Fix permissions on generated certificates

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

.gitignore

@@ -20,3 +20,4 @@
 /freeradius-server-3.0.13.tar.bz2
 /freeradius-server-3.0.14.tar.bz2
 /freeradius-server-3.0.15.tar.bz2
+/freeradius-server-3.0.17.tar.bz2

freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch

@@ -12,24 +12,24 @@ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
 index 2621e183c..94494b2c6 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -472,7 +472,7 @@ eap {
- 			#
+@@ -533,7 +533,7 @@
  			#  You should also delete all of the files
  			#  in the directory when the server starts.
--	#		tmpdir = /tmp/radiusd
-+	#		tmpdir = /var/run/radiusd/tmp
+ 			#
+-		#	tmpdir = /tmp/radiusd
++		#	tmpdir = /var/run/radiusd/tmp
  
  			#  The command used to verify the client cert.
  			#  We recommend using the OpenSSL command-line
-@@ -486,7 +486,7 @@ eap {
- 			#  in PEM format.  This file is automatically
+@@ -548,7 +548,7 @@
  			#  deleted by the server when the command
  			#  returns.
--	#		client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
-+	#		client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
+ 			#
+-		#	client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
++		#	client = "/usr/bin/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
  		}
  
- 		#
+ 		#  OCSP Configuration
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in

freeradius-OpenSSL-HMAC-MD5.patch

@@ -0,0 +1,68 @@
+From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Sep 2018 09:54:46 -0400
+Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's
+
+If OpenSSL EVP is not found, fallback to internal implementation of
+HMAC-MD5.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c
+index 2c662ff368..1cca00fa2a 100644
+--- a/src/lib/hmacmd5.c
++++ b/src/lib/hmacmd5.c
+@@ -27,10 +27,41 @@
+
+ RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $")
+
++#ifdef HAVE_OPENSSL_EVP_H
++#include <openssl/hmac.h>
++#include <openssl/evp.h>
++#endif
++
+ #include <freeradius-devel/libradius.h>
+ #include <freeradius-devel/md5.h>
+
+-/** Calculate HMAC using MD5
++#ifdef HAVE_OPENSSL_EVP_H
++/** Calculate HMAC using OpenSSL's MD5 implementation
++ *
++ * @param digest Caller digest to be filled in.
++ * @param text Pointer to data stream.
++ * @param text_len length of data stream.
++ * @param key Pointer to authentication key.
++ * @param key_len Length of authentication key.
++ *
++ */
++void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
++		 uint8_t const *key, size_t key_len)
++{
++	HMAC_CTX *ctx  = HMAC_CTX_new();
++
++#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
++	/* Since MD5 is not allowed by FIPS, explicitly allow it. */
++	HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
++#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */
++
++	HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL);
++	HMAC_Update(ctx, text, text_len);
++	HMAC_Final(ctx, digest, NULL);
++	HMAC_CTX_free(ctx);
++}
++#else
++/** Calculate HMAC using internal MD5 implementation
+  *
+  * @param digest Caller digest to be filled in.
+  * @param text Pointer to data stream.
+@@ -101,6 +132,7 @@
+ 					      * hash */
+ 	fr_md5_final(digest, &context);	  /* finish up 2nd pass */
+ }
++#endif /* HAVE_OPENSSL_EVP_H */
+
+ /*
+ Test Vectors (Trailing '\0' of a character string not included in test):

