Enable SELinux flag for JIT usage

Resolves: #2427017
Signed-off-by: Antonio Torres <antorres@redhat.com>

.gitignore

@@ -41,3 +41,8 @@ freeradius-*.src.rpm
 /freeradius-server-3.2.0.tar.bz2
 /freeradius-server-3.2.1.tar.bz2
 /freeradius-server-3.2.2.tar.bz2
+/freeradius-server-3.2.3.tar.bz2
+/freeradius-server-3.2.4.tar.bz2
+/freeradius-server-3.2.5.tar.bz2
+/freeradius-server-3.2.7.tar.bz2
+/freeradius-server-3.2.8.tar.bz2

freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch

@@ -3,25 +3,27 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics
 
+[antorres@redhat.com]: update patch to match 3.2.7 release
+
 ---
  raddb/mods-available/eap | 4 ++--
  raddb/radiusd.conf.in    | 7 +++----
  2 files changed, 5 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 2621e183c..94494b2c6 100644
+index 84660d7c1e..ffcef4b406 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -533,7 +533,7 @@
- 			#  You should also delete all of the files
- 			#  in the directory when the server starts.
+@@ -696,7 +696,7 @@ eap {
+ 			#  and create the temporary directory with the
+ 			#  systemd `RuntimeDirectory` unit option.
  			#
 -		#	tmpdir = /tmp/radiusd
 +		#	tmpdir = /var/run/radiusd/tmp
  
  			#  The command used to verify the client cert.
  			#  We recommend using the OpenSSL command-line
-@@ -548,7 +548,7 @@
+@@ -711,7 +711,7 @@ eap {
  			#  deleted by the server when the command
  			#  returns.
  			#
@@ -30,6 +32,7 @@ index 2621e183c..94494b2c6 100644
  		}
  
  		#  OCSP Configuration
+
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in

freeradius-configure-c99.patch

@@ -0,0 +1,35 @@
+The backtrace_symbols function expects a pointer to an array of void *
+values, not a pointer to an array of a single element. Removing the
+address operator ensures that the right type is used.
+
+This avoids an unconditional failure of this probe with compilers that
+treat incompatible pointer types as a compilation error.
+
+Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
+
+diff --git a/configure b/configure
+index ed01ee2bdd912f63..1e6d2284779cdd58 100755
+--- a/configure
++++ b/configure
+@@ -13390,7 +13390,7 @@ main (void)
+ {
+ 
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym))
++        backtrace_symbols(sym, sizeof(sym))
+   ;
+   return 0;
+ }
+diff --git a/configure.ac b/configure.ac
+index 76320213b51d7bb4..6a689711d6c90483 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+         #include <execinfo.h>
+       ]], [[
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
++        backtrace_symbols(sym, sizeof(sym)) ]])],[
+         AC_MSG_RESULT(yes)
+         ac_cv_lib_execinfo_backtrace_symbols="yes"
+       ],[

freeradius-ease-openssl-version-check.patch

@@ -0,0 +1,35 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Tue, 12 Sep 2023
+Subject: Ease OpenSSL version check requirement
+
+FreeRADIUS includes an OpenSSL version check that compares built vs linked version,
+and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as 
+ABI changes are tracked and soname is changed accordingly, as discussed in previous 
+Bugzilla for this issue [1].
+
+[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+ src/main/version.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/main/version.c b/src/main/version.c
+index c190337c1d..fee2150eb2 100644
+--- a/src/main/version.c
++++ b/src/main/version.c
+@@ -79,11 +79,11 @@ int ssl_check_consistency(void)
+ 	 */
+ 	if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) {
+ 	mismatch:
+-		ERROR("libssl version mismatch.  built: %lx linked: %lx",
++		DEBUG2("libssl version mismatch.  built: %lx linked: %lx",
+ 		      (unsigned long) ssl_built,
+ 		      (unsigned long) ssl_linked);
+ 
+-		return -1;
++		return 0;
+ 	}
+ 
+ 	/*

freeradius-logrotate

@@ -34,7 +34,7 @@
 	compress
 	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl reload-or-try-restart radiusd
+		/usr/bin/systemctl try-reload-or-restart radiusd
 	endscript
 }
 

freeradius-no-buildtime-cert-gen.patch

@@ -3,6 +3,8 @@ From: Alexander Scheel <ascheel@redhat.com>
 Date: Wed, 8 May 2019 12:58:02 -0400
 Subject: [PATCH] Don't generate certificates in reproducible builds
 
