diff --git a/.gitignore b/.gitignore index 779754b..4530dbe 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,11 @@ +# Ignore build artifacts and signatures +*.sig +.build*.log +freeradius-server-*/ +x86_64/ +freeradius-*.src.rpm + +# Automatically added /freeradius-server-2.1.9.tar.bz2 /freeradius-server-2.1.10.tar.bz2 /freeradius-server-2.1.11.tar.bz2 @@ -20,3 +28,21 @@ /freeradius-server-3.0.13.tar.bz2 /freeradius-server-3.0.14.tar.bz2 /freeradius-server-3.0.15.tar.bz2 +/freeradius-server-3.0.17.tar.bz2 +/freeradius-server-3.0.18.tar.gz +/freeradius-server-3.0.18.tar.bz2 +/freeradius-server-3.0.19.tar.bz2 +/freeradius-server-3.0.20.tar.bz2 +/freeradius-server-3.0.21.tar.bz2 +/freeradius-server-3.0.22.tar.bz2 +/freeradius-server-3.0.23.tar.bz2 +/freeradius-server-3.0.24.tar.bz2 +/freeradius-server-3.0.25.tar.bz2 +/freeradius-server-3.2.0.tar.bz2 +/freeradius-server-3.2.1.tar.bz2 +/freeradius-server-3.2.2.tar.bz2 +/freeradius-server-3.2.3.tar.bz2 +/freeradius-server-3.2.4.tar.bz2 +/freeradius-server-3.2.5.tar.bz2 +/freeradius-server-3.2.7.tar.bz2 +/freeradius-server-3.2.8.tar.bz2 diff --git a/find_module_deps b/find_module_deps deleted file mode 100755 index c114baa..0000000 --- a/find_module_deps +++ /dev/null @@ -1,385 +0,0 @@ -#!/usr/bin/env python - -import exceptions -import getopt -import os -import re -import rpm -import select -import subprocess -import sys - -#------------------------------------------------------------------------------ - -def get_rlms(root): - rlm_re = re.compile(r'^rlm_') - version_re = re.compile(r'-[0-9.]+\.so$') - names = os.listdir(root) - names = [x for x in names if rlm_re.search(x)] - names = [x for x in names if not version_re.search(x)] - names.sort() - return names - -#------------------------------------------------------------------------------ - -debug = False -verbose = False - -exclude_rpms = ['glibc'] - -build = '2.0.2-1.fc8' -root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius' -libdirs = ['/lib','/usr/lib'] - -#------------------------------------------------------------------------------ - -def get_rpm_nvr_from_header(hdr): - 'Given an RPM header return the package NVR as a string' - name = hdr['name'] - version = hdr['version'] - release = hdr['release'] - - return "%s-%s-%s" % (name, version, release) - -def get_rpm_hdr_by_file_path(path): - if path is None: - return None - - hdr = None - try: - ts = rpm.ts() - mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path) - for hdr in mi: break - except Exception, e: - print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e) - hdr = None - return hdr - -def get_rpm_nvr_by_file_path(path): - if path is None: - return None - - hdr = get_rpm_hdr_by_file_path(path) - if not hdr: - print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) - nvr = get_rpm_nvr_from_header(hdr) - return nvr - -def get_rpm_name_by_file_path(path): - if path is None: - return None - - hdr = get_rpm_hdr_by_file_path(path) - if not hdr: - print >> sys.stderr, "failed to retrieve rpm info for %s" %(path) - name = hdr['name'] - return name - -#------------------------------------------------------------------------------ - -class CmdError(exceptions.Exception): - def __init__(self, errno, msg): - self.errno = errno - self.msg = msg - - -class Command: - def __init__(self, cmd): - self.cmd = cmd - self.sub_process = None - self.bufsize = 1024 - self.stdout_buf = '' - self.stderr_buf = '' - self.stdout_lines = [] - self.stderr_lines = [] - - def run(self, stdout_callback=None, stderr_callback=None): - self.sub_process = subprocess.Popen(self.cmd, \ - stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \ - close_fds=True, shell=True) - self.stdout = self.sub_process.stdout - self.stderr = self.sub_process.stderr - - read_watch = [self.stdout, self.stderr] - while read_watch: - readable = select.select(read_watch, [], [])[0] - for fd in readable: - if fd == self.stdout: - data = os.read(fd.fileno(), self.bufsize) - if not data: - read_watch.remove(fd) - else: - self.stdout_buf += data - for line in self.burst_lines('stdout_buf'): - if stdout_callback: stdout_callback(line) - self.stdout_lines.append(line) - if fd == self.stderr: - data = os.read(fd.fileno(), self.bufsize) - if not data: - read_watch.remove(fd) - else: - self.stderr_buf += data - for line in self.burst_lines('stderr_buf'): - if stdout_callback: stderr_callback(line) - self.stderr_lines.append(line) - - self.returncode = self.sub_process.wait() - if self.returncode: - raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines))) - - return self.returncode - - def burst_lines(self, what): - buf = getattr(self, what) - start = 0 - end = buf.find('\n', start) - while end >= 0: - end += 1 # include newline - line = buf[start:end] - yield line - start = end - end = buf.find('\n', start) - buf = buf[start:] - setattr(self, what, buf) - - -#------------------------------------------------------------------------------ - -def get_so_requires(path): - requires = {} - cmd = 'ldd %s' % (path) - so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)') - - c = Command(cmd) - status = c.run() - - for line in c.stdout_lines: - line = line.strip() - match = so_re.search(line) - if match: - so_name = match.group(1) - if match.group(2).startswith('/'): - so_path = match.group(2) - else: - so_path = None - - requires[so_name] = so_path - return requires - -def get_so_needed(path): - needed = [] - cmd = 'readelf -d %s' % (path) - so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]') - - c = Command(cmd) - status = c.run() - - for line in c.stdout_lines: - line = line.strip() - match = so_re.search(line) - if match: - so_name = match.group(1) - needed.append(so_name) - return needed - -def format_size(size): - if size > 1000000000: - return '%.1f GB' % (size/1000000000.0) - if size > 1000000: - return '%.1f MB' % (size/1000000.0) - if size > 1000: - return '%.1f KB' % (size/1000.0) - return '%d' % (size) -#------------------------------------------------------------------------------ - -class RPM_Prop: - def __init__(self, path=None, name=None): - self.name = name - self.paths = {} - self.rpm_hdr = None - self.used_by = {} - if path: - self.register_path(path) - if not self.rpm_hdr: - self.rpm_hdr = get_rpm_hdr_by_file_path(path) - if self.rpm_hdr: - if not self.name: - self.name = self.rpm_hdr[rpm.RPMTAG_NAME] - self.size = self.rpm_hdr[rpm.RPMTAG_SIZE] - - def __str__(self): - return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys())) - - def register_path(self, path, name=None): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - return self.paths.setdefault(path, path) - -class RPM_Collection: - def __init__(self): - self.names = {} - self.paths = {} - - def __str__(self): - text = '' - names = self.get_names() - for name in names: - text += "%s: %s\n" % (name, self.names[name]) - return text - - def register_path(self, path): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - rpm_prop = self.paths.get(path) - if not rpm_prop: - rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path)) - self.names.setdefault(rpm_prop.name, rpm_prop) - return rpm_prop - - def get_names(self): - names = self.names.keys() - names.sort() - return names - - def get_name(self, name): - return self.names.get(name) - -class SO_File: - def __init__(self, name=None, path=None): - self.name = name - self.path = path - self.rpm = None - - def __str__(self): - if self.rpm: - rpm_name = self.rpm.name - else: - rpm_name = None - return "name=%s rpm=%s" % (self.name, rpm_name) - -class SO_Collection: - def __init__(self): - self.names = {} - self.paths = {} - - def __str__(self): - text = '' - names = self.get_names() - for name in names: - text += "%s: %s\n" % (name, self.names[name]) - return text - - def register_path(self, path, name=None): - if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path) - so_prop = self.paths.get(path) - if not so_prop: - so_prop = self.paths.setdefault(path, SO_File(name, path=path)) - self.names.setdefault(name, so_prop) - return so_prop - - def get_names(self): - names = self.names.keys() - names.sort() - return names - -class LoadableModule: - def __init__(self, path, name=None): - if name is None: - name = os.path.basename(path) - self.name = name - self.path = path - self.rpm_names = {} - self.sos = SO_Collection() - self.get_so_requires() - - def __str__(self): - text = '%s\n' % (self.name) - text += " RPM's: %s\n" % (','.join(self.get_rpm_names())) - text += " SO's: %s\n" % (','.join(self.sos.get_names())) - return text - - def get_so_requires(self): - requires = get_so_requires(self.path) - needed = get_so_needed(self.path) - #print "%s requires=%s" % (self.name, requires) - #print "%s needed=%s" % (self.name, needed) - - for so_name, so_path in requires.items(): - if so_name not in needed: continue - if so_path: - so_prop = self.sos.register_path(so_path, so_name) - rpm_prop = rpms.register_path(so_prop.path) - rpm_prop.used_by[self.name] = 1 - self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name) - so_prop.rpm = rpm_prop - else: - so_prop = None - if verbose: print "found so='%s' %s" % (so_name, so_prop) - - def register_so(self, so): - if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so) - self.sos.setdefault(so, so) - self.names.setdefault(so.name, so) - return so - - def get_rpm_names(self): - rpm_names = self.rpm_names.keys() - rpm_names.sort() - return rpm_names - - def get_sos(self): - sos = self.sos.keys() - sos.sort(lambda a,b: cmp(a.name, b.name)) - return sos - -#------------------------------------------------------------------------------ - -#------------------------------------------------------------------------------ - -opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose']) -for o, a in opts: - if o in ['-b', '--build']: - build = a - elif o in ['-v', '--verbose']: - verbose = True - else: - print >> sys.stderr, "Unknown arg: %s" % o - sys.exit(1) - -root = root_template % build -modules = get_rlms(root) -module_paths = [os.path.join(root,x) for x in modules] -rpms = RPM_Collection() - -lms = [] -for module_path in module_paths[:]: - lm = LoadableModule(module_path) - lms.append(lm) - - -print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules)) - -for lm in lms: - rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms] - if rpm_names: - print lm.name - print ' %s' % (','.join(rpm_names)) - -print "--------------" - -rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms] -rpm_props.sort(lambda a,b: cmp(a.name, b.name)) -for rpm_prop in rpm_props: - used_by = rpm_prop.used_by.keys() - used_by.sort() - print "%s: %s" % (rpm_prop.name, ','.join(used_by)) - -print "--------------" - -rpm_props.sort(lambda a,b: cmp(a.size, b.size)) -for rpm_prop in rpm_props: - print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name) - - -print "--------------" - -for lm in lms: - print lm diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index ad51053..33747d0 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -3,33 +3,36 @@ From: Nikolai Kondrashov Date: Mon, 8 Sep 2014 12:32:13 +0300 Subject: [PATCH] Adjust configuration to fit Red Hat specifics +[antorres@redhat.com]: update patch to match 3.2.7 release + --- raddb/mods-available/eap | 4 ++-- raddb/radiusd.conf.in | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 2621e183c..94494b2c6 100644 +index 84660d7c1e..ffcef4b406 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -472,7 +472,7 @@ eap { +@@ -696,7 +696,7 @@ eap { + # and create the temporary directory with the + # systemd `RuntimeDirectory` unit option. # - # You should also delete all of the files - # in the directory when the server starts. -- # tmpdir = /tmp/radiusd -+ # tmpdir = /var/run/radiusd/tmp +- # tmpdir = /tmp/radiusd ++ # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -486,7 +486,7 @@ eap { - # in PEM format. This file is automatically +@@ -711,7 +711,7 @@ eap { # deleted by the server when the command # returns. -- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" -+ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" + # +- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" ++ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } - # + # OCSP Configuration + diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 1664186..74f3cfd 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -1,33 +1,44 @@ -From d78bf5ab1f5c8102b2b6051cfb1198488be9597d Mon Sep 17 00:00:00 2001 -From: Nikolai Kondrashov -Date: Mon, 26 Sep 2016 19:48:36 +0300 -Subject: [PATCH] Use system crypto policy by default +From a7ed62fbcc043a9ec7a4f09962a2cd2acffa019b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:16:31 -0400 +Subject: [PATCH] Use system-provided crypto-policies by default +Signed-off-by: Alexander Scheel +[antorres@redhat.com]: update patch to 3.2.1 state --- - raddb/mods-available/eap | 2 +- + raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- raddb/sites-available/abfab-tls | 2 +- raddb/sites-available/tls | 4 ++-- - 4 files changed, 5 insertions(+), 5 deletions(-) + 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 94494b2c6..9a8dc9327 100644 +index 62152a6dfc..9f64963034 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -323,7 +323,7 @@ eap { - # - # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" +@@ -400,7 +400,7 @@ eap { + # TLS cipher suites. The format is listed + # in "man 1 ciphers". # - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - # If enabled, OpenSSL will use server cipher list - # (possibly defined by cipher_list option above) + # Set this option to specify the allowed + # TLS signature algorithms for OpenSSL 1.1.1 and above. +@@ -1082,7 +1082,7 @@ eap { + # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is + # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used + # +- # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" ++ # cipher_list = "PROFILE=SYSTEM" + + # PAC lifetime in seconds (default: seven days) + # diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap -index 2b4df6267..af9aa88cd 100644 +index 576eb7739e..ffa07188e2 100644 --- a/raddb/mods-available/inner-eap +++ b/raddb/mods-available/inner-eap -@@ -68,7 +68,7 @@ eap inner-eap { +@@ -77,7 +77,7 @@ eap inner-eap { # certificates. If so, edit this file. ca_file = ${cadir}/ca.pem @@ -37,23 +48,23 @@ index 2b4df6267..af9aa88cd 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index 5dbe143da..46b5fea78 100644 +index b8d0626bbe..073b2933c2 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls -@@ -19,7 +19,7 @@ listen { +@@ -20,7 +20,7 @@ listen { dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - cache { enable = no + lifetime = 24 # hours diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index cf1cd7a8a..7dd59cb6f 100644 +index 137fcbc6cc..a65f8a8711 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -197,7 +197,7 @@ listen { +@@ -292,7 +292,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -62,15 +73,15 @@ index cf1cd7a8a..7dd59cb6f 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -499,7 +499,7 @@ home_server tls { +@@ -676,7 +676,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - } - } + # + # Connection timeout for outgoing TLS connections. -- -2.13.2 +2.21.0 diff --git a/freeradius-autogen.sh b/freeradius-autogen.sh deleted file mode 100755 index 9cba642..0000000 --- a/freeradius-autogen.sh +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh -e - -parentdir=`dirname $0` - -cd $parentdir -parentdir=`pwd` - -libtoolize -f -c -#aclocal -autoheader -autoconf - -mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`" -mysubdirs=`echo $mysubdirs` - -for F in $mysubdirs -do - echo "Configuring