diff --git a/.gitignore b/.gitignore index 2f5a9d8..4530dbe 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,15 @@ freeradius-*.src.rpm /freeradius-server-3.0.19.tar.bz2 /freeradius-server-3.0.20.tar.bz2 /freeradius-server-3.0.21.tar.bz2 +/freeradius-server-3.0.22.tar.bz2 +/freeradius-server-3.0.23.tar.bz2 +/freeradius-server-3.0.24.tar.bz2 +/freeradius-server-3.0.25.tar.bz2 +/freeradius-server-3.2.0.tar.bz2 +/freeradius-server-3.2.1.tar.bz2 +/freeradius-server-3.2.2.tar.bz2 +/freeradius-server-3.2.3.tar.bz2 +/freeradius-server-3.2.4.tar.bz2 +/freeradius-server-3.2.5.tar.bz2 +/freeradius-server-3.2.7.tar.bz2 +/freeradius-server-3.2.8.tar.bz2 diff --git a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch index 6b2329b..33747d0 100644 --- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch +++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch @@ -3,25 +3,27 @@ From: Nikolai Kondrashov Date: Mon, 8 Sep 2014 12:32:13 +0300 Subject: [PATCH] Adjust configuration to fit Red Hat specifics +[antorres@redhat.com]: update patch to match 3.2.7 release + --- raddb/mods-available/eap | 4 ++-- raddb/radiusd.conf.in | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 2621e183c..94494b2c6 100644 +index 84660d7c1e..ffcef4b406 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -533,7 +533,7 @@ - # You should also delete all of the files - # in the directory when the server starts. +@@ -696,7 +696,7 @@ eap { + # and create the temporary directory with the + # systemd `RuntimeDirectory` unit option. # - # tmpdir = /tmp/radiusd + # tmpdir = /var/run/radiusd/tmp # The command used to verify the client cert. # We recommend using the OpenSSL command-line -@@ -548,7 +548,7 @@ +@@ -711,7 +711,7 @@ eap { # deleted by the server when the command # returns. # @@ -30,6 +32,7 @@ index 2621e183c..94494b2c6 100644 } # OCSP Configuration + diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index a83c1f687..e500cf97b 100644 --- a/raddb/radiusd.conf.in diff --git a/freeradius-Use-system-crypto-policy-by-default.patch b/freeradius-Use-system-crypto-policy-by-default.patch index 199e583..74f3cfd 100644 --- a/freeradius-Use-system-crypto-policy-by-default.patch +++ b/freeradius-Use-system-crypto-policy-by-default.patch @@ -4,6 +4,7 @@ Date: Wed, 8 May 2019 10:16:31 -0400 Subject: [PATCH] Use system-provided crypto-policies by default Signed-off-by: Alexander Scheel +[antorres@redhat.com]: update patch to 3.2.1 state --- raddb/mods-available/eap | 4 ++-- raddb/mods-available/inner-eap | 2 +- @@ -12,21 +13,21 @@ Signed-off-by: Alexander Scheel 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap -index 36849e10f2..b28c0f19c6 100644 +index 62152a6dfc..9f64963034 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap -@@ -368,7 +368,7 @@ eap { - # - # For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2" +@@ -400,7 +400,7 @@ eap { + # TLS cipher suites. The format is listed + # in "man 1 ciphers". # - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - # If enabled, OpenSSL will use server cipher list - # (possibly defined by cipher_list option above) -@@ -912,7 +912,7 @@ eap { - # Note - for OpenSSL 1.1.0 and above you may need - # to add ":@SECLEVEL=0" + # Set this option to specify the allowed + # TLS signature algorithms for OpenSSL 1.1.1 and above. +@@ -1082,7 +1082,7 @@ eap { + # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is + # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used # - # cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" + # cipher_list = "PROFILE=SYSTEM" @@ -47,23 +48,23 @@ index 576eb7739e..ffa07188e2 100644 # You may want to set a very small fragment size. # The TLS data here needs to go inside of the diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls -index 92f1d6330e..cd69b3905a 100644 +index b8d0626bbe..073b2933c2 100644 --- a/raddb/sites-available/abfab-tls +++ b/raddb/sites-available/abfab-tls -@@ -19,7 +19,7 @@ listen { +@@ -20,7 +20,7 @@ listen { dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - cache { enable = no + lifetime = 24 # hours diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls -index bbc761b1c5..83cd35b851 100644 +index 137fcbc6cc..a65f8a8711 100644 --- a/raddb/sites-available/tls +++ b/raddb/sites-available/tls -@@ -215,7 +215,7 @@ listen { +@@ -292,7 +292,7 @@ listen { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". @@ -72,15 +73,15 @@ index bbc761b1c5..83cd35b851 100644 # If enabled, OpenSSL will use server cipher list # (possibly defined by cipher_list option above) -@@ -517,7 +517,7 @@ home_server tls { +@@ -676,7 +676,7 @@ home_server tls { # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". - cipher_list = "DEFAULT" + cipher_list = "PROFILE=SYSTEM" - } - } + # + # Connection timeout for outgoing TLS connections. -- 2.21.0 diff --git a/freeradius-configure-c99.patch b/freeradius-configure-c99.patch new file mode 100644 index 0000000..cc9daff --- /dev/null +++ b/freeradius-configure-c99.patch @@ -0,0 +1,35 @@ +The backtrace_symbols function expects a pointer to an array of void * +values, not a pointer to an array of a single element. Removing the +address operator ensures that the right type is used. + +This avoids an unconditional failure of this probe with compilers that +treat incompatible pointer types as a compilation error. + +Submitted upstream: + +diff --git a/configure b/configure +index ed01ee2bdd912f63..1e6d2284779cdd58 100755 +--- a/configure ++++ b/configure +@@ -13390,7 +13390,7 @@ main (void) + { + + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ++ backtrace_symbols(sym, sizeof(sym)) + ; + return 0; + } +diff --git a/configure.ac b/configure.ac +index 76320213b51d7bb4..6a689711d6c90483 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then + #include + ]], [[ + void *sym[1]; +- backtrace_symbols(&sym, sizeof(sym)) ]])],[ ++ backtrace_symbols(sym, sizeof(sym)) ]])],[ + AC_MSG_RESULT(yes) + ac_cv_lib_execinfo_backtrace_symbols="yes" + ],[ diff --git a/freeradius-ease-openssl-version-check.patch b/freeradius-ease-openssl-version-check.patch new file mode 100644 index 0000000..23f1df7 --- /dev/null +++ b/freeradius-ease-openssl-version-check.patch @@ -0,0 +1,35 @@ +From: Antonio Torres +Date: Tue, 12 Sep 2023 +Subject: Ease OpenSSL version check requirement + +FreeRADIUS includes an OpenSSL version check that compares built vs linked version, +and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as +ABI changes are tracked and soname is changed accordingly, as discussed in previous +Bugzilla for this issue [1]. + +[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511 +Signed-off-by: Antonio Torres +--- + src/main/version.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/main/version.c b/src/main/version.c +index c190337c1d..fee2150eb2 100644 +--- a/src/main/version.c ++++ b/src/main/version.c +@@ -79,11 +79,11 @@ int ssl_check_consistency(void) + */ + if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) { + mismatch: +- ERROR("libssl version mismatch. built: %lx linked: %lx", ++ DEBUG2("libssl version mismatch. built: %lx linked: %lx", + (unsigned long) ssl_built, + (unsigned long) ssl_linked); + +- return -1; ++ return 0; + } + + /* diff --git a/freeradius-ldap-infinite-timeout-on-starttls.patch b/freeradius-ldap-infinite-timeout-on-starttls.patch new file mode 100644 index 0000000..40df134 --- /dev/null +++ b/freeradius-ldap-infinite-timeout-on-starttls.patch @@ -0,0 +1,31 @@ +From: Antonio Torres +Date: Fri, 28 Jan 2022 +Subject: Use infinite timeout when using LDAP+start-TLS + +This will ensure that the TLS connection to the LDAP server will complete +before starting FreeRADIUS, as it forces libldap to use a blocking socket during +the process. Infinite timeout is the OpenLDAP default. +Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134 + +Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551 +Signed-off-by: Antonio Torres +--- + src/modules/rlm_ldap/ldap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c +index cf7a84e069..841bf888a1 100644 +--- a/src/modules/rlm_ldap/ldap.c ++++ b/src/modules/rlm_ldap/ldap.c +@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance) + } + + #ifdef LDAP_OPT_NETWORK_TIMEOUT +- if (inst->net_timeout) { ++ bool using_tls = inst->start_tls || ++ inst->port == 636 || ++ strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0; ++ if (inst->net_timeout && !using_tls) { + memset(&tv, 0, sizeof(tv)); + tv.tv_sec = inst->net_timeout; + diff --git a/freeradius-logrotate b/freeradius-logrotate index c962254..1a2ec6f 100644 --- a/freeradius-logrotate +++ b/freeradius-logrotate @@ -34,7 +34,7 @@ compress su radiusd radiusd postrotate - /usr/bin/systemctl reload-or-try-restart radiusd + /usr/bin/systemctl try-reload-or-restart radiusd endscript } diff --git a/freeradius-no-buildtime-cert-gen.patch b/freeradius-no-buildtime-cert-gen.patch index aa3be66..6846827 100644 --- a/freeradius-no-buildtime-cert-gen.patch +++ b/freeradius-no-buildtime-cert-gen.patch @@ -3,48 +3,52 @@ From: Alexander Scheel Date: Wed, 8 May 2019 12:58:02 -0400 Subject: [PATCH] Don't generate certificates in reproducible builds +[antorres@redhat.com]: updated to match upstream release 3.2.7 + Signed-off-by: Alexander Scheel --- Make.inc.in | 5 +++++ - configure | 4 ++++ + configure | 3 +++ configure.ac | 3 +++ raddb/all.mk | 4 ++++ - 4 files changed, 16 insertions(+) + 4 files changed, 15 insertions(+) diff --git a/Make.inc.in b/Make.inc.in index 0b2cd74de8..8c623cf95c 100644 --- a/Make.inc.in +++ b/Make.inc.in -@@ -173,3 +173,8 @@ else - TESTBINDIR = ./$(BUILD_DIR)/bin +@@ -174,6 +174,10 @@ else TESTBIN = ./$(BUILD_DIR)/bin endif -+ + +# +# With reproducible builds, do not generate certificates during installation +# +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@ + + # + # For creating documentation via doc/all.mk diff --git a/configure b/configure -index c2c599c92b..3d4403a844 100755 +index f1dfa97c44..ba5c53768d 100755 --- a/configure +++ b/configure -@@ -655,6 +655,7 @@ RUSERS +@@ -681,6 +681,7 @@ ACLOCAL + LAST + RUSERS SNMPWALK - SNMPGET - PERL +ENABLE_REPRODUCIBLE_BUILDS + SNMPGET openssl_version_check_config - WITH_DHCP - modconfdir -@@ -5586,6 +5587,7 @@ else - fi + WITH_RADLAST +@@ -7001,6 +7002,7 @@ fi -+ENABLE_REPRODUCIBLE_BUILDS=yes # Check whether --enable-reproducible-builds was given. - if test "${enable_reproducible_builds+set}" = set; then : ++ENABLE_REPRODUCIBLE_BUILDS=yes + if test ${enable_reproducible_builds+y} + then : enableval=$enable_reproducible_builds; case "$enableval" in -@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h +@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h ;; *) reproducible_builds=no @@ -52,19 +56,12 @@ index c2c599c92b..3d4403a844 100755 esac fi -@@ -5604,6 +5607,7 @@ fi - - - -+ - CHECKRAD=checkrad - # Extract the first word of "perl", so it can be a program name with args. - set dummy perl; ac_word=$2 + diff --git a/configure.ac b/configure.ac -index a7abf0025a..35b013f4af 100644 +index ce4d9b0ae5..790cbf02a0 100644 --- a/configure.ac +++ b/configure.ac -@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config]) +@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config]) dnl # dnl # extra argument: --enable-reproducible-builds dnl # @@ -72,7 +69,7 @@ index a7abf0025a..35b013f4af 100644 AC_ARG_ENABLE(reproducible-builds, [AS_HELP_STRING([--enable-reproducible-builds], [ensure the build does not change each time])], -@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds, +@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds, ;; *) reproducible_builds=no @@ -81,6 +78,10 @@ index a7abf0025a..35b013f4af 100644 ) +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS) + dnl # + dnl # Enable the -fsanitize=fuzzer and link in the address sanitizer + + dnl ############################################################# diff --git a/raddb/all.mk b/raddb/all.mk diff --git a/freeradius-no-sqlippool-tool.patch b/freeradius-no-sqlippool-tool.patch new file mode 100644 index 0000000..58d3282 --- /dev/null +++ b/freeradius-no-sqlippool-tool.patch @@ -0,0 +1,28 @@ +From: Antonio Torres +Date: Wed, 5 Mar 2025 +Subject: Remove sqlippool tool + +This script relies on a Perl package, perl-Net-IP, that won't be available. +Remove it from build script and let the user pull it manually instead, as it's +just a helper script for SQL module users. + +--- +diff --git a/scripts/all.mk b/scripts/all.mk +index a6e90aa3eb..517adb8590 100644 +--- a/scripts/all.mk ++++ b/scripts/all.mk +@@ -1,5 +1,5 @@ + install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \ +- $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool ++ $(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt + + $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd + @mkdir -p $(dir $@) +@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay + $(R)$(bindir)/radcrypt: scripts/cryptpasswd + @mkdir -p $(dir $@) + @$(INSTALL) -m 755 $< $@ +- +-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool +- @mkdir -p $(dir $@) +- @$(INSTALL) -m 755 $< $@ diff --git a/freeradius-openssl-no-engine.patch b/freeradius-openssl-no-engine.patch new file mode 100644 index 0000000..b03ae2b --- /dev/null +++ b/freeradius-openssl-no-engine.patch @@ -0,0 +1,54 @@ +diff --git a/configure b/configure +index 1e6d228..40a26f5 100755 +--- a/configure ++++ b/configure +@@ -10518,7 +10518,7 @@ smart_prefix= + printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h + + +- for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h ++ for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h + do : + as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh` + ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" +diff --git a/configure.ac b/configure.ac +index 6a68971..4a95148 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then + openssl/rand.h \ + openssl/sha.h \ + openssl/ssl.h \ +- openssl/ocsp.h \ +- openssl/engine.h, ++ openssl/ocsp.h, + [ OPENSSL_CPPFLAGS="$smart_include" ], + [ + AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=, or --with-openssl=no (builds without OpenSSL)]) +diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in +index 4774482..21d5cea 100644 +--- a/src/include/autoconf.h.in ++++ b/src/include/autoconf.h.in +@@ -285,9 +285,6 @@ + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_CRYPTO_H + +-/* Define to 1 if you have the header file. */ +-#undef HAVE_OPENSSL_ENGINE_H +- + /* Define to 1 if you have the header file. */ + #undef HAVE_OPENSSL_ERR_H + +diff --git a/src/include/tls-h b/src/include/tls-h +index 506fb19..514e03a 100644 +--- a/src/include/tls-h ++++ b/src/include/tls-h +@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$") + # define OPENSSL_NO_KRB5 + #endif + #include +-#ifdef HAVE_OPENSSL_ENGINE_H ++#ifndef OPENSSL_NO_ENGINE + # include + #endif + #include diff --git a/freeradius.spec b/freeradius.spec index 2ea27bb..7b65a15 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,8 +1,8 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.21 -Release: 11%{?dist} -License: GPLv2+ and LGPLv2+ +Version: 3.2.8 +Release: 2%{?dist} +License: GPL-2.0-or-later AND LGPL-2.0-or-later URL: http://www.freeradius.org/ # Is elliptic curve cryptography supported? @@ -14,17 +14,23 @@ URL: http://www.freeradius.org/ %global dist_base freeradius-server-%{version} -Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2 +Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2 Source100: radiusd.service Source102: freeradius-logrotate Source103: freeradius-pam-conf Source104: freeradius-tmpfiles.conf +Source105: freeradius.sysusers Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch Patch5: freeradius-bootstrap-make-permissions.patch +Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch +Patch7: freeradius-ease-openssl-version-check.patch +Patch8: freeradius-configure-c99.patch +Patch9: freeradius-openssl-no-engine.patch +Patch10: freeradius-no-sqlippool-tool.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -42,7 +48,9 @@ BuildRequires: readline-devel BuildRequires: libpcap-devel BuildRequires: systemd-units BuildRequires: libtalloc-devel -BuildRequires: pcre-devel +BuildRequires: chrpath +BuildRequires: systemd-rpm-macros +BuildRequires: libxcrypt-devel %if ! 0%{?rhel} BuildRequires: libyubikey-devel @@ -52,7 +60,7 @@ BuildRequires: ykclient-devel # Require OpenSSL version we built with, or newer, to avoid startup failures # due to runtime OpenSSL version checks. Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl) -Requires(pre): shadow-utils glibc-common +Requires(pre): glibc-common Requires(post): systemd-sysv Requires(post): systemd-units # Needed for certificate generation as upstream bootstrap script isn't @@ -123,7 +131,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project. %package perl Summary: Perl support for freeradius Requires: %{name} = %{version}-%{release} -Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) %{?fedora:BuildRequires: perl-devel} BuildRequires: perl-devel BuildRequires: perl-generators @@ -197,33 +204,39 @@ BuildRequires: json-c-devel %description rest This plugin provides the REST support for the FreeRADIUS server