Use infinite timeout when using LDAP+start-TLS

This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: 87ffc60006/libraries/libldap/tls2.c (L1134) Resolves: #1983063 Signed-off-by: Antonio Torres <antorres@redhat.com>
ldap: allow to connect on partially open handle
2022-04-22 15:16:47 +02:00 · 2021-10-19 18:41:01 +02:00 · 2021-07-15 12:54:32 +02:00 · 2021-06-25 16:44:17 +02:00 · 2021-06-25 16:41:02 +02:00
18 changed files with 191 additions and 557 deletions
--- a/.gitignore
+++ b/.gitignore
@ -34,15 +34,3 @@ freeradius-*.src.rpm
 /freeradius-server-3.0.19.tar.bz2
 /freeradius-server-3.0.20.tar.bz2
 /freeradius-server-3.0.21.tar.bz2
-/freeradius-server-3.0.22.tar.bz2
-/freeradius-server-3.0.23.tar.bz2
-/freeradius-server-3.0.24.tar.bz2
-/freeradius-server-3.0.25.tar.bz2
-/freeradius-server-3.2.0.tar.bz2
-/freeradius-server-3.2.1.tar.bz2
-/freeradius-server-3.2.2.tar.bz2
-/freeradius-server-3.2.3.tar.bz2
-/freeradius-server-3.2.4.tar.bz2
-/freeradius-server-3.2.5.tar.bz2
-/freeradius-server-3.2.7.tar.bz2
-/freeradius-server-3.2.8.tar.bz2
--- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
+++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
@ -3,27 +3,25 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics

-[antorres@redhat.com]: update patch to match 3.2.7 release
-
 ---
 raddb/mods-available/eap | 4 ++--
 raddb/radiusd.conf.in    | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 84660d7c1e..ffcef4b406 100644
+index 2621e183c..94494b2c6 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -696,7 +696,7 @@ eap {
- 			#  and create the temporary directory with the
- 			#  systemd `RuntimeDirectory` unit option.
+@@ -533,7 +533,7 @@
+ 			#  You should also delete all of the files
+ 			#  in the directory when the server starts.
 			#
 -		#	tmpdir = /tmp/radiusd
 +		#	tmpdir = /var/run/radiusd/tmp
 
 			#  The command used to verify the client cert.
 			#  We recommend using the OpenSSL command-line
-@@ -711,7 +711,7 @@ eap {
+@@ -548,7 +548,7 @@
 			#  deleted by the server when the command
 			#  returns.
 			#
@ -32,7 +30,6 @@ index 84660d7c1e..ffcef4b406 100644
 		}
 
 		#  OCSP Configuration
-
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in
--- a/freeradius-Fix-resource-hard-limit-error.patch
+++ b/freeradius-Fix-resource-hard-limit-error.patch
@ -0,0 +1,32 @@
+commit 1ce4508c92493cf03ea1b3c42e83540b387884fa
+Author: Antonio Torres <antorres@redhat.com>
+Date:   Fri Jul 2 07:12:48 2021 -0400
+Subject: [PATCH] debug: don't set resource hard limit to zero
+
+    Setting the resource hard limit to zero is irreversible, meaning if it
+    is set to zero then there is no way to set it higher. This means
+    enabling core dump is not possible, since setting a new resource limit
+    for RLIMIT_CORE would fail. By only setting the soft limit to zero, we
+    can disable and enable core dumps without failures.
+
+    This fix is present in both main and 3.0.x upstream branches.
+    
+    Ticket in RHEL Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977572
+    Signed-off-by: Antonio Torres antorres@redhat.com
+---
+ src/lib/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/lib/debug.c b/src/lib/debug.c
+index 576bcb2a65..6330c9cb66 100644
+--- a/src/lib/debug.c
+++ b/src/lib/debug.c
+@@ -599,7 +599,7 @@ int fr_set_dumpable(bool allow_core_dumps)
+ 		struct rlimit no_core;
+ 
+ 		no_core.rlim_cur = 0;
+-		no_core.rlim_max = 0;
+		no_core.rlim_max = core_limits.rlim_max;
+ 
+ 		if (setrlimit(RLIMIT_CORE, &no_core) < 0) {
+ 			fr_strerror_printf("Failed disabling core dumps: %s", fr_syserror(errno));
--- a/freeradius-Use-system-crypto-policy-by-default.patch
+++ b/freeradius-Use-system-crypto-policy-by-default.patch
@ -4,7 +4,6 @@ Date: Wed, 8 May 2019 10:16:31 -0400
 Subject: [PATCH] Use system-provided crypto-policies by default

 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
-[antorres@redhat.com]: update patch to 3.2.1 state
 ---
 raddb/mods-available/eap        | 4 ++--
 raddb/mods-available/inner-eap  | 2 +-
@ -13,21 +12,21 @@ Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 4 files changed, 6 insertions(+), 6 deletions(-)

 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 62152a6dfc..9f64963034 100644
+index 36849e10f2..b28c0f19c6 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -400,7 +400,7 @@ eap {
- 		#  TLS cipher suites.  The format is listed
- 		#  in "man 1 ciphers".
+@@ -368,7 +368,7 @@ eap {
+ 		#
+ 		#  For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
 		#
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
 