in $F..." - (cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir) - (cd $F && autoconf -I$parentdir) -done diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch new file mode 100644 index 0000000..17cab04 --- /dev/null +++ b/freeradius-bootstrap-create-only.patch @@ -0,0 +1,89 @@ +From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 13 May 2020 10:01:47 -0400 +Subject: [PATCH] Don't clobber existing files on bootstrap + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index ede09bc..e555491 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -20,56 +20,55 @@ cd `dirname $0` + # Don't edit the following text. Instead, edit the Makefile, and + # re-generate these commands. + # +-if [ ! -f dh ]; then ++if [ ! -e dh ]; then + openssl dhparam -out dh 2048 || exit 1 +- if [ -e /dev/urandom ] ; then +- ln -sf /dev/urandom random +- else +- date > ./random; +- fi ++ ln -sf /dev/urandom random + fi + +-if [ ! -f server.key ]; then ++if [ ! -e server.key ]; then + openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + chmod g+r server.key + fi + +-if [ ! -f ca.key ]; then ++if [ ! -e ca.key ]; then + openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 + fi + +-if [ ! -f index.txt ]; then ++if [ ! -e index.txt ]; then + touch index.txt + fi + +-if [ ! -f serial ]; then ++if [ ! -e serial ]; then + echo '01' > serial + fi + +-if [ ! -f server.crt ]; then ++if [ ! -e server.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 + fi + +-if [ ! -f server.p12 ]; then ++if [ ! -e server.p12 ]; then + openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + chmod g+r server.p12 + fi + +-if [ ! -f server.pem ]; then ++if [ ! -e server.pem ]; then + openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + openssl verify -CAfile ca.pem server.pem || exit 1 + chmod g+r server.pem + fi + +-if [ ! -f ca.der ]; then ++if [ ! -e ca.der ]; then + openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 + fi + +-if [ ! -f client.key ]; then ++if [ ! -e client.key ]; then + openssl req -new -out client.csr -keyout client.key -config ./client.cnf + chmod g+r client.key + fi + +-if [ ! -f client.crt ]; then ++if [ ! -e client.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf + fi ++ ++chown root:radiusd dh ca.* client.* server.* ++chmod 640 dh ca.* client.* server.* +-- +2.26.2 + diff --git a/freeradius-bootstrap-make-permissions.patch b/freeradius-bootstrap-make-permissions.patch new file mode 100644 index 0000000..3548fa6 --- /dev/null +++ b/freeradius-bootstrap-make-permissions.patch @@ -0,0 +1,29 @@ +From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 4 Aug 2020 10:08:15 -0400 +Subject: [PATCH] Fix permissions after generating certificates with make + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 336a2bd..9920ecf 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1 + # + if [ "$?" = "0" ]; then + make all +- exit $? ++ ret=$? ++ chown root:radiusd dh ca.* client.* server.* ++ chmod 640 dh ca.* client.* server.* ++ exit $ret + fi + + # +-- +2.26.2 + diff --git a/freeradius-configure-c99.patch b/freeradius-configure-c99.patch new file mode 100644 index 0000000..cc9daff --- /dev/null +++ b/freeradius-configure-c99.patch @@ -0,0 +1,35 @@ +The backtrace_symbols function expects a pointer to an array of void * +values, not a pointer to an array of a single element. Removing the +address operator ensures that the right type is used. + +This avoids an unconditional failure of this probe with compilers that +treat incompatible pointer types as a compilation error. + +Submitted upstream: + +diff --git a/configure b/configure +index ed01ee2bdd912f63..1e6d2284779cdd58 100755 +--- a/configure ++++ b/configure +@@ -13390,7 +13390,7 @@ main (void) + { + + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ++ backtrace_symbols(sym, sizeof(sym)) + ; + return 0; + } +diff --git a/configure.ac b/configure.ac +index 76320213b51d7bb4..6a689711d6c90483 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then + #include + ]], [[ + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ]])],[ ++ backtrace_symbols(sym, sizeof(sym)) ]])],[ + AC_MSG_RESULT(yes) + ac_cv_lib_execinfo_backtrace_symbols="yes" + ],[ diff --git a/freeradius-ease-openssl-version-check.patch b/freeradius-ease-openssl-version-check.patch new file mode 100644 index 0000000..23f1df7 --- /dev/null +++ b/freeradius-ease-openssl-version-check.patch @@ -0,0 +1,35 @@ +From: Antonio Torres +Date: Tue, 12 Sep 2023 +Subject: Ease OpenSSL version check requirement + +FreeRADIUS includes an OpenSSL version check that compares built vs linked version, +and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as +ABI changes are tracked and soname is changed accordingly, as discussed in previous +Bugzilla for this issue [1]. + +[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511 +Signed-off-by: Antonio Torres +--- + src/main/version.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/main/version.c b/src/main/version.c +index c190337c1d..fee2150eb2 100644 +--- a/src/main/version.c ++++ b/src/main/version.c +@@ -79,11 +79,11 @@ int ssl_check_consistency(void) + */ + if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) { + mismatch: +- ERROR("libssl version mismatch. built: %lx linked: %lx", ++ DEBUG2("libssl version mismatch. built: %lx linked: %lx", + (unsigned long) ssl_built, + (unsigned long) ssl_linked); + +- return -1; ++ return 0; + } + + /* diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius-logrotate b/freeradius-logrotate index 1c3c5b9..1a2ec6f 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -14,6 +14,7 @@ nocreate missingok compress + su radiusd radiusd } /var/log/radius/checkrad.log { @@ -22,6 +23,7 @@ create missingok compress + su radiusd radiusd } /var/log/radius/radius.log { @@ -30,8 +32,9 @@ create missingok compress + su radiusd radiusd postrotate - /usr/bin/systemctl reload-or-try-restart radiusd + /usr/bin/systemctl try-reload-or-restart radiusd endscript } @@ -41,6 +44,7 @@ create compress missingok + su radiusd radiusd } /var/log/radius/sqltrace.sql { monthly @@ -48,4 +52,5 @@ create compress missingok + su radiusd radiusd } diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch new file mode 100644 index 0000000..6846827 --- /dev/null +++ b/freeradius-no-buildtime-cert-gen.patch @@ -0,0 +1,105 @@ +From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 12:58:02 -0400 +Subject: [PATCH] Don't generate certificates in reproducible builds + +[antorres@redhat.com]: updated to match upstream release 3.2.7 + +Signed-off-by: Alexander Scheel +--- + Make.inc.in | 5 +++++ + configure | 3 +++ + configure.ac | 3 +++ + raddb/all.mk | 4 ++++ + 4 files changed, 15 insertions(+) + +diff --git a/Make.inc.in b/Make.inc.in +index 0b2cd74de8..8c623cf95c 100644 +--- a/Make.inc.in ++++ b/Make.inc.in +@@ -174,6 +174,10 @@ else + TESTBIN = ./$(BUILD_DIR)/bin + endif + ++# ++# With reproducible builds, do not generate certificates during installation ++# ++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ + + # + # For creating documentation via doc/all.mk +diff --git a/configure b/configure +index f1dfa97c44..ba5c53768d 100755 +--- a/configure ++++ b/configure +@@ -681,6 +681,7 @@ ACLOCAL + LAST + RUSERS + SNMPWALK ++ENABLE_REPRODUCIBLE_BUILDS + SNMPGET + openssl_version_check_config + WITH_RADLAST +@@ -7001,6 +7002,7 @@ fi + + + # Check whether --enable-reproducible-builds was given. ++ENABLE_REPRODUCIBLE_BUILDS=yes + if test ${enable_reproducible_builds+y} + then : + enableval=$enable_reproducible_builds; case "$enableval" in +@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac + + fi + +diff --git a/configure.ac b/configure.ac +index ce4d9b0ae5..790cbf02a0 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config]) + dnl # + dnl # extra argument: --enable-reproducible-builds + dnl # ++ENABLE_REPRODUCIBLE_BUILDS=yes + AC_ARG_ENABLE(reproducible-builds, + [AS_HELP_STRING([--enable-reproducible-builds], + [ensure the build does not change each time])], +@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds, + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac ] + ) ++AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) + + dnl # + dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer + + + + dnl ############################################################# +diff --git a/raddb/all.mk b/raddb/all.mk +index c966edd657..c8e976a499 100644 +--- a/raddb/all.mk ++++ b/raddb/all.mk +@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize + ifneq "$(LOCAL_CERT_PRODUCTS)" "" + $(LOCAL_CERT_PRODUCTS): + @echo BOOTSTRAP raddb/certs/ ++ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes" ++ @$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk ++else + @$(MAKE) -C $(R)$(raddbdir)/certs/ ++endif + + # Bootstrap is special + $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS) +-- +2.21.0 + diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch new file mode 100644 index 0000000..58d3282 --- /dev/null +++ b/freeradius-no-sqlippool-tool.patch @@ -0,0 +1,28 @@ +From: Antonio Torres +Date: Wed, 5 Mar 2025 +Subject: Remove sqlippool tool + +This script relies on a Perl package, perl-Net-IP, that won't be available. +Remove it from build script and let the user pull it manually instead, as it's +just a helper script for SQL module users. + +--- +diff --git a/scripts/all.mk b/scripts/all.mk +index a6e90aa3eb..517adb8590 100644 +--- a/scripts/all.mk ++++ b/scripts/all.mk +@@ -1,5 +1,5 @@ + install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \ +- $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool ++ $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt + + $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd + @mkdir -p $(dir $@) +@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay + $(R)$(bindir)/radcrypt: scripts/cryptpasswd + @mkdir -p $(dir $@) + @$(INSTALL) -m 755 $< $@ +- +-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool +- @mkdir -p $(dir $@) +- @$(INSTALL) -m 755 $< $@ diff --git a/freeradius-openssl-no-engine.patch b/freeradius-openssl-no-engine.patch new file mode 100644 index 0000000..b03ae2b --- /dev/null +++ b/freeradius-openssl-no-engine.patch @@ -0,0 +1,54 @@ +diff --git a/configure b/configure +index 1e6d228..40a26f5 100755 +--- a/configure ++++ b/configure +@@ -10518,7 +10518,7 @@ smart_prefix= + printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h + + +- for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h ++ for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h + do : + as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh` + ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" +diff --git a/configure.ac b/configure.ac +index 6a68971..4a95148 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then + openssl/rand.h \ + openssl/sha.h \ + openssl/ssl.h \ +- openssl/ocsp.h \ +- openssl/engine.h, ++ openssl/ocsp.h, + [ OPENSSL_CPPFLAGS="$smart_include" ], + [ + AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL)]) +diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in +index 4774482..21d5cea 100644 +--- a/src/include/autoconf.h.in ++++ b/src/include/autoconf.h.in +@@ -285,9 +285,6 @@ + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_CRYPTO_H + +-/* Define to 1 if you have the header file. */ +-#undef HAVE_OPENSSL_ENGINE_H +- + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_ERR_H + +diff --git a/src/include/tls-h b/src/include/tls-h +index 506fb19..514e03a 100644 +--- a/src/include/tls-h ++++ b/src/include/tls-h +@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$") + # define OPENSSL_NO_KRB5 + #endif + #include +-#ifdef HAVE_OPENSSL_ENGINE_H ++#ifndef OPENSSL_NO_ENGINE + # include + #endif + #include diff --git a/freeradius-radiusd-init b/freeradius-radiusd-init deleted file mode 100644 index 977a51f..0000000 --- a/freeradius-radiusd-init +++ /dev/null @@ -1,113 +0,0 @@ -#!/bin/sh -# -# radiusd Start/Stop the FreeRADIUS daemon -# -# chkconfig: - 88 10 -# description: Extensible, configurable, high performance RADIUS server. - -### BEGIN INIT INFO -# Provides: radiusd -# Required-Start: $network -# Required-Stop: -# Default-Start: -# Default-Stop: -# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc -# Should-Stop: -# Short-Description: FreeRADIUS server -# Description: Extensible, configurable, high performance RADIUS server. -### END INIT INFO - -# Source function library. -. /etc/rc.d/init.d/functions - -prog=radiusd - -[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog - -exec=${exec:=/usr/sbin/$prog} -config_dir=${config_dir:=/etc/raddb} -config=${config:=$config_dir/radiusd.conf} -pidfile=${pidfile:=/var/run/$prog/$prog.pid} -lockfile=${lockfile:=/var/lock/subsys/radiusd} - -start() { - [ -x $exec ] || exit 5 - [ -f $config ] || exit 6 - echo -n $"Starting $prog: " - daemon --pidfile $pidfile $exec -d $config_dir - retval=$? - echo - [ $retval -eq 0 ] && touch $lockfile - return $retval -} - -stop() { - echo -n $"Stopping $prog: " - killproc -p $pidfile $prog - retval=$? - echo - [ $retval -eq 0 ] && rm -f $lockfile - return $retval -} - -restart() { - stop - start -} - -reload() { - # radiusd may not be capable of a 100% configuration reload depending - # on which loadable modules are in use, if sending the server a - # HUP is not sufficient then use restart here instead. However, we - # prefer by default to use HUP since it's what is usually desired. - # - # restart - - kill -HUP `pidofproc -p $pidfile $prog` -} - -force_reload() { - restart -} - -rh_status() { - # run checks to determine if the service is running or use generic status - status -p $pidfile $prog -} - -rh_status_q() { - rh_status >/dev/null 2>&1 -} - - -case "$1" in - start) - rh_status_q && exit 0 - $1 - ;; - stop) - rh_status_q || exit 0 - $1 - ;; - restart) - $1 - ;; - reload) - rh_status_q || exit 7 - $1 - ;; - force-reload) - force_reload - ;; - status) - rh_status - ;; - condrestart|try-restart) - rh_status_q || exit 0 - restart - ;; - *) - echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}" - exit 2 -esac -exit $? diff --git a/freeradius-tmpfiles.conf b/freeradius-tmpfiles.conf index ead7a2f..8f20796 100644 --- a/freeradius-tmpfiles.conf +++ b/freeradius-tmpfiles.conf @@ -1 +1 @@ -D /var/run/radiusd 0710 radiusd radiusd - +D /run/radiusd 0710 radiusd radiusd - diff --git a/freeradius.spec b/freeradius.spec index 0cb9dde..7b65a15 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,9 +1,8 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.15 -Release: 12%{?dist} -License: GPLv2+ and LGPLv2+ -Group: System Environment/Daemons +Version: 3.2.8 +Release: 2%{?dist} +License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ # Is elliptic curve cryptography supported? @@ -15,18 +14,29 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 +Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf Source104: freeradius-tmpfiles.conf +Source105: freeradius.sysusers Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch +Patch4: freeradius-no-buildtime-cert-gen.patch +Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch +Patch7: freeradius-ease-openssl-version-check.patch +Patch8: freeradius-configure-c99.patch +Patch9: freeradius-openssl-no-engine.patch +Patch10: freeradius-no-sqlippool-tool.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} BuildRequires: autoconf +BuildRequires: make +BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl BuildRequires: openssl-devel @@ -38,7 +48,9 @@ BuildRequires: readline-devel BuildRequires: libpcap-devel BuildRequires: systemd-units BuildRequires: libtalloc-devel -BuildRequires: pcre-devel +BuildRequires: chrpath +BuildRequires: systemd-rpm-macros +BuildRequires: libxcrypt-devel %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -48,9 +60,12 @@ BuildRequires: ykclient-devel # Require OpenSSL version we built with, or newer, to avoid startup failures # due to runtime OpenSSL version checks. Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) -Requires(pre): shadow-utils glibc-common +Requires(pre): glibc-common Requires(post): systemd-sysv Requires(post): systemd-units +# Needed for certificate generation as upstream bootstrap script isn't +# compatible with Makefile equivalent. +Requires: make Requires(preun): systemd-units Requires(postun): systemd-units @@ -70,7 +85,6 @@ be centralized, and minimizes the amount of re-configuration which has to be done when adding or deleting new users. %package doc -Group: Documentation Summary: FreeRADIUS documentation %description doc @@ -78,7 +92,6 @@ All documentation supplied by the FreeRADIUS project is included in this package. %package utils -Group: System Environment/Daemons Summary: FreeRADIUS utilities Requires: %{name} = %{version}-%{release} Requires: libpcap >= 0.9.4 @@ -93,7 +106,6 @@ Support for RFC and VSA Attributes Additional server configuration attributes Selecting a particular configuration Authentication methods %package devel -Group: System Environment/Daemons Summary: FreeRADIUS development files Requires: %{name} = %{version}-%{release} @@ -102,7 +114,6 @@ Development headers and libraries for FreeRADIUS. %package ldap Summary: LDAP support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: openldap-devel @@ -111,7 +122,6 @@ This plugin provides the LDAP support for the FreeRADIUS server project. %package krb5 Summary: Kerberos 5 support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: krb5-devel @@ -120,9 +130,7 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} BuildRequires: perl-devel BuildRequires: perl-generators @@ -131,9 +139,9 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. +%if 0%{?fedora} <= 30 && 0%{?rhel} < 8 %package -n python2-freeradius -Summary: Python support for freeradius -Group: System Environment/Daemons +Summary: Python 2 support for freeradius Requires: %{name} = %{version}-%{release} BuildRequires: python2-devel %{?python_provide:%python_provide python2-freeradius} @@ -143,11 +151,20 @@ Provides: %{name}-python%{?_isa} = %{version}-%{release} Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius -This plugin provides the Python support for the FreeRADIUS server project. +This plugin provides the Python 2 support for the FreeRADIUS server project. +%endif + +%package -n python3-freeradius +Summary: Python 3 support for freeradius +Requires: %{name} = %{version}-%{release} +BuildRequires: python3-devel +%{?python_provide:%python_provide python3-freeradius} + +%description -n python3-freeradius +This plugin provides the Python 3 support for the FreeRADIUS server project. %package mysql Summary: MySQL support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: mariadb-connector-c-devel @@ -156,16 +173,14 @@ This plugin provides the MySQL support for the FreeRADIUS server project. %package postgresql Summary: Postgresql support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -BuildRequires: postgresql-devel +BuildRequires: libpq-devel %description postgresql This plugin provides the postgresql support for the FreeRADIUS server project. %package sqlite Summary: SQLite support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: sqlite-devel @@ -174,7 +189,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project. %package unixODBC Summary: Unix ODBC support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: unixODBC-devel @@ -183,7 +197,6 @@ This plugin provides the unixODBC support for the FreeRADIUS server project. %package rest Summary: REST support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: libcurl-devel BuildRequires: json-c-devel @@ -191,20 +204,44 @@ BuildRequires: json-c-devel %description rest This plugin provides the REST support for the FreeRADIUS server project. + +%package kafka +Summary: Kafka producer support for FreeRADIUS +Requires: %{name} = %{version}-%{release} +Requires: librdkafka +BuildRequires: librdkafka-devel + +%description kafka +This plugin provides Kafka producer support for the FreeRADIUS server project. + %prep %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' # mistakenly includes the backup files, especially problematic for raddb config files. -%patch1 -p1 -%patch2 -p1 +%patch -P1 -p1 +%patch -P2 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 %build # Force compile/link options, extra security for network facing daemon %global _hardened_build 1 +%global build_ldflags %{build_ldflags} $(python3-config --embed --libs) +export PY3_LIB_DIR="$(python3-config --configdir)" +export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" + %configure \ --libdir=%{_libdir}/freeradius \ + --enable-reproducible-builds \ --disable-openssl-version-check \ + --with-openssl \ --with-udpfromto \ --with-threads \ --with-docdir=%{docdir} \ @@ -215,6 +252,10 @@ This plugin provides the REST support for the FreeRADIUS server project. --with-unixodbc-lib-dir=%{_libdir} \ --with-rlm-dbm-lib-dir=%{_libdir} \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ + --with-rlm_python3 \ + --with-rlm-python3-lib-dir=$PY3_LIB_DIR \ + --with-rlm-python3-include-dir=$PY3_INC_DIR \ + --without-rlm_python \ --without-rlm_eap_ikev2 \ --without-rlm_eap_tnc \ --without-rlm_sql_iodbc \ @@ -226,7 +267,8 @@ This plugin provides the REST support for the FreeRADIUS server project. --without-rlm_rediswho \ --without-rlm_cache_memcached -make +# Build fast, but get better errors if we fail +make %{?_smp_mflags} || make -j1 %install mkdir -p $RPM_BUILD_ROOT/%{_localstatedir}/lib/radiusd @@ -245,13 +287,24 @@ mkdir -p %{buildroot}%{_localstatedir}/run/ install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/ install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf +install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf # install SNMP MIB files mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ +# remove rpath where needed +chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so +for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done +for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done + +# update ld with freeradius libs +mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d +echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf + # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key @@ -270,6 +323,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle +rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids @@ -288,6 +342,10 @@ rm $RPM_BUILD_ROOT/%{_libdir}/freeradius/rlm_test.so # remove unsupported config files rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/experimental.conf +# Mongo will never be supported on Fedora or RHEL +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/mods-config/sql/ippool/mongo/queries.conf +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/mods-config/sql/main/mongo/queries.conf + # install doc files omitted by standard install for f in COPYRIGHT CREDITS INSTALL.rst README.rst VERSION; do cp $f $RPM_BUILD_ROOT/%{docdir} @@ -310,39 +368,28 @@ All documentation is in the freeradius-doc sub-package. EOF - -# Make sure our user/group is present prior to any package or subpackage installation -%pre -getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1 -getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 -exit 0 - -%post -%systemd_post radiusd.service -if [ $1 -eq 1 ]; then # install - # Initial installation - if [ ! -e /etc/raddb/certs/server.pem ]; then - /sbin/runuser -g radiusd -c 'umask 007; /etc/raddb/certs/bootstrap' > /dev/null 2>&1 - fi -fi -exit 0 - %preun %systemd_preun radiusd.service -%postun -%systemd_postun_with_restart radiusd.service -if [ $1 -eq 0 ]; then # uninstall - getent passwd radiusd >/dev/null && /usr/sbin/userdel radiusd > /dev/null 2>&1 - getent group radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1 +%post +# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017 +# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96 +if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit on || : fi -exit 0 + +%postun +if [ $1 -eq 0 ]; then + if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit off || : + fi +fi +%systemd_postun_with_restart radiusd.service /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : %files -%defattr(-,root,root) # doc %license %{docdir}/LICENSE.gpl @@ -353,8 +400,10 @@ exit 0 # system %config(noreplace) %{_sysconfdir}/pam.d/radiusd %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd +%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %{_unitdir}/radiusd.service %{_tmpfilesdir}/radiusd.conf +%{_sysusersdir}/freeradius.conf %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd @@ -387,7 +436,8 @@ exit 0 %dir %attr(770,root,radiusd) /etc/raddb/certs %config(noreplace) /etc/raddb/certs/Makefile %config(noreplace) /etc/raddb/certs/passwords.mk -/etc/raddb/certs/README +/etc/raddb/certs/README.md +/etc/raddb/certs/realms/README.md %config(noreplace) /etc/raddb/certs/xpextensions %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf %attr(750,root,radiusd) /etc/raddb/certs/bootstrap @@ -401,6 +451,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter @@ -412,11 +463,14 @@ exit 0 # sites-available %dir %attr(750,root,radiusd) /etc/raddb/sites-available /etc/raddb/sites-available/README +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/coa +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/coa-relay %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/example %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/inner-tunnel %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/dhcp @@ -432,8 +486,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache # sites-enabled # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx @@ -447,7 +504,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui @@ -456,6 +513,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients @@ -469,6 +529,8 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip @@ -476,12 +538,12 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/python +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/python3 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/radutmp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/realm %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/redis @@ -492,26 +554,28 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled %config(missingok) /etc/raddb/mods-enabled/always %config(missingok) /etc/raddb/mods-enabled/attr_filter -%config(missingok) /etc/raddb/mods-enabled/cache_eap %config(missingok) /etc/raddb/mods-enabled/chap %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail %config(missingok) /etc/raddb/mods-enabled/detail.log -%config(missingok) /etc/raddb/mods-enabled/dhcp %config(missingok) /etc/raddb/mods-enabled/digest %config(missingok) /etc/raddb/mods-enabled/dynamic_clients %config(missingok) /etc/raddb/mods-enabled/eap @@ -532,9 +596,11 @@ exit 0 %config(missingok) /etc/raddb/mods-enabled/replicate %config(missingok) /etc/raddb/mods-enabled/soh %config(missingok) /etc/raddb/mods-enabled/sradutmp +%config(missingok) /etc/raddb/mods-enabled/totp %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 +%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit # policy %dir %attr(750,root,radiusd) /etc/raddb/policy.d @@ -547,14 +613,15 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/operator-name +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/rfc7542 # binaries %defattr(-,root,root) -/usr/sbin/checkrad -/usr/sbin/raddebug -/usr/sbin/radiusd -/usr/sbin/radmin +%{_bindir}/checkrad +%{_bindir}/raddebug +%{_bindir}/radiusd +%{_bindir}/radmin # dictionaries %dir %attr(755,root,root) /usr/share/freeradius @@ -579,7 +646,6 @@ exit 0 %{_libdir}/freeradius/rlm_cache_rbtree.so %{_libdir}/freeradius/rlm_chap.so %{_libdir}/freeradius/rlm_counter.so -%{_libdir}/freeradius/rlm_cram.so %{_libdir}/freeradius/rlm_date.so %{_libdir}/freeradius/rlm_detail.so %{_libdir}/freeradius/rlm_dhcp.so @@ -588,7 +654,6 @@ exit 0 %{_libdir}/freeradius/rlm_eap.so %{_libdir}/freeradius/rlm_eap_fast.so %{_libdir}/freeradius/rlm_eap_gtc.so -%{_libdir}/freeradius/rlm_eap_leap.so %{_libdir}/freeradius/rlm_eap_md5.so %{_libdir}/freeradius/rlm_eap_mschapv2.so %{_libdir}/freeradius/rlm_eap_peap.so @@ -603,10 +668,10 @@ exit 0 %{_libdir}/freeradius/rlm_expr.so %{_libdir}/freeradius/rlm_files.so %{_libdir}/freeradius/rlm_ippool.so +%{_libdir}/freeradius/rlm_json.so %{_libdir}/freeradius/rlm_linelog.so %{_libdir}/freeradius/rlm_logintime.so %{_libdir}/freeradius/rlm_mschap.so -%{_libdir}/freeradius/rlm_otp.so %{_libdir}/freeradius/rlm_pam.so %{_libdir}/freeradius/rlm_pap.so %{_libdir}/freeradius/rlm_passwd.so @@ -619,12 +684,17 @@ exit 0 %{_libdir}/freeradius/rlm_sql.so %{_libdir}/freeradius/rlm_sqlcounter.so %{_libdir}/freeradius/rlm_sqlippool.so +%{_libdir}/freeradius/rlm_sql_map.so %{_libdir}/freeradius/rlm_sql_null.so +%{_libdir}/freeradius/rlm_totp.so %{_libdir}/freeradius/rlm_unix.so %{_libdir}/freeradius/rlm_unpack.so %{_libdir}/freeradius/rlm_utf8.so %{_libdir}/freeradius/rlm_wimax.so %{_libdir}/freeradius/rlm_yubikey.so +%{_libdir}/freeradius/rlm_dpsk.so +%{_libdir}/freeradius/rlm_eap_teap.so +%{_libdir}/freeradius/rlm_proxy_rate_limit.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -645,6 +715,7 @@ exit 0 %doc %{_mandir}/man5/rlm_passwd.5.gz %doc %{_mandir}/man5/rlm_realm.5.gz %doc %{_mandir}/man5/rlm_sql.5.gz +%doc %{_mandir}/man5/rlm_unbound.5.gz %doc %{_mandir}/man5/rlm_unix.5.gz %doc %{_mandir}/man5/unlang.5.gz %doc %{_mandir}/man5/users.5.gz @@ -652,6 +723,7 @@ exit 0 %doc %{_mandir}/man8/radiusd.8.gz %doc %{_mandir}/man8/radmin.8.gz %doc %{_mandir}/man8/radrelay.8.gz +%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz # MIB files %{_datadir}/snmp/mibs/*RADIUS*.mib @@ -695,16 +767,25 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so +%if 0%{?fedora} <= 30 && 0%{?rhel} < 8 %files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* /etc/raddb/mods-config/python/radiusd.py* %{_libdir}/freeradius/rlm_python.so +%endif + +%files -n python3-freeradius +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/python3 +/etc/raddb/mods-config/python3/example.py* +/etc/raddb/mods-config/python3/radiusd.py* +%{_libdir}/freeradius/rlm_python3.so %files mysql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf @@ -712,18 +793,55 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql + %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax @@ -741,6 +859,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf @@ -751,14 +870,15 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/procedure.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/update_radacct_group.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql @@ -768,6 +888,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf @@ -786,6 +907,9 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -800,7 +924,311 @@ exit 0 %{_libdir}/freeradius/rlm_rest.so %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest +%files kafka +%{_libdir}/freeradius/rlm_kafka.so +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf + %changelog +* Mon Jan 05 2026 Antonio Torres - 3.2.8-2 +- Enable selinux flag for JIT usage + Resolves: #2427017 + +* Mon Nov 10 2025 Antonio Torres - 3.2.8-1 +- Update to upstream release 3.2.8 + +* Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 +- Perl 5.42 rebuild + +* Wed Jun 11 2025 Antonio Torres - 3.2.7-4 +- Update logrotate postrotate script with `systemctl try-reload-or-restart` + Resolves: rhbz#2371329 + +* Mon Jun 02 2025 Python Maint - 3.2.7-3 +- Rebuilt for Python 3.14 + +* Wed Mar 5 2025 Antonio Torres - 3.2.7-1 +- Update to upstream release 3.2.7 + +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 +- Drop call to %sysusers_create_compat + +* Sat Feb 01 2025 Björn Esser - 3.2.5-6 +- Add explicit BR: libxcrypt-devel + +* Thu Jan 23 2025 Antonio Torres - 3.2.5-5 +- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin + +* Thu Jan 16 2025 Fedora Release Engineering - 3.2.