net-dialup/freeradius: new package, add 3.2.1
Closes: https://bugs.gentoo.org/891265
This commit is contained in:
parent
f1ac9645ac
commit
2ed94b4bc0
GPG Key ID:
7AFE62C6DF8BCDEC
|
|
@ -0,0 +1 @@
|
|||
DIST freeradius-server-3.2.1.tar.bz2 3399164 BLAKE2B d0e69d468736d2a5dd85b32bb8b1fa44f2e56725ae525a3895df1b926f5ce525c70af08c2b76b62a9479d00d02c3e4915586fb1e5c7d42955c6b9e5cdeda8f6e SHA512 0f9e98cbf0eff4c5af54731ec34a8c9070252eaf2f91ca0c87caae939f6356fa91a6e1ed98ba66dbf1c1bafecdfcf38603fb4f65a5955e88974f49a5b7885f7a
|
||||
|
|
@ -0,0 +1,57 @@
|
|||
diff --git a/debian/freeradius.service b/debian/freeradius.service
|
||||
index 378702d184..ee33c2a294 100644
|
||||
--- a/debian/freeradius.service
|
||||
+++ b/debian/freeradius.service
|
||||
@@ -7,7 +7,6 @@ Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ htt
|
||||
Type=notify
|
||||
WatchdogSec=60
|
||||
NotifyAccess=all
|
||||
-EnvironmentFile=-/etc/default/freeradius
|
||||
|
||||
# FreeRADIUS can do static evaluation of policy language rules based
|
||||
# on environmental variables which is very useful for doing per-host
|
||||
@@ -25,16 +24,15 @@ MemoryLimit=2G
|
||||
# Ensure the daemon can still write its pidfile after it drops
|
||||
# privileges. Combination of options that work on a variety of
|
||||
# systems. Test very carefully if you alter these lines.
|
||||
-RuntimeDirectory=freeradius
|
||||
+RuntimeDirectory=radiusd
|
||||
RuntimeDirectoryMode=0775
|
||||
# This does not work on Debian Jessie:
|
||||
-User=freerad
|
||||
-Group=freerad
|
||||
-# This does not work on Ubuntu Bionic:
|
||||
-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
|
||||
+User=radius
|
||||
+Group=radius
|
||||
|
||||
-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
|
||||
-ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS
|
||||
+ExecStartPre=/usr/sbin/radiusd $RADIUSD_OPTIONS -Cx -lstdout
|
||||
+ExecStart=/usr/sbin/radiusd -f $RADIUSD_OPTIONS
|
||||
+ExecReload=/bin/kill -HUP $MAINPID
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
|
||||
@@ -42,7 +40,7 @@ RestartSec=5
|
||||
NoNewPrivileges=true
|
||||
|
||||
# Allow binding to secure ports, broadcast addresses, and raw interfaces.
|
||||
-#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
|
||||
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
|
||||
|
||||
# Private /tmp that isn't shared by other processes
|
||||
PrivateTmp=true
|
||||
@@ -60,10 +58,10 @@ ProtectKernelTunables=true
|
||||
SystemCallArchitectures=native
|
||||
|
||||
# We shouldn't be writing to the configuration directory
|
||||
-ReadOnlyDirectories=/etc/freeradius/
|
||||
+ReadOnlyDirectories=/etc/raddb/
|
||||
|
||||
# We can read and write to the log directory.
|
||||
-ReadWriteDirectories=/var/log/freeradius/
|
||||
+ReadWriteDirectories=/var/log/radius/
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
# Config file for /etc/init.d/radiusd
|
||||
|
||||
# see man pages for radiusd run `radiusd -h`
|
||||
# for valid cmdline options
|
||||
#RADIUSD_OPTS=""