- 		#  Set this option to specify the allowed
- 		#  TLS signature algorithms for OpenSSL 1.1.1 and above.
-@@ -1082,7 +1082,7 @@ eap {
- 		#  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
- 		#  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+ 		#  If enabled, OpenSSL will use server cipher list
+ 		#  (possibly defined by cipher_list option above)
+@@ -912,7 +912,7 @@ eap {
+ 		#  Note - for OpenSSL 1.1.0 and above you may need
+ 		#  to add ":@SECLEVEL=0"
 		#
 -	#	cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
 +	#	cipher_list = "PROFILE=SYSTEM"
@ -48,23 +47,23 @@ index 576eb7739e..ffa07188e2 100644
 		#  You may want to set a very small fragment size.
 		#  The TLS data here needs to go inside of the
 diff --git a/raddb/sites-available/abfab-tls b/raddb/sites-available/abfab-tls
-index b8d0626bbe..073b2933c2 100644
+index 92f1d6330e..cd69b3905a 100644
 --- a/raddb/sites-available/abfab-tls
 +++ b/raddb/sites-available/abfab-tls
-@@ -20,7 +20,7 @@ listen {
+@@ -19,7 +19,7 @@ listen {
 		dh_file = ${certdir}/dh
 		fragment_size = 8192
 		ca_path = ${cadir}
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
+ 
 		cache {
 			enable = no
- 			lifetime = 24 # hours
 diff --git a/raddb/sites-available/tls b/raddb/sites-available/tls
-index 137fcbc6cc..a65f8a8711 100644
+index bbc761b1c5..83cd35b851 100644
 --- a/raddb/sites-available/tls
 +++ b/raddb/sites-available/tls
-@@ -292,7 +292,7 @@ listen {
+@@ -215,7 +215,7 @@ listen {
 		# Set this option to specify the allowed
 		# TLS cipher suites.  The format is listed
 		# in "man 1 ciphers".
@ -73,15 +72,15 @@ index 137fcbc6cc..a65f8a8711 100644
 
 		# If enabled, OpenSSL will use server cipher list
 		# (possibly defined by cipher_list option above)
-@@ -676,7 +676,7 @@ home_server tls {
+@@ -517,7 +517,7 @@ home_server tls {
 		# Set this option to specify the allowed
 		# TLS cipher suites.  The format is listed
 		# in "man 1 ciphers".
 -		cipher_list = "DEFAULT"
 +		cipher_list = "PROFILE=SYSTEM"
+ 	}
 
- 		#
- 		#  Connection timeout for outgoing TLS connections.
+ }
 -- 
 2.21.0

--- a/freeradius-configure-c99.patch
+++ b/freeradius-configure-c99.patch
@ -1,35 +0,0 @@
-The backtrace_symbols function expects a pointer to an array of void *
-values, not a pointer to an array of a single element. Removing the
-address operator ensures that the right type is used.
-
-This avoids an unconditional failure of this probe with compilers that
-treat incompatible pointer types as a compilation error.
-
-Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
-
-diff --git a/configure b/configure
-index ed01ee2bdd912f63..1e6d2284779cdd58 100755
--- a/configure
-+++ b/configure
-@@ -13390,7 +13390,7 @@ main (void)
- {
- 
-         void *sym[1];
-        backtrace_symbols(&sym, sizeof(sym))
-+        backtrace_symbols(sym, sizeof(sym))
-   ;
-   return 0;
- }
-diff --git a/configure.ac b/configure.ac
-index 76320213b51d7bb4..6a689711d6c90483 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
-         #include <execinfo.h>
-       ]], [[
-         void *sym[1];
-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
-+        backtrace_symbols(sym, sizeof(sym)) ]])],[
-         AC_MSG_RESULT(yes)
-         ac_cv_lib_execinfo_backtrace_symbols="yes"
-       ],[
--- a/freeradius-ease-openssl-version-check.patch
+++ b/freeradius-ease-openssl-version-check.patch
@ -1,35 +0,0 @@
-From: Antonio Torres <antorres@redhat.com>
-Date: Tue, 12 Sep 2023
-Subject: Ease OpenSSL version check requirement
-
-FreeRADIUS includes an OpenSSL version check that compares built vs linked version,
-and fails to start if this check fails. We can ease this requirement in Fedora/RHEL as 
-ABI changes are tracked and soname is changed accordingly, as discussed in previous 
-Bugzilla for this issue [1].
-
-[1]: https://bugzilla.redhat.com/show_bug.cgi?id=1299388
-
-Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2238511
-Signed-off-by: Antonio Torres <antorres@redhat.com>
---
- src/main/version.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/main/version.c b/src/main/version.c
-index c190337c1d..fee2150eb2 100644
--- a/src/main/version.c
-+++ b/src/main/version.c
-@@ -79,11 +79,11 @@ int ssl_check_consistency(void)
- 	 */
- 	if ((ssl_linked & 0x0000000f) != (ssl_built & 0x0000000f)) {
- 	mismatch:
-		ERROR("libssl version mismatch.  built: %lx linked: %lx",
-+		DEBUG2("libssl version mismatch.  built: %lx linked: %lx",
- 		      (unsigned long) ssl_built,
- 		      (unsigned long) ssl_linked);
- 
-		return -1;
-+		return 0;
- 	}
- 
- 	/*
--- a/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch
+++ b/freeradius-ldap-allow-to-connect-on-partially-open-handle.patch
@ -0,0 +1,49 @@
+From ab6bbcc41293ae745c1607618f88e5404b98d769 Mon Sep 17 00:00:00 2001
+From: Antonio Torres <antorres@redhat.com>
+Date: Wed, 13 Oct 2021 13:29:02 +0200
+Subject: [PATCH] ldap: allow to connect on partially open handle
+
+The LDAP library returns a partially open connection. Setting the
+'retry' flag to true during the module inst creation and the pool start
+to 0 allows to connect even if the connection is not completely opened
+yet.
+
+Upstream commit: https://github.com/FreeRADIUS/freeradius-server/commit/21d95b268b4cf56e75064898d83123825d673818
+
+Signed-off-by: Antonio Torres <antorres@redhat.com>
+---
+diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
+index f25ee9e2e0..4b6ae44afb 100644
+--- a/src/modules/rlm_ldap/ldap.c
+++ b/src/modules/rlm_ldap/ldap.c
+@@ -717,7 +717,8 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle
+ 	 *	For sanity, for when no connections are viable,
+ 	 *	and we can't make a new one.
+ 	 */
+-	num = retry ? fr_connection_pool_get_num(inst->pool) : 0;
+	num = 0;
+	if (inst->pool && retry) num = fr_connection_pool_get_num(inst->pool);
+ 	for (i = num; i >= 0; i--) {
+ #ifdef WITH_SASL
+ 		if (sasl && sasl->mech) {
+@@ -758,7 +759,7 @@ ldap_rcode_t rlm_ldap_bind(rlm_ldap_t const *inst, REQUEST *request, ldap_handle
+ 			break;
+ 
+ 		case LDAP_PROC_RETRY:
+-			if (retry) {
+			if (num) {
+ 				*pconn = fr_connection_reconnect(inst->pool, *pconn);
+ 				if (*pconn) {
+ 					LDAP_DBGW_REQ("Bind with %s to %s failed: %s. Got new socket, retrying...",
+@@ -1563,7 +1564,7 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
+ 	}
+ 
+ 	status = rlm_ldap_bind(inst, NULL, &conn, conn->inst->admin_identity, conn->inst->admin_password,
+-			       &(conn->inst->admin_sasl), false);
+			       &(conn->inst->admin_sasl), true);
+ 	if (status != LDAP_PROC_SUCCESS) {
+ 		goto error;
+ 	}
+-- 
+2.31.1
+
--- a/2
+++ b/2
@ -34,7 +34,7 @@
 	compress
 	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl try-reload-or-restart radiusd
+		/usr/bin/systemctl reload-or-try-restart radiusd
 	endscript
 }

