Enable SELinux flag for JIT usage

Resolves: #2427017
Signed-off-by: Antonio Torres <antorres@redhat.com>

.gitignore

@@ -1,3 +1,11 @@
+# Ignore build artifacts and signatures
+*.sig
+.build*.log
+freeradius-server-*/
+x86_64/
+freeradius-*.src.rpm
+
+# Automatically added
 /freeradius-server-2.1.9.tar.bz2
 /freeradius-server-2.1.10.tar.bz2
 /freeradius-server-2.1.11.tar.bz2
@@ -20,3 +28,21 @@
 /freeradius-server-3.0.13.tar.bz2
 /freeradius-server-3.0.14.tar.bz2
 /freeradius-server-3.0.15.tar.bz2
+/freeradius-server-3.0.17.tar.bz2
+/freeradius-server-3.0.18.tar.gz
+/freeradius-server-3.0.18.tar.bz2
+/freeradius-server-3.0.19.tar.bz2
+/freeradius-server-3.0.20.tar.bz2
+/freeradius-server-3.0.21.tar.bz2
+/freeradius-server-3.0.22.tar.bz2
+/freeradius-server-3.0.23.tar.bz2
+/freeradius-server-3.0.24.tar.bz2
+/freeradius-server-3.0.25.tar.bz2
+/freeradius-server-3.2.0.tar.bz2
+/freeradius-server-3.2.1.tar.bz2
+/freeradius-server-3.2.2.tar.bz2
+/freeradius-server-3.2.3.tar.bz2
+/freeradius-server-3.2.4.tar.bz2
+/freeradius-server-3.2.5.tar.bz2
+/freeradius-server-3.2.7.tar.bz2
+/freeradius-server-3.2.8.tar.bz2

