From 20e2650682dcd7d963b078a3b4c4dee4470e4a3a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 18 Oct 2018 11:06:58 -0400 Subject: [PATCH 01/12] Add patches for using OpenSSL's HMAC implementation Signed-off-by: Alexander Scheel --- freeradius-OpenSSL-HMAC-MD5.patch | 68 ++++++++++++++++++++++++++++ freeradius-OpenSSL-HMAC-SHA1.patch | 73 ++++++++++++++++++++++++++++++ freeradius.spec | 16 ++++++- 3 files changed, 155 insertions(+), 2 deletions(-) create mode 100644 freeradius-OpenSSL-HMAC-MD5.patch create mode 100644 freeradius-OpenSSL-HMAC-SHA1.patch diff --git a/freeradius-OpenSSL-HMAC-MD5.patch b/freeradius-OpenSSL-HMAC-MD5.patch new file mode 100644 index 0000000..1e54c55 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-MD5.patch @@ -0,0 +1,68 @@ +From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 09:54:46 -0400 +Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-MD5. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++- + 1 file changed, 33 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c +index 2c662ff368..1cca00fa2a 100644 +--- a/src/lib/hmacmd5.c ++++ b/src/lib/hmacmd5.c +@@ -27,10 +27,41 @@ + + RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + #include + +-/** Calculate HMAC using MD5 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's MD5 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ * ++ */ ++void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ ++#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW ++ /* Since MD5 is not allowed by FIPS, explicitly allow it. */ ++ HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW); ++#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */ ++ ++ HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++#else ++/** Calculate HMAC using internal MD5 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -101,6 +132,7 @@ + * hash */ + fr_md5_final(digest, &context); /* finish up 2nd pass */ + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius-OpenSSL-HMAC-SHA1.patch b/freeradius-OpenSSL-HMAC-SHA1.patch new file mode 100644 index 0000000..6c60951 --- /dev/null +++ b/freeradius-OpenSSL-HMAC-SHA1.patch @@ -0,0 +1,73 @@ +From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Sep 2018 11:03:52 -0400 +Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's + +If OpenSSL EVP is not found, fallback to internal implementation of +HMAC-SHA1. + +Signed-off-by: Alexander Scheel +--- + src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c +index c3cbd87a2c..211470ea35 100644 +--- a/src/lib/hmacsha1.c ++++ b/src/lib/hmacsha1.c +@@ -10,13 +10,19 @@ + + RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $") + ++#ifdef HAVE_OPENSSL_EVP_H ++#include ++#include ++#endif ++ + #include + + #ifdef HMAC_SHA1_DATA_PROBLEMS + unsigned int sha1_data_problems = 0; + #endif + +-/** Calculate HMAC using SHA1 ++#ifdef HAVE_OPENSSL_EVP_H ++/** Calculate HMAC using OpenSSL's SHA1 implementation + * + * @param digest Caller digest to be filled in. + * @param text Pointer to data stream. +@@ -28,6 +34,26 @@ + void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, + uint8_t const *key, size_t key_len) + { ++ HMAC_CTX *ctx = HMAC_CTX_new(); ++ HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL); ++ HMAC_Update(ctx, text, text_len); ++ HMAC_Final(ctx, digest, NULL); ++ HMAC_CTX_free(ctx); ++} ++ ++#else ++ ++/** Calculate HMAC using internal SHA1 implementation ++ * ++ * @param digest Caller digest to be filled in. ++ * @param text Pointer to data stream. ++ * @param text_len length of data stream. ++ * @param key Pointer to authentication key. ++ * @param key_len Length of authentication key. ++ */ ++void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len, ++ uint8_t const *key, size_t key_len) ++{ + fr_sha1_ctx context; + uint8_t k_ipad[65]; /* inner padding - key XORd with ipad */ + uint8_t k_opad[65]; /* outer padding - key XORd with opad */ +@@ -142,6 +168,7 @@ + } + #endif + } ++#endif /* HAVE_OPENSSL_EVP_H */ + + /* + Test Vectors (Trailing '\0' of a character string not included in test): diff --git a/freeradius.spec b/freeradius.spec index 0cb9dde..60752d8 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.15 -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -15,7 +15,9 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 +# 3.0.15 has moved to the old releases directory; update when +# updating spec versions. +Source0: ftp://ftp.freeradius.org/pub/radius/old/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf @@ -24,6 +26,11 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +# Note that the following two patches were modified to apply +# cleanly to the 3.0.15 release. +Patch3: freeradius-OpenSSL-HMAC-MD5.patch +Patch4: freeradius-OpenSSL-HMAC-SHA1.patch + %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} BuildRequires: autoconf @@ -197,6 +204,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -801,6 +810,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Thu Oct 18 2018 Alexander Scheel - 3.0.15-13 +- Added OpenSSL HMAC patches from upstream. + * Tue Mar 06 2018 Björn Esser - 3.0.15-12 - Rebuilt for libjson-c.so.4 (json-c v0.13.1) From 0264bfd470ddf9a602b52aca6055ce612de50b71 Mon Sep 17 00:00:00 2001 From: Nikolai Kondrashov Date: Fri, 14 Sep 2018 12:39:20 +0300 Subject: [PATCH 02/12] Fix a few minor manpage issues --- ...dius-Add-missing-option-descriptions.patch | 97 +++++++++++++++++++ freeradius-man-Fix-some-typos.patch | 94 ++++++++++++++++++ 2 files changed, 191 insertions(+) create mode 100644 freeradius-Add-missing-option-descriptions.patch create mode 100644 freeradius-man-Fix-some-typos.patch diff --git