fdb219a9d2f5e63ab452eaf18b72e457b1d95dcc Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 29 Jun 2022 12:51:37 +0200 Subject: [PATCH 084/126] Use 95 GID/UID as it's reserved for FreeRADIUS Since 95 is reserved GID/UID for FreeRADIUS, we can safely use it. https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107 Signed-off-by: Antonio Torres --- freeradius.spec | 6 +++++- freeradius.sysusers | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 0e47673..ddb5ba7 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.25 -Release: 7%{?dist} +Release: 8%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -896,6 +896,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jun 29 2022 Antonio Torres - 3.0.25-8 +- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107) + Related: #2095741 + * Fri Jun 24 2022 Antonio Torres - 3.0.25-7 - Dynamically allocate users using sysusers.d format Related: #2095741 diff --git a/freeradius.sysusers b/freeradius.sysusers index e261886..af912e0 100644 --- a/freeradius.sysusers +++ b/freeradius.sysusers @@ -1,2 +1,3 @@ #Type Name ID GECOS Home directory Shell -u radiusd - "radiusd user" /var/lib/radiusd /sbin/nologin +u radiusd 95 "radiusd user" /var/lib/radiusd /sbin/nologin +g radiusd 95 - - - From 39a371f96e8b2cd6304ab8d63686a1fb55519744 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 19 Jul 2022 16:39:00 +0200 Subject: [PATCH 085/126] Rebase to 3.2.0 upstream release Resolves: #2077687 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius-no-buildtime-cert-gen.patch | 29 ++++++++++---------------- freeradius.spec | 19 ++++++++++------- sources | 2 +- 4 files changed, 25 insertions(+), 26 deletions(-) diff --git a/.gitignore b/.gitignore index 4a7e0f9..08a4341 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.23.tar.bz2 /freeradius-server-3.0.24.tar.bz2 /freeradius-server-3.0.25.tar.bz2 +/freeradius-server-3.2.0.tar.bz2 diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index e285c75..a291bae 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -6,10 +6,10 @@ Subject: [PATCH] Don't generate certificates in reproducible builds Signed-off-by: Alexander Scheel --- Make.inc.in | 5 +++++ - configure | 4 ++++ + configure | 3 +++ configure.ac | 3 +++ raddb/all.mk | 4 ++++ - 4 files changed, 16 insertions(+) + 4 files changed, 15 insertions(+) diff --git a/Make.inc.in b/Make.inc.in index 0b2cd74de8..8c623cf95c 100644 @@ -27,26 +27,26 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index c2c599c92b..3d4403a844 100755 +index b9adc3be20..5bdb2f081b 100755 --- a/configure +++ b/configure -@@ -654,6 +654,7 @@ ACLOCAL +@@ -679,6 +679,7 @@ AUTOCONF + ACLOCAL RUSERS SNMPWALK - SNMPGET +ENABLE_REPRODUCIBLE_BUILDS + SNMPGET openssl_version_check_config WITH_DHCP - modconfdir -@@ -5586,6 +5587,7 @@ else +@@ -7031,6 +7032,7 @@ else fi +ENABLE_REPRODUCIBLE_BUILDS=yes # Check whether --enable-reproducible-builds was given. - if test "${enable_reproducible_builds+set}" = set; then : - enableval=$enable_reproducible_builds; case "$enableval" in -@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + if test ${enable_reproducible_builds+y} + then : +@@ -7043,6 +7045,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -54,14 +54,7 @@ index c2c599c92b..3d4403a844 100755 esac fi -@@ -5604,6 +5607,7 @@ fi - - - -+ - CHECKRAD=checkrad - # Extract the first word of "perl", so it can be a program name with args. - set dummy perl; ac_word=$2 + diff --git a/configure.ac b/configure.ac index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac diff --git a/freeradius.spec b/freeradius.spec index ddb5ba7..d88e67c 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.25 -Release: 8%{?dist} +Version: 3.2.0 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -469,6 +469,8 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache # sites-enabled # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx @@ -482,7 +484,7 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui @@ -507,6 +509,8 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip @@ -514,7 +518,6 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd @@ -547,7 +550,6 @@ EOF %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled %config(missingok) /etc/raddb/mods-enabled/always %config(missingok) /etc/raddb/mods-enabled/attr_filter -%config(missingok) /etc/raddb/mods-enabled/cache_eap %config(missingok) /etc/raddb/mods-enabled/chap %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail @@ -621,7 +623,6 @@ EOF %{_libdir}/freeradius/rlm_cache_rbtree.so %{_libdir}/freeradius/rlm_chap.so %{_libdir}/freeradius/rlm_counter.so -%{_libdir}/freeradius/rlm_cram.so %{_libdir}/freeradius/rlm_date.so %{_libdir}/freeradius/rlm_detail.so %{_libdir}/freeradius/rlm_dhcp.so @@ -644,10 +645,10 @@ EOF %{_libdir}/freeradius/rlm_expr.so %{_libdir}/freeradius/rlm_files.so %{_libdir}/freeradius/rlm_ippool.so +%{_libdir}/freeradius/rlm_json.so %{_libdir}/freeradius/rlm_linelog.so %{_libdir}/freeradius/rlm_logintime.so %{_libdir}/freeradius/rlm_mschap.so -%{_libdir}/freeradius/rlm_otp.so %{_libdir}/freeradius/rlm_pam.so %{_libdir}/freeradius/rlm_pap.so %{_libdir}/freeradius/rlm_passwd.so @@ -896,6 +897,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jul 19 2022 Antonio Torres - 3.2.0-1 +- Rebase to 3.2.0 upstream release + Related: #2077687 + * Wed Jun 29 2022 Antonio Torres - 3.0.25-8 - Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107) Related: #2095741 diff --git a/sources b/sources index b73c6d2..88ed946 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.25.tar.bz2) = 984bb65c86c541c91708370340ac6157b4d4d89a4ae7cbc690a9f17ead0e63fb20180333cdc33093877f84b6d40445495d881ae677858cbf60fcfd990fb02ba4 +SHA512 (freeradius-server-3.2.0.tar.bz2) = e7aa7bfc5a6968cdb860bb565ebd45bc1b3f78a665a9888a8b8dacaa1c5256755468aed33bdffe39465f8678c1fb9d6f47f0dbcf0178dfdcb38d99e3bc4b747d From 3d25326b00d1744f65c555f1252177ad6fdc3b89 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 03:37:41 +0000 Subject: [PATCH 086/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index d88e67c..d549105 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -897,6 +897,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 3.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Jul 19 2022 Antonio Torres - 3.2.0-1 - Rebase to 3.2.0 upstream release Related: #2077687 From d9e143bb12a75b4e77f7860949e7f46303be5e72 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 5 Sep 2022 17:05:18 +0200 Subject: [PATCH 087/126] configure: allow building with runstatedir option In Fedora 38+, redhat-rpm-config adds --runstatedir=/run to %configure macro. Since this is not supported in current FreeRADIUS configure scripts, add the option placeholder so that we can continue building the package. Resolves: #2123374 Signed-off-by: Antonio Torres --- freeradius-configure-runstatedir.patch | 719 +++++++++++++++++++++++++ freeradius.spec | 8 +- 2 files changed, 726 insertions(+), 1 deletion(-) create mode 100644 freeradius-configure-runstatedir.patch diff --git a/freeradius-configure-runstatedir.patch b/freeradius-configure-runstatedir.patch new file mode 100644 index 0000000..ab4f960 --- /dev/null +++ b/freeradius-configure-runstatedir.patch @@ -0,0 +1,719 @@ +From: Antonio Torres +Date: Mon, 5 Sep 2022 +Subject: configure: allow building with runstatedir option + +In Fedora 38+, redhat-rpm-config adds --runstatedir=/run to %configure macro. +Since this is not supported in current FreeRADIUS configure scripts, add the option +placeholder so that we can continue building the package. + +Resolves: #2123374 + +Signed-off-by: Antonio Torres +--- + src/modules/rlm_cache/configure | 3 +++ + src/modules/rlm_cache/drivers/rlm_cache_memcached/configure | 3 +++ + src/modules/rlm_couchbase/configure | 3 +++ + src/modules/rlm_counter/configure | 3 +++ + src/modules/rlm_eap/configure | 3 +++ + src/modules/rlm_eap/types/rlm_eap_fast/configure | 3 +++ + src/modules/rlm_eap/types/rlm_eap_ikev2/configure | 3 +++ + src/modules/rlm_eap/types/rlm_eap_pwd/configure | 3 +++ + src/modules/rlm_eap/types/rlm_eap_sim/configure | 3 +++ + src/modules/rlm_eap/types/rlm_eap_tnc/configure | 3 +++ + src/modules/rlm_example/configure | 3 +++ + src/modules/rlm_idn/configure | 3 +++ + src/modules/rlm_ippool/configure | 3 +++ + src/modules/rlm_krb5/configure | 3 +++ + src/modules/rlm_ldap/configure | 3 +++ + src/modules/rlm_mschap/configure | 3 +++ + src/modules/rlm_opendirectory/configure | 3 +++ + src/modules/rlm_pam/configure | 3 +++ + src/modules/rlm_perl/configure | 3 +++ + src/modules/rlm_python/configure | 3 +++ + src/modules/rlm_python3/configure | 3 +++ + src/modules/rlm_radutmp/configure | 3 +++ + src/modules/rlm_realm/configure | 3 +++ + src/modules/rlm_redis/configure | 3 +++ + src/modules/rlm_rediswho/configure | 3 +++ + src/modules/rlm_rest/configure | 3 +++ + src/modules/rlm_ruby/configure | 3 +++ + src/modules/rlm_securid/configure | 3 +++ + src/modules/rlm_smsotp/configure | 3 +++ + src/modules/rlm_sql/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_db2/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_firebird/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_freetds/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_mongo/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_mysql/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_oracle/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure | 3 +++ + src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure | 3 +++ + src/modules/rlm_sql_map/configure | 3 +++ + src/modules/rlm_sqlcounter/configure | 3 +++ + src/modules/rlm_sqlhpwippool/configure | 3 +++ + src/modules/rlm_sqlippool/configure | 3 +++ + src/modules/rlm_unbound/configure | 3 +++ + src/modules/rlm_unix/configure | 3 +++ + src/modules/rlm_yubikey/configure | 3 +++ + 47 files changed, 141 insertions(+) + +diff --git a/src/modules/rlm_cache/configure b/src/modules/rlm_cache/configure +index e6382e91ee..d9f6a6d021 100755 +--- a/src/modules/rlm_cache/configure ++++ b/src/modules/rlm_cache/configure +@@ -936,6 +936,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure b/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure +index ecb7f11ca5..3701e0f5c5 100755 +--- a/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure ++++ b/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure +@@ -941,6 +941,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_couchbase/configure b/src/modules/rlm_couchbase/configure +index 1e1bd898da..6d0a65a578 100755 +--- a/src/modules/rlm_couchbase/configure ++++ b/src/modules/rlm_couchbase/configure +@@ -944,6 +944,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_counter/configure b/src/modules/rlm_counter/configure +index c254e7ac3e..281671727c 100755 +--- a/src/modules/rlm_counter/configure ++++ b/src/modules/rlm_counter/configure +@@ -941,6 +941,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/configure b/src/modules/rlm_eap/configure +index 4aff92daff..5179fa33e9 100755 +--- a/src/modules/rlm_eap/configure ++++ b/src/modules/rlm_eap/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure b/src/modules/rlm_eap/types/rlm_eap_fast/configure +index b360af6bf9..4145de9937 100755 +--- a/src/modules/rlm_eap/types/rlm_eap_fast/configure ++++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure +@@ -943,6 +943,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/types/rlm_eap_ikev2/configure b/src/modules/rlm_eap/types/rlm_eap_ikev2/configure +index 8671d86c1d..71ce73ece9 100755 +--- a/src/modules/rlm_eap/types/rlm_eap_ikev2/configure ++++ b/src/modules/rlm_eap/types/rlm_eap_ikev2/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/configure b/src/modules/rlm_eap/types/rlm_eap_pwd/configure +index b4b5bc085f..f13170c85d 100755 +--- a/src/modules/rlm_eap/types/rlm_eap_pwd/configure ++++ b/src/modules/rlm_eap/types/rlm_eap_pwd/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/types/rlm_eap_sim/configure b/src/modules/rlm_eap/types/rlm_eap_sim/configure +index ef5f2bac1f..664d0dc3fa 100755 +--- a/src/modules/rlm_eap/types/rlm_eap_sim/configure ++++ b/src/modules/rlm_eap/types/rlm_eap_sim/configure +@@ -924,6 +924,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_eap/types/rlm_eap_tnc/configure b/src/modules/rlm_eap/types/rlm_eap_tnc/configure +index 92da810c75..852511afbb 100755 +--- a/src/modules/rlm_eap/types/rlm_eap_tnc/configure ++++ b/src/modules/rlm_eap/types/rlm_eap_tnc/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_example/configure b/src/modules/rlm_example/configure +index 280e00dd85..23b6c6a681 100755 +--- a/src/modules/rlm_example/configure ++++ b/src/modules/rlm_example/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_idn/configure b/src/modules/rlm_idn/configure +index 7b25ba14d6..2fd00ffa8a 100755 +--- a/src/modules/rlm_idn/configure ++++ b/src/modules/rlm_idn/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_ippool/configure b/src/modules/rlm_ippool/configure +index c911010098..ed62cd8f07 100755 +--- a/src/modules/rlm_ippool/configure ++++ b/src/modules/rlm_ippool/configure +@@ -943,6 +943,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_krb5/configure b/src/modules/rlm_krb5/configure +index 991131b531..4439a4671d 100755 +--- a/src/modules/rlm_krb5/configure ++++ b/src/modules/rlm_krb5/configure +@@ -940,6 +940,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_ldap/configure b/src/modules/rlm_ldap/configure +index ded503f6ee..a8f502174c 100755 +--- a/src/modules/rlm_ldap/configure ++++ b/src/modules/rlm_ldap/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_mschap/configure b/src/modules/rlm_mschap/configure +index dec56aaf31..770a2a57ab 100755 +--- a/src/modules/rlm_mschap/configure ++++ b/src/modules/rlm_mschap/configure +@@ -942,6 +942,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_opendirectory/configure b/src/modules/rlm_opendirectory/configure +index b85c9fd1b3..0b81c8b49a 100755 +--- a/src/modules/rlm_opendirectory/configure ++++ b/src/modules/rlm_opendirectory/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_pam/configure b/src/modules/rlm_pam/configure +index 5adcf9b366..461887f370 100755 +--- a/src/modules/rlm_pam/configure ++++ b/src/modules/rlm_pam/configure +@@ -977,6 +977,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_perl/configure b/src/modules/rlm_perl/configure +index aa1e4e9dbf..9c047ee362 100755 +--- a/src/modules/rlm_perl/configure ++++ b/src/modules/rlm_perl/configure +@@ -941,6 +941,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_python/configure b/src/modules/rlm_python/configure +index d7d6bc9454..958fb4f3fa 100755 +--- a/src/modules/rlm_python/configure ++++ b/src/modules/rlm_python/configure +@@ -942,6 +942,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_python3/configure b/src/modules/rlm_python3/configure +index 52bc177dcd..927f1049f6 100755 +--- a/src/modules/rlm_python3/configure ++++ b/src/modules/rlm_python3/configure +@@ -950,6 +950,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_radutmp/configure b/src/modules/rlm_radutmp/configure +index 2bfb8570f4..84eeba4858 100755 +--- a/src/modules/rlm_radutmp/configure ++++ b/src/modules/rlm_radutmp/configure +@@ -977,6 +977,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_realm/configure b/src/modules/rlm_realm/configure +index 13e202aa10..6f339ca25a 100755 +--- a/src/modules/rlm_realm/configure ++++ b/src/modules/rlm_realm/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_redis/configure b/src/modules/rlm_redis/configure +index 12357e127e..e529ca6bfa 100755 +--- a/src/modules/rlm_redis/configure ++++ b/src/modules/rlm_redis/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_rediswho/configure b/src/modules/rlm_rediswho/configure +index f906a222e8..2c8833176f 100755 +--- a/src/modules/rlm_rediswho/configure ++++ b/src/modules/rlm_rediswho/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_rest/configure b/src/modules/rlm_rest/configure +index 2a97662fad..dbefc261ed 100755 +--- a/src/modules/rlm_rest/configure ++++ b/src/modules/rlm_rest/configure +@@ -946,6 +946,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_ruby/configure b/src/modules/rlm_ruby/configure +index 92bc11eae5..2e434f20b1 100755 +--- a/src/modules/rlm_ruby/configure ++++ b/src/modules/rlm_ruby/configure +@@ -951,6 +951,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_securid/configure b/src/modules/rlm_securid/configure +index 88d6871019..1ab7633088 100755 +--- a/src/modules/rlm_securid/configure ++++ b/src/modules/rlm_securid/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_smsotp/configure b/src/modules/rlm_smsotp/configure +index c90bc60810..0d7e944fee 100755 +--- a/src/modules/rlm_smsotp/configure ++++ b/src/modules/rlm_smsotp/configure +@@ -977,6 +977,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/configure b/src/modules/rlm_sql/configure +index 422e5baf64..285a634bcc 100755 +--- a/src/modules/rlm_sql/configure ++++ b/src/modules/rlm_sql/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_db2/configure b/src/modules/rlm_sql/drivers/rlm_sql_db2/configure +index 0eeffda80a..5001dd5f84 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_db2/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_db2/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure b/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure +index ffdfca36f1..1ab7613426 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure b/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure +index 501daaeb02..bf643f1931 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure b/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure +index 99d0bbc3f3..5a02d9479a 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure b/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure +index 8ddcba052b..af09bb9fab 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure +@@ -940,6 +940,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure b/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure +index 7ed19587c3..283b5c2cdf 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure +@@ -941,6 +941,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure b/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure +index 5a8123851a..44b2a059db 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure b/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure +index db98a9296a..509882a6e9 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure +index 6ea76be4e1..f0846f7cef 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure b/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure +index f6a6157ebb..3ca3b7117b 100755 +--- a/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure ++++ b/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure +@@ -939,6 +939,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sql_map/configure b/src/modules/rlm_sql_map/configure +index 08c49a2631..99e9543d0c 100755 +--- a/src/modules/rlm_sql_map/configure ++++ b/src/modules/rlm_sql_map/configure +@@ -924,6 +924,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sqlcounter/configure b/src/modules/rlm_sqlcounter/configure +index 72a475c392..606804b146 100755 +--- a/src/modules/rlm_sqlcounter/configure ++++ b/src/modules/rlm_sqlcounter/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sqlhpwippool/configure b/src/modules/rlm_sqlhpwippool/configure +index 9e434c9f85..16e07caf6e 100755 +--- a/src/modules/rlm_sqlhpwippool/configure ++++ b/src/modules/rlm_sqlhpwippool/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_sqlippool/configure b/src/modules/rlm_sqlippool/configure +index 6d07b2c4a6..5866c2a43e 100755 +--- a/src/modules/rlm_sqlippool/configure ++++ b/src/modules/rlm_sqlippool/configure +@@ -924,6 +924,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_unbound/configure b/src/modules/rlm_unbound/configure +index 4d92d5b127..4da5738078 100755 +--- a/src/modules/rlm_unbound/configure ++++ b/src/modules/rlm_unbound/configure +@@ -938,6 +938,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_unix/configure b/src/modules/rlm_unix/configure +index 8ad9a34042..8949a43d13 100755 +--- a/src/modules/rlm_unix/configure ++++ b/src/modules/rlm_unix/configure +@@ -977,6 +977,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ +diff --git a/src/modules/rlm_yubikey/configure b/src/modules/rlm_yubikey/configure +index 146d432ed6..ffc8561ed8 100755 +--- a/src/modules/rlm_yubikey/configure ++++ b/src/modules/rlm_yubikey/configure +@@ -942,6 +942,9 @@ do + | -silent | --silent | --silen | --sile | --sil) + silent=yes ;; + ++ --runstatedir=*) ++ true ;; ++ + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) + ac_prev=sbindir ;; + -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ diff --git a/freeradius.spec b/freeradius.spec index d549105..07690cd 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -27,6 +27,7 @@ Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch +Patch7: freeradius-configure-runstatedir.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -211,6 +212,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch4 -p1 %patch5 -p1 %patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -897,6 +899,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Sep 5 2022 Antonio Torres - 3.2.0-3 +- configure: allow building with runstatedir option + Resolves: #2123374 + * Thu Jul 21 2022 Fedora Release Engineering - 3.2.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 491f4aac7b90aa0c8bc53d1b933b4422e78e41c6 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 20 Sep 2022 17:56:48 +0200 Subject: [PATCH 088/126] Remove deprecated pcre-devel dependency Resolves: #2128292 Signed-off-by: Antonio Torres --- freeradius.