Update to 3.2.5

Signed-off-by: Antonio Torres <antorres@redhat.com>
Update to 3.2.4 upstream release
2024-07-09 14:49:02 +02:00 · 2024-05-31 10:18:20 +02:00
10 changed files with 35 additions and 223 deletions
--- a/.gitignore
+++ b/.gitignore
@ -44,5 +44,3 @@ freeradius-*.src.rpm
 /freeradius-server-3.2.3.tar.bz2
 /freeradius-server-3.2.4.tar.bz2
 /freeradius-server-3.2.5.tar.bz2
-/freeradius-server-3.2.7.tar.bz2
-/freeradius-server-3.2.8.tar.bz2
--- a/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
+++ b/freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
@ -3,27 +3,25 @@ From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Mon, 8 Sep 2014 12:32:13 +0300
 Subject: [PATCH] Adjust configuration to fit Red Hat specifics

-[antorres@redhat.com]: update patch to match 3.2.7 release
-
 ---
 raddb/mods-available/eap | 4 ++--
 raddb/radiusd.conf.in    | 7 +++----
 2 files changed, 5 insertions(+), 6 deletions(-)

 diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
-index 84660d7c1e..ffcef4b406 100644
+index 2621e183c..94494b2c6 100644
 --- a/raddb/mods-available/eap
 +++ b/raddb/mods-available/eap
-@@ -696,7 +696,7 @@ eap {
- 			#  and create the temporary directory with the
- 			#  systemd `RuntimeDirectory` unit option.
+@@ -533,7 +533,7 @@
+ 			#  You should also delete all of the files
+ 			#  in the directory when the server starts.
 			#
 -		#	tmpdir = /tmp/radiusd
 +		#	tmpdir = /var/run/radiusd/tmp
 
 			#  The command used to verify the client cert.
 			#  We recommend using the OpenSSL command-line
-@@ -711,7 +711,7 @@ eap {
+@@ -548,7 +548,7 @@
 			#  deleted by the server when the command
 			#  returns.
 			#
@ -32,7 +30,6 @@ index 84660d7c1e..ffcef4b406 100644
 		}
 
 		#  OCSP Configuration
-
 diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in
 index a83c1f687..e500cf97b 100644
 --- a/raddb/radiusd.conf.in
--- a/2
+++ b/2
@ -34,7 +34,7 @@
 	compress
 	su radiusd radiusd
 	postrotate
-		/usr/bin/systemctl try-reload-or-restart radiusd
+		/usr/bin/systemctl reload-or-try-restart radiusd
 	endscript
 }

--- a/freeradius-no-buildtime-cert-gen.patch
+++ b/freeradius-no-buildtime-cert-gen.patch
@ -3,8 +3,6 @@ From: Alexander Scheel <ascheel@redhat.com>
 Date: Wed, 8 May 2019 12:58:02 -0400
 Subject: [PATCH] Don't generate certificates in reproducible builds

-[antorres@redhat.com]: updated to match upstream release 3.2.7
-
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 Make.inc.in  | 5 +++++
@ -29,18 +27,18 @@ index 0b2cd74de8..8c623cf95c 100644
 #
 #  For creating documentation via doc/all.mk
 diff --git a/configure b/configure
-index f1dfa97c44..ba5c53768d 100755
+index 5041ca264f..ed01ee2bdd 100755
 --- a/configure
 +++ b/configure
-@@ -681,6 +681,7 @@ ACLOCAL
- LAST
+@@ -679,6 +679,7 @@ AUTOCONF
+ ACLOCAL
 RUSERS
 SNMPWALK
 +ENABLE_REPRODUCIBLE_BUILDS
 SNMPGET
 openssl_version_check_config
- WITH_RADLAST
-@@ -7001,6 +7002,7 @@ fi
+ WITH_DHCP
+@@ -6976,6 +6977,7 @@ fi
 
 
 # Check whether --enable-reproducible-builds was given.
@ -48,7 +46,7 @@ index f1dfa97c44..ba5c53768d 100755
 if test ${enable_reproducible_builds+y}
 then :
   enableval=$enable_reproducible_builds;  case "$enableval" in
-@@ -7012,6 +7014,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
+@@ -6987,6 +6989,7 @@ printf "%s\n" "#define ENABLE_REPRODUCIBLE_BUILDS 1" >>confdefs.h
     ;;
   *)
     reproducible_builds=no
@ -56,7 +54,6 @@ index f1dfa97c44..ba5c53768d 100755
   esac
 