|
||||
|
||||
# Change this value if you change it in /etc/raddb/radiusd.conf
|
||||
pidfile=/var/run/radiusd/radiusd.pid
|
||||
|
||||
# Change these values if you change them in /etc/raddb/radiusd.conf
|
||||
RADIUSD_USER=radius
|
||||
RADIUSD_GROUP=radius
|
||||
|
||||
# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want
|
||||
# to uncomment the following line.
|
||||
#rc_use="logger"
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
# Config file for /etc/init.d/radiusd
|
||||
|
||||
# see man pages for radiusd run `radiusd -h`
|
||||
# for valid cmdline options
|
||||
#RADIUSD_OPTS=""
|
||||
|
||||
# Change this value if you change it in /etc/raddb/radiusd.conf
|
||||
pidfile=/var/run/radiusd/radiusd.pid
|
||||
|
||||
# Change these values if you change them in /etc/raddb/radiusd.conf
|
||||
RADIUSD_USER=radius
|
||||
RADIUSD_GROUP=radius
|
||||
|
||||
RADIUSD_LOGPATH=/var/log/radius
|
||||
|
||||
# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want
|
||||
# to uncomment the following line.
|
||||
#rc_use="logger"
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2016 Gentoo Foundation
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
command=/usr/sbin/radiusd
|
||||
command_args="${RADIUSD_OPTS}"
|
||||
pidfile="${pidfile:-/run/radiusd/radiusd.pid}"
|
||||
extra_started_commands="reload"
|
||||
|
||||
depend() {
|
||||
need localmount
|
||||
use dns
|
||||
}
|
||||
|
||||
start_pre() {
|
||||
if [ ! -f /etc/raddb/radiusd.conf ] ; then
|
||||
eerror "No /etc/raddb/radiusd.conf file exists!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
|
||||
$(dirname ${pidfile}) /var/log/radius
|
||||
checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
|
||||
$(dirname ${pidfile}) /run/radiusd
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Reloading radiusd"
|
||||
kill -HUP $(cat ${pidfile})
|
||||
eend $?
|
||||
}
|
||||
|
|
@ -0,0 +1,31 @@
|
|||
#!/sbin/openrc-run
|
||||
# Copyright 1999-2020 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
command=/usr/sbin/radiusd
|
||||
command_args="${RADIUSD_OPTS}"
|
||||
pidfile="${pidfile:-/run/radiusd/radiusd.pid}"
|
||||
extra_started_commands="reload"
|
||||
|
||||
depend() {
|
||||
need localmount
|
||||
use dns
|
||||
}
|
||||
|
||||
start_pre() {
|
||||
if [ ! -f /etc/raddb/radiusd.conf ] ; then
|
||||
eerror "No /etc/raddb/radiusd.conf file exists!"
|
||||
return 1
|
||||
fi
|
||||
|
||||
checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
|
||||
$(dirname ${pidfile}) "${RADIUSD_LOGPATH:-/var/log/radius}"
|
||||
checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
|
||||
$(dirname ${pidfile}) /run/radiusd
|
||||
}
|
||||
|
||||
reload() {
|
||||
ebegin "Reloading radiusd"
|
||||
kill -HUP $(cat ${pidfile})
|
||||
eend $?
|
||||
}
|
||||
|
|
@ -0,0 +1,309 @@
|
|||
# Copyright 1999-2023 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=8
|
||||
|
||||
PYTHON_COMPAT=( python3_{9..11} )
|
||||
inherit autotools pam python-single-r1 systemd
|
||||
|
||||
MY_PN=${PN}-server
|
||||
MY_P=${MY_PN}-${PV}
|
||||
MY_PV=$(ver_rs 1- "_")
|
||||
|
||||
DESCRIPTION="Highly configurable free RADIUS server"
|
||||
HOMEPAGE="https://freeradius.org/"
|
||||
SRC_URI="https://github.com/FreeRADIUS/freeradius-server/releases/download/release_${MY_PV}/${MY_P}.tar.bz2"
|
||||
S="${WORKDIR}"/${MY_P}
|
||||
|
||||
LICENSE="GPL-2"
|
||||
SLOT="0"
|
||||
KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~sparc x86"
|
||||
|
||||
IUSE="
|
||||
debug firebird iodbc kerberos ldap memcached mysql mongodb odbc oracle pam
|
||||
postgres python readline redis samba sqlite ssl systemd
|
||||
"
|
||||
|
||||
RESTRICT="firebird? ( bindist )"