project. + +%package kafka +Summary: Kafka producer support for FreeRADIUS +Requires: %{name} = %{version}-%{release} +Requires: librdkafka +BuildRequires: librdkafka-devel + +%description kafka +This plugin provides Kafka producer support for the FreeRADIUS server project. + %prep %setup -q -n %{dist_base} # Note: We explicitly do not make patch backup files because 'make install' # mistakenly includes the backup files, especially problematic for raddb config files. -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 +%patch -P1 -p1 +%patch -P2 -p1 +%patch -P3 -p1 +%patch -P4 -p1 +%patch -P5 -p1 +%patch -P6 -p1 +%patch -P7 -p1 +%patch -P8 -p1 +%patch -P9 -p1 +%patch -P10 -p1 %build # Force compile/link options, extra security for network facing daemon %global _hardened_build 1 -# Hack: rlm_python3 as stable; prevents building other unstable modules. -sed 's/rlm_python/rlm_python3/g' src/modules/stable -i - -# python3-config is broken: -# https://bugzilla.redhat.com/show_bug.cgi?id=1772988 -export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" +%global build_ldflags %{build_ldflags} $(python3-config --embed --libs) +export PY3_LIB_DIR="$(python3-config --configdir)" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" -# In order for the above hack to stick, do a fake configure so -# we can run reconfig before cleaning up after ourselves and running -# configure for real. -./configure && make reconfig && (make clean distclean || true) - %configure \ --libdir=%{_libdir}/freeradius \ --enable-reproducible-builds \ @@ -242,6 +255,7 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v --with-rlm_python3 \ --with-rlm-python3-lib-dir=$PY3_LIB_DIR \ --with-rlm-python3-include-dir=$PY3_INC_DIR \ + --without-rlm_python \ --without-rlm_eap_ikev2 \ --without-rlm_eap_tnc \ --without-rlm_sql_iodbc \ @@ -273,11 +287,21 @@ mkdir -p %{buildroot}%{_localstatedir}/run/ install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/ install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf +install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf # install SNMP MIB files mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ +# remove rpath where needed +chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so +for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done +for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done + +# update ld with freeradius libs +mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d +echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf + # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl @@ -344,23 +368,23 @@ All documentation is in the freeradius-doc sub-package. EOF - -# Make sure our user/group is present prior to any package or subpackage installation -%pre -getent group radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1 -getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1 -exit 0 - %preun %systemd_preun radiusd.service -%postun -%systemd_postun_with_restart radiusd.service -if [ $1 -eq 0 ]; then # uninstall - getent passwd radiusd >/dev/null && /usr/sbin/userdel radiusd > /dev/null 2>&1 - getent group radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1 +%post +# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017 +# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96 +if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit on || : fi -exit 0 + +%postun +if [ $1 -eq 0 ]; then + if [ -x /usr/sbin/setsebool ]; then + /usr/sbin/setsebool -P radius_use_jit off || : + fi +fi +%systemd_postun_with_restart radiusd.service /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || : @@ -376,8 +400,10 @@ exit 0 # system %config(noreplace) %{_sysconfdir}/pam.d/radiusd %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd +%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf %{_unitdir}/radiusd.service %{_tmpfilesdir}/radiusd.conf +%{_sysusersdir}/freeradius.conf %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd @@ -410,7 +436,8 @@ exit 0 %dir %attr(770,root,radiusd) /etc/raddb/certs %config(noreplace) /etc/raddb/certs/Makefile %config(noreplace) /etc/raddb/certs/passwords.mk -/etc/raddb/certs/README +/etc/raddb/certs/README.md +/etc/raddb/certs/realms/README.md %config(noreplace) /etc/raddb/certs/xpextensions %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf %attr(750,root,radiusd) /etc/raddb/certs/bootstrap @@ -424,6 +451,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/* %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/* +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter @@ -435,6 +463,8 @@ exit 0 # sites-available %dir %attr(750,root,radiusd) /etc/raddb/sites-available /etc/raddb/sites-available/README +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting @@ -456,8 +486,11 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache # sites-enabled # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx @@ -471,7 +504,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui @@ -480,6 +513,9 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients @@ -493,6 +529,8 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip @@ -500,7 +538,6 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd @@ -517,21 +554,24 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit # mods-enabled # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled %config(missingok) /etc/raddb/mods-enabled/always %config(missingok) /etc/raddb/mods-enabled/attr_filter -%config(missingok) /etc/raddb/mods-enabled/cache_eap %config(missingok) /etc/raddb/mods-enabled/chap %config(missingok) /etc/raddb/mods-enabled/date %config(missingok) /etc/raddb/mods-enabled/detail @@ -556,9 +596,11 @@ exit 0 %config(missingok) /etc/raddb/mods-enabled/replicate %config(missingok) /etc/raddb/mods-enabled/soh %config(missingok) /etc/raddb/mods-enabled/sradutmp +%config(missingok) /etc/raddb/mods-enabled/totp %config(missingok) /etc/raddb/mods-enabled/unix %config(missingok) /etc/raddb/mods-enabled/unpack %config(missingok) /etc/raddb/mods-enabled/utf8 +%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit # policy %dir %attr(750,root,radiusd) /etc/raddb/policy.d @@ -576,10 +618,10 @@ exit 0 # binaries %defattr(-,root,root) -/usr/sbin/checkrad -/usr/sbin/raddebug -/usr/sbin/radiusd -/usr/sbin/radmin +%{_bindir}/checkrad +%{_bindir}/raddebug +%{_bindir}/radiusd +%{_bindir}/radmin # dictionaries %dir %attr(755,root,root) /usr/share/freeradius @@ -604,7 +646,6 @@ exit 0 %{_libdir}/freeradius/rlm_cache_rbtree.so %{_libdir}/freeradius/rlm_chap.so %{_libdir}/freeradius/rlm_counter.so -%{_libdir}/freeradius/rlm_cram.so %{_libdir}/freeradius/rlm_date.so %{_libdir}/freeradius/rlm_detail.so %{_libdir}/freeradius/rlm_dhcp.so @@ -613,7 +654,6 @@ exit 0 %{_libdir}/freeradius/rlm_eap.so %{_libdir}/freeradius/rlm_eap_fast.so %{_libdir}/freeradius/rlm_eap_gtc.so -%{_libdir}/freeradius/rlm_eap_leap.so %{_libdir}/freeradius/rlm_eap_md5.so %{_libdir}/freeradius/rlm_eap_mschapv2.so %{_libdir}/freeradius/rlm_eap_peap.so @@ -628,10 +668,10 @@ exit 0 %{_libdir}/freeradius/rlm_expr.so %{_libdir}/freeradius/rlm_files.so %{_libdir}/freeradius/rlm_ippool.so +%{_libdir}/freeradius/rlm_json.so %{_libdir}/freeradius/rlm_linelog.so %{_libdir}/freeradius/rlm_logintime.so %{_libdir}/freeradius/rlm_mschap.so -%{_libdir}/freeradius/rlm_otp.so %{_libdir}/freeradius/rlm_pam.so %{_libdir}/freeradius/rlm_pap.so %{_libdir}/freeradius/rlm_passwd.so @@ -644,12 +684,17 @@ exit 0 %{_libdir}/freeradius/rlm_sql.so %{_libdir}/freeradius/rlm_sqlcounter.so %{_libdir}/freeradius/rlm_sqlippool.so +%{_libdir}/freeradius/rlm_sql_map.so %{_libdir}/freeradius/rlm_sql_null.so +%{_libdir}/freeradius/rlm_totp.so %{_libdir}/freeradius/rlm_unix.so %{_libdir}/freeradius/rlm_unpack.so %{_libdir}/freeradius/rlm_utf8.so %{_libdir}/freeradius/rlm_wimax.so %{_libdir}/freeradius/rlm_yubikey.so +%{_libdir}/freeradius/rlm_dpsk.so +%{_libdir}/freeradius/rlm_eap_teap.so +%{_libdir}/freeradius/rlm_proxy_rate_limit.so # main man pages %doc %{_mandir}/man5/clients.conf.5.gz @@ -670,6 +715,7 @@ exit 0 %doc %{_mandir}/man5/rlm_passwd.5.gz %doc %{_mandir}/man5/rlm_realm.5.gz %doc %{_mandir}/man5/rlm_sql.5.gz +%doc %{_mandir}/man5/rlm_unbound.5.gz %doc %{_mandir}/man5/rlm_unix.5.gz %doc %{_mandir}/man5/unlang.5.gz %doc %{_mandir}/man5/users.5.gz @@ -677,6 +723,7 @@ exit 0 %doc %{_mandir}/man8/radiusd.8.gz %doc %{_mandir}/man8/radmin.8.gz %doc %{_mandir}/man8/radrelay.8.gz +%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz # MIB files %{_datadir}/snmp/mibs/*RADIUS*.mib @@ -738,6 +785,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf @@ -745,14 +793,49 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf +%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql + %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql + +%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql @@ -776,6 +859,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf @@ -804,6 +888,7 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf @@ -822,8 +907,9 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql -%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -838,7 +924,193 @@ exit 0 %{_libdir}/freeradius/rlm_rest.so %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest +%files kafka +%{_libdir}/freeradius/rlm_kafka.so +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf + %changelog +* Mon Jan 05 2026 Antonio Torres - 3.2.8-2 +- Enable selinux flag for JIT usage + Resolves: #2427017 + +* Mon Nov 10 2025 Antonio Torres - 3.2.8-1 +- Update to upstream release 3.2.8 + +* Wed Jul 23 2025 Fedora Release Engineering - 3.2.7-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jul 08 2025 Jitka Plesnikova - 3.2.7-5 +- Perl 5.42 rebuild + +* Wed Jun 11 2025 Antonio Torres - 3.2.7-4 +- Update logrotate postrotate script with `systemctl try-reload-or-restart` + Resolves: rhbz#2371329 + +* Mon Jun 02 2025 Python Maint - 3.2.7-3 +- Rebuilt for Python 3.14 + +* Wed Mar 5 2025 Antonio Torres - 3.2.7-1 +- Update to upstream release 3.2.7 + +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - 3.2.5-7 +- Drop call to %sysusers_create_compat + +* Sat Feb 01 2025 Björn Esser - 3.2.5-6 +- Add explicit BR: libxcrypt-devel + +* Thu Jan 23 2025 Antonio Torres - 3.2.5-5 +- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin + +* Thu Jan 16 2025 Fedora Release Engineering - 3.2.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Nov 06 2024 Yaakov Selkowitz - 3.2.5-3 +- Drop openssl-devel-engine dependency + +* Wed Jul 17 2024 Fedora Release Engineering - 3.2.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jul 09 2024 Antonio Torres - 3.2.5-1 +- Update to upstream release 3.2.5 + +* Wed Jun 12 2024 Jitka Plesnikova - 3.2.4-3 +- Perl 5.40 rebuild + +* Fri Jun 07 2024 Python Maint - 3.2.4-2 +- Rebuilt for Python 3.13 + +* Fri May 31 2024 Antonio Torres - 3.2.4-1 +- Update to upstream release 3.2.4 + +* Wed Jan 24 2024 Fedora Release Engineering - 3.2.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jan 19 2024 Fedora Release Engineering - 3.2.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Dec 19 2023 Florian Weimer - 3.2.3-2 +- Fix C compatibility issue in configure script + +* Tue Oct 24 2023 Antonio Torres - 3.2.3-1 +- Update to upstream release 3.2.3 + +* Tue Sep 12 2023 Antonio Torres - 3.2.2-5 +- Ease OpenSSL version check requirement + Resolves #2238511 + +* Wed Jul 19 2023 Fedora Release Engineering - 3.2.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Jitka Plesnikova - 3.2.2-3 +- Perl 5.38 rebuild + +* Tue Jun 13 2023 Python Maint - 3.2.2-2 +- Rebuilt for Python 3.12 + +* Tue Mar 21 2023 Antonio Torres - 3.2.2-1 +- Update to upstream release 3.2.2 + +* Wed Mar 15 2023 Antonio Torres - 3.2.1-4 +- Migrate to SPDX license + +* Thu Jan 19 2023 Fedora Release Engineering - 3.2.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Oct 17 2022 Antonio Torres - 3.2.1-2 +- Remove hack for Python3 support from specfile + +* Mon Oct 17 2022 Antonio Torres - 3.2.1-1 +- Update to 3.2.1 upstream release + Resolves #2131850 + +* Tue Sep 20 2022 Antonio Torres - 3.2.0-4 +- Remove deprecated pcre-devel dependency + Resolves #2128292 + +* Mon Sep 5 2022 Antonio Torres - 3.2.0-3 +- configure: allow building with runstatedir option + Resolves: #2123374 + +* Thu Jul 21 2022 Fedora Release Engineering - 3.