2016-10-11 16:12:41 +02:00
|
|
|
# $NetBSD: Makefile,v 1.44 2016/10/11 14:12:41 sevan Exp $
|
2008-05-15 21:43:47 +02:00
|
|
|
|
|
|
|
|
DISTNAME= freeradius-server-${RADVER}
|
|
|
|
|
PKGNAME= ${DISTNAME:S/-server//}
|
|
|
|
|
CATEGORIES= net
|
|
|
|
|
MASTER_SITES= ftp://ftp.freeradius.org/pub/freeradius/
|
|
|
|
|
EXTRACT_SUFX= .tar.bz2
|
|
|
|
|
|
2009-07-17 20:00:13 +02:00
|
|
|
MAINTAINER= pkgsrc-users@NetBSD.org
|
2010-11-13 22:08:54 +01:00
|
|
|
HOMEPAGE= http://freeradius.org/
|
2008-05-15 21:43:47 +02:00
|
|
|
COMMENT= Free RADIUS server implementation
|
2010-05-23 19:28:44 +02:00
|
|
|
LICENSE= gnu-gpl-v2
|
2008-05-15 21:43:47 +02:00
|
|
|
|
|
|
|
|
CONFLICTS+= radiusd-cistron-[0-9]*
|
2008-12-19 23:49:18 +01:00
|
|
|
CONFLICTS+= freeradius<2.0
|
2008-05-15 21:43:47 +02:00
|
|
|
USE_TOOLS+= gmake perl:run
|
2016-10-11 16:12:41 +02:00
|
|
|
USE_LANGUAGES+= c c++
|
2010-05-23 19:28:44 +02:00
|
|
|
USE_LIBTOOL= yes
|
|
|
|
|
USE_OLD_DES_API= yes
|
|
|
|
|
MAKE_JOBS_SAFE= no
|
|
|
|
|
|
|
|
|
|
.include "../../mk/bsd.prefs.mk"
|
2008-05-15 21:43:47 +02:00
|
|
|
|
Changes 2.1.10:
* Install the "radcrypt" program.
* Enable radclient to send requests containing MS-CHAPv1 Send packets with:
MS-CHAP-Password = "password". It will be automatically converted to the
correct MS-CHAP attributes.
* Added "-t" command-line option to radtest. You can use "-t pap", "-t chap",
"-t mschap", or "-t eap-md5". The default is "-t pap"
* Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120 This change
and the previous one makes PEAP testing much easier.
* Added more documentation and examples for the "passwd" module.
* Added dictionaries for RFC 5607 and RFC 5904.
* Added note in proxy.conf that we recommend setting
"require_message_authenticator = yes" for all home servers.
* Added example of second "files" configuration, with documentation.
This shows how and where to use two instances of a module.
* Updated radsniff to have it write pcap files, too. See '-w'.
* Print out large WARNING message if we send an Access-Challenge for EAP, and
receive no follow-up messages from the client.
* Added Cached-Session-Policy for EAP session resumption. See raddb/eap.conf.
* Added support for TLS-Cert-* attributes. For details, see
raddb/sites-available/default, "post-auth" section.
* Added sample raddb/modules/{opendirectory,dynamic_clients}
* Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
* Added RFCs 5607, 5904, and 5997.
* For EAP-TLS, client certificates can now be validated using an external
command. See eap.conf, "validate" subsection of "tls".
* Made rlm_pap aware of {nthash} prefix, for compatibility with legacy RADIUS
systems.
* Add Module-Failure-Message for mschap module (ntlm_auth)
* Made rlm_sql_sqlite database configurable. Use "filename" in sql{} section.
* Added %{tolower: ...string ... }, which returns the lowercase version of the
string. Also added %{toupper: ... } for uppercase.
* Bug fixes.
2010-10-29 17:59:00 +02:00
|
|
|
BUILD_DEFS+= VARBASE
|
Update to 2.1.1
Patches mainly from adam@ with some changes by me
05 September 2008 - Version 2.1.0 has been released.
The focus of this release is features.