find_module_deps

@@ -1,385 +0,0 @@
-#!/usr/bin/env python
-
-import exceptions
-import getopt
-import os
-import re
-import rpm
-import select
-import subprocess
-import sys
-
-#------------------------------------------------------------------------------
-
-def get_rlms(root):
-    rlm_re = re.compile(r'^rlm_')
-    version_re = re.compile(r'-[0-9.]+\.so$')
-    names = os.listdir(root)
-    names = [x for x in names if rlm_re.search(x)]
-    names = [x for x in names if not version_re.search(x)]
-    names.sort()
-    return names
-
-#------------------------------------------------------------------------------
-
-debug = False
-verbose = False
-
-exclude_rpms = ['glibc']
-
-build = '2.0.2-1.fc8'
-root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius'
-libdirs = ['/lib','/usr/lib']
-
-#------------------------------------------------------------------------------
-
-def get_rpm_nvr_from_header(hdr):
-    'Given an RPM header return the package NVR as a string'
-    name    = hdr['name']
-    version = hdr['version']
-    release = hdr['release']
-
-    return "%s-%s-%s" % (name, version, release)
-
-def get_rpm_hdr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = None
-    try:
-        ts = rpm.ts()
-        mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path)
-        for hdr in mi: break
-    except Exception, e:
-        print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e)
-        hdr = None
-    return hdr
-
-def get_rpm_nvr_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    nvr = get_rpm_nvr_from_header(hdr)
-    return nvr
-
-def get_rpm_name_by_file_path(path):
-    if path is None:
-        return None
-
-    hdr = get_rpm_hdr_by_file_path(path)
-    if not hdr:
-        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
-    name = hdr['name']
-    return name
-
-#------------------------------------------------------------------------------
-
-class CmdError(exceptions.Exception):
-    def __init__(self, errno, msg):
-        self.errno = errno
-        self.msg = msg
-
-
-class Command:
-    def __init__(self, cmd):
-        self.cmd = cmd
-        self.sub_process = None
-        self.bufsize = 1024
-        self.stdout_buf = ''
-        self.stderr_buf = ''
-        self.stdout_lines = []
-        self.stderr_lines = []
-
-    def run(self, stdout_callback=None, stderr_callback=None):
-        self.sub_process = subprocess.Popen(self.cmd, \
-            stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \
-            close_fds=True, shell=True)
-        self.stdout = self.sub_process.stdout
-        self.stderr = self.sub_process.stderr
-
-        read_watch = [self.stdout, self.stderr]
-        while read_watch:
-            readable = select.select(read_watch, [], [])[0]
-            for fd in readable:
-                if fd == self.stdout:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stdout_buf += data
-                    for line in self.burst_lines('stdout_buf'):
-                        if stdout_callback: stdout_callback(line)
-                        self.stdout_lines.append(line)
-                if fd == self.stderr:
-                    data = os.read(fd.fileno(), self.bufsize)
-                    if not data:
-                        read_watch.remove(fd)
-                    else:
-                        self.stderr_buf += data
-                    for line in self.burst_lines('stderr_buf'):
-                        if stdout_callback: stderr_callback(line)
-                        self.stderr_lines.append(line)
-
-        self.returncode = self.sub_process.wait()
-        if self.returncode:
-            raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines)))
-
-        return self.returncode
-
-    def burst_lines(self, what):
-        buf = getattr(self, what)
-        start = 0
-        end = buf.find('\n', start)
-        while end >= 0:
-            end += 1                # include newline
-            line = buf[start:end]
-            yield line
-            start = end
-            end = buf.find('\n', start)
-        buf = buf[start:]
-        setattr(self, what, buf)
-
-
-#------------------------------------------------------------------------------
-
-def get_so_requires(path):
-    requires = {}
-    cmd = 'ldd %s' % (path)
-    so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            if match.group(2).startswith('/'):
-                so_path = match.group(2)
-            else:
-                so_path = None
-
-            requires[so_name] = so_path
-    return requires
-
-def get_so_needed(path):
-    needed = []
-    cmd = 'readelf -d %s' % (path)
-    so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]')
-
-    c = Command(cmd)
-    status = c.run()
-
-    for line in c.stdout_lines:
-        line = line.strip()
-        match = so_re.search(line)
-        if match:
-            so_name = match.group(1)
-            needed.append(so_name)
-    return needed
-
-def format_size(size):
-    if size > 1000000000:
-        return '%.1f GB' % (size/1000000000.0)
-    if size > 1000000:
-        return '%.1f MB' % (size/1000000.0)
-    if size > 1000:
-        return '%.1f KB' % (size/1000.0)
-    return '%d' % (size)
-#------------------------------------------------------------------------------
-
-class RPM_Prop:
-    def __init__(self, path=None, name=None):
-        self.name = name
-        self.paths = {}
-        self.rpm_hdr = None
-        self.used_by = {}
-        if path:
-            self.register_path(path)
-            if not self.rpm_hdr:
-                self.rpm_hdr = get_rpm_hdr_by_file_path(path)
-            if self.rpm_hdr:
-                if not self.name:
-                    self.name = self.rpm_hdr[rpm.RPMTAG_NAME]
-                self.size = self.rpm_hdr[rpm.RPMTAG_SIZE]
-
-    def __str__(self):
-        return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys()))
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        return self.paths.setdefault(path, path)
-
-class RPM_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        rpm_prop = self.paths.get(path)
-        if not rpm_prop:
-            rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path))
-        self.names.setdefault(rpm_prop.name, rpm_prop)
-        return rpm_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-    def get_name(self, name):
-        return self.names.get(name)
-
-class SO_File:
-    def __init__(self, name=None, path=None):
-        self.name = name
-        self.path = path
-        self.rpm = None
-
-    def __str__(self):
-        if self.rpm:
-            rpm_name = self.rpm.name
-        else:
-            rpm_name = None
-        return "name=%s rpm=%s" % (self.name, rpm_name)
-
-class SO_Collection:
-    def __init__(self):
-        self.names = {}
-        self.paths = {}
-
-    def __str__(self):
-        text = ''
-        names = self.get_names()
-        for name in names:
-            text += "%s: %s\n" % (name, self.names[name])
-        return text
-
-    def register_path(self, path, name=None):
-        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
-        so_prop = self.paths.get(path)
-        if not so_prop:
-            so_prop = self.paths.setdefault(path, SO_File(name, path=path))
-        self.names.setdefault(name, so_prop)
-        return so_prop
-
-    def get_names(self):
-        names = self.names.keys()
-        names.sort()
-        return names
-
-class LoadableModule:
-    def __init__(self, path, name=None):
-        if name is None:
-            name = os.path.basename(path)
-        self.name = name
-        self.path = path
-        self.rpm_names = {}
-        self.sos = SO_Collection()
-        self.get_so_requires()
-
-    def __str__(self):
-        text = '%s\n' % (self.name)
-        text += "    RPM's: %s\n" % (','.join(self.get_rpm_names()))
-        text += "    SO's: %s\n" % (','.join(self.sos.get_names()))
-        return text
-
-    def get_so_requires(self):
-        requires = get_so_requires(self.path)
-        needed = get_so_needed(self.path)
-        #print "%s requires=%s" % (self.name, requires)
-        #print "%s needed=%s" % (self.name, needed)
-
-        for so_name, so_path in requires.items():
-            if so_name not in needed: continue
-            if so_path:
-                so_prop = self.sos.register_path(so_path, so_name)
-                rpm_prop = rpms.register_path(so_prop.path)
-                rpm_prop.used_by[self.name] = 1
-                self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name)
-                so_prop.rpm = rpm_prop
-            else:
-                so_prop = None
-            if verbose: print "found so='%s' %s" % (so_name, so_prop)
-
-    def register_so(self, so):
-        if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so)
-        self.sos.setdefault(so, so)
-        self.names.setdefault(so.name, so)
-        return so
-
-    def get_rpm_names(self):
-        rpm_names = self.rpm_names.keys()
-        rpm_names.sort()
-        return rpm_names
-
-    def get_sos(self):
-        sos = self.sos.keys()
-        sos.sort(lambda a,b: cmp(a.name, b.name))
-        return sos
-
-#------------------------------------------------------------------------------
-
-#------------------------------------------------------------------------------
-
-opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose'])
-for o, a in opts:
-    if o in ['-b', '--build']:
-        build = a
-    elif o in ['-v', '--verbose']:
-        verbose = True
-    else:
-        print >> sys.stderr, "Unknown arg: %s" % o
-        sys.exit(1)
-
-root = root_template % build
-modules = get_rlms(root)
-module_paths = [os.path.join(root,x) for x in modules]
-rpms = RPM_Collection()
-
-lms = []
-for module_path in module_paths[:]:
-    lm = LoadableModule(module_path)
-    lms.append(lm)
-
-
-print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules))
-
-for lm in lms:
-    rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms]
-    if rpm_names:
-        print lm.name
-        print '    %s' % (','.join(rpm_names))
-
-print "--------------"
-
-rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms]
-rpm_props.sort(lambda a,b: cmp(a.name, b.name))
-for rpm_prop in rpm_props:
-    used_by = rpm_prop.used_by.keys()
-    used_by.sort()
-    print "%s: %s" % (rpm_prop.name, ','.join(used_by))
-
-print "--------------"
-
-rpm_props.sort(lambda a,b: cmp(a.size, b.size))
-for rpm_prop in rpm_props:
-    print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name)
-
-
-print "--------------"
-
-for lm in lms:
-    print lm

freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch

@@ -3,33 +3,36 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics
 
+[antorres@redhat.com]: update patch to match 3.2.7 release
+
 ---
  raddb/mods-available/eap | 4 ++--
  raddb/radiusd.conf.in    | 7 +++----
  2 files changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 2621e183c..94494b2c6 100644
+index 84660d7c1e..ffcef4b406 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -472,7 +472,7 @@ eap {
+@@ -696,7 +696,7 @@ eap {
+ 			#  and create the temporary directory with the
+ 			#  systemd `RuntimeDirectory` unit option.
  			#
- 			#  You should also delete all of the files
- 			#  in the directory when the server starts.
--	#		tmpdir = /tmp/radiusd
-+	#		tmpdir = /var/run/radiusd/tmp
+-		#	tmpdir = /tmp/radiusd
++		#	tmpdir = /var/run/radiusd/tmp
  
  			#  The command used to verify the client cert.
  			#  We recommend using the OpenSSL command-line
-@@ -486,7 +486,7 @@ eap {
- 			#  in PEM format.  This file is automatically
+@@ -711,7 +711,7 @@ eap {
  			#  deleted by the server when the command
  			#  returns.
--	#		client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
-+	#		client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
+ 			#
+-		#	client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
++		#	client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
  		}
  
- 		#
+ 		#  OCSP Configuration
+
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in

freeradius-Use-system-crypto-policy-by-default.patch

@@ -1,33 +1,44 @@
-From d78bf5ab1f5c8102b2b6051cfb1198488be9597d Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Mon, 26 Sep 2016 19:48:36 +0300
-Subject: [PATCH] Use system crypto policy by default
+From a7ed62fbcc043a9ec7a4f09962a2cd2acffa019b Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 10:16:31 -0400
+Subject: [PATCH] Use system-provided crypto-policies by default
 
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+[antorres@redhat.com]: update patch to 3.2.1 state
 ---
- raddb/mods-available/eap        | 2 +-
+ raddb/mods-available/eap        | 4 ++--
  raddb/mods-available/inner-eap  | 2 +-
  raddb/sites-available/abfab-tls | 2 +-
  raddb/sites-available/tls       | 4 ++--
- 4 files changed, 5 insertions(+), 5 deletions(-)
+ 4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 94494b2c6..9a8dc9327 100644
+index 62152a6dfc..9f64963034 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -323,7 +323,7 @@ eap {
- 		#
- 		# For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
+@@ -400,7 +400,7 @@ eap {
+ 		#  TLS cipher suites.  The format is listed
+ 		#  in "man 1 ciphers".
  		#
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
  
- 		# If enabled, OpenSSL will use server cipher list
- 		# (possibly defined by cipher_list option above)
+ 		#  Set this option to specify the allowed
+ 		#  TLS signature algorithms for OpenSSL 1.1.1 and above.
+@@ -1082,7 +1082,7 @@ eap {
+ 		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+ 		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+ 		#
+-	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
++	#	cipher_list = "PROFILE=SYSTEM"
+ 
+ 		#  PAC lifetime in seconds (default: seven days)
+ 		#
 diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap
-index 2b4df6267..af9aa88cd 100644
+index 576eb7739e..ffa07188e2 100644
 --- a/raddb/mods-available/inner-eap
 +++ b/raddb/mods-available/inner-eap
-@@ -68,7 +68,7 @@ eap inner-eap {
+@@ -77,7 +77,7 @@ eap inner-eap {
  		#  certificates.  If so, edit this file.
  		ca_file = ${cadir}/ca.pem
  