|
||||
|
||||
# NOTE: Temporary freeradius doesn't support linking with mariadb client
|
||||
# libs also if code is compliant, will be available in the next release.
|
||||
# (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a
|
||||
|
||||
# TODO: rlm_mschap works with both samba library or without. I need to avoid
|
||||
# linking of samba library if -samba is used.
|
||||
|
||||
# TODO: unconditional json-c for now as automagic dep despite efforts to stop it
|
||||
# ditto libpcap. Can restore USE=rest, USE=pcap if/when fixed.
|
||||
|
||||
RDEPEND="acct-group/radius
|
||||
acct-user/radius
|
||||
!net-dialup/cistronradius
|
||||
dev-libs/libltdl
|
||||
dev-libs/libpcre
|
||||
dev-libs/json-c:=
|
||||
dev-lang/perl:=
|
||||
net-libs/libpcap
|
||||
sys-libs/gdbm:=
|
||||
sys-libs/libcap
|
||||
sys-libs/talloc
|
||||
virtual/libcrypt:=
|
||||
firebird? ( dev-db/firebird )
|
||||
iodbc? ( dev-db/libiodbc )
|
||||
kerberos? ( virtual/krb5 )
|
||||
ldap? ( net-nds/openldap:= )
|
||||
memcached? ( dev-libs/libmemcached )
|
||||
mysql? ( dev-db/mysql-connector-c:= )
|
||||
mongodb? ( >=dev-libs/mongo-c-driver-1.13.0-r1 )
|
||||
odbc? ( dev-db/unixODBC )
|
||||
oracle? ( dev-db/oracle-instantclient[sdk] )
|
||||
pam? ( sys-libs/pam )
|
||||
postgres? ( dev-db/postgresql:= )
|
||||
python? ( ${PYTHON_DEPS} )
|
||||
readline? ( sys-libs/readline:= )
|
||||
redis? ( dev-libs/hiredis:= )
|
||||
samba? ( net-fs/samba )
|
||||
sqlite? ( dev-db/sqlite:3 )
|
||||
ssl? ( >=dev-libs/openssl-1.0.2:=[-bindist(-)] )
|
||||
systemd? ( sys-apps/systemd:= )"
|
||||
DEPEND="${RDEPEND}"
|
||||
|
||||
REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
|
||||
|
||||
# bug #721040
|
||||
QA_SONAME="usr/lib.*/libfreeradius-.*.so"
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}"/${PN}-3.0.20-systemd-service.patch
|
||||
)
|
||||
|
||||
pkg_setup() {
|
||||
if use python ; then
|
||||
python-single-r1_pkg_setup
|
||||
export PYTHONBIN="${EPYTHON}"
|
||||
fi
|
||||
}
|
||||
|
||||
src_prepare() {
|
||||
default
|
||||
|
||||
# Most of the configuration options do not appear as ./configure
|
||||
# switches. Instead it identifies the directories that are available
|
||||
# and run through them. These might check for the presence of
|
||||
# various libraries, in which case they are not built. To avoid
|
||||
# automagic dependencies, we just remove all the modules that we're
|
||||
# not interested in using.
|
||||
# TODO: shift more of these into configure args below as things
|
||||
# are a bit better now.
|
||||
use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; }
|
||||
use ldap || { rm -r src/modules/rlm_ldap || die ; }
|
||||
use kerberos || { rm -r src/modules/rlm_krb5 || die ; }
|
||||
use memcached || { rm -r src/modules/rlm_cache/drivers/rlm_cache_memcached || die ; }