Feature Improvements
* Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients.
* SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README
* SNMP statistics are also available through Status-Server packets. See raddb/sites-available/status
* Added more Microsoft attributes from bug #568.
* The linelog module has more functionality and flexibility. See raddb/modules/linelog.
* The debugging output has been sanitized. It should be much more readable.
* Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the log section of raddb/radiusd.conf.
* Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax
* Added session resumption for PEAP and TTLS. See raddb/eap.conf, and the cache sub-section.
* Added radmin command-line tool for administering a running server. See man radmin and raddb/sites-available/control-socket.
Bug Fixes
* Double escaping of '\\' in the users (and some other) files has been fixed. If you have '\\' in the users file, your configuration will need to be checked, and fixed!
* Parse security section of radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566.
* Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces.
* Fix handling of giaddr in DHCP responses.
* Corrected parsing of status_check in home_server so that it works.
* Fix hints so that "Puser" works again.
* Removed length restrictions on attribute names in the dictionaries.
* Update socket code to avoid C compiler optimizations.
25 September 2008 - Version 2.1.1 has been released.
The focus of this release is stability.
Feature Improvements
* Many more options and features are available via radmin. See man radmin and raddb/sites-available/control-socket.
* Many more commands available via the control socket. Connect via radmin, and type help for more information.
* Added dictionary.networkphysics and dictionary.lancom.
* Calculate WiMAX MIP keys, and added sample WiMAX SQL tables.
Bug Fixes
* Fixed bug that made radmin not work.
* Fixed Suse && Debian package scripts.
* Fixed issues with dynamic clients.
* Fixed configure checks for -lreadline
* rlm_sqlippool no longer needs to be linked to rlm_sql.
* Add statistics for detail file listeners. This closes bug #593.
* Fixed printing of some WiMAX attributes.
* Fixed double free on exit() in rlm_attr_filter.
* Fixed build issues on Solaris.
* Fixed fast session resumption for EAP-TLS.
2008-10-12 15:57:27 +02:00
|
|
|
FILES_SUBST+= RADIUS_USER=${RADIUS_USER}
|
|
|
|
|
FILES_SUBST+= RADIUS_GROUP=${RADIUS_GROUP}
|
2008-05-15 21:43:47 +02:00
|
|
|
PLIST_SUBST+= RADVER=${RADVER}
|
2016-10-11 16:12:41 +02:00
|
|
|
PLIST_SUBST+= RADVERALT=${RADVERALT}
|
2014-11-02 06:55:43 +01:00
|
|
|
MESSAGE_SRC+= ${PKGDIR}/MESSAGE
|
2008-05-15 21:43:47 +02:00
|
|
|
MESSAGE_SUBST+= CHOWN=${CHOWN:Q} CHMOD=${CHMOD:Q} VARBASE=${VARBASE}
|
Update to 2.1.1
Patches mainly from adam@ with some changes by me
05 September 2008 - Version 2.1.0 has been released.
The focus of this release is features.
Feature Improvements
* Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients.
* SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README
* SNMP statistics are also available through Status-Server packets. See raddb/sites-available/status
* Added more Microsoft attributes from bug #568.
* The linelog module has more functionality and flexibility. See raddb/modules/linelog.
* The debugging output has been sanitized. It should be much more readable.
* Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the log section of raddb/radiusd.conf.
* Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax
* Added session resumption for PEAP and TTLS. See raddb/eap.conf, and the cache sub-section.
* Added radmin command-line tool for administering a running server. See man radmin and raddb/sites-available/control-socket.
Bug Fixes
* Double escaping of '\\' in the users (and some other) files has been fixed. If you have '\\' in the users file, your configuration will need to be checked, and fixed!
* Parse security section of radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566.
* Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces.
* Fix handling of giaddr in DHCP responses.
* Corrected parsing of status_check in home_server so that it works.
* Fix hints so that "Puser" works again.