--- a/freeradius-no-buildtime-cert-gen.patch
+++ b/freeradius-no-buildtime-cert-gen.patch
@ -3,52 +3,48 @@ From: Alexander Scheel <ascheel@redhat.com>
 Date: Wed, 8 May 2019 12:58:02 -0400
 Subject: [PATCH] Don't generate certificates in reproducible builds

-[antorres@redhat.com]: updated to match upstream release 3.2.7
-
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 Make.inc.in  | 5 +++++
- configure    | 3 +++
+ configure    | 4 ++++
 configure.ac | 3 +++
 raddb/all.mk | 4 ++++
- 4 files changed, 15 insertions(+)
+ 4 files changed, 16 insertions(+)

 diff --git a/Make.inc.in b/Make.inc.in
 index 0b2cd74de8..8c623cf95c 100644
 --- a/Make.inc.in
 +++ b/Make.inc.in
-@@ -174,6 +174,10 @@ else
+@@ -173,3 +173,8 @@ else
+ 	TESTBINDIR = ./$(BUILD_DIR)/bin
 	TESTBIN    = ./$(BUILD_DIR)/bin
 endif
- 
+
 +#
 +#  With reproducible builds, do not generate certificates during installation
 +#
 +ENABLE_REPRODUCIBLE_BUILDS = @ENABLE_REPRODUCIBLE_BUILDS@
- 
- #
- #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index f1dfa97c44..ba5c53768d 100755
+index c2c599c92b..3d4403a844 100755
 --- a/configure
 +++ b/configure
-@@ -681,6 +681,7 @@ ACLOCAL
- LAST
- RUSERS
+@@ -655,6 +655,7 @@ RUSERS
 SNMPWALK
-+ENABLE_REPRODUCIBLE_BUILDS
 SNMPGET
+ PERL
+ENABLE_REPRODUCIBLE_BUILDS
 openssl_version_check_config
- WITH_RADLAST
-@@ -7001,6 +7002,7 @@ fi
+ WITH_DHCP
+ modconfdir
+@@ -5586,6 +5587,7 @@ else
+ fi
 
 
- # Check whether --enable-reproducible-builds was given.
 +ENABLE_REPRODUCIBLE_BUILDS=yes
- if test ${enable_reproducible_builds+y}
- then :
+ # Check whether --enable-reproducible-builds was given.
+ if test "${enable_reproducible_builds+set}" = set; then :
   enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+@@ -5597,6 +5599,7 @@ $as_echo "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
     ;;
   *)
     reproducible_builds=no
@ -56,12 +52,19 @@ index f1dfa97c44..ba5c53768d 100755
   esac
 
 fi
-
+@@ -5604,6 +5607,7 @@ fi
+ 
+ 
+ 
+
+ CHECKRAD=checkrad
+ # Extract the first word of "perl", so it can be a program name with args.
+ set dummy perl; ac_word=$2
 diff --git a/configure.ac b/configure.ac
-index ce4d9b0ae5..790cbf02a0 100644
+index a7abf0025a..35b013f4af 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -697,6 +697,7 @@ AC_SUBST([openssl_version_check_config])
+@@ -619,6 +619,7 @@ AC_SUBST([openssl_version_check_config])
 dnl #
 dnl #  extra argument: --enable-reproducible-builds
 dnl #
@ -69,7 +72,7 @@ index ce4d9b0ae5..790cbf02a0 100644
 AC_ARG_ENABLE(reproducible-builds,
 [AS_HELP_STRING([--enable-reproducible-builds],
                 [ensure the build does not change each time])],
-@@ -708,8 +709,10 @@ AC_ARG_ENABLE(reproducible-builds,
+@@ -630,8 +631,10 @@ AC_ARG_ENABLE(reproducible-builds,
     ;;
   *)
     reproducible_builds=no
@ -78,10 +81,6 @@ index ce4d9b0ae5..790cbf02a0 100644
 )
 +AC_SUBST(ENABLE_REPRODUCIBLE_BUILDS)
 