@@ -37,23 +48,23 @@ index 2b4df6267..af9aa88cd 100644
  		#  You may want to set a very small fragment size.
  		#  The TLS data here needs to go inside of the
 diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
-index 5dbe143da..46b5fea78 100644
+index b8d0626bbe..073b2933c2 100644
 --- a/raddb/sites-available/abfab-tls
 +++ b/raddb/sites-available/abfab-tls
-@@ -19,7 +19,7 @@ listen {
+@@ -20,7 +20,7 @@ listen {
  		dh_file = ${certdir}/dh
  		fragment_size = 8192
  		ca_path = ${cadir}
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 
  		cache {
  			enable = no
+ 			lifetime = 24 # hours
 diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
-index cf1cd7a8a..7dd59cb6f 100644
+index 137fcbc6cc..a65f8a8711 100644
 --- a/raddb/sites-available/tls
 +++ b/raddb/sites-available/tls
-@@ -197,7 +197,7 @@ listen {
+@@ -292,7 +292,7 @@ listen {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
@@ -62,15 +73,15 @@ index cf1cd7a8a..7dd59cb6f 100644
  
  		# If enabled, OpenSSL will use server cipher list
  		# (possibly defined by cipher_list option above)
-@@ -499,7 +499,7 @@ home_server tls {
+@@ -676,7 +676,7 @@ home_server tls {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
- 	}
  
- }
+ 		#
+ 		#  Connection timeout for outgoing TLS connections.
 -- 
-2.13.2
+2.21.0
 

freeradius-autogen.sh

@@ -1,21 +0,0 @@
-#!/bin/sh -e
-
-parentdir=`dirname $0`
-
-cd $parentdir
-parentdir=`pwd`
-
-libtoolize -f -c
-#aclocal
-autoheader
-autoconf
-
-mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`"
-mysubdirs=`echo $mysubdirs`
-
-for F in $mysubdirs
-do
-	echo "Configuring in $F..."
-	(cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir)
-	(cd $F && autoconf -I$parentdir)
-done

freeradius-bootstrap-create-only.patch

@@ -0,0 +1,89 @@
+From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 13 May 2020 10:01:47 -0400
+Subject: [PATCH] Don't clobber existing files on bootstrap
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index ede09bc..e555491 100755
+--- a/raddb/certs/bootstrap
++++ b/raddb/certs/bootstrap
+@@ -20,56 +20,55 @@ cd `dirname $0`
+ #  Don't edit the following text.  Instead, edit the Makefile, and
+ #  re-generate these commands.
+ #
+-if [ ! -f dh ]; then
++if [ ! -e dh ]; then
+   openssl dhparam -out dh 2048 || exit 1
+-  if [ -e /dev/urandom ] ; then
+-	ln -sf /dev/urandom random
+-  else
+-	date > ./random;
+-  fi
++  ln -sf /dev/urandom random
+ fi
+ 
+-if [ ! -f server.key ]; then
++if [ ! -e server.key ]; then
+   openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+   chmod g+r server.key
+ fi
+ 
+-if [ ! -f ca.key ]; then
++if [ ! -e ca.key ]; then
+   openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
+ fi
+ 
+-if [ ! -f index.txt ]; then
++if [ ! -e index.txt ]; then
+   touch index.txt
+ fi
+ 
+-if [ ! -f serial ]; then
++if [ ! -e serial ]; then
+   echo '01' > serial
+ fi
+ 
+-if [ ! -f server.crt ]; then
++if [ ! -e server.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
+ fi
+ 
+-if [ ! -f server.p12 ]; then
++if [ ! -e server.p12 ]; then
+   openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   chmod g+r server.p12
+ fi
+ 
+-if [ ! -f server.pem ]; then
++if [ ! -e server.pem ]; then
+   openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   openssl verify -CAfile ca.pem server.pem || exit 1
+   chmod g+r server.pem
+ fi
+ 
+-if [ ! -f ca.der ]; then
++if [ ! -e ca.der ]; then
+   openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
+ fi
+ 
+-if [ ! -f client.key ]; then
++if [ ! -e client.key ]; then
+   openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+   chmod g+r client.key
+ fi
+ 
+-if [ ! -f client.crt ]; then
++if [ ! -e client.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+ fi
++
++chown root:radiusd dh ca.* client.* server.*
++chmod 640 dh ca.* client.* server.*
+-- 
+2.26.2
+