freeradius-OpenSSL-HMAC-SHA1.patch

@@ -0,0 +1,73 @@
+From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Sep 2018 11:03:52 -0400
+Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's
+
+If OpenSSL EVP is not found, fallback to internal implementation of
+HMAC-SHA1.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c
+index c3cbd87a2c..211470ea35 100644
+--- a/src/lib/hmacsha1.c
++++ b/src/lib/hmacsha1.c
+@@ -10,13 +10,19 @@
+
+ RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $")
+
++#ifdef HAVE_OPENSSL_EVP_H
++#include <openssl/hmac.h>
++#include <openssl/evp.h>
++#endif
++
+ #include <freeradius-devel/libradius.h>
+
+ #ifdef HMAC_SHA1_DATA_PROBLEMS
+ unsigned int sha1_data_problems = 0;
+ #endif
+
+-/** Calculate HMAC using SHA1
++#ifdef HAVE_OPENSSL_EVP_H
++/** Calculate HMAC using OpenSSL's SHA1 implementation
+  *
+  * @param digest Caller digest to be filled in.
+  * @param text Pointer to data stream.
+@@ -28,6 +34,26 @@
+ void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
+ 		  uint8_t const *key, size_t key_len)
+ {
++	HMAC_CTX *ctx  = HMAC_CTX_new();
++	HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL);
++	HMAC_Update(ctx, text, text_len);
++	HMAC_Final(ctx, digest, NULL);
++	HMAC_CTX_free(ctx);
++}
++
++#else
++
++/** Calculate HMAC using internal SHA1 implementation
++ *
++ * @param digest Caller digest to be filled in.
++ * @param text Pointer to data stream.
++ * @param text_len length of data stream.
++ * @param key Pointer to authentication key.
++ * @param key_len Length of authentication key.
++ */
++void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
++		  uint8_t const *key, size_t key_len)
++{
+ 	fr_sha1_ctx context;
+ 	uint8_t k_ipad[65];    /* inner padding - key XORd with ipad */
+ 	uint8_t k_opad[65];    /* outer padding - key XORd with opad */
+@@ -142,6 +168,7 @@
+ 	}
+ #endif
+ }
++#endif /* HAVE_OPENSSL_EVP_H */
+
+ /*
+ Test Vectors (Trailing '\0' of a character string not included in test):

freeradius-Use-system-crypto-policy-by-default.patch

@@ -1,33 +1,43 @@
-From d78bf5ab1f5c8102b2b6051cfb1198488be9597d Mon Sep 17 00:00:00 2001
-From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
-Date: Mon, 26 Sep 2016 19:48:36 +0300
-Subject: [PATCH] Use system crypto policy by default
+From a7ed62fbcc043a9ec7a4f09962a2cd2acffa019b Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 10:16:31 -0400
+Subject: [PATCH] Use system-provided crypto-policies by default
 
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
- raddb/mods-available/eap        | 2 +-
+ raddb/mods-available/eap        | 4 ++--
  raddb/mods-available/inner-eap  | 2 +-
  raddb/sites-available/abfab-tls | 2 +-
  raddb/sites-available/tls       | 4 ++--
- 4 files changed, 5 insertions(+), 5 deletions(-)
+ 4 files changed, 6 insertions(+), 6 deletions(-)
 
 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 94494b2c6..9a8dc9327 100644
+index 36849e10f2..b28c0f19c6 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -323,7 +323,7 @@ eap {
+@@ -368,7 +368,7 @@ eap {
  		#
- 		# For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
+ 		#  For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
  		#
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
  
- 		# If enabled, OpenSSL will use server cipher list
- 		# (possibly defined by cipher_list option above)
+ 		#  If enabled, OpenSSL will use server cipher list
+ 		#  (possibly defined by cipher_list option above)
+@@ -912,7 +912,7 @@ eap {
+ 		#  Note - for OpenSSL 1.1.0 and above you may need
+ 		#  to add ":@SECLEVEL=0"
+ 		#
+-	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
++	#	cipher_list = "PROFILE=SYSTEM"
+ 
+ 		#  PAC lifetime in seconds (default: seven days)
+ 		#
 diff --git a/raddb/mods-available/inner-eap b/raddb/mods-available/inner-eap
-index 2b4df6267..af9aa88cd 100644
+index 576eb7739e..ffa07188e2 100644
 --- a/raddb/mods-available/inner-eap
 +++ b/raddb/mods-available/inner-eap
-@@ -68,7 +68,7 @@ eap inner-eap {
+@@ -77,7 +77,7 @@ eap inner-eap {
  		#  certificates.  If so, edit this file.
  		ca_file = ${cadir}/ca.pem
  
