From 2ed94b4bc0c5cb6340b4863df76b7234b18c4ee1 Mon Sep 17 00:00:00 2001 From: Alarig Le Lay Date: Mon, 30 Jan 2023 10:26:45 +0100 Subject: [PATCH] net-dialup/freeradius: new package, add 3.2.1 Closes: https://bugs.gentoo.org/891265 --- net-dialup/freeradius/Manifest | 1 + .../freeradius-3.0.20-systemd-service.patch | 57 ++++ net-dialup/freeradius/files/radius.conf-r4 | 16 + net-dialup/freeradius/files/radius.conf-r5 | 18 + net-dialup/freeradius/files/radius.init-r3 | 31 ++ net-dialup/freeradius/files/radius.init-r4 | 31 ++ net-dialup/freeradius/freeradius-3.2.1.ebuild | 309 ++++++++++++++++++ net-dialup/freeradius/metadata.xml | 22 ++ 8 files changed, 485 insertions(+) create mode 100644 net-dialup/freeradius/Manifest create mode 100644 net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch create mode 100644 net-dialup/freeradius/files/radius.conf-r4 create mode 100644 net-dialup/freeradius/files/radius.conf-r5 create mode 100644 net-dialup/freeradius/files/radius.init-r3 create mode 100644 net-dialup/freeradius/files/radius.init-r4 create mode 100644 net-dialup/freeradius/freeradius-3.2.1.ebuild create mode 100644 net-dialup/freeradius/metadata.xml diff --git a/net-dialup/freeradius/Manifest b/net-dialup/freeradius/Manifest new file mode 100644 index 0000000..f5fc57c --- /dev/null +++ b/net-dialup/freeradius/Manifest @@ -0,0 +1 @@ +DIST freeradius-server-3.2.1.tar.bz2 3399164 BLAKE2B d0e69d468736d2a5dd85b32bb8b1fa44f2e56725ae525a3895df1b926f5ce525c70af08c2b76b62a9479d00d02c3e4915586fb1e5c7d42955c6b9e5cdeda8f6e SHA512 0f9e98cbf0eff4c5af54731ec34a8c9070252eaf2f91ca0c87caae939f6356fa91a6e1ed98ba66dbf1c1bafecdfcf38603fb4f65a5955e88974f49a5b7885f7a diff --git a/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch b/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch new file mode 100644 index 0000000..0422365 --- /dev/null +++ b/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch @@ -0,0 +1,57 @@ +diff --git a/debian/freeradius.service b/debian/freeradius.service +index 378702d184..ee33c2a294 100644 +--- a/debian/freeradius.service ++++ b/debian/freeradius.service +@@ -7,7 +7,6 @@ Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ htt + Type=notify + WatchdogSec=60 + NotifyAccess=all +-EnvironmentFile=-/etc/default/freeradius + + # FreeRADIUS can do static evaluation of policy language rules based + # on environmental variables which is very useful for doing per-host +@@ -25,16 +24,15 @@ MemoryLimit=2G + # Ensure the daemon can still write its pidfile after it drops + # privileges. Combination of options that work on a variety of + # systems. Test very carefully if you alter these lines. +-RuntimeDirectory=freeradius ++RuntimeDirectory=radiusd + RuntimeDirectoryMode=0775 + # This does not work on Debian Jessie: +-User=freerad +-Group=freerad +-# This does not work on Ubuntu Bionic: +-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius ++User=radius ++Group=radius + +-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout +-ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS ++ExecStartPre=/usr/sbin/radiusd $RADIUSD_OPTIONS -Cx -lstdout ++ExecStart=/usr/sbin/radiusd -f $RADIUSD_OPTIONS ++ExecReload=/bin/kill -HUP $MAINPID + Restart=on-failure + RestartSec=5 + +@@ -42,7 +40,7 @@ RestartSec=5 + NoNewPrivileges=true + + # Allow binding to secure ports, broadcast addresses, and raw interfaces. +-#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE ++CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE + + # Private /tmp that isn't shared by other processes + PrivateTmp=true +@@ -60,10 +58,10 @@ ProtectKernelTunables=true + SystemCallArchitectures=native + + # We shouldn't be writing to the configuration directory +-ReadOnlyDirectories=/etc/freeradius/ ++ReadOnlyDirectories=/etc/raddb/ + + # We can read and write to the log directory. +-ReadWriteDirectories=/var/log/freeradius/ ++ReadWriteDirectories=/var/log/radius/ + + [Install] + WantedBy=multi-user.target diff --git a/net-dialup/freeradius/files/radius.conf-r4 b/net-dialup/freeradius/files/radius.conf-r4 new file mode 100644 index 