a/freeradius-Add-missing-option-descriptions.patch b/freeradius-Add-missing-option-descriptions.patch new file mode 100644 index 0000000..4138b4f --- /dev/null +++ b/freeradius-Add-missing-option-descriptions.patch @@ -0,0 +1,97 @@ +From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 12:20:11 +0300 +Subject: [PATCH] man: Add missing option descriptions + +--- + man/man8/raddebug.8 | 4 ++++ + man/man8/radiusd.8 | 7 +++++++ + man/man8/radmin.8 | 4 ++++ + 3 files changed, 15 insertions(+) + +diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8 +index 66e80e64fa..6e27e2453c 100644 +--- a/man/man8/raddebug.8 ++++ b/man/man8/raddebug.8 +@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server. + .IR condition ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-n + .IR name ] + .RB [ \-i +@@ -73,6 +75,8 @@ option is equivalent to using: + .IP "\-d \fIconfig directory\fP" + The radius configuration directory, usually /etc/raddb. See the + \fIradmin\fP manual page for more description of this option. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-n \fImname\fP" + Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP. + .IP \-I\ \fIipv6-address\fP +diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8 +index c825f22d0d..98aef5e1be 100644 +--- a/man/man8/radiusd.8 ++++ b/man/man8/radiusd.8 +@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server + .RB [ \-C ] + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-f ] + .RB [ \-h ] + .RB [ \-i +@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server + .IR name ] + .RB [ \-p + .IR port ] ++.RB [ \-P ] + .RB [ \-s ] + .RB [ \-t ] + .RB [ \-v ] +@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked. + .IP "\-d \fIconfig directory\fP" + Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration + files such as the \fIdictionary\fP and the \fIusers\fP files. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP \-f + Do not fork, stay running as a foreground process. + .IP \-h +@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in + \fIradiusd.conf\fP are ignored. + + This option MUST be used in conjunction with "-i". ++.IP "\-P ++Always write out PID, even with -f. + .IP \-s + Run in "single server" mode. The server normally runs with multiple + threads and/or processes, which can lower its response time to +diff --git a/man/man8/radmin.8 b/man/man8/radmin.8 +index 5ecc963d81..5bf661fa71 100644 +--- a/man/man8/radmin.8 ++++ b/man/man8/radmin.8 +@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool + .B radmin + .RB [ \-d + .IR config_directory ] ++.RB [ \-D ++.IR dictionary_directory ] + .RB [ \-e + .IR command ] + .RB [ \-E ] +@@ -34,6 +36,8 @@ The following command-line options are accepted by the program. + Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server + configuration files to find the "listen" section that defines the + control socket filename. ++.IP "\-D \fIdictionary directory\fP" ++Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP. + .IP "\-e \fIcommand\fP" + Run \fIcommand\fP and exit. + .IP \-E +-- +2.18.0 + diff --git a/freeradius-man-Fix-some-typos.patch b/freeradius-man-Fix-some-typos.patch new file mode 100644 index 0000000..26d84de --- /dev/null +++ b/freeradius-man-Fix-some-typos.patch @@ -0,0 +1,94 @@ +From 285f6f1891e8e8acfeb7281136efdae50dbfbe78 Mon Sep 17 00:00:00 2001 +From: Nikolai Kondrashov +Date: Fri, 14 Sep 2018 11:53:28 +0300 +Subject: [PATCH] man: Fix some typos + +--- + man/man5/radrelay.conf.5 | 2 +- + man/man5/rlm_files.5 | 2 +- + man/man5/unlang.5 | 8 ++++---- + man/man8/radrelay.8 | 2 +- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/man/man5/radrelay.conf.5 b/man/man5/radrelay.conf.5 +index 5fb38bfc4e..e3e665024b 100644 +--- a/man/man5/radrelay.conf.5 ++++ b/man/man5/radrelay.conf.5 +@@ -26,7 +26,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +diff --git a/man/man5/rlm_files.5 b/man/man5/rlm_files.5 +index bfee5030ff..52f4734ae3 100644 +--- a/man/man5/rlm_files.5 ++++ b/man/man5/rlm_files.5 +@@ -48,7 +48,7 @@ This configuration entry enables you to have configurations that + perform per-group checks, and return per-group attributes, where the + group membership is dynamically defined by a previous module. It also + lets you do things like key off of attributes in the reply, and +-express policies like like "when I send replies containing attribute ++express policies like "when I send replies containing attribute + FOO with value BAR, do more checks, and maybe send additional + attributes". + .SH CONFIGURATION +diff --git a/man/man5/unlang.5 b/man/man5/unlang.5 +index 76db8f2d1c..12fe7855b2 100644 +--- a/man/man5/unlang.5 ++++ b/man/man5/unlang.5 +@@ -36,7 +36,7 @@ the pre-defined keywords here. + + Subject to a few limitations described below, any keyword can appear + in any context. The language consists of a series of entries, each +-one one line. Each entry begins with a keyword. Entries are ++one line. Each entry begins with a keyword. Entries are + organized into lists. Processing of the language is line by line, + from the start of the list to the end. Actions are executed + per-keyword. +@@ -131,7 +131,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + No statement other than "case" can appear in a "switch" block. +@@ -155,7 +155,7 @@ expanded as described in the DATA TYPES section, below. The match is + then performed on the string returned from the expansion. If the + argument is an attribute reference (e.g. &User-Name), then the match + is performed on the value of that attribute. Otherwise, the argument +-is taken to be a literal string, and and matching is done via simple ++is taken to be a literal string, and matching