* Removed length restrictions on attribute names in the dictionaries.
* Update socket code to avoid C compiler optimizations.
25 September 2008 - Version 2.1.1 has been released.
The focus of this release is stability.
Feature Improvements
* Many more options and features are available via radmin. See man radmin and raddb/sites-available/control-socket.
* Many more commands available via the control socket. Connect via radmin, and type help for more information.
* Added dictionary.networkphysics and dictionary.lancom.
* Calculate WiMAX MIP keys, and added sample WiMAX SQL tables.
Bug Fixes
* Fixed bug that made radmin not work.
* Fixed Suse && Debian package scripts.
* Fixed issues with dynamic clients.
* Fixed configure checks for -lreadline
* rlm_sqlippool no longer needs to be linked to rlm_sql.
* Add statistics for detail file listeners. This closes bug #593.
* Fixed printing of some WiMAX attributes.
* Fixed double free on exit() in rlm_attr_filter.
* Fixed build issues on Solaris.
* Fixed fast session resumption for EAP-TLS.
2008-10-12 15:57:27 +02:00
|
|
|
MESSAGE_SUBST+= RADIUS_USER=${RADIUS_USER} XARGS=${XARGS:Q}
|
|
|
|
|
MESSAGE_SUBST+= RADIUS_GROUP=${RADIUS_GROUP} FIND=${FIND:Q}
|
2008-05-15 21:43:47 +02:00
|
|
|
|
|
|
|
|
PKG_SYSCONFSUBDIR= raddb
|
|
|
|
|
RCD_SCRIPTS= radiusd
|
|
|
|
|
RADIUS_USER?= radius
|
|
|
|
|
RADIUS_GROUP?= radius
|
|
|
|
|
PKG_GROUPS= ${RADIUS_USER}
|
|
|
|
|
PKG_USERS= ${RADIUS_USER}:${RADIUS_GROUP}
|
|
|
|
|
PKG_GROUPS_VARS+= RADIUS_GROUP
|
Changes 2.1.10:
* Install the "radcrypt" program.
* Enable radclient to send requests containing MS-CHAPv1 Send packets with:
MS-CHAP-Password = "password". It will be automatically converted to the
correct MS-CHAP attributes.
* Added "-t" command-line option to radtest. You can use "-t pap", "-t chap",
"-t mschap", or "-t eap-md5". The default is "-t pap"
* Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120 This change
and the previous one makes PEAP testing much easier.
* Added more documentation and examples for the "passwd" module.
* Added dictionaries for RFC 5607 and RFC 5904.
* Added note in proxy.conf that we recommend setting
"require_message_authenticator = yes" for all home servers.
* Added example of second "files" configuration, with documentation.
This shows how and where to use two instances of a module.
* Updated radsniff to have it write pcap files, too. See '-w'.
* Print out large WARNING message if we send an Access-Challenge for EAP, and
receive no follow-up messages from the client.
* Added Cached-Session-Policy for EAP session resumption. See raddb/eap.conf.
* Added support for TLS-Cert-* attributes. For details, see
raddb/sites-available/default, "post-auth" section.
* Added sample raddb/modules/{opendirectory,dynamic_clients}
* Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
* Added RFCs 5607, 5904, and 5997.
* For EAP-TLS, client certificates can now be validated using an external
command. See eap.conf, "validate" subsection of "tls".
* Made rlm_pap aware of {nthash} prefix, for compatibility with legacy RADIUS
systems.
* Add Module-Failure-Message for mschap module (ntlm_auth)
* Made rlm_sql_sqlite database configurable. Use "filename" in sql{} section.
* Added %{tolower: ...string ... }, which returns the lowercase version of the
string. Also added %{toupper: ... } for uppercase.
* Bug fixes.