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Jul 19 2022 Antonio Torres - 3.2.0-1 +- Rebase to 3.2.0 upstream release + Related: #2077687 + +* Wed Jun 29 2022 Antonio Torres - 3.0.25-8 +- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107) + Related: #2095741 + +* Fri Jun 24 2022 Antonio Torres - 3.0.25-7 +- Dynamically allocate users using sysusers.d format + Related: #2095741 + +* Mon Jun 13 2022 Python Maint - 3.0.25-6 +- Rebuilt for Python 3.11 + +* Tue May 31 2022 Jitka Plesnikova - 3.0.25-5 +- Perl 5.36 rebuild + +* Fri Apr 22 2022 Antonio Torres - 3.0.25-4 +- Use infinite timeout when using LDAP+start-TLS + Related: #1983063 + +* Thu Jan 20 2022 Fedora Release Engineering - 3.0.25-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Oct 14 2021 Antonio Torres - 3.0.25-2 +- Fix file conflict in SQL files + Resolves: bz#2014014 + +* Fri Oct 08 2021 Antonio Torres - 3.0.25-1 +- Update to 3.0.25. + Resolves: bz#2011984 + +* Thu Sep 30 2021 Antonio Torres - 3.0.24-1 +- Update to 3.0.24. + Resolves: bz#2009036 + +* Tue Sep 14 2021 Sahana Prasad - 3.0.23-7 +- Rebuilt with OpenSSL 3.0.0 + +* Wed Jul 21 2021 Fedora Release Engineering - 3.0.23-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Jul 15 2021 Antonio Torres - 3.0.23-5 +- Fix coredump not being able to be enabled + +* Sat Jul 10 2021 Björn Esser - 3.0.23-4 +- Rebuild for versioned symbols in json-c + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Fix rpath not being removed correctly + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-2 +- Remove RPATH usage from additional binaries + +* Tue Jun 29 2021 Antonio Torres - 3.0.23-1 +- Rebase to 3.0.23 + Fixes: bz#1970528 + +* Tue Jun 29 2021 Antonio Torres - 3.0.22-5 +- Fix binaries not being correctly linked after RPATH removal + +* Fri Jun 25 2021 Antonio Torres - 3.0.22-4 +- Fix python3 not being correctly linked + +* Mon Jun 07 2021 Python Maint - 3.0.22-2 +- Rebuilt for Python 3.10 + +* Fri Jun 4 2021 Antonio Torres - 3.0.22-1 +- Rebased to 3.0.22 + Resolves: bz#1961190 + +* Fri May 21 2021 Jitka Plesnikova - 3.0.21-12 +- Perl 5.34 rebuild + * Wed Mar 10 2021 Robbie Harwood - 3.0.21-11 - Disable automatic bootstrap diff --git a/freeradius.sysusers b/freeradius.sysusers new file mode 100644 index 0000000..af912e0 --- /dev/null +++ b/freeradius.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +u radiusd 95 "radiusd user" /var/lib/radiusd /sbin/nologin +g radiusd 95 - - - diff --git a/radiusd.service b/radiusd.service index f545280..9bfa3cd 100644 --- a/radiusd.service +++ b/radiusd.service @@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv [Service] Type=forking PIDFile=/var/run/radiusd/radiusd.pid -ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd +ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd ExecStartPre=/usr/sbin/radiusd -C ExecStart=/usr/sbin/radiusd -d /etc/raddb ExecReload=/usr/sbin/radiusd -C diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..0c3bdf7 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,3 @@ +--- +inspections: + badfuncs: off diff --git a/sources b/sources index a895a5a..3fdee90 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729 +SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae diff --git a/tests/auth-tests/freeradius-tests.py b/tests/auth-tests/freeradius-tests.py index da5afe1..d646188 100755 --- a/tests/auth-tests/freeradius-tests.py +++ b/tests/auth-tests/freeradius-tests.py @@ -15,7 +15,6 @@ import unittest import subprocess import signal import shutil -import psutil import socket RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid' diff --git a/tests/auth-tests/runtest.sh b/tests/auth-tests/runtest.sh index 7be8432..ceaeaa7 100755 --- a/tests/auth-tests/runtest.sh +++ b/tests/auth-tests/runtest.sh @@ -16,6 +16,25 @@ PACKAGE="freeradius" RADIUS_CLIENT_CONF="/etc/raddb/clients.conf" RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize" +generate_cert(){ + pushd /etc/raddb/certs/ + #remove certificates if exists;generate new certificates + if [[ -f /etc/raddb/certs/bootstrap ]]; then + rlLog "Destroy and create new default certificates via bootstrap script" + rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh + rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates" + else + rlLogWarning "!!! WARNING bootsrap file does not exist !!!" + rlLog "Destroy and create new default certificates via make scripts" + make destroycerts -C /etc/raddb/certs/ + #create new certificates + make -C /etc/raddb/certs/ + chown root:radiusd dh ca.* client.* server.* + chmod 640 dh ca.* client.* server.* + fi + popd +} + rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE @@ -29,6 +48,7 @@ rlJournalStart rlRun "cp clients.conf $RADIUS_CLIENT_CONF" rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE" rlRun "systemctl daemon-reload" + generate_cert rlPhaseEnd rlPhaseStartTest