 fi
-
 diff --git a/configure.ac b/configure.ac
 index ce4d9b0ae5..790cbf02a0 100644
 --- a/configure.ac
--- a/freeradius-no-sqlippool-tool.patch
+++ b/freeradius-no-sqlippool-tool.patch
@ -1,28 +0,0 @@
-From: Antonio Torres <antorres@redhat.com>
-Date: Wed, 5 Mar 2025
-Subject: Remove sqlippool tool
-
-This script relies on a Perl package, perl-Net-IP, that won't be available.
-Remove it from build script and let the user pull it manually instead, as it's
-just a helper script for SQL module users.
-
---
-diff --git a/scripts/all.mk b/scripts/all.mk
-index a6e90aa3eb..517adb8590 100644
--- a/scripts/all.mk
-+++ b/scripts/all.mk
-@@ -1,5 +1,5 @@
- install: $(R)$(sbindir)/rc.radiusd $(R)$(sbindir)/raddebug \
-	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt $(R)$(bindir)/rlm_sqlippool_tool
-+	$(R)$(bindir)/radsqlrelay $(R)$(bindir)/radcrypt
- 
- $(R)$(sbindir)/rc.radiusd: scripts/rc.radiusd
- 	@mkdir -p $(dir $@)
-@@ -16,7 +16,3 @@ $(R)$(bindir)/radsqlrelay: scripts/sql/radsqlrelay
- $(R)$(bindir)/radcrypt: scripts/cryptpasswd
- 	@mkdir -p $(dir $@)
- 	@$(INSTALL) -m 755 $< $@
-
-$(R)$(bindir)/rlm_sqlippool_tool: scripts/sql/rlm_sqlippool_tool
-	@mkdir -p $(dir $@)
-	@$(INSTALL) -m 755 $< $@
--- a/freeradius-openssl-no-engine.patch
+++ b/freeradius-openssl-no-engine.patch
@ -1,54 +0,0 @@
-diff --git a/configure b/configure
-index 1e6d228..40a26f5 100755
--- a/configure
-+++ b/configure
-@@ -10518,7 +10518,7 @@ smart_prefix=
- printf "%s\n" "#define HAVE_OPENSSL_SSL_H 1" >>confdefs.h
- 
- 
-           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h openssl/engine.h
-+           for ac_header in openssl/asn1.h openssl/conf.h openssl/crypto.h openssl/err.h openssl/evp.h openssl/hmac.h openssl/md5.h openssl/md4.h openssl/rand.h openssl/sha.h openssl/ssl.h openssl/ocsp.h
- do :
-   as_ac_Header=`printf "%s\n" "ac_cv_header_$ac_header" | $as_tr_sh`
- ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-diff --git a/configure.ac b/configure.ac
-index 6a68971..4a95148 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1449,8 +1449,7 @@ if test "x$WITH_OPENSSL" = xyes; then
-       openssl/rand.h \
-       openssl/sha.h \
-       openssl/ssl.h \
-      openssl/ocsp.h \
-      openssl/engine.h,
-+      openssl/ocsp.h,
-       [ OPENSSL_CPPFLAGS="$smart_include" ],
-       [
-         AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
-diff --git a/src/include/autoconf.h.in b/src/include/autoconf.h.in
-index 4774482..21d5cea 100644
--- a/src/include/autoconf.h.in
-+++ b/src/include/autoconf.h.in
-@@ -285,9 +285,6 @@
- /* Define to 1 if you have the <openssl/crypto.h> header file. */
- #undef HAVE_OPENSSL_CRYPTO_H
- 
-/* Define to 1 if you have the <openssl/engine.h> header file. */
-#undef HAVE_OPENSSL_ENGINE_H
-
- /* Define to 1 if you have the <openssl/err.h> header file. */
- #undef HAVE_OPENSSL_ERR_H
- 
-diff --git a/src/include/tls-h b/src/include/tls-h
-index 506fb19..514e03a 100644
--- a/src/include/tls-h
-+++ b/src/include/tls-h
-@@ -37,7 +37,7 @@ RCSIDH(tls_h, "$Id$")
- #  define OPENSSL_NO_KRB5
- #endif
- #include <openssl/err.h>
-#ifdef HAVE_OPENSSL_ENGINE_H
-+#ifndef OPENSSL_NO_ENGINE
- #  include <openssl/engine.h>
- #endif
- #include <openssl/ssl.h>
--- a/freeradius.spec
+++ b/freeradius.spec
@ -1,7 +1,7 @@
 Summary: High-performance and highly configurable free RADIUS server
 Name: freeradius
-Version: 3.2.8
-Release: 2%{?dist}
+Version: 3.2.5
+Release: 1%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: http://www.freeradius.org/