freeradius-bootstrap-make-permissions.patch

@@ -0,0 +1,29 @@
+From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 4 Aug 2020 10:08:15 -0400
+Subject: [PATCH] Fix permissions after generating certificates with make
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index 336a2bd..9920ecf 100755
+--- a/raddb/certs/bootstrap
++++ b/raddb/certs/bootstrap
+@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1
+ #
+ if [ "$?" = "0" ]; then
+   make all
+-  exit $?
++  ret=$?
++  chown root:radiusd dh ca.* client.* server.*
++  chmod 640 dh ca.* client.* server.*
++  exit $ret
+ fi
+ 
+ #
+-- 
+2.26.2
+

freeradius-configure-c99.patch

@@ -0,0 +1,35 @@
+The backtrace_symbols function expects a pointer to an array of void *
+values, not a pointer to an array of a single element. Removing the
+address operator ensures that the right type is used.
+
+This avoids an unconditional failure of this probe with compilers that
+treat incompatible pointer types as a compilation error.
+
+Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
+
+diff --git a/configure b/configure
+index ed01ee2bdd912f63..1e6d2284779cdd58 100755
+--- a/configure
++++ b/configure
+@@ -13390,7 +13390,7 @@ main (void)
+ {
+ 
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym))
++        backtrace_symbols(sym, sizeof(sym))
+   ;
+   return 0;
+ }
+diff --git a/configure.ac b/configure.ac
+index 76320213b51d7bb4..6a689711d6c90483 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+         #include <execinfo.h>
+       ]], [[
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
++        backtrace_symbols(sym, sizeof(sym)) ]])],[
+         AC_MSG_RESULT(yes)
+         ac_cv_lib_execinfo_backtrace_symbols="yes"
+       ],[

freeradius-ease-openssl-version-check.patch

@@ -0,0 +1,35 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Tue, 12 Sep 2023
+Subject: Ease OpenSSL version check requirement
+
+FreeRADIUS includes an OpenSSL version check that compares built vs linked version,
+and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as 
+ABI changes are tracked and soname is changed accordingly, as discussed in previous 
+Bugzilla for this issue [1].
+
+[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/main/version.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/version.c b/src/main/version.c
+index c190337c1d..fee2150eb2 100644
+--- a/src/main/version.c
++++ b/src/main/version.c
+@@ -79,11 +79,11 @@ int ssl_check_consistency(void)
+ 	 */
+ 	if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) {
+ 	mismatch:
+-		ERROR("libssl version mismatch.  built: %lx linked: %lx",
++		DEBUG2("libssl version mismatch.  built: %lx linked: %lx",
+ 		      (unsigned long) ssl_built,
+ 		      (unsigned long) ssl_linked);
+ 
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	/*

freeradius-ldap-infinite-timeout-on-starttls.patch

@@ -0,0 +1,31 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Fri, 28 Jan 2022
+Subject: Use infinite timeout when using LDAP+start-TLS
+
+This will ensure that the TLS connection to the LDAP server will complete
+before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
+the process. Infinite timeout is the OpenLDAP default.
+Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/modules/rlm_ldap/ldap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index cf7a84e069..841bf888a1 100644
+--- a/src/modules/rlm_ldap/ldap.c
++++ b/src/modules/rlm_ldap/ldap.c
+@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ #ifdef LDAP_OPT_NETWORK_TIMEOUT
+-	if (inst->net_timeout) {
++	bool using_tls = inst->start_tls ||
++					 inst->port == 636 ||
++					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
++	if (inst->net_timeout && !using_tls) {
+ 		memset(&tv, 0, sizeof(tv));
+ 		tv.tv_sec = inst->net_timeout;
+ 

freeradius-logrotate

@@ -14,6 +14,7 @@
 	nocreate
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/checkrad.log {
@@ -22,6 +23,7 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/radius.log {
@@ -30,8 +32,9 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl reload-or-try-restart radiusd
+		/usr/bin/systemctl try-reload-or-restart radiusd
 	endscript
 }
 
@@ -41,6 +44,7 @@
 	create
 	compress
 	missingok
+	su radiusd radiusd
 }
 /var/log/radius/sqltrace.sql {
         monthly
@@ -48,4 +52,5 @@
         create
         compress
         missingok
+	su radiusd radiusd
 }