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 07690cd..1515969 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.0 -Release: 3%{?dist} +Release: 4%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -45,9 +45,8 @@ BuildRequires: readline-devel BuildRequires: libpcap-devel BuildRequires: systemd-units BuildRequires: libtalloc-devel -BuildRequires: pcre-devel BuildRequires: chrpath -BuildRequires: systemd-rpm-macros +BuildRequires: systemd-rpm-macros %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -899,6 +898,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue 20 Sep 2022 Antonio Torres - 3.2.0-4 +- Remove deprecated pcre-devel dependency + Resolves #2128292 + * Mon Sep 5 2022 Antonio Torres - 3.2.0-3 - configure: allow building with runstatedir option Resolves: #2123374 From d2db6eed8c35f39ecae9c6717c087435194779cd Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 17 Oct 2022 13:25:03 +0200 Subject: [PATCH 089/126] Update to upstream release 3.2.1 Resolves: #2131850 Signed-off-by: Antonio Torres --- .gitignore | 1 + ...-Use-system-crypto-policy-by-default.patch | 21 +- freeradius-configure-runstatedir.patch | 719 ------------------ freeradius-no-buildtime-cert-gen.patch | 16 +- freeradius.spec | 17 +- sources | 2 +- 6 files changed, 32 insertions(+), 744 deletions(-) delete mode 100644 freeradius-configure-runstatedir.patch diff --git a/.gitignore b/.gitignore index 08a4341..a9618a9 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.24.tar.bz2 /freeradius-server-3.0.25.tar.bz2 /freeradius-server-3.2.0.tar.bz2 +/freeradius-server-3.2.1.tar.bz2 diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index fc2501b..74f3cfd 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -4,6 +4,7 @@ Date: Wed, 8 May 2019 10:16:31 -0400 Subject: [PATCH] Use system-provided crypto-policies by default Signed-off-by: Alexander Scheel +[antorres@redhat.com]: update patch to 3.2.1 state --- raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- @@ -12,19 +13,19 @@ Signed-off-by: Alexander Scheel 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 36849e10f2..b28c0f19c6 100644 +index 62152a6dfc..9f64963034 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -370,7 +370,7 @@ eap { +@@ -400,7 +400,7 @@ eap { # TLS cipher suites. The format is listed # in "man 1 ciphers". # - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - # If enabled, OpenSSL will use server cipher list - # (possibly defined by cipher_list option above) -@@ -1008,7 +1008,7 @@ eap { + # Set this option to specify the allowed + # TLS signature algorithms for OpenSSL 1.1.1 and above. +@@ -1082,7 +1082,7 @@ eap { # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used # @@ -60,10 +61,10 @@ index b8d0626bbe..073b2933c2 100644 enable = no lifetime = 24 # hours diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index bbc761b1c5..83cd35b851 100644 +index 137fcbc6cc..a65f8a8711 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -215,7 +215,7 @@ listen { +@@ -292,7 +292,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -72,15 +73,15 @@ index bbc761b1c5..83cd35b851 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -517,7 +517,7 @@ home_server tls { +@@ -676,7 +676,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - } - } + # + # Connection timeout for outgoing TLS connections. -- 2.21.0 diff --git a/freeradius-configure-runstatedir.patch b/freeradius-configure-runstatedir.patch deleted file mode 100644 index ab4f960..0000000 --- a/freeradius-configure-runstatedir.patch +++ /dev/null @@ -1,719 +0,0 @@ -From: Antonio Torres -Date: Mon, 5 Sep 2022 -Subject: configure: allow building with runstatedir option - -In Fedora 38+, redhat-rpm-config adds --runstatedir=/run to %configure macro. -Since this is not supported in current FreeRADIUS configure scripts, add the option -placeholder so that we can continue building the package. - -Resolves: #2123374 - -Signed-off-by: Antonio Torres ---- - src/modules/rlm_cache/configure | 3 +++ - src/modules/rlm_cache/drivers/rlm_cache_memcached/configure | 3 +++ - src/modules/rlm_couchbase/configure | 3 +++ - src/modules/rlm_counter/configure | 3 +++ - src/modules/rlm_eap/configure | 3 +++ - src/modules/rlm_eap/types/rlm_eap_fast/configure | 3 +++ - src/modules/rlm_eap/types/rlm_eap_ikev2/configure | 3 +++ - src/modules/rlm_eap/types/rlm_eap_pwd/configure | 3 +++ - src/modules/rlm_eap/types/rlm_eap_sim/configure | 3 +++ - src/modules/rlm_eap/types/rlm_eap_tnc/configure | 3 +++ - src/modules/rlm_example/configure | 3 +++ - src/modules/rlm_idn/configure | 3 +++ - src/modules/rlm_ippool/configure | 3 +++ - src/modules/rlm_krb5/configure | 3 +++ - src/modules/rlm_ldap/configure | 3 +++ - src/modules/rlm_mschap/configure | 3 +++ - src/modules/rlm_opendirectory/configure | 3 +++ - src/modules/rlm_pam/configure | 3 +++ - src/modules/rlm_perl/configure | 3 +++ - src/modules/rlm_python/configure | 3 +++ - src/modules/rlm_python3/configure | 3 +++ - src/modules/rlm_radutmp/configure | 3 +++ - src/modules/rlm_realm/configure | 3 +++ - src/modules/rlm_redis/configure | 3 +++ - src/modules/rlm_rediswho/configure | 3 +++ - src/modules/rlm_rest/configure | 3 +++ - src/modules/rlm_ruby/configure | 3 +++ - src/modules/rlm_securid/configure | 3 +++ - src/modules/rlm_smsotp/configure | 3 +++ - src/modules/rlm_sql/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_db2/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_firebird/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_freetds/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_mongo/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_mysql/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_oracle/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure | 3 +++ - src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure | 3 +++ - src/modules/rlm_sql_map/configure | 3 +++ - src/modules/rlm_sqlcounter/configure | 3 +++ - src/modules/rlm_sqlhpwippool/configure | 3 +++ - src/modules/rlm_sqlippool/configure | 3 +++ - src/modules/rlm_unbound/configure | 3 +++ - src/modules/rlm_unix/configure | 3 +++ - src/modules/rlm_yubikey/configure | 3 +++ - 47 files changed, 141 insertions(+) - -diff --git a/src/modules/rlm_cache/configure b/src/modules/rlm_cache/configure -index e6382e91ee..d9f6a6d021 100755 ---- a/src/modules/rlm_cache/configure -+++ b/src/modules/rlm_cache/configure -@@ -936,6 +936,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure b/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure -index ecb7f11ca5..3701e0f5c5 100755 ---- a/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure -+++ b/src/modules/rlm_cache/drivers/rlm_cache_memcached/configure -@@ -941,6 +941,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_couchbase/configure b/src/modules/rlm_couchbase/configure -index 1e1bd898da..6d0a65a578 100755 ---- a/src/modules/rlm_couchbase/configure -+++ b/src/modules/rlm_couchbase/configure -@@ -944,6 +944,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_counter/configure b/src/modules/rlm_counter/configure -index c254e7ac3e..281671727c 100755 ---- a/src/modules/rlm_counter/configure -+++ b/src/modules/rlm_counter/configure -@@ -941,6 +941,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/configure b/src/modules/rlm_eap/configure -index 4aff92daff..5179fa33e9 100755 ---- a/src/modules/rlm_eap/configure -+++ b/src/modules/rlm_eap/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/types/rlm_eap_fast/configure b/src/modules/rlm_eap/types/rlm_eap_fast/configure -index b360af6bf9..4145de9937 100755 ---- a/src/modules/rlm_eap/types/rlm_eap_fast/configure -+++ b/src/modules/rlm_eap/types/rlm_eap_fast/configure -@@ -943,6 +943,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/types/rlm_eap_ikev2/configure b/src/modules/rlm_eap/types/rlm_eap_ikev2/configure -index 8671d86c1d..71ce73ece9 100755 ---- a/src/modules/rlm_eap/types/rlm_eap_ikev2/configure -+++ b/src/modules/rlm_eap/types/rlm_eap_ikev2/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/configure b/src/modules/rlm_eap/types/rlm_eap_pwd/configure -index b4b5bc085f..f13170c85d 100755 ---- a/src/modules/rlm_eap/types/rlm_eap_pwd/configure -+++ b/src/modules/rlm_eap/types/rlm_eap_pwd/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/types/rlm_eap_sim/configure b/src/modules/rlm_eap/types/rlm_eap_sim/configure -index ef5f2bac1f..664d0dc3fa 100755 ---- a/src/modules/rlm_eap/types/rlm_eap_sim/configure -+++ b/src/modules/rlm_eap/types/rlm_eap_sim/configure -@@ -924,6 +924,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_eap/types/rlm_eap_tnc/configure b/src/modules/rlm_eap/types/rlm_eap_tnc/configure -index 92da810c75..852511afbb 100755 ---- a/src/modules/rlm_eap/types/rlm_eap_tnc/configure -+++ b/src/modules/rlm_eap/types/rlm_eap_tnc/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_example/configure b/src/modules/rlm_example/configure -index 280e00dd85..23b6c6a681 100755 ---- a/src/modules/rlm_example/configure -+++ b/src/modules/rlm_example/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_idn/configure b/src/modules/rlm_idn/configure -index 7b25ba14d6..2fd00ffa8a 100755 ---- a/src/modules/rlm_idn/configure -+++ b/src/modules/rlm_idn/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_ippool/configure b/src/modules/rlm_ippool/configure -index c911010098..ed62cd8f07 100755 ---- a/src/modules/rlm_ippool/configure -+++ b/src/modules/rlm_ippool/configure -@@ -943,6 +943,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_krb5/configure b/src/modules/rlm_krb5/configure -index 991131b531..4439a4671d 100755 ---- a/src/modules/rlm_krb5/configure -+++ b/src/modules/rlm_krb5/configure -@@ -940,6 +940,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_ldap/configure b/src/modules/rlm_ldap/configure -index ded503f6ee..a8f502174c 100755 ---- a/src/modules/rlm_ldap/configure -+++ b/src/modules/rlm_ldap/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_mschap/configure b/src/modules/rlm_mschap/configure -index dec56aaf31..770a2a57ab 100755 ---- a/src/modules/rlm_mschap/configure -+++ b/src/modules/rlm_mschap/configure -@@ -942,6 +942,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_opendirectory/configure b/src/modules/rlm_opendirectory/configure -index b85c9fd1b3..0b81c8b49a 100755 ---- a/src/modules/rlm_opendirectory/configure -+++ b/src/modules/rlm_opendirectory/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_pam/configure b/src/modules/rlm_pam/configure -index 5adcf9b366..461887f370 100755 ---- a/src/modules/rlm_pam/configure -+++ b/src/modules/rlm_pam/configure -@@ -977,6 +977,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_perl/configure b/src/modules/rlm_perl/configure -index aa1e4e9dbf..9c047ee362 100755 ---- a/src/modules/rlm_perl/configure -+++ b/src/modules/rlm_perl/configure -@@ -941,6 +941,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_python/configure b/src/modules/rlm_python/configure -index d7d6bc9454..958fb4f3fa 100755 ---- a/src/modules/rlm_python/configure -+++ b/src/modules/rlm_python/configure -@@ -942,6 +942,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_python3/configure b/src/modules/rlm_python3/configure -index 52bc177dcd..927f1049f6 100755 ---- a/src/modules/rlm_python3/configure -+++ b/src/modules/rlm_python3/configure -@@ -950,6 +950,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_radutmp/configure b/src/modules/rlm_radutmp/configure -index 2bfb8570f4..84eeba4858 100755 ---- a/src/modules/rlm_radutmp/configure -+++ b/src/modules/rlm_radutmp/configure -@@ -977,6 +977,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_realm/configure b/src/modules/rlm_realm/configure -index 13e202aa10..6f339ca25a 100755 ---- a/src/modules/rlm_realm/configure -+++ b/src/modules/rlm_realm/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_redis/configure b/src/modules/rlm_redis/configure -index 12357e127e..e529ca6bfa 100755 ---- a/src/modules/rlm_redis/configure -+++ b/src/modules/rlm_redis/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_rediswho/configure b/src/modules/rlm_rediswho/configure -index f906a222e8..2c8833176f 100755 ---- a/src/modules/rlm_rediswho/configure -+++ b/src/modules/rlm_rediswho/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_rest/configure b/src/modules/rlm_rest/configure -index 2a97662fad..dbefc261ed 100755 ---- a/src/modules/rlm_rest/configure -+++ b/src/modules/rlm_rest/configure -@@ -946,6 +946,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_ruby/configure b/src/modules/rlm_ruby/configure -index 92bc11eae5..2e434f20b1 100755 ---- a/src/modules/rlm_ruby/configure -+++ b/src/modules/rlm_ruby/configure -@@ -951,6 +951,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_securid/configure b/src/modules/rlm_securid/configure -index 88d6871019..1ab7633088 100755 ---- a/src/modules/rlm_securid/configure -+++ b/src/modules/rlm_securid/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_smsotp/configure b/src/modules/rlm_smsotp/configure -index c90bc60810..0d7e944fee 100755 ---- a/src/modules/rlm_smsotp/configure -+++ b/src/modules/rlm_smsotp/configure -@@ -977,6 +977,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/configure b/src/modules/rlm_sql/configure -index 422e5baf64..285a634bcc 100755 ---- a/src/modules/rlm_sql/configure -+++ b/src/modules/rlm_sql/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_db2/configure b/src/modules/rlm_sql/drivers/rlm_sql_db2/configure -index 0eeffda80a..5001dd5f84 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_db2/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_db2/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure b/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure -index ffdfca36f1..1ab7613426 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_firebird/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure b/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure -index 501daaeb02..bf643f1931 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_freetds/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure b/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure -index 99d0bbc3f3..5a02d9479a 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_iodbc/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure b/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure -index 8ddcba052b..af09bb9fab 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_mongo/configure -@@ -940,6 +940,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure b/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure -index 7ed19587c3..283b5c2cdf 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_mysql/configure -@@ -941,6 +941,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure b/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure -index 5a8123851a..44b2a059db 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_oracle/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure b/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure -index db98a9296a..509882a6e9 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_postgresql/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure -index 6ea76be4e1..f0846f7cef 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_sqlite/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure b/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure -index f6a6157ebb..3ca3b7117b 100755 ---- a/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure -+++ b/src/modules/rlm_sql/drivers/rlm_sql_unixodbc/configure -@@ -939,6 +939,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sql_map/configure b/src/modules/rlm_sql_map/configure -index 08c49a2631..99e9543d0c 100755 ---- a/src/modules/rlm_sql_map/configure -+++ b/src/modules/rlm_sql_map/configure -@@ -924,6 +924,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sqlcounter/configure b/src/modules/rlm_sqlcounter/configure -index 72a475c392..606804b146 100755 ---- a/src/modules/rlm_sqlcounter/configure -+++ b/src/modules/rlm_sqlcounter/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sqlhpwippool/configure b/src/modules/rlm_sqlhpwippool/configure -index 9e434c9f85..16e07caf6e 100755 ---- a/src/modules/rlm_sqlhpwippool/configure -+++ b/src/modules/rlm_sqlhpwippool/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_sqlippool/configure b/src/modules/rlm_sqlippool/configure -index 6d07b2c4a6..5866c2a43e 100755 ---- a/src/modules/rlm_sqlippool/configure -+++ b/src/modules/rlm_sqlippool/configure -@@ -924,6 +924,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_unbound/configure b/src/modules/rlm_unbound/configure -index 4d92d5b127..4da5738078 100755 ---- a/src/modules/rlm_unbound/configure -+++ b/src/modules/rlm_unbound/configure -@@ -938,6 +938,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_unix/configure b/src/modules/rlm_unix/configure -index 8ad9a34042..8949a43d13 100755 ---- a/src/modules/rlm_unix/configure -+++ b/src/modules/rlm_unix/configure -@@ -977,6 +977,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ -diff --git a/src/modules/rlm_yubikey/configure b/src/modules/rlm_yubikey/configure -index 146d432ed6..ffc8561ed8 100755 ---- a/src/modules/rlm_yubikey/configure -+++ b/src/modules/rlm_yubikey/configure -@@ -942,6 +942,9 @@ do - | -silent | --silent | --silen | --sile | --sil) - silent=yes ;; - -+ --runstatedir=*) -+ true ;; -+ - -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) - ac_prev=sbindir ;; - -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index a291bae..0d55138 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -27,10 +27,10 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index b9adc3be20..5bdb2f081b 100755 +index 77a1436510..74ff9a1fd4 100755 --- a/configure +++ b/configure -@@ -679,6 +679,7 @@ AUTOCONF +@@ -652,6 +652,7 @@ AUTOCONF ACLOCAL RUSERS SNMPWALK @@ -38,15 +38,16 @@ index b9adc3be20..5bdb2f081b 100755 SNMPGET openssl_version_check_config WITH_DHCP -@@ -7031,6 +7032,7 @@ else +@@ -5961,7 +5962,7 @@ else + openssl_version_check_config= fi - +- +ENABLE_REPRODUCIBLE_BUILDS=yes # Check whether --enable-reproducible-builds was given. - if test ${enable_reproducible_builds+y} - then : -@@ -7043,6 +7045,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + if test "${enable_reproducible_builds+set}" = set; then : + enableval=$enable_reproducible_builds; case "$enableval" in +@@ -5973,6 +5974,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -54,7 +55,6 @@ index b9adc3be20..5bdb2f081b 100755 esac fi - diff --git a/configure.ac b/configure.ac index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac diff --git a/freeradius.spec b/freeradius.spec index 1515969..934b918 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.0 -Release: 4%{?dist} +Version: 3.2.1 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -27,7 +27,6 @@ Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch -Patch7: freeradius-configure-runstatedir.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -211,7 +210,6 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch4 -p1 %patch5 -p1 %patch6 -p1 -%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -434,6 +432,7 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter @@ -445,6 +444,7 @@ EOF # sites-available %dir %attr(750,root,radiusd) /etc/raddb/sites-available /etc/raddb/sites-available/README +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting @@ -881,8 +881,9 @@ EOF %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -898,7 +899,11 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog -* Tue 20 Sep 2022 Antonio Torres - 3.2.0-4 +* Mon Oct 17 2022 Antonio Torres - 3.2.1-1 +- Update to 3.2.1 upstream release + Resolves #2131850 + +* Tue Sep 20 2022 Antonio Torres - 3.2.0-4 - Remove deprecated pcre-devel dependency Resolves #2128292 diff --git a/sources b/sources index 88ed946..56e81d0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.0.tar.bz2) = e7aa7bfc5a6968cdb860bb565ebd45bc1b3f78a665a9888a8b8dacaa1c5256755468aed33bdffe39465f8678c1fb9d6f47f0dbcf0178dfdcb38d99e3bc4b747d +SHA512 (freeradius-server-3.2.1.tar.bz2) = 0f9e98cbf0eff4c5af54731ec34a8c9070252eaf2f91ca0c87caae939f6356fa91a6e1ed98ba66dbf1c1bafecdfcf38603fb4f65a5955e88974f49a5b7885f7a From 38b3f086ca1df67bc0a47fa6f4bcec48bb47400a Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 17 Oct 2022 17:07:42 +0200 Subject: [PATCH 090/126] Remove Python3 hack from spec file Python 3 module has been marked as stable upstream, so we no longer need this hack, disabling Python 2 support with a configure option is enough. Signed-off-by: Antonio Torres --- freeradius.spec | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 934b918..c67e22b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -215,18 +215,10 @@ This plugin provides the REST support for the FreeRADIUS server project. # Force compile/link options, extra security for network facing daemon %global _hardened_build 1 -# Hack: rlm_python3 as stable; prevents building other unstable modules. -sed 's/rlm_python/rlm_python3/g' src/modules/stable -i - %global build_ldflags %{build_ldflags} $(python3-config --embed --libs) export PY3_LIB_DIR="$(python3-config --configdir)" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" -# In order for the above hack to stick, do a fake configure so -# we can run reconfig before cleaning up after ourselves and running -# configure for real. -./configure && make reconfig && (make clean distclean || true) - %configure \ --libdir=%{_libdir}/freeradius \ --enable-reproducible-builds \ @@ -245,6 +237,7 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v --with-rlm_python3 \ --with-rlm-python3-lib-dir=$PY3_LIB_DIR \ --with-rlm-python3-include-dir=$PY3_INC_DIR \ + --without-rlm_python \ --without-rlm_eap_ikev2 \ --without-rlm_eap_tnc \ --without-rlm_sql_iodbc \ From 8b7c576199be7accd848a13b779b213d17006487 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 17 Oct 2022 17:29:47 +0200 Subject: [PATCH 091/126] Bump release number Signed-off-by: Antonio Torres --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index c67e22b..1d9fd99 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.1 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -892,6 +892,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Oct 17 2022 Antonio Torres - 3.2.1-2 +- Remove hack for Python3 support from specfile + * Mon Oct 17 2022 Antonio Torres - 3.2.1-1 - Update to 3.2.1 upstream release Resolves #2131850 From db29b91ffb561349fcc66c302522d669955936cb Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Fri, 13 Jan 2023 09:34:41 +0100 Subject: [PATCH 092/126] Remove perl(MODULE_COMPAT), it will be replaced by generators --- freeradius.