- dnl #
- dnl #  Enable the -fsanitize=fuzzer and link in the address sanitizer
-
- 
 
 dnl #############################################################
 diff --git a/raddb/all.mk b/raddb/all.mk
--- a/freeradius-no-sqlippool-tool.patch
+++ b/freeradius-no-sqlippool-tool.patch
@ -1,28 +0,0 @@
-From: Antonio Torres <antorres@redhat.com>
-Date: Wed, 5 Mar 2025
-Subject: Remove sqlippool tool
-
-This script relies on a Perl package, perl-Net-IP, that won't be available.
-Remove it from build script and let the user pull it manually instead, as it's
-just a helper script for SQL module users.
-
---
-diff --git a/scripts/all.mk b/scripts/all.mk
-index a6e90aa3eb..517adb8590 100644
--- a/scripts/all.mk
-+++ b/scripts/all.mk
-@@ -1,5 +1,5 @@
- install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
-+	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
- 
- $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
- 	@mkdir -p $(dir $@)
-@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
- $(R)$(bindir)/radcrypt: scripts/cryptpasswd
- 	@mkdir -p $(dir $@)
- 	@$(INSTALL) -m 755 $< $@
-
-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
-	@mkdir -p $(dir $@)
-	@$(INSTALL) -m 755 $< $@
--- a/freeradius-openssl-no-engine.patch
+++ b/freeradius-openssl-no-engine.patch
@ -1,54 +0,0 @@
-diff --git a/configure b/configure
-index 1e6d228..40a26f5 100755
--- a/configure
-+++ b/configure
-@@ -10518,7 +10518,7 @@ smart_prefix=
- printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
- 
- 
-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
-+           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
- do :
-   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
- ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-diff --git a/configure.ac b/configure.ac
-index 6a68971..4a95148 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
-       openssl/rand.h \
-       openssl/sha.h \
-       openssl/ssl.h \
-      openssl/ocsp.h \
-      openssl/engine.h,
-+      openssl/ocsp.h,
-       [ OPENSSL_CPPFLAGS="$smart_include" ],
-       [
-         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
-diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
-index 4774482..21d5cea 100644
--- a/src/include/autoconf.h.in
-+++ b/src/include/autoconf.h.in
-@@ -285,9 +285,6 @@
- /* Define to 1 if you have the <openssl/crypto.h> header file. */
- #undef HAVE_OPENSSL_CRYPTO_H
- 
-/* Define to 1 if you have the <openssl/engine.h> header file. */
-#undef HAVE_OPENSSL_ENGINE_H
-
- /* Define to 1 if you have the <openssl/err.h> header file. */
- #undef HAVE_OPENSSL_ERR_H
- 
-diff --git a/src/include/tls-h b/src/include/tls-h
-index 506fb19..514e03a 100644
--- a/src/include/tls-h
-+++ b/src/include/tls-h
-@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
- #  define OPENSSL_NO_KRB5
- #endif
- #include <openssl/err.h>
-#ifdef HAVE_OPENSSL_ENGINE_H
-+#ifndef OPENSSL_NO_ENGINE
- #  include <openssl/engine.h>
- #endif
- #include <openssl/ssl.h>
--- a/freeradius.spec
+++ b/freeradius.spec
@ -1,8 +1,8 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.2.8
-Release: 2%{?dist}
-License: GPL-2.0-or-later AND LGPL-2.0-or-later
+Version: 3.0.21
+Release: 15%{?dist}
+License: GPLv2+ and LGPLv2+
 URL: http://www.freeradius.org/

 # Is elliptic curve cryptography supported?
@ -14,23 +14,20 @@ URL: http://www.freeradius.org/

 %global dist_base freeradius-server-%{version}

-Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
+Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
 Source104: freeradius-tmpfiles.conf
-Source105: freeradius.sysusers

 Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
 Patch2: freeradius-Use-system-crypto-policy-by-default.patch
 Patch3: freeradius-bootstrap-create-only.patch
 Patch4: freeradius-no-buildtime-cert-gen.patch
 Patch5: freeradius-bootstrap-make-permissions.patch
-Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
-Patch7: freeradius-ease-openssl-version-check.patch
-Patch8: freeradius-configure-c99.patch
-Patch9: freeradius-openssl-no-engine.patch
-Patch10: freeradius-no-sqlippool-tool.patch
+Patch6: freeradius-Fix-resource-hard-limit-error.patch
+Patch7: freeradius-ldap-allow-to-connect-on-partially-open-handle.patch
+Patch8: freeradius-ldap-infinite-timeout-on-starttls.patch

 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}

@ -48,9 +45,7 @@ BuildRequires: readline-devel
 BuildRequires: libpcap-devel
 BuildRequires: systemd-units
 BuildRequires: libtalloc-devel
-BuildRequires: chrpath
-BuildRequires: systemd-rpm-macros
-BuildRequires: libxcrypt-devel
+BuildRequires: pcre-devel

 %if ! 0%{?rhel}
 BuildRequires: libyubikey-devel
@ -60,7 +55,7 @@ BuildRequires: ykclient-devel
 # Require OpenSSL version we built with, or newer, to avoid startup failures
 # due to runtime OpenSSL version checks.
 Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl)
-Requires(pre): glibc-common
+Requires(pre): shadow-utils glibc-common
 Requires(post): systemd-sysv
 Requires(post): systemd-units
 # Needed for certificate generation as upstream bootstrap script isn't
@ -131,6 +126,7 @@ This plugin provides the Kerberos 5 support for the FreeRADIUS server project.
 %package perl
 Summary: Perl support for freeradius
 Requires: %{name} = %{version}-%{release}
+Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 %{?fedora:BuildRequires: perl-devel}
 BuildRequires: perl-devel
 BuildRequires: perl-generators
@ -204,39 +200,35 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.