freeradius-no-buildtime-cert-gen.patch

@@ -0,0 +1,105 @@
+From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 12:58:02 -0400
+Subject: [PATCH] Don't generate certificates in reproducible builds
+
+[antorres@redhat.com]: updated to match upstream release 3.2.7
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ Make.inc.in  | 5 +++++
+ configure    | 3 +++
+ configure.ac | 3 +++
+ raddb/all.mk | 4 ++++
+ 4 files changed, 15 insertions(+)
+
+diff --git a/Make.inc.in b/Make.inc.in
+index 0b2cd74de8..8c623cf95c 100644
+--- a/Make.inc.in
++++ b/Make.inc.in
+@@ -174,6 +174,10 @@ else
+ 	TESTBIN    = ./$(BUILD_DIR)/bin
+ endif
+ 
++#
++#  With reproducible builds, do not generate certificates during installation
++#
++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@
+ 
+ #
+ #  For creating documentation via doc/all.mk
+diff --git a/configure b/configure
+index f1dfa97c44..ba5c53768d 100755
+--- a/configure
++++ b/configure
+@@ -681,6 +681,7 @@ ACLOCAL
+ LAST
+ RUSERS
+ SNMPWALK
++ENABLE_REPRODUCIBLE_BUILDS
+ SNMPGET
+ openssl_version_check_config
+ WITH_RADLAST
+@@ -7001,6 +7002,7 @@ fi
+ 
+ 
+ # Check whether --enable-reproducible-builds was given.
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ if test ${enable_reproducible_builds+y}
+ then :
+   enableval=$enable_reproducible_builds;  case "$enableval" in
+@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+     ;;
+   *)
+     reproducible_builds=no
++    ENABLE_REPRODUCIBLE_BUILDS=no
+   esac
+ 
+ fi
+
+diff --git a/configure.ac b/configure.ac
+index ce4d9b0ae5..790cbf02a0 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config])
+ dnl #
+ dnl #  extra argument: --enable-reproducible-builds
+ dnl #
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ AC_ARG_ENABLE(reproducible-builds,
+ [AS_HELP_STRING([--enable-reproducible-builds],
+                 [ensure the build does not change each time])],
+@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds,
+     ;;
+   *)
+     reproducible_builds=no
++    ENABLE_REPRODUCIBLE_BUILDS=no
+   esac ]
+ )
++AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS)
+ 
+ dnl #
+ dnl #  Enable the -fsanitize=fuzzer and link in the address sanitizer
+
+ 
+ 
+ dnl #############################################################
+diff --git a/raddb/all.mk b/raddb/all.mk
+index c966edd657..c8e976a499 100644
+--- a/raddb/all.mk
++++ b/raddb/all.mk
+@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize
+ ifneq "$(LOCAL_CERT_PRODUCTS)" ""
+ $(LOCAL_CERT_PRODUCTS):
+ 	@echo BOOTSTRAP raddb/certs/
++ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes"
++	@$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk
++else
+ 	@$(MAKE) -C $(R)$(raddbdir)/certs/
++endif
+ 
+ # Bootstrap is special
+ $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS)
+-- 
+2.21.0
+

freeradius-no-sqlippool-tool.patch

@@ -0,0 +1,28 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 5 Mar 2025
+Subject: Remove sqlippool tool
+
+This script relies on a Perl package, perl-Net-IP, that won't be available.
+Remove it from build script and let the user pull it manually instead, as it's
+just a helper script for SQL module users.
+
+---
+diff --git a/scripts/all.mk b/scripts/all.mk
+index a6e90aa3eb..517adb8590 100644
+--- a/scripts/all.mk
++++ b/scripts/all.mk
+@@ -1,5 +1,5 @@
+ install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
+-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
++	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
+ 
+ $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
+ 	@mkdir -p $(dir $@)
+@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
+ $(R)$(bindir)/radcrypt: scripts/cryptpasswd
+ 	@mkdir -p $(dir $@)
+ 	@$(INSTALL) -m 755 $< $@
+-
+-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
+-	@mkdir -p $(dir $@)
+-	@$(INSTALL) -m 755 $< $@

freeradius-openssl-no-engine.patch

@@ -0,0 +1,54 @@
+diff --git a/configure b/configure
+index 1e6d228..40a26f5 100755
+--- a/configure
++++ b/configure
+@@ -10518,7 +10518,7 @@ smart_prefix=
+ printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+ 
+ 
+-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
++           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
+ do :
+   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
+ ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+diff --git a/configure.ac b/configure.ac
+index 6a68971..4a95148 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
+       openssl/rand.h \
+       openssl/sha.h \
+       openssl/ssl.h \
+-      openssl/ocsp.h \
+-      openssl/engine.h,
++      openssl/ocsp.h,
+       [ OPENSSL_CPPFLAGS="$smart_include" ],
+       [
+         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
+index 4774482..21d5cea 100644
+--- a/src/include/autoconf.h.in
++++ b/src/include/autoconf.h.in
+@@ -285,9 +285,6 @@
+ /* Define to 1 if you have the <openssl/crypto.h> header file. */
+ #undef HAVE_OPENSSL_CRYPTO_H
+ 
+-/* Define to 1 if you have the <openssl/engine.h> header file. */
+-#undef HAVE_OPENSSL_ENGINE_H
+-
+ /* Define to 1 if you have the <openssl/err.h> header file. */
+ #undef HAVE_OPENSSL_ERR_H
+ 
+diff --git a/src/include/tls-h b/src/include/tls-h
+index 506fb19..514e03a 100644
+--- a/src/include/tls-h
++++ b/src/include/tls-h
+@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
+ #  define OPENSSL_NO_KRB5
+ #endif
+ #include <openssl/err.h>
+-#ifdef HAVE_OPENSSL_ENGINE_H
++#ifndef OPENSSL_NO_ENGINE
+ #  include <openssl/engine.h>
+ #endif
+ #include <openssl/ssl.h>