@@ -37,7 +47,7 @@ index 2b4df6267..af9aa88cd 100644
  		#  You may want to set a very small fragment size.
  		#  The TLS data here needs to go inside of the
 diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
-index 5dbe143da..46b5fea78 100644
+index 92f1d6330e..cd69b3905a 100644
 --- a/raddb/sites-available/abfab-tls
 +++ b/raddb/sites-available/abfab-tls
 @@ -19,7 +19,7 @@ listen {
@@ -50,10 +60,10 @@ index 5dbe143da..46b5fea78 100644
  		cache {
  			enable = no
 diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
-index cf1cd7a8a..7dd59cb6f 100644
+index bbc761b1c5..83cd35b851 100644
 --- a/raddb/sites-available/tls
 +++ b/raddb/sites-available/tls
-@@ -197,7 +197,7 @@ listen {
+@@ -215,7 +215,7 @@ listen {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
@@ -62,7 +72,7 @@ index cf1cd7a8a..7dd59cb6f 100644
  
  		# If enabled, OpenSSL will use server cipher list
  		# (possibly defined by cipher_list option above)
-@@ -499,7 +499,7 @@ home_server tls {
+@@ -517,7 +517,7 @@ home_server tls {
  		# Set this option to specify the allowed
  		# TLS cipher suites.  The format is listed
  		# in "man 1 ciphers".
@@ -72,5 +82,5 @@ index cf1cd7a8a..7dd59cb6f 100644
  
  }
 -- 
-2.13.2
+2.21.0
 

freeradius-bootstrap-create-only.patch

@@ -0,0 +1,103 @@
+From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 10:29:08 -0400
+Subject: [PATCH] Don't clobber existing files on bootstrap
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ raddb/certs/bootstrap | 39 ++++++++++++---------------------------
+ 1 file changed, 12 insertions(+), 27 deletions(-)
+
+diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
+index 0f719aafd4..be81a2d697 100755
+--- a/raddb/certs/bootstrap
++++ b/raddb/certs/bootstrap
+@@ -13,17 +13,6 @@
+ umask 027
+ cd `dirname $0`
+
+-make -h > /dev/null 2>&1
+-
+-#
+-#  If we have a working "make", then use it.  Otherwise, run the commands
+-#  manually.
+-#
+-if [ "$?" = "0" ]; then
+-  make all
+-  exit $?
+-fi
+-
+ #
+ #  The following commands were created by running "make -n", and edited
+ #  to remove the trailing backslash, and to add "exit 1" after the commands.
+@@ -31,52 +20,51 @@ fi
+ #  Don't edit the following text.  Instead, edit the Makefile, and
+ #  re-generate these commands.
+ #
+-if [ ! -f dh ]; then
++if [ ! -e dh ]; then
+   openssl dhparam -out dh 2048 || exit 1
+-  if [ -e /dev/urandom ] ; then
+-	ln -sf /dev/urandom random
+-  else
+-	date > ./random;
+-  fi
++  ln -sf /dev/urandom random
+ fi
+
+-if [ ! -f server.key ]; then
++if [ ! -e server.key ]; then
+   openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
+ fi
+
+-if [ ! -f ca.key ]; then
++if [ ! -e ca.key ]; then
+   openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
+ fi
+
+-if [ ! -f index.txt ]; then
++if [ ! -e index.txt ]; then
+   touch index.txt
+ fi
+
+-if [ ! -f serial ]; then
++if [ ! -e serial ]; then
+   echo '01' > serial
+ fi
+
+-if [ ! -f server.crt ]; then
++if [ ! -e server.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
+ fi
+
+-if [ ! -f server.p12 ]; then
++if [ ! -e server.p12 ]; then
+   openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12  -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+ fi
+
+-if [ ! -f server.pem ]; then
++if [ ! -e server.pem ]; then
+   openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+   openssl verify -CAfile ca.pem server.pem || exit 1
+ fi
+
+-if [ ! -f ca.der ]; then
++if [ ! -e ca.der ]; then
+   openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
+ fi
+
+-if [ ! -f client.key ]; then
++if [ ! -e client.key ]; then
+   openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
+ fi
+
+-if [ ! -f client.crt ]; then
++if [ ! -e client.crt ]; then
+   openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr  -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+ fi
++
++chown root:radiusd dh ca.* client.* server.*
++chmod 644 dh ca.* client.* server.*
+--
+2.21.0
+