+[antorres@redhat.com]: updated to match upstream release 3.2.7
+
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
  Make.inc.in  | 5 +++++
@@ -27,27 +29,26 @@ index 0b2cd74de8..8c623cf95c 100644
  #
  #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index 77a1436510..74ff9a1fd4 100755
+index f1dfa97c44..ba5c53768d 100755
 --- a/configure
 +++ b/configure
-@@ -652,6 +652,7 @@ AUTOCONF
- ACLOCAL
+@@ -681,6 +681,7 @@ ACLOCAL
+ LAST
  RUSERS
  SNMPWALK
 +ENABLE_REPRODUCIBLE_BUILDS
  SNMPGET
  openssl_version_check_config
- WITH_DHCP
-@@ -5961,7 +5962,7 @@ else
-   openssl_version_check_config=
- fi
+ WITH_RADLAST
+@@ -7001,6 +7002,7 @@ fi
+ 
  
--
-+ENABLE_REPRODUCIBLE_BUILDS=yes
  # Check whether --enable-reproducible-builds was given.
- if test "${enable_reproducible_builds+set}" = set; then :
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ if test ${enable_reproducible_builds+y}
+ then :
    enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -5973,6 +5974,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
      ;;
    *)
      reproducible_builds=no
@@ -55,6 +56,7 @@ index 77a1436510..74ff9a1fd4 100755
    esac
  
  fi
+
 diff --git a/configure.ac b/configure.ac
 index ce4d9b0ae5..790cbf02a0 100644
 --- a/configure.ac

freeradius-no-sqlippool-tool.patch

@@ -0,0 +1,28 @@
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 5 Mar 2025
+Subject: Remove sqlippool tool
+
+This script relies on a Perl package, perl-Net-IP, that won't be available.
+Remove it from build script and let the user pull it manually instead, as it's
+just a helper script for SQL module users.
+
+---
+diff --git a/scripts/all.mk b/scripts/all.mk
+index a6e90aa3eb..517adb8590 100644
+--- a/scripts/all.mk
++++ b/scripts/all.mk
+@@ -1,5 +1,5 @@
+ install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
+-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
++	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
+ 
+ $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
+ 	@mkdir -p $(dir $@)
+@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
+ $(R)$(bindir)/radcrypt: scripts/cryptpasswd
+ 	@mkdir -p $(dir $@)
+ 	@$(INSTALL) -m 755 $< $@
+-
+-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
+-	@mkdir -p $(dir $@)
+-	@$(INSTALL) -m 755 $< $@

freeradius-openssl-no-engine.patch

@@ -0,0 +1,54 @@
+diff --git a/configure b/configure
+index 1e6d228..40a26f5 100755
+--- a/configure
++++ b/configure
+@@ -10518,7 +10518,7 @@ smart_prefix=
+ printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
+ 
+ 
+-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
++           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
+ do :
+   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
+ ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
+diff --git a/configure.ac b/configure.ac
+index 6a68971..4a95148 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
+       openssl/rand.h \
+       openssl/sha.h \
+       openssl/ssl.h \
+-      openssl/ocsp.h \
+-      openssl/engine.h,
++      openssl/ocsp.h,
+       [ OPENSSL_CPPFLAGS="$smart_include" ],
+       [
+         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
+index 4774482..21d5cea 100644
+--- a/src/include/autoconf.h.in
++++ b/src/include/autoconf.h.in
+@@ -285,9 +285,6 @@
+ /* Define to 1 if you have the <openssl/crypto.h> header file. */
+ #undef HAVE_OPENSSL_CRYPTO_H
+ 
+-/* Define to 1 if you have the <openssl/engine.h> header file. */
+-#undef HAVE_OPENSSL_ENGINE_H
+-
+ /* Define to 1 if you have the <openssl/err.h> header file. */
+ #undef HAVE_OPENSSL_ERR_H
+ 
+diff --git a/src/include/tls-h b/src/include/tls-h
+index 506fb19..514e03a 100644
+--- a/src/include/tls-h
++++ b/src/include/tls-h
+@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
+ #  define OPENSSL_NO_KRB5
+ #endif
+ #include <openssl/err.h>
+-#ifdef HAVE_OPENSSL_ENGINE_H
++#ifndef OPENSSL_NO_ENGINE
+ #  include <openssl/engine.h>
+ #endif
+ #include <openssl/ssl.h>