0000000..a5760d2 --- /dev/null +++ b/net-dialup/freeradius/files/radius.conf-r4 @@ -0,0 +1,16 @@ +# Config file for /etc/init.d/radiusd + +# see man pages for radiusd run `radiusd -h` +# for valid cmdline options +#RADIUSD_OPTS="" + +# Change this value if you change it in /etc/raddb/radiusd.conf +pidfile=/var/run/radiusd/radiusd.pid + +# Change these values if you change them in /etc/raddb/radiusd.conf +RADIUSD_USER=radius +RADIUSD_GROUP=radius + +# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want +# to uncomment the following line. +#rc_use="logger" diff --git a/net-dialup/freeradius/files/radius.conf-r5 b/net-dialup/freeradius/files/radius.conf-r5 new file mode 100644 index 0000000..7114c32 --- /dev/null +++ b/net-dialup/freeradius/files/radius.conf-r5 @@ -0,0 +1,18 @@ +# Config file for /etc/init.d/radiusd + +# see man pages for radiusd run `radiusd -h` +# for valid cmdline options +#RADIUSD_OPTS="" + +# Change this value if you change it in /etc/raddb/radiusd.conf +pidfile=/var/run/radiusd/radiusd.pid + +# Change these values if you change them in /etc/raddb/radiusd.conf +RADIUSD_USER=radius +RADIUSD_GROUP=radius + +RADIUSD_LOGPATH=/var/log/radius + +# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want +# to uncomment the following line. +#rc_use="logger" diff --git a/net-dialup/freeradius/files/radius.init-r3 b/net-dialup/freeradius/files/radius.init-r3 new file mode 100644 index 0000000..9c16ac5 --- /dev/null +++ b/net-dialup/freeradius/files/radius.init-r3 @@ -0,0 +1,31 @@ +#!/sbin/openrc-run +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +command=/usr/sbin/radiusd +command_args="${RADIUSD_OPTS}" +pidfile="${pidfile:-/run/radiusd/radiusd.pid}" +extra_started_commands="reload" + +depend() { + need localmount + use dns +} + +start_pre() { + if [ ! -f /etc/raddb/radiusd.conf ] ; then + eerror "No /etc/raddb/radiusd.conf file exists!" + return 1 + fi + + checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \ + $(dirname ${pidfile}) /var/log/radius + checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \ + $(dirname ${pidfile}) /run/radiusd +} + +reload() { + ebegin "Reloading radiusd" + kill -HUP $(cat ${pidfile}) + eend $? +} diff --git a/net-dialup/freeradius/files/radius.init-r4 b/net-dialup/freeradius/files/radius.init-r4 new file mode 100644 index 0000000..dee1842 --- /dev/null +++ b/net-dialup/freeradius/files/radius.init-r4 @@ -0,0 +1,31 @@ +#!/sbin/openrc-run +# Copyright 1999-2020 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +command=/usr/sbin/radiusd +command_args="${RADIUSD_OPTS}" +pidfile="${pidfile:-/run/radiusd/radiusd.pid}" +extra_started_commands="reload" + +depend() { + need localmount + use dns +} + +start_pre() { + if [ ! -f /etc/raddb/radiusd.conf ] ; then + eerror "No /etc/raddb/radiusd.conf file exists!" + return 1 + fi + + checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \ + $(dirname ${pidfile}) "${RADIUSD_LOGPATH:-/var/log/radius}" + checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \ + $(dirname ${pidfile}) /run/radiusd +} + +reload() { + ebegin "Reloading radiusd" + kill -HUP $(cat ${pidfile}) + eend $? +} diff --git a/net-dialup/freeradius/freeradius-3.2.1.ebuild b/net-dialup/freeradius/freeradius-3.2.1.ebuild new file mode 100644 index 0000000..21c2f83 --- /dev/null +++ b/net-dialup/freeradius/freeradius-3.2.1.ebuild @@ -0,0 +1,309 @@ +# Copyright 1999-2023 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +PYTHON_COMPAT=( python3_{9..11} ) +inherit autotools pam python-single-r1 systemd + +MY_PN=${PN}-server +MY_P=${MY_PN}-${PV} +MY_PV=$(ver_rs 1- "_") + +DESCRIPTION="Highly configurable free RADIUS server" +HOMEPAGE="https://freeradius.org/" +SRC_URI="https://github.com/FreeRADIUS/freeradius-server/releases/download/release_${MY_PV}/${MY_P}.tar.bz2" +S="${WORKDIR}"/${MY_P} + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~sparc x86" + +IUSE=" + debug firebird iodbc kerberos ldap memcached mysql mongodb odbc oracle pam + postgres python readline redis samba sqlite ssl systemd +" + +RESTRICT="firebird? ( bindist )" + +# NOTE: Temporary