-
-%package kafka
-Summary: Kafka producer support for FreeRADIUS
-Requires: %{name} = %{version}-%{release}
-Requires: librdkafka
-BuildRequires: librdkafka-devel
-
-%description kafka
-This plugin provides Kafka producer support for the FreeRADIUS server project.
-
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
 # mistakenly includes the backup files, especially problematic for raddb config files.
-%patch -P1 -p1
-%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
-%patch -P6 -p1
-%patch -P7 -p1
-%patch -P8 -p1
-%patch -P9 -p1
-%patch -P10 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1

 %build
 # Force compile/link options, extra security for network facing daemon
 %global _hardened_build 1

+# Hack: rlm_python3 as stable; prevents building other unstable modules.
+sed 's/rlm_python/rlm_python3/g' src/modules/stable -i
+
 %global build_ldflags %{build_ldflags} $(python3-config --embed --libs)
 export PY3_LIB_DIR="$(python3-config --configdir)"
 export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_var("INCLUDEPY"))')"

+# In order for the above hack to stick, do a fake configure so
+# we can run reconfig before cleaning up after ourselves and running
+# configure for real.
+./configure && make reconfig && (make clean distclean || true)
+
 %configure \
        --libdir=%{_libdir}/freeradius \
        --enable-reproducible-builds \
@ -255,7 +247,6 @@ export PY3_INC_DIR="$(python3 -c 'import sysconfig; print(sysconfig.get_config_v
        --with-rlm_python3 \
        --with-rlm-python3-lib-dir=$PY3_LIB_DIR \
        --with-rlm-python3-include-dir=$PY3_INC_DIR \
-        --without-rlm_python \
        --without-rlm_eap_ikev2 \
        --without-rlm_eap_tnc \
        --without-rlm_sql_iodbc \
@ -287,21 +278,11 @@ mkdir -p %{buildroot}%{_localstatedir}/run/
 install -d -m 0710 %{buildroot}%{_localstatedir}/run/radiusd/
 install -d -m 0700 %{buildroot}%{_localstatedir}/run/radiusd/tmp
 install -m 0644 %{SOURCE104} %{buildroot}%{_tmpfilesdir}/radiusd.conf
-install -p -D -m 0644 %{SOURCE105} %{buildroot}%{_sysusersdir}/freeradius.conf

 # install SNMP MIB files
 mkdir -p $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/
 install -m 644 mibs/*RADIUS*.mib $RPM_BUILD_ROOT%{_datadir}/snmp/mibs/

-# remove rpath where needed
-chrpath --delete $RPM_BUILD_ROOT%{_libdir}/freeradius/*.so
-for f in $RPM_BUILD_ROOT/usr/sbin/*; do chrpath --delete $f || true; done
-for f in $RPM_BUILD_ROOT/usr/bin/*; do chrpath --delete $f || true; done
-
-# update ld with freeradius libs
-mkdir -p %{buildroot}/%{_sysconfdir}/ld.so.conf.d
-echo "%{_libdir}/freeradius" > %{buildroot}/%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
-
 # remove unneeded stuff
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crt
 rm -f $RPM_BUILD_ROOT/%{_sysconfdir}/raddb/certs/*.crl
@ -368,23 +349,23 @@ All documentation is in the freeradius-doc sub-package.

 EOF

+
+# Make sure our user/group is present prior to any package or subpackage installation
+%pre
+getent group  radiusd >/dev/null || /usr/sbin/groupadd -r -g 95 radiusd > /dev/null 2>&1
+getent passwd radiusd >/dev/null || /usr/sbin/useradd  -r -g radiusd -u 95 -c "radiusd user" -d %{_localstatedir}/lib/radiusd -s /sbin/nologin radiusd > /dev/null 2>&1
+exit 0
+
 %preun
 %systemd_preun radiusd.service

-%post
-# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
-# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
-if [ -x /usr/sbin/setsebool ]; then
-    /usr/sbin/setsebool -P radius_use_jit on || :
-fi
-
 %postun
-if [ $1 -eq 0 ]; then
-    if [ -x /usr/sbin/setsebool ]; then
-        /usr/sbin/setsebool -P radius_use_jit off || :
-    fi
-fi
 %systemd_postun_with_restart radiusd.service
+if [ $1 -eq 0 ]; then           # uninstall
+  getent passwd radiusd >/dev/null && /usr/sbin/userdel  radiusd > /dev/null 2>&1
+  getent group  radiusd >/dev/null && /usr/sbin/groupdel radiusd > /dev/null 2>&1
+fi
+exit 0

 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :

@ -400,10 +381,8 @@ fi
 # system
 %config(noreplace) %{_sysconfdir}/pam.d/radiusd
 %config(noreplace) %{_sysconfdir}/logrotate.d/radiusd
-%config(noreplace) %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 %{_unitdir}/radiusd.service
 %{_tmpfilesdir}/radiusd.conf
-%{_sysusersdir}/freeradius.conf
 %dir %attr(710,radiusd,radiusd) %{_localstatedir}/run/radiusd
 %dir %attr(700,radiusd,radiusd) %{_localstatedir}/run/radiusd/tmp
 %dir %attr(755,radiusd,radiusd) %{_localstatedir}/lib/radiusd
@ -436,8 +415,7 @@ fi
 %dir %attr(770,root,radiusd) /etc/raddb/certs
 %config(noreplace) /etc/raddb/certs/Makefile
 %config(noreplace) /etc/raddb/certs/passwords.mk
-/etc/raddb/certs/README.md
-/etc/raddb/certs/realms/README.md
+/etc/raddb/certs/README
 %config(noreplace) /etc/raddb/certs/xpextensions
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/certs/*.cnf
 %attr(750,root,radiusd) /etc/raddb/certs/bootstrap
@ -451,7 +429,6 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/files/*
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/preprocess
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/preprocess/*
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/realm/freeradius-naptr-to-home-server.sh