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Nov 06 2024 Yaakov Selkowitz - 3.2.5-3 +- Drop openssl-devel-engine dependency + +* Wed Jul 17 2024 Fedora Release Engineering - 3.2.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jul 09 2024 Antonio Torres - 3.2.5-1 +- Update to upstream release 3.2.5 + +* Wed Jun 12 2024 Jitka Plesnikova - 3.2.4-3 +- Perl 5.40 rebuild + +* Fri Jun 07 2024 Python Maint - 3.2.4-2 +- Rebuilt for Python 3.13 + +* Fri May 31 2024 Antonio Torres - 3.2.4-1 +- Update to upstream release 3.2.4 + +* Wed Jan 24 2024 Fedora Release Engineering - 3.2.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jan 19 2024 Fedora Release Engineering - 3.2.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Dec 19 2023 Florian Weimer - 3.2.3-2 +- Fix C compatibility issue in configure script + +* Tue Oct 24 2023 Antonio Torres - 3.2.3-1 +- Update to upstream release 3.2.3 + +* Tue Sep 12 2023 Antonio Torres - 3.2.2-5 +- Ease OpenSSL version check requirement + Resolves #2238511 + +* Wed Jul 19 2023 Fedora Release Engineering - 3.2.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 3.2.2-3 +- Perl 5.38 rebuild + +* Tue Jun 13 2023 Python Maint - 3.2.2-2 +- Rebuilt for Python 3.12 + +* Tue Mar 21 2023 Antonio Torres - 3.2.2-1 +- Update to upstream release 3.2.2 + +* Wed Mar 15 2023 Antonio Torres - 3.2.1-4 +- Migrate to SPDX license + +* Thu Jan 19 2023 Fedora Release Engineering - 3.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Oct 17 2022 Antonio Torres - 3.2.1-2 +- Remove hack for Python3 support from specfile + +* Mon Oct 17 2022 Antonio Torres - 3.2.1-1 +- Update to 3.2.1 upstream release + Resolves #2131850 + +* Tue Sep 20 2022 Antonio Torres - 3.2.0-4 +- Remove deprecated pcre-devel dependency + Resolves #2128292 + +* Mon Sep 5 2022 Antonio Torres - 3.2.0-3 +- configure: allow building with runstatedir option + Resolves: #2123374 + +* Thu Jul 21 2022 Fedora Release Engineering - 3.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Jul 19 2022 Antonio Torres - 3.2.0-1 +- Rebase to 3.2.0 upstream release + Related: #2077687 + +* Wed Jun 29 2022 Antonio Torres - 3.0.25-8 +- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107) + Related: #2095741 + +* Fri Jun 24 2022 Antonio Torres - 3.0.25-7 +- Dynamically allocate users using sysusers.d format + Related: #2095741 + +* Mon Jun 13 2022 Python Maint - 3.0.25-6 +- Rebuilt for Python 3.11 + +* Tue May 31 2022 Jitka Plesnikova - 3.0.25-5 +- Perl 5.36 rebuild + +* Fri Apr 22 2022 Antonio Torres - 3.0.25-4 +- Use infinite timeout when using LDAP+start-TLS + Related: #1983063 + +* Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Oct 14 2021 Antonio Torres - 3.0.25-2 +- Fix file conflict in SQL files + Resolves: bz#2014014 + +* Fri Oct 08 2021 Antonio Torres - 3.0.25-1 +- Update to 3.0.25. + Resolves: bz#2011984 + +* Thu Sep 30 2021 Antonio Torres - 3.0.24-1 +- Update to 3.0.24. + Resolves: bz#2009036 + +* Tue Sep 14 2021 Sahana Prasad - 3.0.23-7 +- Rebuilt with OpenSSL 3.0.0 + +* Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Jul 15 2021 Antonio Torres - 3.0.23-5 +- Fix coredump not being able to be enabled + +* Sat Jul 10 2021 Björn Esser - 3.0.23-4 +- Rebuild for versioned symbols in json-c + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Fix rpath not being removed correctly + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Remove RPATH usage from additional binaries + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-1 +- Rebase to 3.0.23 + Fixes: bz#1970528 + +* Tue Jun 29 2021 Antonio Torres - 3.0.22-5 +- Fix binaries not being correctly linked after RPATH removal + +* Fri Jun 25 2021 Antonio Torres - 3.0.22-4 +- Fix python3 not being correctly linked + +* Mon Jun 07 2021 Python Maint - 3.0.22-2 +- Rebuilt for Python 3.10 + +* Fri Jun 4 2021 Antonio Torres - 3.0.22-1 +- Rebased to 3.0.22 + Resolves: bz#1961190 + +* Fri May 21 2021 Jitka Plesnikova - 3.0.21-12 +- Perl 5.34 rebuild + +* Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 +- Disable automatic bootstrap + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 3.0.21-10 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Mon Feb 08 2021 Pavel Raiskup - 3.0.21-9 +- rebuild for libpq ABI fix rhbz#1908268 + +* Tue Jan 26 2021 Fedora Release Engineering - 3.0.21-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Tue Aug 04 2020 Alexander Scheel - 3.0.21-7 +- Fix certificate permissions after make-based generation + Resolves: bz#1835249 + +* Tue Aug 04 2020 Alexander Scheel - 3.0.21-6 +- Fix certificate permissions after make-based generation + Resolves: bz#1835249 + +* Mon Jul 27 2020 Fedora Release Engineering - 3.0.21-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jun 23 2020 Jitka Plesnikova - 3.0.21-4 +- Perl 5.32 rebuild + +* Wed May 13 2020 Alexander Scheel - 3.0.21-3 +- Fix certificate generation + Resolves: bz#1835249 + +* Tue Apr 21 2020 Björn Esser - 3.0.21-2 +- Rebuild (json-c) + +* Wed Apr 01 2020 Alexander Scheel - 3.0.21-1 +- Rebased to 3.0.21 + Resolves: bz#1816745 + +* Tue Jan 28 2020 Fedora Release Engineering - 3.0.20-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Sat Jan 11 2020 Paul Wouters - 3.0.20-2 +- fixup tmpfile to use /run instead of /var/run + +* Fri Nov 15 2019 Alexander Scheel - 3.0.20-1 +- Rebased to 3.0.20 + Resolves: bz#1772710 +- Introduced new rlm_python3 module + +* Thu Jul 25 2019 Fedora Release Engineering - 3.0.19-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Fri May 31 2019 Jitka Plesnikova - 3.0.19-4 +- Perl 5.30 rebuild + +* Wed May 08 2019 Alexander Scheel - 3.0.19-3 +- Update boostrap to change ownership of all certificates to root:radiusd + +* Wed May 08 2019 Alexander Scheel - 3.0.19-2 +- Updated crypto-policies patch +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284 +- Updated logrotate definitions to run as radiusd:radiusd: bz#1705343 +- Drop python2 package on Fedora 31+ +- Add database dependencies: bz#1658697 +- Don't generate certificate during build + +* Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 +- Rebased to 3.0.19 + +* Wed Mar 06 2019 Alexander Scheel - 3.0.18-1 +- Rebased to 3.0.18 + +* Sun Feb 17 2019 Igor Gnatenko - 3.0.17-6 +- Rebuild for readline 8.0 + +* Tue Feb 05 2019 Alexander Scheel - 3.0.17-5 +- Unit file generates certificates if not present. + Resolves: bz#1672284 + +* Thu Jan 31 2019 Fedora Release Engineering - 3.0.17-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 3.0.17-3 +- Rebuilt for libcrypt.so.2 (#1666033) + +* Fri Dec 14 2018 Alexander Scheel - 3.0.17-2 +- Updates radiusd.service to start after network-online.target + Resolves: bz#1637275 + +* Thu Oct 18 2018 Alexander Scheel - 3.0.17-1 +- Update to FreeRADIUS server version 3.0.17 +- Adds OpenSSL HMAC patches from upstream (unreleased) +- Adds Python2 shebang patches from upstream (unreleased) + +* Mon Sep 17 2018 Nikolai Kondrashov - 3.0.15-18 +- Actually apply patches added previously. + Related: Bug#1611286 Man page scan results for freeradius + +* Fri Sep 14 2018 Nikolai Kondrashov - 3.0.15-17 +- Fix a few minor manpage issues. + Resolves: Bug#1611286 Man page scan results for freeradius + +* Fri Sep 07 2018 Nikolai Kondrashov - 3.0.15-16 +- Add make to BuildRequires and Requires(post) to fix build and certificate + generation on install. + Resolves: Bug#1574783 Installing freeradius without make results in an + unworkable default configuration + +* Tue Sep 04 2018 Nikolai Kondrashov - 3.0.15-15 +- Add gcc to BuildRequires. + Resolves: Bug#1622470 FTBFS freeradius (rawhide) + +* Fri Jul 13 2018 Fedora Release Engineering - 3.0.15-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri Jun 29 2018 Jitka Plesnikova - 3.0.15-13 +- Perl 5.28 rebuild + * Tue Mar 06 2018 Björn Esser - 3.0.15-12 - Rebuilt for libjson-c.so.4 (json-c v0.13.1) diff --git a/freeradius.sysusers b/freeradius.sysusers new file mode 100644 index 0000000..af912e0 --- /dev/null +++ b/freeradius.