freeradius.spec

@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.2.2
-Release: 4%{?dist}
+Version: 3.2.8
+Release: 2%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: http://www.freeradius.org/
 
@@ -14,7 +14,7 @@ URL: http://www.freeradius.org/
 
 %global dist_base freeradius-server-%{version}
 
-Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
+Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
@@ -27,6 +27,10 @@ Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
 Patch5: freeradius-bootstrap-make-permissions.patch
 Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
+Patch7: freeradius-ease-openssl-version-check.patch
+Patch8: freeradius-configure-c99.patch
+Patch9: freeradius-openssl-no-engine.patch
+Patch10: freeradius-no-sqlippool-tool.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -46,6 +50,7 @@ BuildRequires: systemd-units
 BuildRequires: libtalloc-devel
 BuildRequires: chrpath
 BuildRequires: systemd-rpm-macros
+BuildRequires: libxcrypt-devel
 
 %if ! 0%{?rhel}
 BuildRequires: libyubikey-devel
@@ -55,7 +60,7 @@ BuildRequires: ykclient-devel
 # Require OpenSSL version we built with, or newer, to avoid startup failures
 # due to runtime OpenSSL version checks.
 Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl)
-Requires(pre): shadow-utils glibc-common
+Requires(pre): glibc-common
 Requires(post): systemd-sysv
 Requires(post): systemd-units
 # Needed for certificate generation as upstream bootstrap script isn't
@@ -199,16 +204,30 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.
 
+
+%package kafka
+Summary: Kafka producer support for FreeRADIUS
+Requires: %{name} = %{version}-%{release}
+Requires: librdkafka
+BuildRequires: librdkafka-devel
+
+%description kafka
+This plugin provides Kafka producer support for the FreeRADIUS server project.
+
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
 # mistakenly includes the backup files, especially problematic for raddb config files.
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
 
 %build
 # Force compile/link options, extra security for network facing daemon
@@ -349,15 +368,22 @@ All documentation is in the freeradius-doc sub-package.
 
 EOF
 
-
-# Make sure our user/group is present prior to any package or subpackage installation
-%pre
-%sysusers_create_compat %{SOURCE105}
-
 %preun
 %systemd_preun radiusd.service
 
+%post
+# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
+# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
+if [ -x /usr/sbin/setsebool ]; then
+    /usr/sbin/setsebool -P radius_use_jit on || :
+fi
+
 %postun
+if [ $1 -eq 0 ]; then
+    if [ -x /usr/sbin/setsebool ]; then
+        /usr/sbin/setsebool -P radius_use_jit off || :
+    fi
+fi
 %systemd_postun_with_restart radiusd.service
 
 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :
@@ -411,6 +437,7 @@ EOF
 %config(noreplace) /etc/raddb/certs/Makefile
 %config(noreplace) /etc/raddb/certs/passwords.mk
 /etc/raddb/certs/README.md
+/etc/raddb/certs/realms/README.md
 %config(noreplace) /etc/raddb/certs/xpextensions
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf
 %attr(750,root,radiusd) /etc/raddb/certs/bootstrap
@@ -537,6 +564,8 @@ EOF
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit
 
 # mods-enabled
 # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx
@@ -571,6 +600,7 @@ EOF
 %config(missingok) /etc/raddb/mods-enabled/unix
 %config(missingok) /etc/raddb/mods-enabled/unpack
 %config(missingok) /etc/raddb/mods-enabled/utf8
+%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit
 