freeradius-radiusd-init

@@ -1,113 +0,0 @@
-#!/bin/sh
-#
-# radiusd Start/Stop the FreeRADIUS daemon
-#
-# chkconfig: - 88 10
-# description: Extensible, configurable, high performance RADIUS server.
-
-### BEGIN INIT INFO
-# Provides: radiusd
-# Required-Start: $network
-# Required-Stop:
-# Default-Start:
-# Default-Stop:
-# Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc
-# Should-Stop:
-# Short-Description: FreeRADIUS server
-# Description: Extensible, configurable, high performance RADIUS server.
-### END INIT INFO
-
-# Source function library.
-. /etc/rc.d/init.d/functions
-
-prog=radiusd
-
-[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
-
-exec=${exec:=/usr/sbin/$prog}
-config_dir=${config_dir:=/etc/raddb}
-config=${config:=$config_dir/radiusd.conf}
-pidfile=${pidfile:=/var/run/$prog/$prog.pid}
-lockfile=${lockfile:=/var/lock/subsys/radiusd}
-
-start() {
-    [ -x $exec ] || exit 5
-    [ -f $config ] || exit 6
-    echo -n $"Starting $prog: "
-    daemon --pidfile $pidfile $exec -d $config_dir
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && touch $lockfile
-    return $retval
-}
-
-stop() {
-    echo -n $"Stopping $prog: "
-    killproc -p $pidfile $prog
-    retval=$?
-    echo
-    [ $retval -eq 0 ] && rm -f $lockfile
-    return $retval
-}
-
-restart() {
-    stop
-    start
-}
-
-reload() {
-    # radiusd may not be capable of a 100% configuration reload depending
-    # on which loadable modules are in use, if sending the server a
-    # HUP is not sufficient then use restart here instead. However, we
-    # prefer by default to use HUP since it's what is usually desired.
-    #    
-    # restart
-
-    kill -HUP `pidofproc -p $pidfile $prog`
-}
-
-force_reload() {
-    restart
-}
-
-rh_status() {
-    # run checks to determine if the service is running or use generic status
-    status -p $pidfile $prog
-}
-
-rh_status_q() {
-    rh_status >/dev/null 2>&1
-}
-
-
-case "$1" in
-    start)
-        rh_status_q && exit 0
-        $1
-        ;;
-    stop)
-        rh_status_q || exit 0
-        $1
-        ;;
-    restart)
-        $1
-        ;;
-    reload)
-        rh_status_q || exit 7
-        $1
-        ;;
-    force-reload)
-        force_reload
-        ;;
-    status)
-        rh_status
-        ;;
-    condrestart|try-restart)
-        rh_status_q || exit 0
-        restart
-        ;;
-    *)
-        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
-        exit 2
-esac
-exit $?

freeradius-tmpfiles.conf

@@ -1 +1 @@
-D /var/run/radiusd 0710 radiusd radiusd -
+D /run/radiusd 0710 radiusd radiusd -

freeradius.sysusers

@@ -0,0 +1,3 @@
+#Type Name     ID  GECOS           Home directory        Shell
+u     radiusd  95  "radiusd user"  /var/lib/radiusd      /sbin/nologin
+g     radiusd  95  -               -                     -

radiusd.service

@@ -1,11 +1,11 @@
 [Unit]
 Description=FreeRADIUS high performance RADIUS server.
-After=syslog.target network.target ipa.service dirsrv.target krb5kdc.service
+After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service mysql.service mariadb.service postgresql.service
 
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
+ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C

rpminspect.yaml

@@ -0,0 +1,3 @@
+---
+inspections:
+    badfuncs: off

sources

@@ -1 +1 @@
-SHA512 (freeradius-server-3.0.15.tar.bz2) = a2808f0b70b73f11c4c7d00edcb4a56a2ab8f73ce0ff74a9834c8b613ce5ed75ece372f852b0891f68c6a33f50c1bababb76d2eff9326a7fc29fe6b45ec9af88
+SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae

tests/auth-tests/Makefile

@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/freeradius
+#   Description: Test if freeradius authentication workd ok
+#   Author: Susant Sahani<susant@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+export TEST=/CoreOS/freeradius
+export TESTVERSION=1.0
+BUILT_FILES=
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+.PHONY: all install download clean
+run: $(FILES) build
+	./runtest.sh
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+clean:
+	rm -f *~ $(BUILT_FILES)
+include /usr/share/rhts/lib/rhts-make.include
+$(METADATA): Makefile
+	@echo "Owner:           Susant Sahani<susant@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test if the ABI hasn't changed" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          freeradius" >> $(METADATA)
+	@echo "Requires:        freeradius" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -Fedora 28" >> $(METADATA)
+	rhts-lint $(METADATA)