@ -14,7 +14,7 @@ URL: http://www.freeradius.org/

 %global dist_base freeradius-server-%{version}

-Source0: https://www.freeradius.org/ftp/pub/freeradius/%{dist_base}.tar.bz2
+Source0: ftp://ftp.freeradius.org/pub/radius/%{dist_base}.tar.bz2
 Source100: radiusd.service
 Source102: freeradius-logrotate
 Source103: freeradius-pam-conf
@ -29,8 +29,6 @@ Patch5: freeradius-bootstrap-make-permissions.patch
 Patch6: freeradius-ldap-infinite-timeout-on-starttls.patch
 Patch7: freeradius-ease-openssl-version-check.patch
 Patch8: freeradius-configure-c99.patch
-Patch9: freeradius-openssl-no-engine.patch
-Patch10: freeradius-no-sqlippool-tool.patch

 %global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}

@ -50,7 +48,6 @@ BuildRequires: systemd-units
 BuildRequires: libtalloc-devel
 BuildRequires: chrpath
 BuildRequires: systemd-rpm-macros
-BuildRequires: libxcrypt-devel

 %if ! 0%{?rhel}
 BuildRequires: libyubikey-devel
@ -60,7 +57,7 @@ BuildRequires: ykclient-devel
 # Require OpenSSL version we built with, or newer, to avoid startup failures
 # due to runtime OpenSSL version checks.
 Requires: openssl >= %(rpm -q --queryformat '%%{EPOCH}:%%{VERSION}' openssl)
-Requires(pre): glibc-common
+Requires(pre): shadow-utils glibc-common
 Requires(post): systemd-sysv
 Requires(post): systemd-units
 # Needed for certificate generation as upstream bootstrap script isn't
@ -204,30 +201,18 @@ BuildRequires: json-c-devel
 %description rest
 This plugin provides the REST support for the FreeRADIUS server project.

-
-%package kafka
-Summary: Kafka producer support for FreeRADIUS
-Requires: %{name} = %{version}-%{release}
-Requires: librdkafka
-BuildRequires: librdkafka-devel
-
-%description kafka
-This plugin provides Kafka producer support for the FreeRADIUS server project.
-
 %prep
 %setup -q -n %{dist_base}
 # Note: We explicitly do not make patch backup files because 'make install'
 # mistakenly includes the backup files, especially problematic for raddb config files.
-%patch -P1 -p1
-%patch -P2 -p1
-%patch -P3 -p1
-%patch -P4 -p1
-%patch -P5 -p1
-%patch -P6 -p1
-%patch -P7 -p1
-%patch -P8 -p1
-%patch -P9 -p1
-%patch -P10 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1

 %build
 # Force compile/link options, extra security for network facing daemon
@ -368,22 +353,15 @@ All documentation is in the freeradius-doc sub-package.

 EOF

+
+# Make sure our user/group is present prior to any package or subpackage installation
+%pre
+%sysusers_create_compat %{SOURCE105}
+
 %preun
 %systemd_preun radiusd.service

-%post
-# related: https://bugzilla.redhat.com/show_bug.cgi?id=2427017
-# https://github.com/FreeRADIUS/freeradius-server/commit/7d9fcdff99113b7eb3413f436fecccbc5d34bd96
-if [ -x /usr/sbin/setsebool ]; then
-    /usr/sbin/setsebool -P radius_use_jit on || :
-fi
-
 %postun
-if [ $1 -eq 0 ]; then
-    if [ -x /usr/sbin/setsebool ]; then
-        /usr/sbin/setsebool -P radius_use_jit off || :
-    fi
-fi
 %systemd_postun_with_restart radiusd.service

 /bin/systemctl try-restart radiusd.service >/dev/null 2>&1 || :
@ -565,7 +543,6 @@ fi
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/wimax
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/yubikey
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/dpsk
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/proxy_rate_limit

 # mods-enabled
 # symlink: /etc/raddb/mods-enabled/xxx -> ../mods-available/xxx
@ -600,7 +577,6 @@ fi
 %config(missingok) /etc/raddb/mods-enabled/unix
 %config(missingok) /etc/raddb/mods-enabled/unpack
 %config(missingok) /etc/raddb/mods-enabled/utf8
-%config(missingok) /etc/raddb/mods-enabled/proxy_rate_limit

 # policy
 %dir %attr(750,root,radiusd) /etc/raddb/policy.d
@ -618,10 +594,10 @@ fi

 # binaries
 %defattr(-,root,root)
-%{_bindir}/checkrad
-%{_bindir}/raddebug
-%{_bindir}/radiusd
-%{_bindir}/radmin
+/usr/sbin/checkrad
+/usr/sbin/raddebug
+/usr/sbin/radiusd
+/usr/sbin/radmin