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 1d9fd99..10c5141 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -126,7 +126,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius Requires: %{name} = %{version}-%{release} -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} BuildRequires: perl-devel BuildRequires: perl-generators From 8b93308d8202c7e60a1d5e834952f67f3863230a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 03:53:53 +0000 Subject: [PATCH 093/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 10c5141..331a11d 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.1 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -891,6 +891,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 3.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Mon Oct 17 2022 Antonio Torres - 3.2.1-2 - Remove hack for Python3 support from specfile From d04d68f8de4bbc99cfa20adbcfdb668e9ab1ff64 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 15 Mar 2023 11:50:38 +0100 Subject: [PATCH 094/126] Migrate to SPDX license Signed-off-by: Antonio Torres --- freeradius.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 331a11d..43c8991 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,8 +1,8 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.1 -Release: 3%{?dist} -License: GPLv2+ and LGPLv2+ +Release: 4%{?dist} +License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ # Is elliptic curve cryptography supported? @@ -891,6 +891,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Mar 15 2023 Antonio Torres - 3.2.1-4 +- Migrate to SPDX license + * Thu Jan 19 2023 Fedora Release Engineering - 3.2.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 049df291ead2f8c0c98b8a75ae860a0cd8b0c7fc Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 21 Mar 2023 09:39:33 +0100 Subject: [PATCH 095/126] Update to 3.2.2 upstream release Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a9618a9..2000371 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.25.tar.bz2 /freeradius-server-3.2.0.tar.bz2 /freeradius-server-3.2.1.tar.bz2 +/freeradius-server-3.2.2.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 43c8991..bc30b7a 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.1 -Release: 4%{?dist} +Version: 3.2.2 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -891,6 +891,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Mar 21 2023 Antonio Torres - 3.2.2-1 +- Update to upstream release 3.2.2 + * Wed Mar 15 2023 Antonio Torres - 3.2.1-4 - Migrate to SPDX license diff --git a/sources b/sources index 56e81d0..4c58610 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.1.tar.bz2) = 0f9e98cbf0eff4c5af54731ec34a8c9070252eaf2f91ca0c87caae939f6356fa91a6e1ed98ba66dbf1c1bafecdfcf38603fb4f65a5955e88974f49a5b7885f7a +SHA512 (freeradius-server-3.2.2.tar.bz2) = 91dc574560a1f75cafa8bc78c0676f0e3dae7154ecbb395e0e1f6738f78d8bcfe1bff122364452798fd0434c4056fd946799b8f29a1141398bf0542a37870689 From e6dba7c680751f1208f0e853d144a41003c39b68 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 21 Mar 2023 10:08:47 +0100 Subject: [PATCH 096/126] Add new packaged file to spec Signed-off-by: Antonio Torres --- freeradius.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/freeradius.spec b/freeradius.spec index bc30b7a..7dff486 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -682,6 +682,7 @@ EOF %doc %{_mandir}/man5/rlm_passwd.5.gz %doc %{_mandir}/man5/rlm_realm.5.gz %doc %{_mandir}/man5/rlm_sql.5.gz +%doc %{_mandir}/man5/rlm_unbound.5.gz %doc %{_mandir}/man5/rlm_unix.5.gz %doc %{_mandir}/man5/unlang.5.gz %doc %{_mandir}/man5/users.5.gz From 3f56050138088ee8fa767d1b8690bed9ff8d5773 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 14 Jun 2023 00:18:40 +0200 Subject: [PATCH 097/126] Rebuilt for Python 3.12 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 7dff486..ed59651 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -892,6 +892,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jun 13 2023 Python Maint - 3.2.2-2 +- Rebuilt for Python 3.12 + * Tue Mar 21 2023 Antonio Torres - 3.2.2-1 - Update to upstream release 3.2.2 From d1c3541f6618536b08ae5b1b38360a7b6a5a882e Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 11 Jul 2023 15:55:37 +0200 Subject: [PATCH 098/126] Perl 5.38 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index ed59651..db969b6 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.2 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -892,6 +892,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jul 11 2023 Jitka Plesnikova - 3.2.2-3 +- Perl 5.38 rebuild + * Tue Jun 13 2023 Python Maint - 3.2.2-2 - Rebuilt for Python 3.12 From ca09fc02d802483ed32117062687b46d66a8d0f6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 19 Jul 2023 20:14:54 +0000 Subject: [PATCH 099/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index db969b6..d3d9b15 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.2 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -892,6 +892,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jul 19 2023 Fedora Release Engineering - 3.2.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Jul 11 2023 Jitka Plesnikova - 3.2.2-3 - Perl 5.38 rebuild From edb8438befbfbb64a666ca7f85889303f2191e9a Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 12 Sep 2023 14:35:31 +0200 Subject: [PATCH 100/126] Ease OpenSSL version check requirement FreeRADIUS includes an OpenSSL version check that compares built vs linked version, and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as ABI changes are tracked and soname is changed accordingly, as discussed in previous Bugzilla for this issue [1]. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 Resolves: #2238511 Signed-off-by: Antonio Torres --- freeradius-ease-openssl-version-check.patch | 35 +++++++++++++++++++++ freeradius.spec | 8 ++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 freeradius-ease-openssl-version-check.patch diff --git a/freeradius-ease-openssl-version-check.patch b/freeradius-ease-openssl-version-check.patch new file mode 100644 index 0000000..23f1df7 --- /dev/null +++ b/freeradius-ease-openssl-version-check.patch @@ -0,0 +1,35 @@ +From: Antonio Torres +Date: Tue, 12 Sep 2023 +Subject: Ease OpenSSL version check requirement + +FreeRADIUS includes an OpenSSL version check that compares built vs linked version, +and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as +ABI changes are tracked and soname is changed accordingly, as discussed in previous +Bugzilla for this issue [1]. + +[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511 +Signed-off-by: Antonio Torres +--- + src/main/version.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/main/version.c b/src/main/version.c +index c190337c1d..fee2150eb2 100644 +--- a/src/main/version.c ++++ b/src/main/version.c +@@ -79,11 +79,11 @@ int ssl_check_consistency(void) + */ + if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) { + mismatch: +- ERROR("libssl version mismatch. built: %lx linked: %lx", ++ DEBUG2("libssl version mismatch. built: %lx linked: %lx", + (unsigned long) ssl_built, + (unsigned long) ssl_linked); + +- return -1; ++ return 0; + } + + /* diff --git a/freeradius.spec b/freeradius.spec index d3d9b15..a9798eb 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.2 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -27,6 +27,7 @@ Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch +Patch7: freeradius-ease-openssl-version-check.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -209,6 +210,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch4 -p1 %patch5 -p1 %patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -892,6 +894,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Sep 12 2023 Antonio Torres - 3.2.2-5 +- Ease OpenSSL version check requirement + Resolves #2238511 + * Wed Jul 19 2023 Fedora Release Engineering - 3.2.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From ea6ff99048fa146680862b947a8741a670b1dc63 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 24 Oct 2023 14:16:56 +0200 Subject: [PATCH 101/126] Update to 3.2.3 upstream release Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius-no-buildtime-cert-gen.patch | 17 ++++++++--------- freeradius.spec | 7 +++++-- sources | 2 +- 4 files changed, 15 insertions(+), 12 deletions(-) diff --git a/.gitignore b/.gitignore index 2000371..860d69f 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ freeradius-*.src.rpm /freeradius-server-3.2.0.tar.bz2 /freeradius-server-3.2.1.tar.bz2 /freeradius-server-3.2.2.tar.bz2 +/freeradius-server-3.2.3.tar.bz2 diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index 0d55138..b435d82 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -27,10 +27,10 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index 77a1436510..74ff9a1fd4 100755 +index 5041ca264f..ed01ee2bdd 100755 --- a/configure +++ b/configure -@@ -652,6 +652,7 @@ AUTOCONF +@@ -679,6 +679,7 @@ AUTOCONF ACLOCAL RUSERS SNMPWALK @@ -38,16 +38,15 @@ index 77a1436510..74ff9a1fd4 100755 SNMPGET openssl_version_check_config WITH_DHCP -@@ -5961,7 +5962,7 @@ else - openssl_version_check_config= - fi +@@ -6976,6 +6977,7 @@ fi + -- -+ENABLE_REPRODUCIBLE_BUILDS=yes # Check whether --enable-reproducible-builds was given. - if test "${enable_reproducible_builds+set}" = set; then : ++ENABLE_REPRODUCIBLE_BUILDS=yes + if test ${enable_reproducible_builds+y} + then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -5973,6 +5974,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -6987,6 +6989,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no diff --git a/freeradius.spec b/freeradius.spec index a9798eb..1602744 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.2 -Release: 5%{?dist} +Version: 3.2.3 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -894,6 +894,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Oct 24 2023 Antonio Torres - 3.2.3-1 +- Update to upstream release 3.2.3 + * Tue Sep 12 2023 Antonio Torres - 3.2.2-5 - Ease OpenSSL version check requirement Resolves #2238511 diff --git a/sources