freeradius-logrotate

@@ -14,6 +14,7 @@
 	nocreate
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/checkrad.log {
@@ -22,6 +23,7 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 }
 
 /var/log/radius/radius.log {
@@ -30,6 +32,7 @@
 	create
 	missingok
 	compress
+	su radiusd radiusd
 	postrotate
 		/usr/bin/systemctl reload-or-try-restart radiusd
 	endscript
@@ -41,6 +44,7 @@
 	create
 	compress
 	missingok
+	su radiusd radiusd
 }
 /var/log/radius/sqltrace.sql {
         monthly
@@ -48,4 +52,5 @@
         create
         compress
         missingok
+	su radiusd radiusd
 }

freeradius-no-buildtime-cert-gen.patch

@@ -0,0 +1,104 @@
+From e6f7c9d4c2af1cda7760ca8155166bb5d4d541d0 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 8 May 2019 12:58:02 -0400
+Subject: [PATCH] Don't generate certificates in reproducible builds
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ Make.inc.in  | 5 +++++
+ configure    | 4 ++++
+ configure.ac | 3 +++
+ raddb/all.mk | 4 ++++
+ 4 files changed, 16 insertions(+)
+
+diff --git a/Make.inc.in b/Make.inc.in
+index 0b2cd74de8..8c623cf95c 100644
+--- a/Make.inc.in
++++ b/Make.inc.in
+@@ -173,3 +173,8 @@ else
+ 	TESTBINDIR = ./$(BUILD_DIR)/bin
+ 	TESTBIN    = ./$(BUILD_DIR)/bin
+ endif
++
++#
++#  With reproducible builds, do not generate certificates during installation
++#
++ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@
+diff --git a/configure b/configure
+index c2c599c92b..3d4403a844 100755
+--- a/configure
++++ b/configure
+@@ -655,6 +655,7 @@ RUSERS
+ SNMPWALK
+ SNMPGET
+ PERL
++ENABLE_REPRODUCIBLE_BUILDS
+ openssl_version_check_config
+ WITH_DHCP
+ modconfdir
+@@ -5586,6 +5587,7 @@ else
+ fi
+ 
+ 
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ # Check whether --enable-reproducible-builds was given.
+ if test "${enable_reproducible_builds+set}" = set; then :
+   enableval=$enable_reproducible_builds;  case "$enableval" in
+@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+     ;;
+   *)
+     reproducible_builds=no
++    ENABLE_REPRODUCIBLE_BUILDS=no
+   esac
+ 
+ fi
+@@ -5604,6 +5607,7 @@ fi
+ 
+ 
+ 
++
+ CHECKRAD=checkrad
+ # Extract the first word of "perl", so it can be a program name with args.
+ set dummy perl; ac_word=$2
+diff --git a/configure.ac b/configure.ac
+index a7abf0025a..35b013f4af 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config])
+ dnl #
+ dnl #  extra argument: --enable-reproducible-builds
+ dnl #
++ENABLE_REPRODUCIBLE_BUILDS=yes
+ AC_ARG_ENABLE(reproducible-builds,
+ [AS_HELP_STRING([--enable-reproducible-builds],
+                 [ensure the build does not change each time])],
+@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds,
+     ;;
+   *)
+     reproducible_builds=no
++    ENABLE_REPRODUCIBLE_BUILDS=no
+   esac ]
+ )
++AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS)
+ 
+ 
+ dnl #############################################################
+diff --git a/raddb/all.mk b/raddb/all.mk
+index c966edd657..c8e976a499 100644
+--- a/raddb/all.mk
++++ b/raddb/all.mk
+@@ -124,7 +124,11 @@ $(R)$(raddbdir)/users: $(R)$(modconfdir)/files/authorize
+ ifneq "$(LOCAL_CERT_PRODUCTS)" ""
+ $(LOCAL_CERT_PRODUCTS):
+ 	@echo BOOTSTRAP raddb/certs/
++ifeq "$(ENABLE_REPRODUCIBLE_BUILDS)" "yes"
++	@$(MAKE) -C $(R)$(raddbdir)/certs/ passwords.mk
++else
+ 	@$(MAKE) -C $(R)$(raddbdir)/certs/
++endif
+ 
+ # Bootstrap is special
+ $(R)$(raddbdir)/certs/bootstrap: | raddb/certs/bootstrap $(LOCAL_CERT_PRODUCTS)
+-- 
+2.21.0
+