|
||||
use pam || { rm -r src/modules/rlm_pam || die ; }
|
||||
|
||||
# Drop support for python2
|
||||
rm -r src/modules/rlm_python || die
|
||||
|
||||
use python || { rm -r src/modules/rlm_python3 || die ; }
|
||||
#use rest || { rm -r src/modules/rlm_rest || die ; }
|
||||
use redis || { rm -r src/modules/rlm_redis{,who} || die ; }
|
||||
# Do not install ruby rlm module, bug #483108
|
||||
rm -r src/modules/rlm_ruby || die
|
||||
|
||||
# These are all things we don't have in portage/I don't want to deal
|
||||
# with myself.
|
||||
#
|
||||
# Requires TNCS library
|
||||
rm -r src/modules/rlm_eap/types/rlm_eap_tnc || die
|
||||
# Requires libeap-ikev2
|
||||
rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die
|
||||
# Requires some membership.h
|
||||
rm -r src/modules/rlm_opendirectory || die
|
||||
# ?
|
||||
rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die
|
||||
|
||||
# SQL drivers that are not part of experimental are loaded from a
|
||||
# file, so we have to remove them from the file itself when we
|
||||
# remove them.
|
||||
usesqldriver() {
|
||||
local flag=$1
|
||||
local driver=rlm_sql_${2:-${flag}}
|
||||
|
||||
if ! use ${flag} ; then
|
||||
rm -r src/modules/rlm_sql/drivers/${driver} || die
|
||||
sed -i -e /${driver}/d src/modules/rlm_sql/stable || die
|
||||
fi
|
||||
}
|
||||
|
||||
sed -i \
|
||||
-e 's:^#\tuser = :\tuser = :g' \
|
||||
-e 's:^#\tgroup = :\tgroup = :g' \
|
||||
-e 's:/var/run/radiusd:/run/radiusd:g' \
|
||||
-e '/^run_dir/s:${localstatedir}::g' \
|
||||
raddb/radiusd.conf.in || die
|
||||
|
||||
# - Verbosity
|
||||
# - B uild shared libraries using jlibtool -shared
|
||||
sed -i \
|
||||
-e '/$(LIBTOOL)/s|--quiet ||g' \
|
||||
-e 's:--mode=\(compile\|link\):& -shared:g' \
|
||||
Make.inc.in || die
|
||||
sed -i \
|
||||
-e 's|--silent ||g' \
|
||||
-e 's:--mode=\(compile\|link\):& -shared:g' \
|
||||
scripts/libtool.mk || die
|
||||
|
||||
# Crude measure to stop jlibtool from running ranlib and ar
|
||||
sed -i \
|
||||
-e '/LIBRARIAN/s|".*"|"true"|g' \
|
||||
-e '/RANLIB/s|".*"|"true"|g' \
|
||||
scripts/jlibtool.c || die
|
||||
|
||||
usesqldriver mysql
|
||||
usesqldriver postgres postgresql
|
||||
usesqldriver firebird
|
||||
usesqldriver iodbc
|
||||
usesqldriver odbc unixodbc
|
||||
usesqldriver oracle
|
||||
usesqldriver sqlite
|
||||
usesqldriver mongodb mongo
|
||||
|
||||
eautoreconf
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
# Do not try to enable static with static-libs; upstream is a
|
||||
# massacre of libtool best practices so you also have to make sure
|
||||
# to --enable-shared explicitly.
|
||||
local myeconfargs=(
|
||||
# Revisit confcache when not needing to use ac_cv anymore
|
||||
# for automagic deps.
|
||||
#--cache-file="${S}"/config.cache
|
||||
|
||||
--enable-shared
|
||||
--disable-ltdl-install
|
||||
--disable-silent-rules
|
||||
--with-system-libtool
|
||||
--with-system-libltdl
|
||||
|
||||
--enable-strict-dependencies
|
||||
--without-rlm_couchbase
|
||||
--without-rlm_securid
|
||||
--without-rlm_unbound
|
||||
--without-rlm_idn
|
||||
#--without-rlm_json
|
||||
#$(use_with rest libfreeradius-json)
