From fd3f25e28ae86d407d7d08c30f4e3181e4b0a68f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 22 Nov 2019 12:12:37 -0500 Subject: [PATCH 1/4] Fix hack for broken configure/configure.ac Signed-off-by: Alexander Scheel --- freeradius.spec | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/freeradius.spec b/freeradius.spec index 7658dee..62a28d2 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -216,14 +216,10 @@ sed 's/rlm_python/rlm_python3/g' src/modules/stable -i export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" -# Hack: rlm_python3 configure.ac script is broken because it doesn't +# Hack: rlm_python3 configure{,.ac} script is broken because it doesn't # respect --with-rlm-python3-include-dir. -sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION[m]*"#smart_try_dir=$PY_INC_DIR#g' src/modules/rlm_python3/configure.ac - -# In order for the above hack to stick, do a fake configure so -# we can run reconfig before cleaning up after ourselves and running -# configure for real. -./configure && make reconfig && (make clean distclean || true) +sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"#smart_try_dir="$PY_INC_DIR"#g' src/modules/rlm_python3/configure.ac +sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"#smart_try_dir="$PY_INC_DIR"#g' src/modules/rlm_python3/configure %configure \ --libdir=%{_libdir}/freeradius \ From a11ab9322f31e4e512688fa9739c32548bef817a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 1 Apr 2020 13:21:27 -0400 Subject: [PATCH 2/4] Rebase to FreeRADIUS v3.0.21 Signed-off-by: Alexander Scheel --- .gitignore | 1 + freeradius.spec | 23 ++++++++++++----------- sources | 2 +- 3 files changed, 14 insertions(+), 12 deletions(-) diff --git a/.gitignore b/.gitignore index 2a06a22..2f5a9d8 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ freeradius-*.src.rpm /freeradius-server-3.0.18.tar.bz2 /freeradius-server-3.0.19.tar.bz2 /freeradius-server-3.0.20.tar.bz2 +/freeradius-server-3.0.21.tar.bz2 diff --git a/freeradius.spec b/freeradius.spec index e7f0824..930b2e8 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius -Version: 3.0.20 -Release: 2%{?dist} +Version: 3.0.21 +Release: 1%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,8 +22,6 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch -Patch3: freeradius-bootstrap-create-only.patch -Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -201,8 +199,6 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 -%patch3 -p1 -%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -216,11 +212,6 @@ sed 's/rlm_python/rlm_python3/g' src/modules/stable -i export PY3_LIB_DIR=%{_libdir}/"$(python3-config --configdir | sed 's#/usr/lib/##g')" export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')" -# Hack: rlm_python3 configure{,.ac} script is broken because it doesn't -# respect --with-rlm-python3-include-dir. -sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"#smart_try_dir="$PY_INC_DIR"#g' src/modules/rlm_python3/configure.ac -sed -i 's#smart_try_dir="$PY_PREFIX/include/python$PY_SYS_VERSION"#smart_try_dir="$PY_INC_DIR"#g' src/modules/rlm_python3/configure - %configure \ --libdir=%{_libdir}/freeradius \ --enable-reproducible-builds \ @@ -276,6 +267,7 @@ install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/ # remove unneeded stuff rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt +rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.csr rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.der rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.key @@ -294,6 +286,7 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/freeradius/*.la rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/oracle +rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool/mssql rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/ippool-dhcp/oracle rm -rf $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/main/oracle rm -r $RPM_BUILD_ROOT/etc/raddb/mods-config/sql/moonshot-targeted-ids @@ -752,6 +745,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql/extras/wimax @@ -785,6 +779,7 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/process-radacct.sql %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf @@ -814,6 +809,8 @@ exit 0 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh +%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql %{_libdir}/freeradius/rlm_sql_sqlite.so @@ -829,6 +826,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Tue Apr 07 2020 Alexander Scheel - 3.0.21-1 +- Rebased to 3.0.21 + Resolves: bz#1816745 + * Sat Jan 11 2020 Paul Wouters - 3.0.20-2 - fixup tmpfile to use /run instead of /var/run diff --git a/sources b/sources index ab35246..a895a5a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (freeradius-server-3.0.20.tar.bz2) = d5e0732a75268480092b46822a0e0fffb683adb93be13932eb170d2dc783a46d0daff4cadd0de69fd5ce4578083c9f69a9cccc485ea9c0c2eecf82c772f54b8e +SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729 From e7844aeb9a282c108239efb23ed95f0353e104e2 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 13 May 2020 10:02:47 -0400 Subject: [PATCH 3/4] Fix certificate generation Signed-off-by: Alexander Scheel --- freeradius-bootstrap-create-only.patch | 60 ++++++++++---------------- freeradius.spec | 10 ++++- 2 files changed, 32 insertions(+), 38 deletions(-) diff --git a/freeradius-bootstrap-create-only.patch b/freeradius-bootstrap-create-only.patch index 7af7c94..17cab04 100644 --- a/freeradius-bootstrap-create-only.patch +++ b/freeradius-bootstrap-create-only.patch @@ -1,36 +1,18 @@ -From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001 +From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001 From: Alexander Scheel -Date: Wed, 8 May 2019 10:29:08 -0400 +Date: Wed, 13 May 2020 10:01:47 -0400 Subject: [PATCH] Don't clobber existing files on bootstrap