freeradius-python2-shebangs.patch

@@ -0,0 +1,64 @@
+From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Thu, 18 Oct 2018 12:40:53 -0400
+Subject: [PATCH] Clarify shebangs to be python2
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ scripts/radtee                         | 2 +-
+ src/modules/rlm_python/example.py      | 2 +-
+ src/modules/rlm_python/prepaid.py      | 2 +-
+ src/modules/rlm_python/radiusd.py      | 2 +-
+ src/modules/rlm_python/radiusd_test.py | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/scripts/radtee b/scripts/radtee
+index 123769d244..78b4bcbe0b 100755
+--- a/scripts/radtee
++++ b/scripts/radtee
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python
++#!/usr/bin/env python2
+ from __future__ import with_statement 
+ 
+ # RADIUS comparison tee v1.0
+diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py
+index 5950a07678..eaf456e349 100644
+--- a/src/modules/rlm_python/example.py
++++ b/src/modules/rlm_python/example.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/env python
++#! /usr/bin/env python2
+ #
+ # Python module example file
+ # Miguel A.L. Paraz <mparaz@mparaz.com>
+diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py
+index c3cbf57b8f..3b1dc2e2e8 100644
+--- a/src/modules/rlm_python/prepaid.py
++++ b/src/modules/rlm_python/prepaid.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/env python
++#! /usr/bin/env python2
+ #
+ # Example Python module for prepaid usage using MySQL
+ 
+diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py
+index c535bb3caf..7129923994 100644
+--- a/src/modules/rlm_python/radiusd.py
++++ b/src/modules/rlm_python/radiusd.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/env python
++#! /usr/bin/env python2
+ #
+ # Definitions for RADIUS programs
+ #
+diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py
+index 13b7128b29..97b5b64f08 100644
+--- a/src/modules/rlm_python/radiusd_test.py
++++ b/src/modules/rlm_python/radiusd_test.py
+@@ -1,4 +1,4 @@
+-#! /usr/bin/env python
++#! /usr/bin/env python2
+ #
+ # Python module test
+ # Miguel A.L. Paraz <mparaz@mparaz.com>

freeradius.spec

@@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.0.15
-Release: 18%{?dist}
+Version: 3.0.19
+Release: 3%{?dist}
 License: GPLv2+ and LGPLv2+
 Group: System Environment/Daemons
 URL: http://www.freeradius.org/
@@ -23,8 +23,8 @@ Source104: freeradius-tmpfiles.conf
 
 Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
 Patch2: freeradius-Use-system-crypto-policy-by-default.patch
-Patch3: freeradius-man-Fix-some-typos.patch
-Patch4: freeradius-Add-missing-option-descriptions.patch
+Patch3: freeradius-bootstrap-create-only.patch
+Patch4: freeradius-no-buildtime-cert-gen.patch
 
 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
 
@@ -76,7 +76,6 @@ be centralized, and minimizes the amount of re-configuration which has to be
 done when adding or deleting new users.
 