|
||||
|
||||
# Our OpenSSL should be patched. Avoid false-positive failures.
|
||||
--disable-openssl-version-check
|
||||
--with-ascend-binary
|
||||
--with-udpfromto
|
||||
--with-dhcp
|
||||
--with-pcre
|
||||
--with-iodbc-include-dir=/usr/include/iodbc
|
||||
--with-experimental-modules
|
||||
--with-docdir=/usr/share/doc/${PF}
|
||||
--with-logdir=/var/log/radius
|
||||
|
||||
$(use_enable debug developer)
|
||||
$(use_with ldap edir)
|
||||
$(use_with ssl openssl)
|
||||
$(use_with systemd systemd)
|
||||
)
|
||||
|
||||
# bug #77613
|
||||
if has_version app-crypt/heimdal ; then
|
||||
myeconfargs+=( --enable-heimdal-krb5 )
|
||||
fi
|
||||
|
||||
if use python ; then
|
||||
myeconfargs+=(
|
||||
--with-rlm-python3-bin=${EPYTHON}
|
||||
--with-rlm-python3-config-bin=${EPYTHON}-config
|
||||
)
|
||||
fi
|
||||
|
||||
if ! use readline ; then
|
||||
export ac_cv_lib_readline=no
|
||||
fi
|
||||
|
||||
#if ! use pcap ; then
|
||||
# export ac_cv_lib_pcap_pcap_open_live=no
|
||||
# export ac_cv_header_pcap_h=no
|
||||
#fi
|
||||
|
||||
econf "${myeconfargs[@]}"
|
||||
}
|
||||
|
||||
src_compile() {
|
||||
# Verbose, do not generate certificates
|
||||
emake \
|
||||
Q='' ECHO=true \
|
||||
LOCAL_CERT_PRODUCTS=''
|
||||
}
|
||||
|
||||
src_install() {
|
||||
dodir /etc
|
||||
|
||||
diropts -m0750 -o root -g radius
|
||||
dodir /etc/raddb
|
||||
|
||||
diropts -m0750 -o radius -g radius
|
||||
dodir /var/log/radius
|
||||
|
||||
keepdir /var/log/radius/radacct
|
||||
diropts
|
||||
|
||||
# - Verbose, do not install certificates
|
||||
# - Parallel install fails (bug #509498)
|
||||
emake -j1 \
|
||||
Q='' ECHO=true \
|
||||
LOCAL_CERT_PRODUCTS='' \
|
||||
R="${D}" \
|
||||
install
|
||||
|
||||
if use pam ; then
|
||||
pamd_mimic_system radiusd auth account password session
|
||||
fi
|
||||
|
||||
# bug #711756
|
||||
fowners -R radius:radius /etc/raddb
|
||||
fowners -R radius:radius /var/log/radius
|
||||
|
||||
dodoc CREDITS
|
||||
|
||||
rm "${ED}"/usr/sbin/rc.radiusd || die
|
||||
|
||||
newinitd "${FILESDIR}"/radius.init-r4 radiusd
|
||||
newconfd "${FILESDIR}"/radius.conf-r6 radiusd
|
||||
|
||||
if ! use systemd ; then
|
||||
# If systemd builtin is not enabled we need use Type=Simple
|
||||
# as systemd .service
|
||||
sed -i -e 's:^Type=.*::g' \
|
||||
-e 's:^WatchdogSec=.*::g' -e 's:^NotifyAccess=all.*::g' \
|
||||
"${S}"/debian/freeradius.service
|
||||
fi
|
||||
|
||||
systemd_dounit "${S}"/debian/freeradius.service
|
||||
|
||||
find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die
|
||||
}
|
||||
|
||||
pkg_config() {
|
||||
if use ssl ; then
|
||||
cd "${ROOT}"/etc/raddb/certs || die
|
||||
|
||||
./bootstrap || die "Error while running ./bootstrap script."
|
||||
chown root:radius "${ROOT}"/etc/raddb/certs || die
|
||||
chown root:radius "${ROOT}"/etc/raddb/certs/ca.pem || die
|
||||
chown root:radius "${ROOT}"/etc/raddb/certs/server.{key,crt,pem} || die
|
||||
fi
|
||||
}
|
||||
|
||||
pkg_preinst() {
|
||||
if ! has_version ${CATEGORY}/${PN} && use ssl ; then
|
||||
elog "You have to run \`emerge --config =${CATEGORY}/${PF}\` to be able"
|
||||
elog "to start the radiusd service."
|
||||
fi
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
|
||||
<pkgmetadata>
|
||||
<!-- maintainer-needed -->
|
||||
<use>
|
||||
<flag name="memcached">
|
||||
Include <pkg>dev-libs/libmemcached</pkg> in caching drivers
|
||||
</flag>
|
||||
<flag name="pcap">
|
||||
Build the RADIUS sniffer which requires <pkg>net-libs/libpcap</pkg>.
|
||||
</flag>
|
||||
<flag name="rest">
|
||||
Include support for sending and receiving HTTP requests
|
||||
</flag>
|
||||
<flag name="redis">
|
||||
Include support for Redis database
|
||||
</flag>
|
||||
<flag name="mongodb">
|
||||
Include support for MongoDB database
|
||||
</flag>
|
||||
</use>
|
||||
</pkgmetadata>
|
||||
Loading…
Reference in New Issue