is done via simple + comparison. + + .DS +@@ -799,7 +799,7 @@ regular expression. If no attribute matches, nothing else is done. + The value can be an attribute reference, or an attribute-specific + string. + +-When the value is an an attribute reference, it must take the form of ++When the value is an attribute reference, it must take the form of + "&Attribute-Name". The leading "&" signifies that the value is a + reference. The "Attribute-Name" is an attribute name, such as + "User-Name" or "request:User-Name". When an attribute reference is +diff --git a/man/man8/radrelay.8 b/man/man8/radrelay.8 +index fdba6995d5..99e65732a2 100644 +--- a/man/man8/radrelay.8 ++++ b/man/man8/radrelay.8 +@@ -13,7 +13,7 @@ Many sites run multiple radius servers; at least one primary and one + backup server. When the primary goes down, most NASes detect that and + switch to the backup server. + +-That will cause your accounting packets to go the the backup server - ++That will cause your accounting packets to go to the backup server - + and some NASes don't even switch back to the primary server when it + comes back up. + +-- +2.18.0 + From 2d88916e4b43f1af176e04b0861c014e1c4071c6 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 18 Oct 2018 16:21:59 -0400 Subject: [PATCH 03/12] Update to upstream release v3.0.17 Signed-off-by: Alexander Scheel --- .gitignore | 1 + freeradius-python2-shebangs.patch | 64 +++++++++++++++++++++++++++++++ freeradius.spec | 24 +++++++----- sources | 2 +- 4 files changed, 81 insertions(+), 10 deletions(-) create mode 100644 freeradius-python2-shebangs.patch diff --git a/.gitignore b/.gitignore index 779754b..28f9f6c 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /freeradius-server-3.0.13.tar.bz2 /freeradius-server-3.0.14.tar.bz2 /freeradius-server-3.0.15.tar.bz2 +/freeradius-server-3.0.17.tar.bz2 diff --git a/freeradius-python2-shebangs.patch b/freeradius-python2-shebangs.patch new file mode 100644 index 0000000..86954db --- /dev/null +++ b/freeradius-python2-shebangs.patch @@ -0,0 +1,64 @@ +From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 18 Oct 2018 12:40:53 -0400 +Subject: [PATCH] Clarify shebangs to be python2 + +Signed-off-by: Alexander Scheel +--- + scripts/radtee | 2 +- + src/modules/rlm_python/example.py | 2 +- + src/modules/rlm_python/prepaid.py | 2 +- + src/modules/rlm_python/radiusd.py | 2 +- + src/modules/rlm_python/radiusd_test.py | 2 +- + 5 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/scripts/radtee b/scripts/radtee +index 123769d244..78b4bcbe0b 100755 +--- a/scripts/radtee ++++ b/scripts/radtee +@@ -1,4 +1,4 @@ +-#!/usr/bin/env python ++#!/usr/bin/env python2 + from __future__ import with_statement + + # RADIUS comparison tee v1.0 +diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py +index 5950a07678..eaf456e349 100644 +--- a/src/modules/rlm_python/example.py ++++ b/src/modules/rlm_python/example.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module example file + # Miguel A.L. Paraz +diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py +index c3cbf57b8f..3b1dc2e2e8 100644 +--- a/src/modules/rlm_python/prepaid.py ++++ b/src/modules/rlm_python/prepaid.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Example Python module for prepaid usage using MySQL + +diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py +index c535bb3caf..7129923994 100644 +--- a/src/modules/rlm_python/radiusd.py ++++ b/src/modules/rlm_python/radiusd.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Definitions for RADIUS programs + # +diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py +index 13b7128b29..97b5b64f08 100644 +--- a/src/modules/rlm_python/radiusd_test.py ++++ b/src/modules/rlm_python/radiusd_test.py +@@ -1,4 +1,4 @@ +-#! /usr/bin/env python ++#! /usr/bin/env python2 + # + # Python module test + # Miguel A.L. Paraz diff --git a/freeradius.spec b/freeradius.spec index 60752d8..cbe2089 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.15 -Release: 13%{?dist} +Version: 3.0.17 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -25,11 +25,11 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch - -# Note that the following two patches were modified to apply -# cleanly to the 3.0.15 release. -Patch3: freeradius-OpenSSL-HMAC-MD5.patch -Patch4: freeradius-OpenSSL-HMAC-SHA1.patch +Patch3: freeradius-man-Fix-some-typos.patch +Patch4: freeradius-Add-missing-option-descriptions.patch +Patch5: freeradius-OpenSSL-HMAC-MD5.patch +Patch6: freeradius-OpenSSL-HMAC-SHA1.patch +Patch7: freeradius-python2-shebangs.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -206,6 +206,9 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 +%patch6 -p1 +%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -214,6 +217,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %configure \ --libdir=%{_libdir}/freeradius \ --disable-openssl-version-check \ + --with-openssl \ --with-udpfromto \ --with-threads \ --with-docdir=%{docdir} \ @@ -520,7 +524,6 @@ exit 0 %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail %config(missingok) /etc/raddb/mods-enabled/detail.log -%config(missingok) /etc/raddb/mods-enabled/dhcp %config(missingok) /etc/raddb/mods-enabled/digest %config(missingok) /etc/raddb/mods-enabled/dynamic_clients %config(missingok) /etc/raddb/mods-enabled/eap @@ -767,7 +770,6 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/update_radacct_group.