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter
@ -463,8 +440,6 @@ fi
 # sites-available
 %dir %attr(750,root,radiusd) /etc/raddb/sites-available
 /etc/raddb/sites-available/README
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/aws-nlb
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/resource-check
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/control-socket
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/decoupled-accounting
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/robust-proxy-accounting
@ -486,11 +461,8 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/copy-acct-to-home-server
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/buffered-sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/channel_bindings
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/challenge
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/google-ldap-auth
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/sites-available/tls-cache

 # sites-enabled
 # symlink: /etc/raddb/sites-enabled/xxx -> ../sites-available/xxx
@ -504,7 +476,7 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/always
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/attr_filter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_auth
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cache_eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/chap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/counter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/cui
@ -513,9 +485,6 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.example.com
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/detail.log
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_files
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_passwd
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dhcp_sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/digest
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dynamic_clients
@ -529,8 +498,6 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/idn
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/inner-eap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ippool
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/json
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ldap_google
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/linelog
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/logintime
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mac2ip
@ -538,6 +505,7 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/mschap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/ntlm_auth
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/opendirectory
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/otp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pam
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/pap
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/passwd
@ -554,24 +522,21 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/soh
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sometimes
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sql_map
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlcounter
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sqlippool
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/sradutmp
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/totp
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unix
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/unpack
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/utf8
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit

 # mods-enabled
 # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx
 %dir %attr(750,root,radiusd) /etc/raddb/mods-enabled
 %config(missingok) /etc/raddb/mods-enabled/always
 %config(missingok) /etc/raddb/mods-enabled/attr_filter
+%config(missingok) /etc/raddb/mods-enabled/cache_eap
 %config(missingok) /etc/raddb/mods-enabled/chap
 %config(missingok) /etc/raddb/mods-enabled/date
 %config(missingok) /etc/raddb/mods-enabled/detail
@ -596,11 +561,9 @@ fi
 %config(missingok) /etc/raddb/mods-enabled/replicate
 %config(missingok) /etc/raddb/mods-enabled/soh
 %config(missingok) /etc/raddb/mods-enabled/sradutmp
-%config(missingok) /etc/raddb/mods-enabled/totp
 %config(missingok) /etc/raddb/mods-enabled/unix
 %config(missingok) /etc/raddb/mods-enabled/unpack
 %config(missingok) /etc/raddb/mods-enabled/utf8
-%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit

 # policy
 %dir %attr(750,root,radiusd) /etc/raddb/policy.d
@ -618,10 +581,10 @@ fi

 # binaries
 %defattr(-,root,root)
-%{_bindir}/checkrad
-%{_bindir}/raddebug
-%{_bindir}/radiusd
-%{_bindir}/radmin
+/usr/sbin/checkrad
+/usr/sbin/raddebug
+/usr/sbin/radiusd
+/usr/sbin/radmin

 # dictionaries
 %dir %attr(755,root,root) /usr/share/freeradius
@ -646,6 +609,7 @@ fi
 %{_libdir}/freeradius/rlm_cache_rbtree.so
 %{_libdir}/freeradius/rlm_chap.so
 %{_libdir}/freeradius/rlm_counter.so
+%{_libdir}/freeradius/rlm_cram.so
 %{_libdir}/freeradius/rlm_date.so
 %{_libdir}/freeradius/rlm_detail.so
 %{_libdir}/freeradius/rlm_dhcp.so
@ -654,6 +618,7 @@ fi
 %{_libdir}/freeradius/rlm_eap.so
 %{_libdir}/freeradius/rlm_eap_fast.so
 %{_libdir}/freeradius/rlm_eap_gtc.so
+%{_libdir}/freeradius/rlm_eap_leap.so
 %{_libdir}/freeradius/rlm_eap_md5.so
 %{_libdir}/freeradius/rlm_eap_mschapv2.so
 %{_libdir}/freeradius/rlm_eap_peap.so
@ -668,10 +633,10 @@ fi
 %{_libdir}/freeradius/rlm_expr.so
 %{_libdir}/freeradius/rlm_files.so
 %{_libdir}/freeradius/rlm_ippool.so
-%{_libdir}/freeradius/rlm_json.so
 %{_libdir}/freeradius/rlm_linelog.so
 %{_libdir}/freeradius/rlm_logintime.so
 %{_libdir}/freeradius/rlm_mschap.so
+%{_libdir}/freeradius/rlm_otp.so
 %{_libdir}/freeradius/rlm_pam.so
 %{_libdir}/freeradius/rlm_pap.so
 %{_libdir}/freeradius/rlm_passwd.so
@ -684,17 +649,12 @@ fi
 %{_libdir}/freeradius/rlm_sql.so
 %{_libdir}/freeradius/rlm_sqlcounter.so
 %{_libdir}/freeradius/rlm_sqlippool.so
-%{_libdir}/freeradius/rlm_sql_map.so
 %{_libdir}/freeradius/rlm_sql_null.so
-%{_libdir}/freeradius/rlm_totp.so
 %{_libdir}/freeradius/rlm_unix.so
 %{_libdir}/freeradius/rlm_unpack.so
 %{_libdir}/freeradius/rlm_utf8.so
 %{_libdir}/freeradius/rlm_wimax.so
 %{_libdir}/freeradius/rlm_yubikey.so
-%{_libdir}/freeradius/rlm_dpsk.so
-%{_libdir}/freeradius/rlm_eap_teap.so
-%{_libdir}/freeradius/rlm_proxy_rate_limit.so