freeradius doesn't support linking with mariadb client +# libs also if code is compliant, will be available in the next release. +# (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a + +# TODO: rlm_mschap works with both samba library or without. I need to avoid +# linking of samba library if -samba is used. + +# TODO: unconditional json-c for now as automagic dep despite efforts to stop it +# ditto libpcap. Can restore USE=rest, USE=pcap if/when fixed. + +RDEPEND="acct-group/radius + acct-user/radius + !net-dialup/cistronradius + dev-libs/libltdl + dev-libs/libpcre + dev-libs/json-c:= + dev-lang/perl:= + net-libs/libpcap + sys-libs/gdbm:= + sys-libs/libcap + sys-libs/talloc + virtual/libcrypt:= + firebird? ( dev-db/firebird ) + iodbc? ( dev-db/libiodbc ) + kerberos? ( virtual/krb5 ) + ldap? ( net-nds/openldap:= ) + memcached? ( dev-libs/libmemcached ) + mysql? ( dev-db/mysql-connector-c:= ) + mongodb? ( >=dev-libs/mongo-c-driver-1.13.0-r1 ) + odbc? ( dev-db/unixODBC ) + oracle? ( dev-db/oracle-instantclient[sdk] ) + pam? ( sys-libs/pam ) + postgres? ( dev-db/postgresql:= ) + python? ( ${PYTHON_DEPS} ) + readline? ( sys-libs/readline:= ) + redis? ( dev-libs/hiredis:= ) + samba? ( net-fs/samba ) + sqlite? ( dev-db/sqlite:3 ) + ssl? ( >=dev-libs/openssl-1.0.2:=[-bindist(-)] ) + systemd? ( sys-apps/systemd:= )" +DEPEND="${RDEPEND}" + +REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )" + +# bug #721040 +QA_SONAME="usr/lib.*/libfreeradius-.*.so" + +PATCHES=( + "${FILESDIR}"/${PN}-3.0.20-systemd-service.patch +) + +pkg_setup() { + if use python ; then + python-single-r1_pkg_setup + export PYTHONBIN="${EPYTHON}" + fi +} + +src_prepare() { + default + + # Most of the configuration options do not appear as ./configure + # switches. Instead it identifies the directories that are available + # and run through them. These might check for the presence of + # various libraries, in which case they are not built. To avoid + # automagic dependencies, we just remove all the modules that we're + # not interested in using. + # TODO: shift more of these into configure args below as things + # are a bit better now. + use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; } + use ldap || { rm -r src/modules/rlm_ldap || die ; } + use kerberos || { rm -r src/modules/rlm_krb5 || die ; } + use memcached || { rm -r src/modules/rlm_cache/drivers/rlm_cache_memcached || die ; } + use pam || { rm -r src/modules/rlm_pam || die ; } + + # Drop support for python2 + rm -r src/modules/rlm_python || die + + use python || { rm -r src/modules/rlm_python3 || die ; } + #use rest || { rm -r src/modules/rlm_rest || die ; } + use redis || { rm -r src/modules/rlm_redis{,who} || die ; } + # Do not install ruby rlm module, bug #483108 + rm -r src/modules/rlm_ruby || die + + # These are all things we don't have in portage/I don't want to deal + # with myself. + # + # Requires TNCS library + rm -r src/modules/rlm_eap/types/rlm_eap_tnc || die + # Requires libeap-ikev2 + rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die + # Requires some membership.h + rm -r src/modules/rlm_opendirectory || die + # ? + rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die + + # SQL drivers that are not part of experimental are loaded from a + # file, so we have to remove them from the file itself when we + # remove them. + usesqldriver() { + local flag=$1 + local driver=rlm_sql_${2:-${flag}} + + if ! use ${flag} ; then + rm -r src/modules/rlm_sql/drivers/${driver} || die + sed -i -e /${driver}/d src/modules/rlm_sql/stable || die + fi + } + + sed -i \ + -e 's:^#\tuser = :\tuser = :g' \ + -e 's:^#\tgroup = :\tgroup = :g' \ + -e 's:/var/run/radiusd:/run/radiusd:g' \ + -e '/^run_dir/s:${localstatedir}::g' \ + raddb/radiusd.conf.in || die + + # - Verbosity + # - B uild shared libraries using jlibtool -shared + sed -i \ + -e '/$(LIBTOOL)/s|--quiet ||g' \ + -e 's:--mode=\(compile\|link\):& -shared:g' \ + Make.inc.in || die + sed -i \ + -e 's|--silent ||g' \ + -e 's:--mode=\(compile\|link\):& -shared:g' \ + scripts/libtool.mk || die + + # Crude measure to stop jlibtool from running ranlib and ar + sed -i \ + -e '/LIBRARIAN/s|".