 %package doc
-Group: Documentation
 Summary: FreeRADIUS documentation
 
 %description doc
@@ -84,7 +83,6 @@ All documentation supplied by the FreeRADIUS project is included
 in this package.
 
 %package utils
-Group: System Environment/Daemons
 Summary: FreeRADIUS utilities
 Requires: %{name} = %{version}-%{release}
 Requires: libpcap >= 0.9.4
@@ -99,7 +97,6 @@ Support for RFC and VSA Attributes Additional server configuration
 attributes Selecting a particular configuration Authentication methods
 
 %package devel
-Group: System Environment/Daemons
 Summary: FreeRADIUS development files
 Requires: %{name} = %{version}-%{release}
 
@@ -108,7 +105,6 @@ Development headers and libraries for FreeRADIUS.
 
 %package ldap
 Summary: LDAP support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: openldap-devel
 
@@ -117,7 +113,6 @@ This plugin provides the LDAP support for the FreeRADIUS server project.
 
 %package krb5
 Summary: Kerberos 5 support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: krb5-devel
 
@@ -126,7 +121,6 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project.
 
 %package perl
 Summary: Perl support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 %{?fedora:BuildRequires: perl-devel}
@@ -137,9 +131,9 @@ BuildRequires: perl(ExtUtils::Embed)
 %description perl
 This plugin provides the Perl support for the FreeRADIUS server project.
 
+%if 0%{?fedora} <= 30
 %package -n python2-freeradius
 Summary: Python support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: python2-devel
 %{?python_provide:%python_provide python2-freeradius}
@@ -150,10 +144,10 @@ Obsoletes: %{name}-python < %{version}-%{release}
 
 %description -n python2-freeradius
 This plugin provides the Python support for the FreeRADIUS server project.
+%endif
 
 %package mysql
 Summary: MySQL support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: mariadb-connector-c-devel
 
@@ -180,7 +174,6 @@ This plugin provides the SQLite support for the FreeRADIUS server project.
 
 %package unixODBC
 Summary: Unix ODBC support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: unixODBC-devel
 
@@ -189,7 +182,6 @@ This plugin provides the unixODBC support for the FreeRADIUS server project.
 
 %package rest
 Summary: REST support for freeradius
-Group: System Environment/Daemons
 Requires: %{name} = %{version}-%{release}
 BuildRequires: libcurl-devel
 BuildRequires: json-c-devel
@@ -212,7 +204,10 @@ This plugin provides the REST support for the FreeRADIUS server project.
 
 %configure \
         --libdir=%{_libdir}/freeradius \
+        --enable-reproducible-builds \
+        --with-package \
         --disable-openssl-version-check \
+        --with-openssl \
         --with-udpfromto \
         --with-threads \
         --with-docdir=%{docdir} \
@@ -325,16 +320,6 @@ getent group  radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/n
 getent passwd radiusd >/dev/null || /usr/sbin/useradd  -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1
 exit 0
 
-%post
-%systemd_post radiusd.service
-if [ $1 -eq 1 ]; then           # install
-  # Initial installation
-  if [ ! -e /etc/raddb/certs/server.pem ]; then
-    /sbin/runuser -g radiusd -c 'umask 007; /etc/raddb/certs/bootstrap' > /dev/null 2>&1
-  fi
-fi
-exit 0
-
 %preun
 %systemd_preun radiusd.service
 
@@ -518,7 +503,6 @@ exit 0
 %config(missingok) /etc/raddb/mods-enabled/date
 %config(missingok) /etc/raddb/mods-enabled/detail
 %config(missingok) /etc/raddb/mods-enabled/detail.log
-%config(missingok) /etc/raddb/mods-enabled/dhcp
 %config(missingok) /etc/raddb/mods-enabled/digest
 %config(missingok) /etc/raddb/mods-enabled/dynamic_clients
 %config(missingok) /etc/raddb/mods-enabled/eap
@@ -554,6 +538,7 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/filter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/operator-name
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/policy.d/rfc7542
 