 # main man pages
 %doc %{_mandir}/man5/clients.conf.5.gz
@ -715,7 +675,6 @@ fi
 %doc %{_mandir}/man5/rlm_passwd.5.gz
 %doc %{_mandir}/man5/rlm_realm.5.gz
 %doc %{_mandir}/man5/rlm_sql.5.gz
-%doc %{_mandir}/man5/rlm_unbound.5.gz
 %doc %{_mandir}/man5/rlm_unix.5.gz
 %doc %{_mandir}/man5/unlang.5.gz
 %doc %{_mandir}/man5/users.5.gz
@ -723,7 +682,6 @@ fi
 %doc %{_mandir}/man8/radiusd.8.gz
 %doc %{_mandir}/man8/radmin.8.gz
 %doc %{_mandir}/man8/radrelay.8.gz
-%doc %{_mandir}/man8/rlm_sqlippool_tool.8.gz

 # MIB files
 %{_datadir}/snmp/mibs/*RADIUS*.mib
@ -785,7 +743,6 @@ fi
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf

@ -793,49 +750,14 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/cui/mysql/schema.sql

-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/queries.conf
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mssql/schema.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/queries.conf
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/schema.sql
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/mysql/setup.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/queries.conf
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/oracle/schema.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/queries.conf
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/schema.sql
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/postgresql/setup.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/queries.conf
-%attr(640,root,radiusd) /etc/raddb/mods-config/sql/dhcp/sqlite/schema.sql
-
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/schema.sql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool/mysql/procedure-no-skip-locked.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/schema.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mysql/procedure-no-skip-locked.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/mssql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/procedure.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/queries.conf
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/mssql/schema.sql
-
-%dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/procedure.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/queries.conf
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/ippool-dhcp/postgresql/schema.sql

 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/mysql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/mysql/setup.sql
@ -859,7 +781,6 @@ fi
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/postgresql
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/expire_on_login.conf
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/postgresql/noresetcounter.conf

@ -888,7 +809,6 @@ fi
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/counter/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/dailycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/expire_on_login.conf
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/weeklycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/monthlycounter.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/counter/sqlite/noresetcounter.conf

@ -907,9 +827,8 @@ fi
 %dir %attr(750,root,radiusd) /etc/raddb/mods-config/sql/main/sqlite
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/queries.conf
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/schema.sql
+%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-refresh.sh
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-schema.sql
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-close-after-reload.pl
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/sql/main/sqlite/process-radacct-new-data-usage-period.sh

 %{_libdir}/freeradius/rlm_sql_sqlite.so

@ -924,193 +843,21 @@ fi
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest

-%files kafka
-%{_libdir}/freeradius/rlm_kafka.so
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
-
 %changelog
-* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
- Enable selinux flag for JIT usage
-  Resolves: #2427017
-
-* Mon Nov 10 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
- Update to upstream release 3.2.8
-
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.7-5
- Perl 5.42 rebuild
-
-* Wed Jun 11 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-4
- Update logrotate postrotate script with `systemctl try-reload-or-restart`
-  Resolves: rhbz#2371329
-
-* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.2.7-3
- Rebuilt for Python 3.14
-
-* Wed Mar 5 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-1
- Update to upstream release 3.2.7
-
-* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.5-7
- Drop call to %sysusers_create_compat
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.2.5-6
- Add explicit BR: libxcrypt-devel
-
-* Thu Jan 23 2025 Antonio Torres <antorres@redhat.com> - 3.2.5-5
- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Nov 06 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 3.2.5-3
- Drop openssl-devel-engine dependency
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Antonio Torres <antorres@redhat.com> - 3.2.5-1
- Update to upstream release 3.2.5
-
-* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.4-3
- Perl 5.40 rebuild
-
-* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 3.2.4-2
- Rebuilt for Python 3.13
-
-* Fri May 31 2024 Antonio Torres <antorres@redhat.com> - 3.2.4-1
- Update to upstream release 3.2.4
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Dec 19 2023 Florian Weimer <fweimer@redhat.com> - 3.2.3-2
- Fix C compatibility issue in configure script
-
-* Tue Oct 24 2023 Antonio Torres <antorres@redhat.com> - 3.2.3-1
- Update to upstream release 3.2.3
-
-* Tue Sep 12 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-5
- Ease OpenSSL version check requirement
-  Resolves #2238511
-
-* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.2-3
- Perl 5.38 rebuild
-
-* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 3.2.2-2
- Rebuilt for Python 3.12
-
-* Tue Mar 21 2023 Antonio Torres <antorres@redhat.com> - 3.2.2-1
- Update to upstream release 3.2.2
-
-* Wed Mar 15 2023 Antonio Torres <antorres@redhat.com> - 3.2.1-4
- Migrate to SPDX license
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-2
- Remove hack for Python3 support from specfile
-
-* Mon Oct 17 2022 Antonio Torres <antorres@redhat.com> - 3.2.1-1
- Update to 3.2.1 upstream release
-  Resolves #2131850
-
-* Tue Sep 20 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-4
- Remove deprecated pcre-devel dependency
-  Resolves #2128292
-
-* Mon Sep 5 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-3
- configure: allow building with runstatedir option
-  Resolves: #2123374
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Tue Jul 19 2022 Antonio Torres <antorres@redhat.com> - 3.2.0-1
- Rebase to 3.2.0 upstream release
-  Related: #2077687
-
-* Wed Jun 29 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-8
- Use GID / UID 95 as it's reserved for FreeRADIUS (https://pagure.io/setup/blob/07f8debf03dfb0e5ed36051c13c86c8cd00cd241/f/uidgid#_107)
-  Related: #2095741
-
-* Fri Jun 24 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-7
- Dynamically allocate users using sysusers.d format
-  Related: #2095741
-
-* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 3.0.25-6
- Rebuilt for Python 3.11
-
-* Tue May 31 2022 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.25-5
- Perl 5.36 rebuild
-
-* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.25-4
+* Fri Apr 22 2022 Antonio Torres <antorres@redhat.com> - 3.0.21-15
 - Use infinite timeout when using LDAP+start-TLS
-  Related: #1983063
+  Resolves: #1983063