 # policy
 %dir %attr(750,root,radiusd) /etc/raddb/policy.d
@@ -588,10 +618,10 @@ EOF
 
 # binaries
 %defattr(-,root,root)
-/usr/sbin/checkrad
-/usr/sbin/raddebug
-/usr/sbin/radiusd
-/usr/sbin/radmin
+%{_bindir}/checkrad
+%{_bindir}/raddebug
+%{_bindir}/radiusd
+%{_bindir}/radmin
 
 # dictionaries
 %dir %attr(755,root,root) /usr/share/freeradius
@@ -662,6 +692,9 @@ EOF
 %{_libdir}/freeradius/rlm_utf8.so
 %{_libdir}/freeradius/rlm_wimax.so
 %{_libdir}/freeradius/rlm_yubikey.so
+%{_libdir}/freeradius/rlm_dpsk.so
+%{_libdir}/freeradius/rlm_eap_teap.so
+%{_libdir}/freeradius/rlm_proxy_rate_limit.so
 
 # main man pages
 %doc %{_mandir}/man5/clients.conf.5.gz
@@ -891,7 +924,82 @@ EOF
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
+%files kafka
+%{_libdir}/freeradius/rlm_kafka.so
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
+
 %changelog
+* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
+- Enable selinux flag for JIT usage
+  Resolves: #2427017
+
+* Mon Nov 10 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
+- Update to upstream release 3.2.8
+
+* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.7-5
+- Perl 5.42 rebuild
+
+* Wed Jun 11 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-4
+- Update logrotate postrotate script with `systemctl try-reload-or-restart`
+  Resolves: rhbz#2371329
+
+* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.2.7-3
+- Rebuilt for Python 3.14
+
+* Wed Mar 5 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-1
+- Update to upstream release 3.2.7
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.5-7
+- Drop call to %sysusers_create_compat
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.2.5-6
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Antonio Torres <antorres@redhat.com> - 3.2.5-5
+- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
+
+* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Wed Nov 06 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 3.2.5-3
+- Drop openssl-devel-engine dependency
+
+* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Antonio Torres <antorres@redhat.com> - 3.2.5-1
+- Update to upstream release 3.2.5
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.4-3
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 3.2.4-2
+- Rebuilt for Python 3.13
+
+* Fri May 31 2024 Antonio Torres <antorres@redhat.com> - 3.2.4-1
+- Update to upstream release 3.2.4
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Dec 19 2023 Florian Weimer <fweimer@redhat.com> - 3.2.3-2
+- Fix C compatibility issue in configure script
+
+* Tue Oct 24 2023 Antonio Torres <antorres@redhat.com> - 3.2.3-1
+- Update to upstream release 3.2.3
+
+* Tue Sep 12 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-5
+- Ease OpenSSL version check requirement
+  Resolves #2238511
+
 * Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 

radiusd.service

@@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
+ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C

sources

@@ -1 +1 @@
-SHA512 (freeradius-server-3.2.2.tar.bz2) = 91dc574560a1f75cafa8bc78c0676f0e3dae7154ecbb395e0e1f6738f78d8bcfe1bff122364452798fd0434c4056fd946799b8f29a1141398bf0542a37870689
+SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae

tests/auth-tests/runtest.sh

@@ -16,6 +16,25 @@ PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"
 
+generate_cert(){
+    pushd /etc/raddb/certs/
+    #remove certificates if exists;generate new certificates
+    if [[ -f /etc/raddb/certs/bootstrap ]]; then
+        rlLog "Destroy and create new default certificates via bootstrap script"
+        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
+        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
+    else
+        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
+        rlLog "Destroy and create new default certificates via make scripts"
+        make destroycerts -C /etc/raddb/certs/
+        #create new certificates
+        make -C /etc/raddb/certs/
+        chown root:radiusd dh ca.* client.* server.*
+        chmod 640 dh ca.* client.* server.*
+    fi
+    popd
+}
+
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm $PACKAGE
@@ -29,6 +48,7 @@ rlJournalStart
         rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
         rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
         rlRun "systemctl daemon-reload"
+        generate_cert
     rlPhaseEnd
 
     rlPhaseStartTest