tests/auth-tests/PURPOSE

@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/freeradius
+Description: tests for freeradius
+Author: Susant Sahani<susant@redhat.com>

tests/auth-tests/authorize

@@ -0,0 +1,2 @@
+fedora-ci Cleartext-Password := "password"
+       Reply-Message = "Hello, %{User-Name}"

tests/auth-tests/clients.conf

@@ -0,0 +1,6 @@
+client localhost {
+     ipaddr = 127.0.0.1
+     secret = testing123
+     require_message_authenticator = no
+     nastype = other
+}

tests/auth-tests/freeradius-tests.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~
+#   Description: Tests for freeradius
+#
+#   Author: Susant Sahani <susant@redhat.com>
+#   Copyright (c) 2018 Red Hat, Inc.
+# ~~~
+
+import errno
+import os
+import sys
+import time
+import unittest
+import subprocess
+import signal
+import shutil
+import socket
+
+RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid'
+
+def setUpModule():
+    """Initialize the environment, and perform sanity checks on it."""
+
+    if shutil.which('radiusd') is None:
+        raise OSError(errno.ENOENT, 'radiusd not found')
+
+    if shutil.which('radtest') is None:
+        raise OSError(errno.ENOENT, 'radtest not found')
+
+    if subprocess.call(['systemctl', 'is-active', '--quiet',
+                        'radiusd.service']) == 0:
+        raise unittest.SkipTest('radiusd.service is already active')
+
+def tearDownModule():
+        pass
+
+class GenericUtilities():
+    """Provide a set of utility functions start stop daemons. write config files etc """
+
+    def StartRadiusServer(self):
+        """Start radiusd"""
+        subprocess.check_output(['systemctl', 'start', 'radiusd'])
+
+    def StopRadiusServer(self):
+        """stop radiusd"""
+        subprocess.check_output(['systemctl', 'stop', 'radiusd'])
+
+class RadiousTests(unittest.TestCase, GenericUtilities):
+
+    def setUp(self):
+        self.StartRadiusServer()
+
+    def tearDown(self):
+        self.StopRadiusServer()
+
+    def test_radius_plaintext_auth(self):
+        time.sleep(1)
+        output=subprocess.check_output(['radtest', 'fedora-ci', 'password', '127.0.0.1',  '100', 'testing123']).rstrip().decode('utf-8')
+        print(output)
+
+        self.assertRegex(output, "Received Access-Accept")
+        self.assertRegex(output, "Reply-Message = \"Hello, fedora-ci\"")
+
+if __name__ == '__main__':
+    unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout,
+                                                     verbosity=3))

tests/auth-tests/runtest.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+# SPDX-License-Identifier: LGPL-2.1+
+# ~~~
+#   runtest.sh of freeradius
+#   Description:  RADIUS server
+#
+#   Author: Susant Sahani <susant@redhat.com>
+#   Copyright (c) 2018 Red Hat, Inc.
+# ~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="freeradius"
+
+RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
+RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"
+
+generate_cert(){
+    pushd /etc/raddb/certs/
+    #remove certificates if exists;generate new certificates
+    if [[ -f /etc/raddb/certs/bootstrap ]]; then
+        rlLog "Destroy and create new default certificates via bootstrap script"
+        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
+        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
+    else
+        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
+        rlLog "Destroy and create new default certificates via make scripts"
+        make destroycerts -C /etc/raddb/certs/
+        #create new certificates
+        make -C /etc/raddb/certs/
+        chown root:radiusd dh ca.* client.* server.*
+        chmod 640 dh ca.* client.* server.*
+    fi
+    popd
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "systemctl stop firewalld" 0,5
+        rlRun "systemctl stop radiusd.service"
+        rlRun "setenforce 0"
+        rlFileBackup "$RADIUS_CLIENT_CONF"
+        rlFileBackup "$RADIUD_PALIN_TEXT_AUTH_FILE"
+
+        rlRun "cp freeradius-tests.py /usr/bin/"
+        rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
+        rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
+        rlRun "systemctl daemon-reload"
+        generate_cert
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlLog "Starting radius auth tests ..."
+        rlRun "/usr/bin/python3 /usr/bin/freeradius-tests.py"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm /usr/bin/freeradius-tests.py"
+        rlRun "systemctl start firewalld" 0,5
+        rlRun "setenforce 1"
+        rlFileRestore
+        rlLog "freeradius tests done"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
+rlGetTestState

tests/tests.yml

@@ -0,0 +1,12 @@
+- hosts: localhost
+  roles:
+    - role: standard-test-beakerlib
+      tags:
+      - classic
+      tests:
+      - auth-tests
+      required_packages:
+      - python3
+      - systemd
+      - freeradius
+      - freeradius-utils