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql @@ -810,6 +812,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Dec 14 2018 Alexander Scheel - 3.0.17-1 +- Update to FreeRADIUS server version 3.0.17 +- Adds Python2 shebang patches from upstream (unreleased) + * Thu Oct 18 2018 Alexander Scheel - 3.0.15-13 - Added OpenSSL HMAC patches from upstream. diff --git a/sources b/sources index 1e5a2c5..d4d7f35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.15.tar.bz2) = a2808f0b70b73f11c4c7d00edcb4a56a2ab8f73ce0ff74a9834c8b613ce5ed75ece372f852b0891f68c6a33f50c1bababb76d2eff9326a7fc29fe6b45ec9af88 +SHA512 (freeradius-server-3.0.17.tar.bz2) = f4510d8e77eb7c72a21fbfad851f13460ff4b5a35f0b7bea6102076ceb71188a63b277fb7e4fcd9c3033b396b63e1bf0e455cc03608d7ab1380d1662407cb399 From a13cc5fc8c754e2cfc27baa3d73ca31accf50c11 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 14 Dec 2018 15:14:53 -0500 Subject: [PATCH 04/12] Add network-online.target instead of network.target in RADIUS spec file Signed-off-by: Alexander Scheel --- freeradius.spec | 6 +++++- radiusd.service | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index cbe2089..579b0f0 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.17 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -812,6 +812,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Fri Dec 14 2018 Alexander Scheel - 3.0.17-2 +- Updates radiusd.service to start after network-online.target + Resolves: bz#1637275 + * Fri Dec 14 2018 Alexander Scheel - 3.0.17-1 - Update to FreeRADIUS server version 3.0.17 - Adds Python2 shebang patches from upstream (unreleased) diff --git a/radiusd.service b/radiusd.service index 67696ad..32ed926 100644 --- a/radiusd.service +++ b/radiusd.service @@ -1,6 +1,6 @@ [Unit] Description=FreeRADIUS high performance RADIUS server. -After=syslog.target network.target ipa.service dirsrv.target krb5kdc.service +After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service [Service] Type=forking From 80c142b0acfa1455e3b37d1185e8d9db79c7ef3b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 10 Apr 2019 14:31:23 -0400 Subject: [PATCH 05/12] Rebase to 3.0.18 Signed-off-by: Alexander Scheel --- ...nfiguration-to-fit-Red-Hat-specifics.patch | 18 ++--- ...-Use-system-crypto-policy-by-default.patch | 14 ++-- freeradius.spec | 66 ++++++++----------- radiusd.service | 2 + sources | 2 +- 5 files changed, 48 insertions(+), 54 deletions(-) diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index ad51053..6b2329b 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -12,24 +12,24 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 2621e183c..94494b2c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -472,7 +472,7 @@ eap { - # +@@ -533,7 +533,7 @@ # You should also delete all of the files # in the directory when the server starts. -- # tmpdir = /tmp/radiusd -+ # tmpdir = /var/run/radiusd/tmp + # +- # tmpdir = /tmp/radiusd ++ # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -486,7 +486,7 @@ eap { - # in PEM format. This file is automatically +@@ -548,7 +548,7 @@ # deleted by the server when the command # returns. -- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" -+ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" + # +- # client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" ++ # client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}" } - # + # OCSP Configuration diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 1664186..836a81a 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -14,15 +14,15 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 94494b2c6..9a8dc9327 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -323,7 +323,7 @@ eap { +@@ -912,7 +912,7 @@ + # Note - for OpenSSL 1.1.0 and above you may need + # to add ":@SECLEVEL=0" # - # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" - # -- cipher_list = "DEFAULT" -+ cipher_list = "PROFILE=SYSTEM" +- # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" ++ # cipher_list = "PROFILE=SYSTEM" - # If enabled, OpenSSL will use server cipher list - # (possibly defined by cipher_list option above) + # PAC lifetime in seconds (default: seven days) + # diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap index 2b4df6267..af9aa88cd 100644 --- a/raddb/mods-available/inner-eap diff --git a/freeradius.spec b/freeradius.spec index 579b0f0..3fce2e0 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.17 -Release: 2%{?dist} +Version: 3.0.19 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -15,9 +15,7 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -# 3.0.15 has moved to the old releases directory; update when -# updating spec versions. -Source0: ftp://ftp.freeradius.org/pub/radius/old/%{dist_base}.tar.bz2 +Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf @@ -25,15 +23,12 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch -Patch3: freeradius-man-Fix-some-typos.patch -Patch4: freeradius-Add-missing-option-descriptions.patch -Patch5: freeradius-OpenSSL-HMAC-MD5.patch -Patch6: freeradius-OpenSSL-HMAC-SHA1.patch -Patch7: freeradius-python2-shebangs.