b/sources index 4c58610..284c2d8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.2.tar.bz2) = 91dc574560a1f75cafa8bc78c0676f0e3dae7154ecbb395e0e1f6738f78d8bcfe1bff122364452798fd0434c4056fd946799b8f29a1141398bf0542a37870689 +SHA512 (freeradius-server-3.2.3.tar.bz2) = 06767153e262a2baa2d0cc74099bc13c23b33c2316348b5dc8ec0f5834c028571bd09b8c01726a6eabeaab8fdc3050f40bfeba2d5b1c299585d1689abad365ce From 1793f410aa789704b5ac0be9cf7d0eaece906d1a Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 19 Dec 2023 07:59:23 +0100 Subject: [PATCH 102/126] Fix C compatibility issue in configure script Related to: --- freeradius-configure-c99.patch | 35 ++++++++++++++++++++++++++++++++++ freeradius.spec | 7 ++++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 freeradius-configure-c99.patch diff --git a/freeradius-configure-c99.patch b/freeradius-configure-c99.patch new file mode 100644 index 0000000..cc9daff --- /dev/null +++ b/freeradius-configure-c99.patch @@ -0,0 +1,35 @@ +The backtrace_symbols function expects a pointer to an array of void * +values, not a pointer to an array of a single element. Removing the +address operator ensures that the right type is used. + +This avoids an unconditional failure of this probe with compilers that +treat incompatible pointer types as a compilation error. + +Submitted upstream: + +diff --git a/configure b/configure +index ed01ee2bdd912f63..1e6d2284779cdd58 100755 +--- a/configure ++++ b/configure +@@ -13390,7 +13390,7 @@ main (void) + { + + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ++ backtrace_symbols(sym, sizeof(sym)) + ; + return 0; + } +diff --git a/configure.ac b/configure.ac +index 76320213b51d7bb4..6a689711d6c90483 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then + #include + ]], [[ + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ]])],[ ++ backtrace_symbols(sym, sizeof(sym)) ]])],[ + AC_MSG_RESULT(yes) + ac_cv_lib_execinfo_backtrace_symbols="yes" + ],[ diff --git a/freeradius.spec b/freeradius.spec index 1602744..aba3a92 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.3 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -28,6 +28,7 @@ Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch Patch7: freeradius-ease-openssl-version-check.patch +Patch8: freeradius-configure-c99.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -211,6 +212,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch5 -p1 %patch6 -p1 %patch7 -p1 +%patch8 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -894,6 +896,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Dec 19 2023 Florian Weimer - 3.2.3-2 +- Fix C compatibility issue in configure script + * Tue Oct 24 2023 Antonio Torres - 3.2.3-1 - Update to upstream release 3.2.3 From bcdc6e99f998861dd38cca80f1838bda785ea555 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jan 2024 19:47:24 +0000 Subject: [PATCH 103/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index aba3a92..17cf81e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.3 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -896,6 +896,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jan 19 2024 Fedora Release Engineering - 3.2.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Dec 19 2023 Florian Weimer - 3.2.3-2 - Fix C compatibility issue in configure script From d68944b4aff752a0d7776893ce1a6a21239e26db Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 12:02:29 +0000 Subject: [PATCH 104/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 17cf81e..e8cd4ad 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.3 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -896,6 +896,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 3.2.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jan 19 2024 Fedora Release Engineering - 3.2.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From db785d8a9d46ae84ce297cc55e60713395cf4155 Mon Sep 17 00:00:00 2001 From: Software Management Team Date: Thu, 30 May 2024 12:46:46 +0200 Subject: [PATCH 105/126] Eliminate use of obsolete %patchN syntax (#2283636) --- freeradius.spec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index e8cd4ad..0f3f01e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -205,14 +205,14 @@ This plugin provides the REST support for the FreeRADIUS server project. %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' # mistakenly includes the backup files, especially problematic for raddb config files. -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 -%patch8 -p1 +%patch -P1 -p1 +%patch -P2 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 %build # Force compile/link options, extra security for network facing daemon From d549c4c107aaf904b0d9953f3c61658c91e42a71 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Fri, 31 May 2024 10:34:15 +0200 Subject: [PATCH 106/126] Update to 3.2.4 upstream release Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 11 +++++++++-- sources | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 860d69f..1eb25d0 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ freeradius-*.src.rpm /freeradius-server-3.2.1.tar.bz2 /freeradius-server-3.2.2.tar.bz2 /freeradius-server-3.2.3.tar.bz2 +/freeradius-server-3.2.4.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 0f3f01e..d4d7a80 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.3 -Release: 4%{?dist} +Version: 3.2.4 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -415,6 +415,7 @@ EOF %config(noreplace) /etc/raddb/certs/Makefile %config(noreplace) /etc/raddb/certs/passwords.mk /etc/raddb/certs/README.md +/etc/raddb/certs/realms/README.md %config(noreplace) /etc/raddb/certs/xpextensions %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf %attr(750,root,radiusd) /etc/raddb/certs/bootstrap @@ -541,6 +542,7 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx @@ -666,6 +668,8 @@ EOF %{_libdir}/freeradius/rlm_utf8.so %{_libdir}/freeradius/rlm_wimax.so %{_libdir}/freeradius/rlm_yubikey.so +%{_libdir}/freeradius/rlm_dpsk.so +%{_libdir}/freeradius/rlm_eap_teap.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -896,6 +900,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri May 31 2024 Antonio Torres - 3.2.4-1 +- Update to upstream release 3.2.4 + * Wed Jan 24 2024 Fedora Release Engineering - 3.2.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 284c2d8..9c2d61f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.3.tar.bz2) = 06767153e262a2baa2d0cc74099bc13c23b33c2316348b5dc8ec0f5834c028571bd09b8c01726a6eabeaab8fdc3050f40bfeba2d5b1c299585d1689abad365ce +SHA512 (freeradius-server-3.2.4.tar.bz2) = f0a0ebec906d72e44740cf66069cd8d29d93703bfb976dbb1b7ce062eb86cc2977af167577b908677a8dd4a0d9ee708605d08eb2f0f77f6feb5a0b1a244833fb From dbcdacd2d0baed12051821a13956c9181e676d79 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 08:46:18 +0200 Subject: [PATCH 107/126] Rebuilt for Python 3.13 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index d4d7a80..4e4f75e 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -900,6 +900,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Jun 07 2024 Python Maint - 3.2.4-2 +- Rebuilt for Python 3.13 + * Fri May 31 2024 Antonio Torres - 3.2.4-1 - Update to upstream release 3.2.4 From 2238015f6add31de28744d38cdcf54cfc8a0f73f Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Wed, 12 Jun 2024 12:52:04 +0200 Subject: [PATCH 108/126] Perl 5.40 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 4e4f75e..3064e03 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.4 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -900,6 +900,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jun 12 2024 Jitka Plesnikova - 3.2.4-3 +- Perl 5.40 rebuild + * Fri Jun 07 2024 Python Maint - 3.2.4-2 - Rebuilt for Python 3.13 From 005987d712cb48eff67c75886b69d27f2e3b54c2 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 26 Jun 2024 12:24:50 +0200 Subject: [PATCH 109/126] Generate certificates in auth test Signed-off-by: Antonio Torres --- tests/auth-tests/runtest.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh index 7be8432..ceaeaa7 100755 --- a/tests/auth-tests/runtest.sh +++ b/tests/auth-tests/runtest.sh @@ -16,6 +16,25 @@ PACKAGE="freeradius" RADIUS_CLIENT_CONF="/etc/raddb/clients.conf" RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize" +generate_cert(){ + pushd /etc/raddb/certs/ + #remove certificates if exists;generate new certificates + if [[ -f /etc/raddb/certs/bootstrap ]]; then + rlLog "Destroy and create new default certificates via bootstrap script" + rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh + rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates" + else + rlLogWarning "!!! WARNING bootsrap file does not exist !!!" + rlLog "Destroy and create new default certificates via make scripts" + make destroycerts -C /etc/raddb/certs/ + #create new certificates + make -C /etc/raddb/certs/ + chown root:radiusd dh ca.* client.* server.* + chmod 640 dh ca.* client.* server.* + fi + popd +} + rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE @@ -29,6 +48,7 @@ rlJournalStart rlRun "cp clients.conf $RADIUS_CLIENT_CONF" rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE" rlRun "systemctl daemon-reload" + generate_cert rlPhaseEnd rlPhaseStartTest From bead332d1108ae465a785c66a89de0d024ca7881 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 9 Jul 2024 14:46:02 +0200 Subject: [PATCH 110/126] Update to 3.2.5 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 1eb25d0..8b82526 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ freeradius-*.src.rpm /freeradius-server-3.2.2.tar.bz2 /freeradius-server-3.2.3.tar.bz2 /freeradius-server-3.2.4.tar.bz2 +/freeradius-server-3.2.5.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 3064e03..b7f86da 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.4 -Release: 3%{?dist} +Version: 3.2.5 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -900,6 +900,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jul 09 2024 Antonio Torres - 3.2.5-1 +- Update to upstream release 3.2.5 + * Wed Jun 12 2024 Jitka Plesnikova - 3.2.4-3 - Perl 5.40 rebuild diff --git a/sources b/sources index 9c2d61f..4768856 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.4.tar.bz2) = f0a0ebec906d72e44740cf66069cd8d29d93703bfb976dbb1b7ce062eb86cc2977af167577b908677a8dd4a0d9ee708605d08eb2f0f77f6feb5a0b1a244833fb +SHA512 (freeradius-server-3.2.5.tar.bz2) = 55e653630674a957dcd52ae58e5fd7b5a510b84aaa80e0552bce8089221e02f652618b53753f438981472a5f47df7c8426b9a5ecda0b06ad9f4c25b23604c86b From bf421ace1262bb0115fc4fb5be5021a242abb85b Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Tue, 9 Jul 2024 16:28:49 +0200 Subject: [PATCH 111/126] Include openssl-devel-engine build dependency Signed-off-by: Antonio Torres --- freeradius.