2010-10-29 17:59:00 +02:00
|
|
|
PKG_USERS_VARS= RADIUS_USER
|
2008-05-15 21:43:47 +02:00
|
|
|
OWN_DIRS_PERMS+= ${VARBASE}/run/radiusd \
|
|
|
|
|
${RADIUS_USER} ${RADIUS_GROUP} 0750
|
|
|
|
|
OWN_DIRS_PERMS+= ${VARBASE}/log/radiusd \
|
|
|
|
|
${RADIUS_USER} ${RADIUS_GROUP} 0750
|
|
|
|
|
OWN_DIRS_PERMS+= ${VARBASE}/log/radiusd/radacct \
|
|
|
|
|
${RADIUS_USER} ${RADIUS_GROUP} 0750
|
|
|
|
|
|
2016-10-11 16:12:41 +02:00
|
|
|
RADVER= 2.2.9
|
|
|
|
|
RADVERALT= 020209
|
2012-04-03 03:22:02 +02:00
|
|
|
EGDIR= ${PREFIX}/share/examples/freeradius
|
2008-05-15 21:43:47 +02:00
|
|
|
|
|
|
|
|
BUILDLINK_API_DEPENDS.openssl+= openssl>=0.9.7
|
|
|
|
|
|
2010-05-23 19:28:44 +02:00
|
|
|
GNU_CONFIGURE= yes
|
Update to 2.1.1
Patches mainly from adam@ with some changes by me
05 September 2008 - Version 2.1.0 has been released.
The focus of this release is features.
Feature Improvements
* Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients.
* SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README
* SNMP statistics are also available through Status-Server packets. See raddb/sites-available/status
* Added more Microsoft attributes from bug #568.
* The linelog module has more functionality and flexibility. See raddb/modules/linelog.
* The debugging output has been sanitized. It should be much more readable.
* Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the log section of raddb/radiusd.conf.
* Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax
* Added session resumption for PEAP and TTLS. See raddb/eap.conf, and the cache sub-section.
* Added radmin command-line tool for administering a running server. See man radmin and raddb/sites-available/control-socket.
Bug Fixes
* Double escaping of '\\' in the users (and some other) files has been fixed. If you have '\\' in the users file, your configuration will need to be checked, and fixed!
* Parse security section of radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566.
* Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces.
* Fix handling of giaddr in DHCP responses.
* Corrected parsing of status_check in home_server so that it works.
* Fix hints so that "Puser" works again.
* Removed length restrictions on attribute names in the dictionaries.
* Update socket code to avoid C compiler optimizations.
25 September 2008 - Version 2.1.1 has been released.
The focus of this release is stability.
Feature Improvements
* Many more options and features are available via radmin. See man radmin and raddb/sites-available/control-socket.
* Many more commands available via the control socket. Connect via radmin, and type help for more information.
* Added dictionary.networkphysics and dictionary.lancom.
* Calculate WiMAX MIP keys, and added sample WiMAX SQL tables.
Bug Fixes
* Fixed bug that made radmin not work.
* Fixed Suse && Debian package scripts.
* Fixed issues with dynamic clients.
* Fixed configure checks for -lreadline
* rlm_sqlippool no longer needs to be linked to rlm_sql.
* Add statistics for detail file listeners. This closes bug #593.
* Fixed printing of some WiMAX attributes.
* Fixed double free on exit() in rlm_attr_filter.
* Fixed build issues on Solaris.
* Fixed fast session resumption for EAP-TLS.
2008-10-12 15:57:27 +02:00
|
|
|
CONFIGURE_ARGS+= --localstatedir=${VARBASE}
|
2009-04-23 20:26:05 +02:00
|
|
|
CONFIGURE_ARGS+= --quiet
|
Update to 2.1.1
Patches mainly from adam@ with some changes by me
05 September 2008 - Version 2.1.0 has been released.
The focus of this release is features.
Feature Improvements
* Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients.
* SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README
* SNMP statistics are also available through Status-Server packets. See raddb/sites-available/status
* Added more Microsoft attributes from bug #568.
* The linelog module has more functionality and flexibility. See raddb/modules/linelog.
* The debugging output has been sanitized. It should be much more readable.
* Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the log section of raddb/radiusd.conf.
* Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax
* Added session resumption for PEAP and TTLS. See raddb/eap.conf, and the cache sub-section.
* Added radmin command-line tool for administering a running server. See man radmin and raddb/sites-available/control-socket.
Bug Fixes
* Double escaping of '\\' in the users (and some other) files has been fixed. If you have '\\' in the users file, your configuration will need to be checked, and fixed!
* Parse security section of radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566.
* Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces.
* Fix handling of giaddr in DHCP responses.
* Corrected parsing of status_check in home_server so that it works.
* Fix hints so that "Puser" works again.
* Removed length restrictions on attribute names in the dictionaries.
* Update socket code to avoid C compiler optimizations.
25 September 2008 - Version 2.1.1 has been released.
The focus of this release is stability.
Feature Improvements
* Many more options and features are available via radmin. See man radmin and raddb/sites-available/control-socket.
* Many more commands available via the control socket. Connect via radmin, and type help for more information.
* Added dictionary.networkphysics and dictionary.lancom.
* Calculate WiMAX MIP keys, and added sample WiMAX SQL tables.
Bug Fixes
* Fixed bug that made radmin not work.
* Fixed Suse && Debian package scripts.
* Fixed issues with dynamic clients.
* Fixed configure checks for -lreadline
* rlm_sqlippool no longer needs to be linked to rlm_sql.
* Add statistics for detail file listeners. This closes bug #593.
* Fixed printing of some WiMAX attributes.
* Fixed double free on exit() in rlm_attr_filter.
* Fixed build issues on Solaris.
* Fixed fast session resumption for EAP-TLS.
2008-10-12 15:57:27 +02:00
|
|
|
CONFIGURE_ARGS+= --sysconfdir=${PKG_SYSCONFBASEDIR}
|
2009-04-23 20:26:05 +02:00
|
|
|
CONFIGURE_ARGS+= --with-logdir=${VARBASE}/log/radiusd
|
Changes 2.1.10:
* Install the "radcrypt" program.
* Enable radclient to send requests containing MS-CHAPv1 Send packets with:
MS-CHAP-Password = "password". It will be automatically converted to the
correct MS-CHAP attributes.
* Added "-t" command-line option to radtest. You can use "-t pap", "-t chap",
"-t mschap", or "-t eap-md5". The default is "-t pap"
* Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120 This change
and the previous one makes PEAP testing much easier.
* Added more documentation and examples for the "passwd" module.
* Added dictionaries for RFC 5607 and RFC 5904.
* Added note in proxy.conf that we recommend setting
"require_message_authenticator = yes" for all home servers.
* Added example of second "files" configuration, with documentation.
This shows how and where to use two instances of a module.
* Updated radsniff to have it write pcap files, too. See '-w'.
* Print out large WARNING message if we send an Access-Challenge for EAP, and
receive no follow-up messages from the client.
* Added Cached-Session-Policy for EAP session resumption. See raddb/eap.conf.
* Added support for TLS-Cert-* attributes. For details, see
raddb/sites-available/default, "post-auth" section.
* Added sample raddb/modules/{opendirectory,dynamic_clients}
* Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
* Added RFCs 5607, 5904, and 5997.
* For EAP-TLS, client certificates can now be validated using an external
command. See eap.conf, "validate" subsection of "tls".
* Made rlm_pap aware of {nthash} prefix, for compatibility with legacy RADIUS
systems.
* Add Module-Failure-Message for mschap module (ntlm_auth)
* Made rlm_sql_sqlite database configurable. Use "filename" in sql{} section.
* Added %{tolower: ...string ... }, which returns the lowercase version of the
string. Also added %{toupper: ... } for uppercase.
* Bug fixes.