Signed-off-by: Alexander Scheel --- - raddb/certs/bootstrap | 39 ++++++++++++--------------------------- - 1 file changed, 12 insertions(+), 27 deletions(-) + raddb/certs/bootstrap | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap -index 0f719aafd4..be81a2d697 100755 +index ede09bc..e555491 100755 --- a/raddb/certs/bootstrap +++ b/raddb/certs/bootstrap -@@ -13,17 +13,6 @@ - umask 027 - cd `dirname $0` - --make -h > /dev/null 2>&1 -- --# --# If we have a working "make", then use it. Otherwise, run the commands --# manually. --# --if [ "$?" = "0" ]; then -- make all -- exit $? --fi -- - # - # The following commands were created by running "make -n", and edited - # to remove the trailing backslash, and to add "exit 1" after the commands. -@@ -31,52 +20,51 @@ fi +@@ -20,56 +20,55 @@ cd `dirname $0` # Don't edit the following text. Instead, edit the Makefile, and # re-generate these commands. # @@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755 - fi + ln -sf /dev/urandom random fi - + -if [ ! -f server.key ]; then +if [ ! -e server.key ]; then openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1 + chmod g+r server.key fi - + -if [ ! -f ca.key ]; then +if [ ! -e ca.key ]; then openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1 fi - + -if [ ! -f index.txt ]; then +if [ ! -e index.txt ]; then touch index.txt fi - + -if [ ! -f serial ]; then +if [ ! -e serial ]; then echo '01' > serial fi - + -if [ ! -f server.crt ]; then +if [ ! -e server.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1 fi - + -if [ ! -f server.p12 ]; then +if [ ! -e server.p12 ]; then openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 + chmod g+r server.p12 fi - + -if [ ! -f server.pem ]; then +if [ ! -e server.pem ]; then openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1 openssl verify -CAfile ca.pem server.pem || exit 1 + chmod g+r server.pem fi - + -if [ ! -f ca.der ]; then +if [ ! -e ca.der ]; then openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1 fi - + -if [ ! -f client.key ]; then +if [ ! -e client.key ]; then openssl req -new -out client.csr -keyout client.key -config ./client.cnf + chmod g+r client.key fi - + -if [ ! -f client.crt ]; then +if [ ! -e client.crt ]; then openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf fi + +chown root:radiusd dh ca.* client.* server.* -+chmod 644 dh ca.* client.* server.* --- -2.21.0 ++chmod 640 dh ca.* client.* server.* +-- +2.26.2 diff --git a/freeradius.spec b/freeradius.spec index 930b2e8..1413469 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -22,6 +22,8 @@ Source104: freeradius-tmpfiles.conf Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch +Patch3: freeradius-bootstrap-create-only.patch +Patch4: freeradius-no-buildtime-cert-gen.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -199,6 +201,8 @@ This plugin provides the REST support for the FreeRADIUS server project. # mistakenly includes the backup files, especially problematic for raddb config files. %patch1 -p1 %patch2 -p1 +%patch3 -p1 +%patch4 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -826,6 +830,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 13 2020 Alexander Scheel - 3.0.21-2 +- Fix certificate generation + Resolves: bz#1835249 + * Tue Apr 07 2020 Alexander Scheel - 3.0.21-1 - Rebased to 3.0.21 Resolves: bz#1816745 From ea5223b1da5f21d3680dc9cc67f3a65c529dd4a1 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 4 Aug 2020 11:13:09 -0400 Subject: [PATCH 4/4] Fix make-based certificate generation Signed-off-by: Alexander Scheel --- freeradius-bootstrap-make-permissions.patch | 29 +++++++++++++++++++++ freeradius.spec | 8 +++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 freeradius-bootstrap-make-permissions.patch diff --git a/freeradius-bootstrap-make-permissions.patch b/freeradius-bootstrap-make-permissions.patch new file mode 100644 index 0000000..3548fa6 --- /dev/null +++ b/freeradius-bootstrap-make-permissions.patch @@ -0,0 +1,29 @@ +From ea164ceafa05f96079204a3f0ae379e46e64a455 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 4 Aug 2020 10:08:15 -0400 +Subject: [PATCH] Fix permissions after generating certificates with make + +Signed-off-by: Alexander Scheel +--- + raddb/certs/bootstrap | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap +index 336a2bd..9920ecf 100755 +--- a/raddb/certs/bootstrap ++++ b/raddb/certs/bootstrap +@@ -21,7 +21,10 @@ make -h > /dev/null 2>&1 + # + if [ "$?" = "0" ]; then + make all +- exit $? ++ ret=$? ++ chown root:radiusd dh ca.* client.* server.* ++ chmod 640 dh ca.* client.* server.* ++ exit $ret + fi + + # +-- +2.26.2 + diff --git a/freeradius.spec b/freeradius.spec index 1413469..7242f5f 100644 --- a/freeradius.spec +++ b/freeradius.spec @@ -1,7 +1,7 @@ Summary: High-performance and highly configurable free RADIUS server Name: freeradius Version: 3.0.21 -Release: 2%{?dist} +Release: 7%{?dist} License: GPLv2+ and LGPLv2+ URL: http://www.freeradius.org/ @@ -24,6 +24,7 @@ Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch Patch2: freeradius-Use-system-crypto-policy-by-default.patch Patch3: freeradius-bootstrap-create-only.patch Patch4: freeradius-no-buildtime-cert-gen.patch +Patch5: freeradius-bootstrap-make-permissions.patch %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} @@ -203,6 +204,7 @@ This plugin provides the REST support for the FreeRADIUS server project. %patch2 -p1 %patch3 -p1 %patch4 -p1 +%patch5 -p1 %build # Force compile/link options, extra security for network facing daemon @@ -830,6 +832,10 @@ exit 0 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest %changelog +* Wed May 13 2020 Alexander Scheel - 3.0.21-7 +- Fix certificate permissions after make-based generation + Resolves: bz#1835249 + * Wed May 13 2020 Alexander Scheel - 3.0.21-2 - Fix certificate generation Resolves: bz#1835249