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} BuildRequires: autoconf +BuildRequires: make +BuildRequires: gcc BuildRequires: gdbm-devel BuildRequires: openssl BuildRequires: openssl-devel @@ -58,6 +53,8 @@ Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) Requires(pre): shadow-utils glibc-common Requires(post): systemd-sysv Requires(post): systemd-units +# Needed for certificate generation +Requires(post): make Requires(preun): systemd-units Requires(postun): systemd-units @@ -77,7 +74,6 @@ be centralized, and minimizes the amount of re-configuration which has to be done when adding or deleting new users. %package doc -Group: Documentation Summary: FreeRADIUS documentation %description doc @@ -85,7 +81,6 @@ All documentation supplied by the FreeRADIUS project is included in this package. %package utils -Group: System Environment/Daemons Summary: FreeRADIUS utilities Requires: %{name} = %{version}-%{release} Requires: libpcap >= 0.9.4 @@ -100,7 +95,6 @@ Support for RFC and VSA Attributes Additional server configuration attributes Selecting a particular configuration Authentication methods %package devel -Group: System Environment/Daemons Summary: FreeRADIUS development files Requires: %{name} = %{version}-%{release} @@ -109,7 +103,6 @@ Development headers and libraries for FreeRADIUS. %package ldap Summary: LDAP support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: openldap-devel @@ -118,7 +111,6 @@ This plugin provides the LDAP support for the FreeRADIUS server project. %package krb5 Summary: Kerberos 5 support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: krb5-devel @@ -127,7 +119,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} @@ -140,7 +131,6 @@ This plugin provides the Perl support for the FreeRADIUS server project. %package -n python2-freeradius Summary: Python support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: python2-devel %{?python_provide:%python_provide python2-freeradius} @@ -154,7 +144,6 @@ This plugin provides the Python support for the FreeRADIUS server project. %package mysql Summary: MySQL support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: mariadb-connector-c-devel @@ -165,7 +154,7 @@ This plugin provides the MySQL support for the FreeRADIUS server project. Summary: Postgresql support for freeradius Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} -BuildRequires: postgresql-devel +BuildRequires: libpq-devel %description postgresql This plugin provides the postgresql support for the FreeRADIUS server project. @@ -181,7 +170,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project. %package unixODBC Summary: Unix ODBC support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: unixODBC-devel @@ -190,7 +178,6 @@ This plugin provides the unixODBC support for the FreeRADIUS server project. %package rest Summary: REST support for freeradius -Group: System Environment/Daemons Requires: %{name} = %{version}-%{release} BuildRequires: libcurl-devel BuildRequires: json-c-devel @@ -204,11 +191,6 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 -%patch6 -p1 -%patch7 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -330,16 +312,6 @@ getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/n getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 exit 0 -%post -%systemd_post radiusd.service -if [ $1 -eq 1 ]; then # install - # Initial installation - if [ ! -e /etc/raddb/certs/server.pem ]; then - /sbin/runuser -g radiusd -c 'umask 007; /etc/raddb/certs/bootstrap' > /dev/null 2>&1 - fi -fi -exit 0 - %preun %systemd_preun radiusd.service @@ -355,7 +327,6 @@ exit 0 %files -%defattr(-,root,root) # doc %license %{docdir}/LICENSE.gpl @@ -559,6 +530,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/operator-name +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/rfc7542 # binaries @@ -763,6 +735,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/procedure.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql @@ -812,6 +785,25 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 +- Rebased to 3.0.19 + +* Wed Mar 06 2019 Alexander Scheel - 3.0.18-1 +- Rebased to 3.0.18 + +* Sun Feb 17 2019 Igor Gnatenko - 3.0.17-6 +- Rebuild for readline 8.0 + +* Tue Feb 05 2019 Alexander Scheel - 3.0.17-5 +- Unit file generates certificates if not present. + Resolves: bz#1672284 + +* Thu Jan 31 2019 Fedora Release Engineering - 3.0.17-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Björn Esser - 3.0.17-3 +- Rebuilt for libcrypt.so.2 (#1666033) + * Fri Dec 14 2018 Alexander Scheel - 3.0.17-2 - Updates radiusd.service to start after network-online.target Resolves: bz#1637275 diff --git a/radiusd.service b/radiusd.service index 32ed926..133788a 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,6 +6,8 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap +ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C diff --git a/sources b/sources index d4d7f35..613a918 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.17.tar.bz2) = f4510d8e77eb7c72a21fbfad851f13460ff4b5a35f0b7bea6102076ceb71188a63b277fb7e4fcd9c3033b396b63e1bf0e455cc03608d7ab1380d1662407cb399 +SHA512 (freeradius-server-3.0.19.tar.bz2) = 9bb3401a52288de541a2272149f4341840dc1df7203583746bef46c0b1b1f2b8886931c9f6f9ce3d92951e271ab5a84a50a8587a3acd69cc20bc86f5817d28e1 From fad9be5361842d317a4321a752e34cacc2453217 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:20:13 -0400 Subject: [PATCH 06/12] Update crypto-policies patch Since introduction, more places for ciphersuites have been introduced by FreeRADIUS; update the crypto-policies patch accordingly. Signed-off-by: Alexander Scheel --- ...