 
 # binaries
@@ -702,11 +687,13 @@ exit 0
 
 %{_libdir}/freeradius/rlm_perl.so
 
+%if 0%{?fedora} <= 30
 %files -n python2-freeradius
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/python
 /etc/raddb/mods-config/python/example.py*
 /etc/raddb/mods-config/python/radiusd.py*
 %{_libdir}/freeradius/rlm_python.so
+%endif
 
 %files mysql
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql
@@ -758,6 +745,7 @@ exit 0
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/postgresql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/postgresql/procedure.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/setup.sql
@@ -765,7 +753,6 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/schema.sql
 
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/postgresql/extras
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/update_radacct_group.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/voip-postpaid.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/postgresql/extras/cisco_h323_db_schema.sql
 
@@ -808,6 +795,47 @@ exit 0
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
 
 %changelog
+* Wed May 08 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-3
+- Update boostrap to change ownership of all certificates to root:radiusd
+
+* Wed May 08 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-2
+- Updated crypto-policies patch
+- Updated /etc/raddb/certs/bootstrap to only create certificates if missing: bz#1705165 bz#1672284
+- Updated logrotate definitions to run as radiusd:radiusd: bz#1705343
+- Drop python2 package on Fedora 31+
+- Add database dependencies: bz#1658697
+- Don't generate certificate during build
+
+* Wed Apr 10 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.19-1
+- Rebased to 3.0.19
+
+* Wed Mar 06 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.18-1
+- Rebased to 3.0.18
+
+* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 3.0.17-6
+- Rebuild for readline 8.0
+
+* Tue Feb 05 2019 Alexander Scheel <ascheel@redhat.com> - 3.0.17-5
+- Unit file generates certificates if not present.
+  Resolves: bz#1672284
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.17-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 3.0.17-3
+- Rebuilt for libcrypt.so.2 (#1666033)
+
+* Fri Dec 14 2018 Alexander Scheel <ascheel@redhat.com> - 3.0.17-2
+- Updates radiusd.service to start after network-online.target
+  Resolves: bz#1637275
+
+* Fri Dec 14 2018 Alexander Scheel <ascheel@redhat.com> - 3.0.17-1
+- Update to FreeRADIUS server version 3.0.17
+- Adds Python2 shebang patches from upstream (unreleased)
+
+* Thu Oct 18 2018 Alexander Scheel <ascheel@redhat.com> - 3.0.15-19
+- Added OpenSSL HMAC patches from upstream.
+
 * Mon Sep 17 2018 Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.15-18
 - Actually apply patches added previously.
   Related: Bug#1611286 Man page scan results for freeradius

radiusd.service

@@ -1,11 +1,12 @@
 [Unit]
 Description=FreeRADIUS high performance RADIUS server.
-After=syslog.target network.target ipa.service dirsrv.target krb5kdc.service
+After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.service mysql.service mariadb.service postgresql.service
 
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
 ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
+ExecStartPre=/bin/sh /etc/raddb/certs/bootstrap
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C

sources

@@ -1 +1 @@
-SHA512 (freeradius-server-3.0.15.tar.bz2) = a2808f0b70b73f11c4c7d00edcb4a56a2ab8f73ce0ff74a9834c8b613ce5ed75ece372f852b0891f68c6a33f50c1bababb76d2eff9326a7fc29fe6b45ec9af88
+SHA512 (freeradius-server-3.0.19.tar.bz2) = 9bb3401a52288de541a2272149f4341840dc1df7203583746bef46c0b1b1f2b8886931c9f6f9ce3d92951e271ab5a84a50a8587a3acd69cc20bc86f5817d28e1