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/freeradius.spec b/freeradius.spec index b7f86da..36a9d7a 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -38,6 +38,8 @@ BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl BuildRequires: openssl-devel +# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine +BuildRequires: openssl-devel-engine BuildRequires: pam-devel BuildRequires: zlib-devel BuildRequires: net-snmp-devel From a49c1eef4fbb923d1c5434033fc2b3942a797f63 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 17 Jul 2024 23:38:19 +0000 Subject: [PATCH 112/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 36a9d7a..cd94c06 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -902,6 +902,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jul 17 2024 Fedora Release Engineering - 3.2.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Antonio Torres - 3.2.5-1 - Update to upstream release 3.2.5 From d3acc3cf6f4817483514bcc9765b78b42a0adec8 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 5 Nov 2024 19:51:30 -0500 Subject: [PATCH 113/126] Drop openssl-devel-engine dependency The only use of OpenSSL ENGINE API is already guarded by OPENSSL_NO_ENGINE, which is now automatically defined when openssl-devel-engine is absent. This allows freeradius to be compiled without it. https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine --- freeradius-openssl-no-engine.patch | 54 ++++++++++++++++++++++++++++++ freeradius.spec | 9 +++-- 2 files changed, 60 insertions(+), 3 deletions(-) create mode 100644 freeradius-openssl-no-engine.patch diff --git a/freeradius-openssl-no-engine.patch b/freeradius-openssl-no-engine.patch new file mode 100644 index 0000000..b03ae2b --- /dev/null +++ b/freeradius-openssl-no-engine.patch @@ -0,0 +1,54 @@ +diff --git a/configure b/configure +index 1e6d228..40a26f5 100755 +--- a/configure ++++ b/configure +@@ -10518,7 +10518,7 @@ smart_prefix= + printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h + + +- for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h ++ for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h + do : + as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh` + ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" +diff --git a/configure.ac b/configure.ac +index 6a68971..4a95148 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then + openssl/rand.h \ + openssl/sha.h \ + openssl/ssl.h \ +- openssl/ocsp.h \ +- openssl/engine.h, ++ openssl/ocsp.h, + [ OPENSSL_CPPFLAGS="$smart_include" ], + [ + AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL)]) +diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in +index 4774482..21d5cea 100644 +--- a/src/include/autoconf.h.in ++++ b/src/include/autoconf.h.in +@@ -285,9 +285,6 @@ + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_CRYPTO_H + +-/* Define to 1 if you have the header file. */ +-#undef HAVE_OPENSSL_ENGINE_H +- + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_ERR_H + +diff --git a/src/include/tls-h b/src/include/tls-h +index 506fb19..514e03a 100644 +--- a/src/include/tls-h ++++ b/src/include/tls-h +@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$") + # define OPENSSL_NO_KRB5 + #endif + #include +-#ifdef HAVE_OPENSSL_ENGINE_H ++#ifndef OPENSSL_NO_ENGINE + # include + #endif + #include diff --git a/freeradius.spec b/freeradius.spec index cd94c06..f5f6645 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -29,6 +29,7 @@ Patch5: freeradius-bootstrap-make-permissions.patch Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch Patch7: freeradius-ease-openssl-version-check.patch Patch8: freeradius-configure-c99.patch +Patch9: freeradius-openssl-no-engine.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -38,8 +39,6 @@ BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl BuildRequires: openssl-devel -# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine -BuildRequires: openssl-devel-engine BuildRequires: pam-devel BuildRequires: zlib-devel BuildRequires: net-snmp-devel @@ -215,6 +214,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch -P6 -p1 %patch -P7 -p1 %patch -P8 -p1 +%patch -P9 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -902,6 +902,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Nov 06 2024 Yaakov Selkowitz - 3.2.5-3 +- Drop openssl-devel-engine dependency + * Wed Jul 17 2024 Fedora Release Engineering - 3.2.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 10de3e72439792481246199eeabbecd8bde3a9d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jan 2025 18:49:50 +0000 Subject: [PATCH 114/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index f5f6645..3efbfdc 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -902,6 +902,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jan 16 2025 Fedora Release Engineering - 3.2.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Nov 06 2024 Yaakov Selkowitz - 3.2.5-3 - Drop openssl-devel-engine dependency From 4e419c7e373b4201dd15191a2ff4e4f9ea109cca Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Thu, 23 Jan 2025 10:52:45 +0100 Subject: [PATCH 115/126] Fix usage of /usr/sbin Point to %_bindir instead, according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin Resolves: #2340178 Signed-off-by: Antonio Torres --- freeradius.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 3efbfdc..d21666f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -596,10 +596,10 @@ EOF # binaries %defattr(-,root,root) -/usr/sbin/checkrad -/usr/sbin/raddebug -/usr/sbin/radiusd -/usr/sbin/radmin +%{_bindir}/checkrad +%{_bindir}/raddebug +%{_bindir}/radiusd +%{_bindir}/radmin # dictionaries %dir %attr(755,root,root) /usr/share/freeradius @@ -902,6 +902,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Jan 23 2025 Antonio Torres - 3.2.5-5 +- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin + * Thu Jan 16 2025 Fedora Release Engineering - 3.2.5-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From e4d007f46777248ab063891e6e85a3b057e33053 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:54:05 +0100 Subject: [PATCH 116/126] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- freeradius.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index d21666f..4360f5b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -49,6 +49,7 @@ BuildRequires: systemd-units BuildRequires: libtalloc-devel BuildRequires: chrpath BuildRequires: systemd-rpm-macros +BuildRequires: libxcrypt-devel %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -902,6 +903,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Sat Feb 01 2025 Björn Esser - 3.2.5-6 +- Add explicit BR: libxcrypt-devel + * Thu Jan 23 2025 Antonio Torres - 3.2.5-5 - Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin From 8f48670e2ad70452bd45e0c3c84120d6e47ff812 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 17:03:17 +0100 Subject: [PATCH 117/126] Drop call to %sysusers_create_compat After https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers, rpm will handle account creation automatically. --- freeradius.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 4360f5b..cf2e24b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.5 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -59,7 +59,7 @@ BuildRequires: ykclient-devel # Require OpenSSL version we built with, or newer, to avoid startup failures # due to runtime OpenSSL version checks. Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) -Requires(pre): shadow-utils glibc-common +Requires(pre): glibc-common Requires(post): systemd-sysv Requires(post): systemd-units # Needed for certificate generation as upstream bootstrap script isn't @@ -356,11 +356,6 @@ All documentation is in the freeradius-doc sub-package. EOF - -# Make sure our user/group is present prior to any package or subpackage installation -%pre -%sysusers_create_compat %{SOURCE105} - %preun %systemd_preun radiusd.service @@ -903,6 +898,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 +- Drop call to %sysusers_create_compat + * Sat Feb 01 2025 Björn Esser - 3.2.5-6 - Add explicit BR: libxcrypt-devel From cc31b38a9e8adef8918a4e6e366e6a54b8e42ccc Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 5 Mar 2025 10:55:22 +0100 Subject: [PATCH 118/126] Update to upstream release 3.2.7 Signed-off-by: Antonio Torres --- .gitignore | 1 + ...t-configuration-to-fit-Red-Hat-specifics.patch | 13 ++++++++----- freeradius-no-buildtime-cert-gen.patch | 15 +++++++++------ freeradius.spec | 10 ++++++++-- sources | 2 +- 5 files changed, 27 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 8b82526..1e3b99a 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ freeradius-*.src.rpm /freeradius-server-3.2.3.tar.bz2 /freeradius-server-3.2.4.tar.bz2 /freeradius-server-3.2.5.tar.bz2 +/freeradius-server-3.2.7.tar.bz2 diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index 6b2329b..33747d0 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -3,25 +3,27 @@ From: Nikolai Kondrashov Date: Mon, 8 Sep 2014 12:32:13 +0300 Subject: [PATCH] Adjust configuration to fit Red Hat specifics +[antorres@redhat.com]: update patch to match 3.2.7 release + --- raddb/mods-available/eap | 4 ++-- raddb/radiusd.conf.in | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 2621e183c..94494b2c6 100644 +index 84660d7c1e..ffcef4b406 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -533,7 +533,7 @@ - # You should also delete all of the files - # in the directory when the server starts. +@@ -696,7 +696,7 @@ eap { + # and create the temporary directory with the + # systemd `RuntimeDirectory` unit option. # - # tmpdir = /tmp/radiusd + # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -548,7 +548,7 @@ +@@ -711,7 +711,7 @@ eap { # deleted by the server when the command # returns. # @@ -30,6 +32,7 @@ index 2621e183c..94494b2c6 100644 } # OCSP Configuration + diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index b435d82..6846827 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -3,6 +3,8 @@ From: Alexander Scheel Date: Wed, 8 May 2019 12:58:02 -0400 Subject: [PATCH] Don't generate certificates in reproducible builds +[antorres@redhat.com]: updated to match upstream release 3.2.7 + Signed-off-by: Alexander Scheel --- Make.inc.in | 5 +++++ @@ -27,18 +29,18 @@ index 0b2cd74de8..8c623cf95c 100644 # # For creating documentation via doc/all.mk diff --git a/configure b/configure -index 5041ca264f..ed01ee2bdd 100755 +index f1dfa97c44..ba5c53768d 100755 --- a/configure +++ b/configure -@@ -679,6 +679,7 @@ AUTOCONF - ACLOCAL +@@ -681,6 +681,7 @@ ACLOCAL + LAST RUSERS SNMPWALK +ENABLE_REPRODUCIBLE_BUILDS SNMPGET openssl_version_check_config - WITH_DHCP -@@ -6976,6 +6977,7 @@ fi + WITH_RADLAST +@@ -7001,6 +7002,7 @@ fi # Check whether --enable-reproducible-builds was given. @@ -46,7 +48,7 @@ index 5041ca264f..ed01ee2bdd 100755 if test ${enable_reproducible_builds+y} then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -6987,6 +6989,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -54,6 +56,7 @@ index 5041ca264f..ed01ee2bdd 100755 esac fi + diff --git a/configure.ac b/configure.ac index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac diff --git a/freeradius.spec b/freeradius.spec index cf2e24b..04cbe1b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.5 -Release: 7%{?dist} +Version: 3.2.7 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -541,6 +541,7 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx @@ -575,6 +576,7 @@ EOF %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 +%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit # policy %dir %attr(750,root,radiusd) /etc/raddb/policy.d @@ -668,6 +670,7 @@ EOF %{_libdir}/freeradius/rlm_yubikey.so %{_libdir}/freeradius/rlm_dpsk.so %{_libdir}/freeradius/rlm_eap_teap.so +%{_libdir}/freeradius/rlm_proxy_rate_limit.