 # dictionaries
 %dir %attr(755,root,root) /usr/share/freeradius
@ -694,7 +670,6 @@ fi
 %{_libdir}/freeradius/rlm_yubikey.so
 %{_libdir}/freeradius/rlm_dpsk.so
 %{_libdir}/freeradius/rlm_eap_teap.so
-%{_libdir}/freeradius/rlm_proxy_rate_limit.so

 # main man pages
 %doc %{_mandir}/man5/clients.conf.5.gz
@ -924,63 +899,10 @@ fi
 %{_libdir}/freeradius/rlm_rest.so
 %attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest

-%files kafka
-%{_libdir}/freeradius/rlm_kafka.so
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/kafka_async
-%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-config/kafka/messages-json.conf
-
 %changelog
-* Mon Jan 05 2026 Antonio Torres <antorres@redhat.com> - 3.2.8-2
- Enable selinux flag for JIT usage
-  Resolves: #2427017
-
-* Mon Nov 10 2025 Antonio Torres <antorres@redhat.com> - 3.2.8-1
- Update to upstream release 3.2.8
-
-* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.7-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jul 08 2025 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.7-5
- Perl 5.42 rebuild
-
-* Wed Jun 11 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-4
- Update logrotate postrotate script with `systemctl try-reload-or-restart`
-  Resolves: rhbz#2371329
-
-* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.2.7-3
- Rebuilt for Python 3.14
-
-* Wed Mar 5 2025 Antonio Torres <antorres@redhat.com> - 3.2.7-1
- Update to upstream release 3.2.7
-
-* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.2.5-7
- Drop call to %sysusers_create_compat
-
-* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 3.2.5-6
- Add explicit BR: libxcrypt-devel
-
-* Thu Jan 23 2025 Antonio Torres <antorres@redhat.com> - 3.2.5-5
- Fix usage of /usr/sbin according to https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
-
-* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Nov 06 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 3.2.5-3
- Drop openssl-devel-engine dependency
-
-* Wed Jul 17 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.2.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
 * Tue Jul 09 2024 Antonio Torres <antorres@redhat.com> - 3.2.5-1
 - Update to upstream release 3.2.5

-* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 3.2.4-3
- Perl 5.40 rebuild
-
-* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 3.2.4-2
- Rebuilt for Python 3.13
-
 * Fri May 31 2024 Antonio Torres <antorres@redhat.com> - 3.2.4-1
 - Update to upstream release 3.2.4

--- a/radiusd.service
+++ b/radiusd.service
@ -5,7 +5,7 @@ After=syslog.target network-online.target ipa.service dirsrv.target krb5kdc.serv
 [Service]
 Type=forking
 PIDFile=/var/run/radiusd/radiusd.pid
-ExecStartPre=-/bin/chown -R radiusd:radiusd /var/run/radiusd
+ExecStartPre=-/bin/chown -R radiusd.radiusd /var/run/radiusd
 ExecStartPre=/usr/sbin/radiusd -C
 ExecStart=/usr/sbin/radiusd -d /etc/raddb
 ExecReload=/usr/sbin/radiusd -C
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (freeradius-server-3.2.8.tar.bz2) = 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae
+SHA512 (freeradius-server-3.2.5.tar.bz2) = 55e653630674a957dcd52ae58e5fd7b5a510b84aaa80e0552bce8089221e02f652618b53753f438981472a5f47df7c8426b9a5ecda0b06ad9f4c25b23604c86b
--- a/tests/auth-tests/runtest.sh
+++ b/tests/auth-tests/runtest.sh
@ -16,25 +16,6 @@ PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"

-generate_cert(){
-    pushd /etc/raddb/certs/
-    #remove certificates if exists;generate new certificates
-    if [[ -f /etc/raddb/certs/bootstrap ]]; then
-        rlLog "Destroy and create new default certificates via bootstrap script"
-        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
-        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
-    else
-        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
-        rlLog "Destroy and create new default certificates via make scripts"
-        make destroycerts -C /etc/raddb/certs/
-        #create new certificates
-        make -C /etc/raddb/certs/
-        chown root:radiusd dh ca.* client.* server.*
-        chmod 640 dh ca.* client.* server.*
-    fi
-    popd
-}
-
 rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm $PACKAGE
@ -48,7 +29,6 @@ rlJournalStart
        rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
        rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
        rlRun "systemctl daemon-reload"
-        generate_cert
    rlPhaseEnd

    rlPhaseStartTest
Author	SHA1	Message	Date
Antonio Torres	43ce71c873	Update to 3.2.5 Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-07-09 14:49:02 +02:00
Antonio Torres	7a47531e6f	Update to 3.2.4 upstream release Signed-off-by: Antonio Torres <antorres@redhat.com>	2024-05-31 10:18:20 +02:00