2010-10-29 17:59:00 +02:00
|
|
|
CONFIGURE_ARGS+= --with-system-libltdl
|
|
|
|
|
CONFIGURE_ARGS+= --with-system-libtool
|
2010-05-23 19:28:44 +02:00
|
|
|
CONFIGURE_ARGS+= --without-rlm_python
|
2008-05-15 21:43:47 +02:00
|
|
|
CONFIGURE_ARGS+= --without-rlm_smb
|
|
|
|
|
CONFIGURE_ARGS+= --without-rlm_sql_oracle
|
|
|
|
|
CONFIGURE_ARGS+= --without-rlm_sql_unixodbc
|
Changes 2.1.9:
Feature improvements
* Add radmin command "stats detail <file>" to see what
is going on inside of a detail file reader.
* Added documentation for CoA. See raddb/sites-available/coa
* Add sub-option support for Option 82. See dictionary.dhcp
* Add "server" field to default SQL NAS table, and documented it.
Bug fixes
* Reset "received ping" counter for Status-Server checks. In some
corner cases it was not getting reset.
* Handle large VMPS attributes.
* Count accounting responses from a home server in SNMP / statistics
code.
* Set EAP-Session-Resumed = Yes, not "No" when session is resumed.
* radmin packet counter statistics are now unsigned, for numbers
2^31..2^32. After that they roll over to zero.
* Be more careful about expanding data in PAP and MS-CHAP modules.
This prevents login failures when passwords contain '{'.
* Clean up zombie children if there were many "exec" modules being
run for one packet, all with "wait = no".
* re-open log file after HUP.
* Fix "no response to proxied packet" complaint for Coa / Disconnect
packets. It shouldn't ignore replies to packets it sent.
* Calculate IPv6 netmasks correctly.
* Fix SQL module to re-open sockets if they unexpectedly close.
* Track scope for IPv6 addresses. This lets us use link-local
addresses properly.
* Updated Makefiles to no longer use the shell for recursing into
subdirs. "make -j 2" should now work.
* Updated raddb/sql/mysql/ippool.conf to use "= NULL".
* Updated Makefiles so that "make reconfig" no longer uses the shell
for recursing into subdirs, and re-builds all "configure" files.
* Used above method to regenerate all configure scripts.
* Updated SQL module to allow "server" field of "nas" table
to be blank: "". This means the same as it being NULL.
* Fixed regex realm example. Create Realm attribute with value
of realm from User-Name, not from regex.
* If processing a DHCP Discover returns "fail / reject", ignore
the packet rather than sending a NAK.
* Allow '%' to be escaped in sqlcounter module.
* Fix typo internal hash table.
* For PEAP and TTLS, the tunneled reply is added to the reply,
rather than integrated via the operators. This allows multiple
VSAs to be added, where they would previously be discarded.
* Make request number unsigned. This changes nothing other than
the debug output when the server receives more than 2^31 packets.
* Don't block when reading child output in 'exec wait'. This means
that blocked children get killed, instead of blocking the server.
* Enabled building without any proxy functionality
* radclient now prefers IPv4, to match the default server config.
* Print useful error when a realm regex is invalid
* relaxed rules for preprocess module "with_cisco_vsa_hack". The
attributes can now be integer, ipaddr, etc. (i.e. non-string)
* Allow rlm_ldap to build if ldap_set_rebind_proc() has only
2 arguments.
* Update configure script for rlm_python to avoid dynamic linking
problems on some platforms.
* Do suid to "user" when running in debug mode as root
* Make "allow_core_dumps" work in more situations.
* In detail file reader, treat bad records as EOF.
This allows it to continue working when the disk is full.
* Fix Oracle default accounting queries to work when there are no
gigawords attributes. Other databases already had the fix.
* Fix rlm_sql to show when it opens and closes sockets. It already
says when it cannot connect, so it should say when it can connect.
* "chmod -x" for a few C source files.
* Pull update spec files, etc. from RedHat into the redhat/ directory.
* Allow spaces when parsing integer values. This helps people who
put "too much" into an SQL value field.