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +u radiusd 95 "radiusd user" /var/lib/radiusd /sbin/nologin +g radiusd 95 - - - diff --git a/radiusd.service b/radiusd.service index 67696ad..9bfa3cd 100644 --- a/radiusd.service +++ b/radiusd.service @@ -1,11 +1,11 @@ [Unit] Description=FreeRADIUS high performance RADIUS server. -After=syslog.target network.target ipa.service dirsrv.target krb5kdc.service +After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service mysql.service mariadb.service postgresql.service [Service] Type=forking PIDFile=/var/run/radiusd/radiusd.pid -ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..0c3bdf7 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,3 @@ +--- +inspections: + badfuncs: off diff --git a/sources b/sources index 1e5a2c5..3fdee90 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.15.tar.bz2) = a2808f0b70b73f11c4c7d00edcb4a56a2ab8f73ce0ff74a9834c8b613ce5ed75ece372f852b0891f68c6a33f50c1bababb76d2eff9326a7fc29fe6b45ec9af88 +SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae diff --git a/tests/auth-tests/Makefile b/tests/auth-tests/Makefile new file mode 100644 index 0000000..afb1a73 --- /dev/null +++ b/tests/auth-tests/Makefile @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/freeradius +# Description: Test if freeradius authentication workd ok +# Author: Susant Sahani +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +export TEST=/CoreOS/freeradius +export TESTVERSION=1.0 +BUILT_FILES= +FILES=$(METADATA) runtest.sh Makefile PURPOSE +.PHONY: all install download clean +run: $(FILES) build + ./runtest.sh +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh +clean: + rm -f *~ $(BUILT_FILES) +include /usr/share/rhts/lib/rhts-make.include +$(METADATA): Makefile + @echo "Owner: Susant Sahani" > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test if the ABI hasn't changed" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: freeradius" >> $(METADATA) + @echo "Requires: freeradius" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -Fedora 28" >> $(METADATA) + rhts-lint $(METADATA) diff --git a/tests/auth-tests/PURPOSE b/tests/auth-tests/PURPOSE new file mode 100644 index 0000000..d4569c9 --- /dev/null +++ b/tests/auth-tests/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/freeradius +Description: tests for freeradius +Author: Susant Sahani diff --git a/tests/auth-tests/authorize b/tests/auth-tests/authorize new file mode 100644 index 0000000..e3600f6 --- /dev/null +++ b/tests/auth-tests/authorize @@ -0,0 +1,2 @@ +fedora-ci Cleartext-Password := "password" + Reply-Message = "Hello, %{User-Name}" diff --git a/tests/auth-tests/clients.conf b/tests/auth-tests/clients.conf new file mode 100644 index 0000000..00efb82 --- /dev/null +++ b/tests/auth-tests/clients.conf @@ -0,0 +1,6 @@ +client localhost { + ipaddr = 127.0.0.1 + secret = testing123 + require_message_authenticator = no + nastype = other +} diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py new file mode 100755 index 0000000..d646188 --- /dev/null +++ b/tests/auth-tests/freeradius-tests.py @@ -0,0 +1,67 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# Description: Tests for freeradius +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +import errno +import os +import sys +import time +import unittest +import subprocess +import signal +import shutil +import socket + +RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid' + +def setUpModule(): + """Initialize the environment, and perform sanity checks on it.""" + + if shutil.which('radiusd') is None: + raise OSError(errno.ENOENT, 'radiusd not found') + + if shutil.which('radtest') is None: + raise OSError(errno.ENOENT, 'radtest not found') + + if subprocess.call(['systemctl', 'is-active', '--quiet', + 'radiusd.service']) == 0: + raise unittest.SkipTest('radiusd.service is already active') + +def tearDownModule(): + pass + +class GenericUtilities(): + """Provide a set of utility functions start stop daemons. write config files etc """ + + def StartRadiusServer(self): + """Start radiusd""" + subprocess.check_output(['systemctl', 'start', 'radiusd']) + + def StopRadiusServer(self): + """stop radiusd""" + subprocess.check_output(['systemctl', 'stop', 'radiusd']) + +class RadiousTests(unittest.TestCase, GenericUtilities): + + def setUp(self): + self.StartRadiusServer() + + def tearDown(self): + self.StopRadiusServer() + + def test_radius_plaintext_auth(self): + time.sleep(1) + output=subprocess.check_output(['radtest', 'fedora-ci', 'password', '127.0.0.1', '100', 'testing123']).rstrip().decode('utf-8') + print(output) + + self.assertRegex(output, "Received Access-Accept") + self.assertRegex(output, "Reply-Message = \"Hello, fedora-ci\"") + +if __name__ == '__main__': + unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout, + verbosity=3)) diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh new file mode 100755 index 0000000..ceaeaa7 --- /dev/null +++ b/tests/auth-tests/runtest.sh @@ -0,0 +1,69 @@ +#!/bin/bash +# SPDX-License-Identifier: LGPL-2.1+ +# ~~~ +# runtest.sh of freeradius +# Description: RADIUS server +# +# Author: Susant Sahani +# Copyright (c) 2018 Red Hat, Inc. +# ~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="freeradius" + +RADIUS_CLIENT_CONF="/etc/raddb/clients.conf" +RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize" + +generate_cert(){ + pushd /etc/raddb/certs/ + #remove certificates if exists;generate new certificates + if [[ -f /etc/raddb/certs/bootstrap ]]; then + rlLog "Destroy and create new default certificates via bootstrap script" + rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh + rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates" + else + rlLogWarning "!!! WARNING bootsrap file does not exist !!!" + rlLog "Destroy and create new default certificates via make scripts" + make destroycerts -C /etc/raddb/certs/ + #create new certificates + make -C /etc/raddb/certs/ + chown root:radiusd dh ca.* client.* server.* + chmod 640 dh ca.* client.* server.* + fi + popd +} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "systemctl stop firewalld" 0,5 + rlRun "systemctl stop radiusd.service" + rlRun "setenforce 0" + rlFileBackup "$RADIUS_CLIENT_CONF" + rlFileBackup "$RADIUD_PALIN_TEXT_AUTH_FILE" + + rlRun "cp freeradius-tests.py /usr/bin/" + rlRun "cp clients.conf $RADIUS_CLIENT_CONF" + rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE" + rlRun "systemctl daemon-reload" + generate_cert + rlPhaseEnd + + rlPhaseStartTest + rlLog "Starting radius auth tests ..." + rlRun "/usr/bin/python3 /usr/bin/freeradius-tests.py" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm /usr/bin/freeradius-tests.py" + rlRun "systemctl start firewalld" 0,5 + rlRun "setenforce 1" + rlFileRestore + rlLog "freeradius tests done" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + +rlGetTestState diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..f070a4d --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,12 @@ +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + tests: + - auth-tests + required_packages: + - python3 + - systemd + - freeradius + - freeradius-utils