-Use-system-crypto-policy-by-default.patch | 40 ++++++++++++------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 836a81a..199e583 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -1,20 +1,30 @@ -From d78bf5ab1f5c8102b2b6051cfb1198488be9597d Mon Sep 17 00:00:00 2001 -From: Nikolai Kondrashov -Date: Mon, 26 Sep 2016 19:48:36 +0300 -Subject: [PATCH] Use system crypto policy by default +From a7ed62fbcc043a9ec7a4f09962a2cd2acffa019b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:16:31 -0400 +Subject: [PATCH] Use system-provided crypto-policies by default +Signed-off-by: Alexander Scheel --- - raddb/mods-available/eap | 2 +- + raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- raddb/sites-available/abfab-tls | 2 +- raddb/sites-available/tls | 4 ++-- - 4 files changed, 5 insertions(+), 5 deletions(-) + 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 94494b2c6..9a8dc9327 100644 +index 36849e10f2..b28c0f19c6 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -912,7 +912,7 @@ +@@ -368,7 +368,7 @@ eap { + # + # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" + # +- cipher_list = "DEFAULT" ++ cipher_list = "PROFILE=SYSTEM" + + # If enabled, OpenSSL will use server cipher list + # (possibly defined by cipher_list option above) +@@ -912,7 +912,7 @@ eap { # Note - for OpenSSL 1.1.0 and above you may need # to add ":@SECLEVEL=0" # @@ -24,10 +34,10 @@ index 94494b2c6..9a8dc9327 100644 # PAC lifetime in seconds (default: seven days) # diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap -index 2b4df6267..af9aa88cd 100644 +index 576eb7739e..ffa07188e2 100644 --- a/raddb/mods-available/inner-eap +++ b/raddb/mods-available/inner-eap -@@ -68,7 +68,7 @@ eap inner-eap { +@@ -77,7 +77,7 @@ eap inner-eap { # certificates. If so, edit this file. ca_file = ${cadir}/ca.pem @@ -37,7 +47,7 @@ index 2b4df6267..af9aa88cd 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index 5dbe143da..46b5fea78 100644 +index 92f1d6330e..cd69b3905a 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls @@ -19,7 +19,7 @@ listen { @@ -50,10 +60,10 @@ index 5dbe143da..46b5fea78 100644 cache { enable = no diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index cf1cd7a8a..7dd59cb6f 100644 +index bbc761b1c5..83cd35b851 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -197,7 +197,7 @@ listen { +@@ -215,7 +215,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -62,7 +72,7 @@ index cf1cd7a8a..7dd59cb6f 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -499,7 +499,7 @@ home_server tls { +@@ -517,7 +517,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -72,5 +82,5 @@ index cf1cd7a8a..7dd59cb6f 100644 } -- -2.13.2 +2.21.0 From e54544f6debde260eb0670b04021499b2ada634c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:37:04 -0400 Subject: [PATCH 07/12] Improvements to FreeRADIUS - Better crypto-policies (previous commit) - Better logrotation - Better bootstrap Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 100 +++++++++++++++++++++++++ freeradius-logrotate | 5 ++ freeradius.spec | 11 ++- radiusd.service | 2 +- 4 files changed, 116 insertions(+), 2 deletions(-) create mode 100644 freeradius-bootstrap-create-only.patch diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch new file mode 100644 index 0000000..5c3e1ac --- /dev/null +++ b/freeradius-bootstrap-create-only.patch @@ -0,0 +1,100 @@ +From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 10:29:08 -0400 +Subject: [PATCH] Don't clobber existing files on bootstrap + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 39 ++++++++++++--------------------------- + 1 file changed, 12 insertions(+), 27 deletions(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 0f719aafd4..be81a2d697 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -13,17 +13,6 @@ + umask 027 + cd `dirname $0` + +-make -h > /dev/null 2>&1 +- +-# +-# If we have a working "make", then use it. Otherwise, run the commands +-# manually. +-# +-if [ "$?" = "0" ]; then +- make all +- exit $? +-fi +- + # + # The following commands were created by running "make -n", and edited + # to remove the trailing backslash, and to add "exit 1" after the commands. +@@ -31,52 +20,48 @@ fi + # Don't edit the following text. Instead, edit the Makefile, and + # re-generate these commands. + # +-if [ ! -f dh ]; then ++if [ ! -e dh ]; then + openssl dhparam -out dh 2048 || exit 1 +- if [ -e /dev/urandom ] ; then +- ln -sf /dev/urandom random +- else +- date > ./random; +- fi ++ ln -sf /dev/urandom random + fi + +-if [ ! -f server.key ]; then ++if [ ! -e server.key ]; then + openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + fi + +-if [ ! -f ca.key ]; then ++if [ ! -e ca.key ]; then + openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 + fi + +-if [ ! -f index.txt ]; then ++if [ ! -e index.txt ]; then + touch index.txt + fi + +-if [ ! -f serial ]; then ++if [ ! -e serial ]; then + echo '01' > serial + fi + +-if [ ! -f server.crt ]; then ++if [ ! -e server.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 + fi + +-if [ ! -f server.p12 ]; then ++if [ ! -e server.p12 ]; then + openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + fi + +-if [ ! -f server.pem ]; then ++if [ ! -e server.pem ]; then + openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + openssl verify -CAfile ca.pem server.pem || exit 1 + fi + +-if [ ! -f ca.der ]; then ++if [ ! -e ca.der ]; then + openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 + fi + +-if [ ! -f client.key ]; then ++if [ ! -e client.key ]; then + openssl req -new -out client.csr -keyout client.key -config ./client.cnf + fi + +-if [ ! -f client.crt ]; then ++if [ ! -e client.crt ]; then + openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf + fi +-- +2.21.0 + diff --git a/freeradius-logrotate b/freeradius-logrotate index 1c3c5b9..c962254 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -14,6 +14,7 @@ nocreate missingok compress + su radiusd radiusd } /var/log/radius/checkrad.log { @@ -22,6 +23,7 @@ create missingok compress + su radiusd radiusd } /var/log/radius/radius.log { @@ -30,6 +32,7 @@ create missingok compress + su radiusd radiusd postrotate /usr/bin/systemctl reload-or-try-restart radiusd endscript @@ -41,6 +44,7 @@ create compress missingok + su radiusd radiusd } /var/log/radius/sqltrace.sql { monthly @@ -48,4 +52,5 @@ create compress missingok + su radiusd radiusd } diff --git a/freeradius.spec b/freeradius.spec index 3fce2e0..5f1c856 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -23,6 +23,7 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -129,6 +130,7 @@ BuildRequires: perl(ExtUtils::Embed) %description perl This plugin provides the Perl support for the FreeRADIUS server project. +%if 0%{?fedora} <= 30 %package -n python2-freeradius Summary: Python support for freeradius Requires: %{name} = %{version}-%{release} @@ -141,6 +143,7 @@ Obsoletes: %{name}-python < %{version}-%{release} %description -n python2-freeradius This plugin provides the Python support for the FreeRADIUS server project. +%endif %package mysql Summary: MySQL support for freeradius @@ -191,6 +194,7 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -785,6 +789,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 08 2019 Alexander Scheel - 3.0.19-2 +- Updated crypto-policies patch +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing +- Updated logrotate definitions to run as radiusd:radiusd + * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 diff --git a/radiusd.service b/radiusd.service index 133788a..894e8aa 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,7 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb From 3605fd99b285d7de6189374e8b2cdc31a7f69134 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 10:41:49 -0400 Subject: [PATCH 08/12] Finish dropping python2 package on Fedora 31+ Signed-off-by: Alexander Scheel --- freeradius.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/freeradius.spec b/freeradius.spec index 5f1c856..181b39b 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -683,11 +683,13 @@ exit 0 %{_libdir}/freeradius/rlm_perl.so +%if 0%{?fedora} <= 30 %files -n python2-freeradius %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python /etc/raddb/mods-config/python/example.py* /etc/raddb/mods-config/python/radiusd.py* %{_libdir}/freeradius/rlm_python.so +%endif %files mysql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql @@ -793,6 +795,7 @@ exit 0 - Updated crypto-policies patch - Updated /etc/raddb/certs/bootstrap to only create certificates if missing - Updated logrotate definitions to run as radiusd:radiusd +- Drop python2 package on Fedora 31+ * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 From 3de1fefba095c719b85611eb2adeec81ce8041e9 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 12:05:51 -0400 Subject: [PATCH 09/12] Add additional After= targets to radiusd.service Signed-off-by: Alexander Scheel --- radiusd.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radiusd.service b/radiusd.service index 894e8aa..a2780bb 100644 --- a/radiusd.service +++ b/radiusd.service @@ -1,6 +1,6 @@ [Unit] Description=FreeRADIUS high performance RADIUS server. -After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service +After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service mysql.service mariadb.service postgresql.service [Service] Type=forking From 841f85c66b05750fd644b71716c2ccadc3375ac3 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 13:58:05 -0400 Subject: [PATCH 10/12] Fix certificate generation at build time Signed-off-by: Alexander Scheel --- freeradius-no-buildtime-cert-gen.patch | 104 +++++++++++++++++++++++++ freeradius.spec | 10 ++- 2 files changed, 112 insertions(+), 2 deletions(-) create mode 100644 freeradius-no-buildtime-cert-gen.patch diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch new file mode 100644 index 0000000..aa3be66 --- /dev/null +++ b/freeradius-no-buildtime-cert-gen.patch @@ -0,0 +1,104 @@ +From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 8 May 2019 12:58:02 -0400 +Subject: [PATCH] Don't generate certificates in reproducible builds + +Signed-off-by: Alexander Scheel +--- + Make.inc.in | 5 +++++ + configure | 4 ++++ + configure.ac | 3 +++ + raddb/all.mk | 4 ++++ + 4 files changed, 16 insertions(+) + +diff --git a/Make.inc.in b/Make.inc.in +index 0b2cd74de8..8c623cf95c 100644 +--- a/Make.inc.in ++++ b/Make.inc.in +@@ -173,3 +173,8 @@ else + TESTBINDIR = ./$(BUILD_DIR)/bin + TESTBIN = ./$(BUILD_DIR)/bin + endif ++ ++# ++# With reproducible builds, do not generate certificates during installation ++# ++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ +diff --git a/configure b/configure +index c2c599c92b..3d4403a844 100755 +--- a/configure ++++ b/configure +@@ -655,6 +655,7 @@ RUSERS + SNMPWALK + SNMPGET + PERL ++ENABLE_REPRODUCIBLE_BUILDS + openssl_version_check_config + WITH_DHCP + modconfdir +@@ -5586,6 +5587,7 @@ else + fi + + ++ENABLE_REPRODUCIBLE_BUILDS=yes + # Check whether --enable-reproducible-builds was given. + if test "${enable_reproducible_builds+set}" = set; then : + enableval=$enable_reproducible_builds; case "$enableval" in +@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac + + fi +@@ -5604,6 +5607,7 @@ fi + + + ++ + CHECKRAD=checkrad + # Extract the first word of "perl", so it can be a program name with args. + set dummy perl; ac_word=$2 +diff --git a/configure.ac b/configure.ac +index a7abf0025a..35b013f4af 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) + dnl # + dnl # extra argument: --enable-reproducible-builds + dnl # ++ENABLE_REPRODUCIBLE_BUILDS=yes + AC_ARG_ENABLE(reproducible-builds, + [AS_HELP_STRING([--enable-reproducible-builds], + [ensure the build does not change each time])], +@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, + ;; + *) + reproducible_builds=no ++ ENABLE_REPRODUCIBLE_BUILDS=no + esac ] + ) ++AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) + + + dnl ############################################################# +diff --git a/raddb/all.mk b/raddb/all.mk +index c966edd657..c8e976a499 100644 +--- a/raddb/all.mk ++++ b/raddb/all.mk +@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize + ifneq "$(LOCAL_CERT_PRODUCTS)" "" + $(LOCAL_CERT_PRODUCTS): + @echo BOOTSTRAP raddb/certs/ ++ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes" ++ @$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk ++else + @$(MAKE) -C $(R)$(raddbdir)/certs/ ++endif + + # Bootstrap is special + $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS) +-- +2.21.0 + diff --git a/freeradius.spec b/freeradius.spec index 181b39b..2f8d11f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -24,6 +24,7 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch +Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -195,6 +196,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -202,6 +204,8 @@ This plugin provides the REST support for the FreeRADIUS server project. %configure \ --libdir=%{_libdir}/freeradius \ + --enable-reproducible-builds \ + --with-package \ --disable-openssl-version-check \ --with-openssl \ --with-udpfromto \ @@ -793,9 +797,11 @@ exit 0 %changelog * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch -- Updated /etc/raddb/certs/bootstrap to only create certificates if missing -- Updated logrotate definitions to run as radiusd:radiusd +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 +- Updated logrotate definitions to run as radiusd:radiusd: bz#1705343 - Drop python2 package on Fedora 31+ +- Add database dependencies: bz#1658697 +- Don't generate certificate during build * Wed Apr 10 2019 Alexander Scheel - 3.0.19-1 - Rebased to 3.0.19 From 899fe534ad0e79a8353c4f5eb6756bb8c81a0a04 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 8 May 2019 14:10:58 -0400 Subject: [PATCH 11/12] Add additional BZ reference Signed-off-by: Alexander Scheel --- freeradius.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/freeradius.spec b/freeradius.spec index 2f8d11f..dc50f57 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -797,7 +797,7 @@ exit 0 %changelog * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch -- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 +- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284 - Updated logrotate definitions to run as radiusd:radiusd: bz#1705343 - Drop python2 package on Fedora 31+ - Add database dependencies: bz#1658697 From 5577d5877c2d4373600603edbbd9cbb4e813d954 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 May 2019 14:20:20 -0400 Subject: [PATCH 12/12] Fix permissions on generated certificates Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 29 ++++++++++++++------------ freeradius.spec | 5 ++++- radiusd.service | 3 +-- 3 files changed, 21 insertions(+), 16 deletions(-) diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch index 5c3e1ac..7af7c94 100644 --- a/freeradius-bootstrap-create-only.patch +++ b/freeradius-bootstrap-create-only.patch @@ -15,7 +15,7 @@ index 0f719aafd4..be81a2d697 100755 @@ -13,17 +13,6 @@ umask 027 cd `dirname $0` - + -make -h > /dev/null 2>&1 - -# @@ -30,7 +30,7 @@ index 0f719aafd4..be81a2d697 100755 # # The following commands were created by running "make -n", and edited # to remove the trailing backslash, and to add "exit 1" after the commands. -@@ -31,52 +20,48 @@ fi +@@ -31,52 +20,51 @@ fi # Don't edit the following text. Instead, edit the Makefile, and # re-generate these commands. # @@ -44,57 +44,60 @@ index 0f719aafd4..be81a2d697 100755 - fi + ln -sf /dev/urandom random fi - + -if [ ! -f server.key ]; then +if [ ! -e server.key ]; then openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 fi - + -if [ ! -f ca.key ]; then +if [ ! -e ca.key ]; then openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 fi - + -if [ ! -f index.txt ]; then +if [ ! -e index.txt ]; then touch index.txt fi - + -if [ ! -f serial ]; then +if [ ! -e serial ]; then echo '01' > serial fi - + -if [ ! -f server.crt ]; then +if [ ! -e server.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 fi - + -if [ ! -f server.p12 ]; then +if [ ! -e server.p12 ]; then openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 fi - + -if [ ! -f server.pem ]; then +if [ ! -e server.pem ]; then openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 openssl verify -CAfile ca.pem server.pem || exit 1 fi - + -if [ ! -f ca.der ]; then +if [ ! -e ca.der ]; then openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 fi - + -if [ ! -f client.key ]; then +if [ ! -e client.key ]; then openssl req -new -out client.csr -keyout client.key -config ./client.cnf fi - + -if [ ! -f client.crt ]; then +if [ ! -e client.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf fi --- ++ ++chown root:radiusd dh ca.* client.* server.* ++chmod 644 dh ca.* client.* server.* +-- 2.21.0 diff --git a/freeradius.spec b/freeradius.spec index dc50f57..0969ea9 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.19 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Daemons URL: http://www.freeradius.org/ @@ -795,6 +795,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 08 2019 Alexander Scheel - 3.0.19-3 +- Update boostrap to change ownership of all certificates to root:radiusd + * Wed May 08 2019 Alexander Scheel - 3.0.19-2 - Updated crypto-policies patch - Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284 diff --git a/radiusd.service b/radiusd.service index a2780bb..d073530 100644 --- a/radiusd.service +++ b/radiusd.service @@ -6,8 +6,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv Type=forking PIDFile=/var/run/radiusd/radiusd.pid ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd -ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap create-only -ExecStartPre=/bin/chgrp -R radiusd /etc/raddb/certs/ +ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C