-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.25-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+* Tue Oct 19 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-14
+- Allow to connect to partially open LDAP handle
+  Related: rhbz#1983063 

-* Thu Oct 14 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-2
- Fix file conflict in SQL files
-  Resolves: bz#2014014 
-
-* Fri Oct 08 2021 Antonio Torres <antorres@redhat.com> - 3.0.25-1
- Update to 3.0.25.
-  Resolves: bz#2011984
-
-* Thu Sep 30 2021 Antonio Torres <antorres@redhat.com> - 3.0.24-1
- Update to 3.0.24.
-  Resolves: bz#2009036
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 3.0.23-7
- Rebuilt with OpenSSL 3.0.0
-
-* Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.23-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Thu Jul 15 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-5
+* Thu Jul 15 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-13
 - Fix coredump not being able to be enabled

-* Sat Jul 10 2021 Björn Esser <besser82@fedoraproject.org> - 3.0.23-4
- Rebuild for versioned symbols in json-c
-
-* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
- Fix rpath not being removed correctly
-
-* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-2
- Remove RPATH usage from additional binaries
-
-* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.23-1
- Rebase to 3.0.23
-  Fixes: bz#1970528
-
-* Tue Jun 29 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-5
- Fix binaries not being correctly linked after RPATH removal
-
-* Fri Jun 25 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-4
+* Fri Jun 25 2021 Antonio Torres <antorres@redhat.com> - 3.0.21-12
 - Fix python3 not being correctly linked

-* Mon Jun 07 2021 Python Maint <python-maint@redhat.com> - 3.0.22-2
- Rebuilt for Python 3.10
-
-* Fri Jun 4 2021 Antonio Torres <antorres@redhat.com> - 3.0.22-1
- Rebased to 3.0.22
-  Resolves: bz#1961190
-
-* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 3.0.21-12
- Perl 5.34 rebuild
-
 * Wed Mar 10 2021 Robbie Harwood <rharwood@redhat.com> - 3.0.21-11
 - Disable automatic bootstrap

--- a/freeradius.sysusers
+++ b/freeradius.sysusers
@ -1,3 +0,0 @@
-#Type Name     ID  GECOS           Home directory        Shell
-u     radiusd  95  "radiusd user"  /var/lib/radiusd      /sbin/nologin
-g     radiusd  95  -               -                     -
--- a/radiusd.service
+++ b/radiusd.service
@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
+ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,3 +0,0 @@
---
-inspections:
-    badfuncs: off
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae
+SHA512 (freeradius-server-3.0.21.tar.bz2) = 18cc142caad2143e30bc54242e3824b5f659f2f6e8f3401c71ce3b9063de0bd8d206d84822c4ad1d99457dfd7121333d4accd0c8340fcfc6b33b8fbe24a31729
--- a/tests/auth-tests/freeradius-tests.py
+++ b/tests/auth-tests/freeradius-tests.py
@ -15,6 +15,7 @@ import unittest
 import subprocess
 import signal
 import shutil
+import psutil
 import socket

 RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid'
--- a/tests/auth-tests/runtest.sh
+++ b/tests/auth-tests/runtest.sh
@ -16,25 +16,6 @@ PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"

-generate_cert(){
-    pushd /etc/raddb/certs/
-    #remove certificates if exists;generate new certificates
-    if [[ -f /etc/raddb/certs/bootstrap ]]; then
-        rlLog "Destroy and create new default certificates via bootstrap script"
-        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
-        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
-    else
-        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
-        rlLog "Destroy and create new default certificates via make scripts"
-        make destroycerts -C /etc/raddb/certs/
-        #create new certificates
-        make -C /etc/raddb/certs/
-        chown root:radiusd dh ca.* client.* server.*
-        chmod 640 dh ca.* client.* server.*
-    fi
-    popd
-}
-
 rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm $PACKAGE
@ -48,7 +29,6 @@ rlJournalStart
        rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
        rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
        rlRun "systemctl daemon-reload"
-        generate_cert
    rlPhaseEnd

    rlPhaseStartTest
Author	SHA1	Message	Date
Antonio Torres	db99eee16a	Use infinite timeout when using LDAP+start-TLS This will ensure that the TLS connection to the LDAP server will complete before starting FreeRADIUS, as it forces libldap to use a blocking socket during the process. Infinite timeout is the OpenLDAP default. Avoids this: `87ffc60006/libraries/libldap/tls2.c (L1134)` Resolves: #1983063 Signed-off-by: Antonio Torres <antorres@redhat.com>	2022-04-22 15:16:47 +02:00
Antonio Torres	8e37012f3a	ldap: allow to connect on partially open handle The LDAP library returns a partially open connection. Setting the 'retry' flag to true during the module inst creation and the pool start to 0 allows to connect even if the connection is not completely opened yet. Upstream commit: `21d95b268b` Related: #1983063 Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-10-19 18:41:01 +02:00
Antonio Torres	daf64df5b1	Fix coredump not being able to be enabled If resource hard limit is set to zero, then it cannot be raised again, and this causes coredump to not being able to be enabled. Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-07-15 12:54:32 +02:00
Antonio Torres	2649cfb18d	Fix typo in spec file changelog Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-25 16:44:17 +02:00
Antonio Torres	0fbe1b7db0	Fix python3 not being correctly linked Since Python 3.8, there is a new way to link against libpython. https://docs.python.org/3/whatsnew/3.8.html#debug-build-uses-the-same-abi-as-release-build Signed-off-by: Antonio Torres <antorres@redhat.com>	2021-06-25 16:41:02 +02:00