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -898,6 +901,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Mar 5 2025 Antonio Torres - 3.2.7-1 +- Update to upstream release 3.2.7 + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 - Drop call to %sysusers_create_compat diff --git a/sources b/sources index 4768856..38a1c91 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.5.tar.bz2) = 55e653630674a957dcd52ae58e5fd7b5a510b84aaa80e0552bce8089221e02f652618b53753f438981472a5f47df7c8426b9a5ecda0b06ad9f4c25b23604c86b +SHA512 (freeradius-server-3.2.7.tar.bz2) = c4a13471844ab4ce041db1567e2827370433725beadfbf425d2522b0bf9a4def8ebd41d3c4f45ad350dacdf86bc5bf3952d519d84672c7dde25a12005a009ae5 From 017f82cf9096d8f05e65ee9a3de052053bbd1f8d Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 5 Mar 2025 12:47:16 +0100 Subject: [PATCH 119/126] Skip building rlm_sqlippool_tool helper script This script relies on a Perl package that is no longer available. Skip building it and let the users clone it manually instead, as it's only a helper script for SQL modules users. Signed-off-by: Antonio Torres --- freeradius-no-sqlippool-tool.patch | 28 ++++++++++++++++++++++++++++ freeradius.spec | 4 +++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 freeradius-no-sqlippool-tool.patch diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch new file mode 100644 index 0000000..58d3282 --- /dev/null +++ b/freeradius-no-sqlippool-tool.patch @@ -0,0 +1,28 @@ +From: Antonio Torres +Date: Wed, 5 Mar 2025 +Subject: Remove sqlippool tool + +This script relies on a Perl package, perl-Net-IP, that won't be available. +Remove it from build script and let the user pull it manually instead, as it's +just a helper script for SQL module users. + +--- +diff --git a/scripts/all.mk b/scripts/all.mk +index a6e90aa3eb..517adb8590 100644 +--- a/scripts/all.mk ++++ b/scripts/all.mk +@@ -1,5 +1,5 @@ + install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \ +- $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool ++ $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt + + $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd + @mkdir -p $(dir $@) +@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay + $(R)$(bindir)/radcrypt: scripts/cryptpasswd + @mkdir -p $(dir $@) + @$(INSTALL) -m 755 $< $@ +- +-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool +- @mkdir -p $(dir $@) +- @$(INSTALL) -m 755 $< $@ diff --git a/freeradius.spec b/freeradius.spec index 04cbe1b..305a171 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.7 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -30,6 +30,7 @@ Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch Patch7: freeradius-ease-openssl-version-check.patch Patch8: freeradius-configure-c99.patch Patch9: freeradius-openssl-no-engine.patch +Patch10: freeradius-no-sqlippool-tool.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -216,6 +217,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch -P7 -p1 %patch -P8 -p1 %patch -P9 -p1 +%patch -P10 -p1 %build # Force compile/link options, extra security for network facing daemon From d2672b8eeeae945377a5de60a0387871e17f8ddc Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 20:20:01 +0200 Subject: [PATCH 120/126] Rebuilt for Python 3.14 --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 305a171..ff157b6 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.7 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -903,6 +903,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Mon Jun 02 2025 Python Maint - 3.2.7-3 +- Rebuilt for Python 3.14 + * Wed Mar 5 2025 Antonio Torres - 3.2.7-1 - Update to upstream release 3.2.7 From 7629f49dacdf122486ae365b6f26d4658bb9c0fd Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 11 Jun 2025 10:02:40 +0200 Subject: [PATCH 121/126] Update logrotate script with try-reload-or-restart systemd has renamed reload-or-try-restart to try-reload-or-restart. The former is still accepted, but may be removed in the future. Resolves: rhbz#2371329 Signed-off-by: Antonio Torres --- freeradius-logrotate | 2 +- freeradius.spec | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/freeradius-logrotate b/freeradius-logrotate index c962254..1a2ec6f 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -34,7 +34,7 @@ compress su radiusd radiusd postrotate - /usr/bin/systemctl reload-or-try-restart radiusd + /usr/bin/systemctl try-reload-or-restart radiusd endscript } diff --git a/freeradius.spec b/freeradius.spec index ff157b6..c2efab3 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.7 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -903,6 +903,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jun 11 2025 Antonio Torres - 3.2.7-4 +- Update logrotate postrotate script with `systemctl try-reload-or-restart` + Resolves: rhbz#2371329 + * Mon Jun 02 2025 Python Maint - 3.2.7-3 - Rebuilt for Python 3.14 From 62f35fae1411fc1285c7b554108ae0ba5052acd7 Mon Sep 17 00:00:00 2001 From: Bruno Vernay Date: Mon, 16 Jun 2025 07:04:30 +0000 Subject: [PATCH 122/126] Fix chown syntax MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Quoting the man page: "The BSD syntax user[.group] was changed to user[:group] in this volume of POSIX.1‐2017 because the is a valid character in login names (as specified by the Base Definitions volume of POSIX.1‐2017, login names consist of characters in the portable filename character set)." --- radiusd.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radiusd.service b/radiusd.service index f545280..9bfa3cd 100644 --- a/radiusd.service +++ b/radiusd.service @@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv [Service] Type=forking PIDFile=/var/run/radiusd/radiusd.pid -ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C From 7b23cc2e89448478a738fffd043bb017b13269ad Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 8 Jul 2025 14:25:54 +0200 Subject: [PATCH 123/126] Perl 5.42 rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index c2efab3..1459c44 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.7 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -903,6 +903,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 +- Perl 5.42 rebuild + * Wed Jun 11 2025 Antonio Torres - 3.2.7-4 - Update logrotate postrotate script with `systemctl try-reload-or-restart` Resolves: rhbz#2371329 From 94437a86b09e0f7535344f88949168b3e042c775 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 23 Jul 2025 20:47:53 +0000 Subject: [PATCH 124/126] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- freeradius.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 1459c44..7629663 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.7 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -903,6 +903,9 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 - Perl 5.42 rebuild From dda92203906463ccaa1074755a5ba8a1577af2b4 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Mon, 10 Nov 2025 10:04:31 +0100 Subject: [PATCH 125/126] Update to 3.2.8 Signed-off-by: Antonio Torres --- .gitignore | 1 + freeradius.spec | 25 ++++++++++++++++++++++--- sources | 2 +- 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1e3b99a..4530dbe 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,4 @@ freeradius-*.src.rpm /freeradius-server-3.2.4.tar.bz2 /freeradius-server-3.2.5.tar.bz2 /freeradius-server-3.2.7.tar.bz2 +/freeradius-server-3.2.8.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index 7629663..700a7d4 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.2.7 -Release: 6%{?dist} +Version: 3.2.8 +Release: 1%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -14,7 +14,7 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 +Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf @@ -204,6 +204,16 @@ BuildRequires: json-c-devel %description rest This plugin provides the REST support for the FreeRADIUS server project. + +%package kafka +Summary: Kafka producer support for FreeRADIUS +Requires: %{name} = %{version}-%{release} +Requires: librdkafka +BuildRequires: librdkafka-devel + +%description kafka +This plugin provides Kafka producer support for the FreeRADIUS server project. + %prep %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' @@ -902,7 +912,16 @@ EOF %{_libdir}/freeradius/rlm_rest.so %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest +%files kafka +%{_libdir}/freeradius/rlm_kafka.so +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf + %changelog +* Mon Nov 10 2025 Antonio Torres - 3.2.8-1 +- Update to upstream release 3.2.8 + * Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 38a1c91..3fdee90 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.2.7.tar.bz2) = c4a13471844ab4ce041db1567e2827370433725beadfbf425d2522b0bf9a4def8ebd41d3c4f45ad350dacdf86bc5bf3952d519d84672c7dde25a12005a009ae5 +SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae From 43ef939726ac1d34a901b5d0dc672fd358c975e0 Mon Sep 17 00:00:00 2001 From: Antonio Torres Date: Wed, 7 Jan 2026 11:21:33 +0100 Subject: [PATCH 126/126] Enable SELinux flag for JIT usage Resolves: #2427017 Signed-off-by: Antonio Torres --- freeradius.spec | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 700a7d4..7b65a15 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.2.8 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ @@ -371,7 +371,19 @@ EOF %preun %systemd_preun radiusd.service +%post +# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017 +# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96 +if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit on || : +fi + %postun +if [ $1 -eq 0 ]; then + if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit off || : + fi +fi %systemd_postun_with_restart radiusd.service /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : @@ -919,6 +931,10 @@ EOF %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf %changelog +* Mon Jan 05 2026 Antonio Torres - 3.2.8-2 +- Enable selinux flag for JIT usage + Resolves: #2427017 + * Mon Nov 10 2025 Antonio Torres - 3.2.8-1 - Update to upstream release 3.2.8