*"|"true"|g' \ + -e '/RANLIB/s|".*"|"true"|g' \ + scripts/jlibtool.c || die + + usesqldriver mysql + usesqldriver postgres postgresql + usesqldriver firebird + usesqldriver iodbc + usesqldriver odbc unixodbc + usesqldriver oracle + usesqldriver sqlite + usesqldriver mongodb mongo + + eautoreconf +} + +src_configure() { + # Do not try to enable static with static-libs; upstream is a + # massacre of libtool best practices so you also have to make sure + # to --enable-shared explicitly. + local myeconfargs=( + # Revisit confcache when not needing to use ac_cv anymore + # for automagic deps. + #--cache-file="${S}"/config.cache + + --enable-shared + --disable-ltdl-install + --disable-silent-rules + --with-system-libtool + --with-system-libltdl + + --enable-strict-dependencies + --without-rlm_couchbase + --without-rlm_securid + --without-rlm_unbound + --without-rlm_idn + #--without-rlm_json + #$(use_with rest libfreeradius-json) + + # Our OpenSSL should be patched. Avoid false-positive failures. + --disable-openssl-version-check + --with-ascend-binary + --with-udpfromto + --with-dhcp + --with-pcre + --with-iodbc-include-dir=/usr/include/iodbc + --with-experimental-modules + --with-docdir=/usr/share/doc/${PF} + --with-logdir=/var/log/radius + + $(use_enable debug developer) + $(use_with ldap edir) + $(use_with ssl openssl) + $(use_with systemd systemd) + ) + + # bug #77613 + if has_version app-crypt/heimdal ; then + myeconfargs+=( --enable-heimdal-krb5 ) + fi + + if use python ; then + myeconfargs+=( + --with-rlm-python3-bin=${EPYTHON} + --with-rlm-python3-config-bin=${EPYTHON}-config + ) + fi + + if ! use readline ; then + export ac_cv_lib_readline=no + fi + + #if ! use pcap ; then + # export ac_cv_lib_pcap_pcap_open_live=no + # export ac_cv_header_pcap_h=no + #fi + + econf "${myeconfargs[@]}" +} + +src_compile() { + # Verbose, do not generate certificates + emake \ + Q='' ECHO=true \ + LOCAL_CERT_PRODUCTS='' +} + +src_install() { + dodir /etc + + diropts -m0750 -o root -g radius + dodir /etc/raddb + + diropts -m0750 -o radius -g radius + dodir /var/log/radius + + keepdir /var/log/radius/radacct + diropts + + # - Verbose, do not install certificates + # - Parallel install fails (bug #509498) + emake -j1 \ + Q='' ECHO=true \ + LOCAL_CERT_PRODUCTS='' \ + R="${D}" \ + install + + if use pam ; then + pamd_mimic_system radiusd auth account password session + fi + + # bug #711756 + fowners -R radius:radius /etc/raddb + fowners -R radius:radius /var/log/radius + + dodoc CREDITS + + rm "${ED}"/usr/sbin/rc.radiusd || die + + newinitd "${FILESDIR}"/radius.init-r4 radiusd + newconfd "${FILESDIR}"/radius.conf-r6 radiusd + + if ! use systemd ; then + # If systemd builtin is not enabled we need use Type=Simple + # as systemd .service + sed -i -e 's:^Type=.*::g' \ + -e 's:^WatchdogSec=.*::g' -e 's:^NotifyAccess=all.*::g' \ + "${S}"/debian/freeradius.service + fi + + systemd_dounit "${S}"/debian/freeradius.service + + find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die +} + +pkg_config() { + if use ssl ; then + cd "${ROOT}"/etc/raddb/certs || die + + ./bootstrap || die "Error while running ./bootstrap script." + chown root:radius "${ROOT}"/etc/raddb/certs || die + chown root:radius "${ROOT}"/etc/raddb/certs/ca.pem || die + chown root:radius "${ROOT}"/etc/raddb/certs/server.{key,crt,pem} || die + fi +} + +pkg_preinst() { + if ! has_version ${CATEGORY}/${PN} && use ssl ; then + elog "You have to run \`emerge --config =${CATEGORY}/${PF}\` to be able" + elog "to start the radiusd service." + fi +} diff --git a/net-dialup/freeradius/metadata.xml b/net-dialup/freeradius/metadata.xml new file mode 100644 index 0000000..2ae2372 --- /dev/null +++ b/net-dialup/freeradius/metadata.xml @@ -0,0 +1,22 @@ + + + + + + + Include dev-libs/libmemcached in caching drivers + + + Build the RADIUS sniffer which requires net-libs/libpcap. + + + Include support for sending and receiving HTTP requests + + + Include support for Redis database + + + Include support for MongoDB database + + +