2010-07-20 10:41:21 +02:00
|
|
|
MAKE_ENV+= R=${DESTDIR}
|
2008-05-15 21:43:47 +02:00
|
|
|
|
Upgrade to freeradius 2.2.0:
FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium
Feature improvements
* 100% configuration file compatible with 2.1.x.
The only fix needed is to disallow "hashsize=0" for rlm_passwd
* Update Aruba, Alcatel Lucent, APC, BT, PaloAlto, Pureware,
Redback, and Mikrotik dictionaries
* Switch to using SHA1 for certificate digests instead of MD5.
See raddb/certs/*.cnf
* Added copyright statements to the dictionaries, so that we know
when people are using them.
* Better documentation for radrelay and detail file writer.
See raddb/modules/radrelay and raddb/radrelay.conf
* Added TLS-Cert-Subject-Alt-Name-Email from patch by Luke Howard
* Added -F <file> to radwho
* Added query timeouts to MySQL driver. Patch from Brian De Wolf.
* Add /etc/default/freeradius to debian package.
Patch from Matthew Newton
* Finalize DHCP and DHCP relay code. It should now work everywhere.
See raddb/sites-available/dhcp, src_ipaddr and src_interface.
* DHCP capabilitiies are now compiled in by default.
It runs as a DHCP server ONLY when manually enabled.
* Added one letter expansions: %G - request minute and %I request
ID.
* Added script to convert ISC DHCP lease files to SQL pools.
See scripts/isc2ippool.pl
* Added rlm_cache to cache arbitrary attributes.
* Added max_use to rlm_ldap to force connection to be re-established
after a given number of queries.
* Added configtest option to Debian init scripts, and automatic
config test on restart.
* Added cache config item to rlm_krb5. When set to "no" ticket
caching is disabled which may increase performance.
Bug fixes
* Fix CVE-2012-3547. All users of 2.1.10, 2.1.11, 2.1.12,
and 802.1X should upgrade immediately.
* Fix typo in detail file writer, to skip writing if the packet
was read from this detail file.
* Free cached replies when closing resumed SSL sessions.
* Fix a number of issues found by Coverity.
* Fix memory leak and race condition in the EAP-TLS session cache.
Thanks to Phil Mayers for tracking down OpenSSL APIs.
* Restrict ATTRIBUTE names to character sets that make sense.
* Fix EAP-TLS session Id length so that OpenSSL doesn't get
excited.
* Fix SQL IPPool logic for non-timer attributes. Closes bug #181
* Change some informational messages to DEBUG rather than error.
* Portability fixes for FreeBSD. Closes bug #177
* A much better fix for the _lt__PROGRAM__LTX_preloaded_symbols
nonsense.
* Safely handle extremely long lines in conf file variable expansion
* Fix for Debian bug #606450
* Mutex lock around rlm_perl Clone routines. Patch from Eike Dehling
* The passwd module no longer permits "hashsize = 0". Setting that
is pointless for a host of reasons. It will also break the server.
* Fix proxied inner-tunnel packets sometimes having zero authentication
vector. Found by Brian Julin.
* Added $(EXEEXT) to Makefiles for portability. Closes bug #188.
* Fix minor build issue which would cause rlm_eap to be built twice.
* When using "status_check=request" for a home server, the username
and password must be specified, or the server will not start.
* EAP-SIM now calculates keys from the SIM identity, not from the
EAP-Identity. Changing the EAP type via NAK may result in
identities changing. Bug reported by Microsoft EAP team.
* Use home server src_ipaddr when sending Status-Server packets
* Decrypt encrypted ERX attributes in CoA packets.
* Fix registration of internal xlat's so %{mschap:...} doesn't
disappear after a HUP.
* Can now reference tagged attributes in expansions.
e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work.
* Correct calculation of Message-Authenticator for CoA and Disconnect
replies. Patch from Jouni Malinen
* Install rad_counter, for managing rlm_counter files.
* Add unique index constraint to all SQL flavours so that alternate
queries work correctly.
* The TTLS diameter decoder is now more lenient. It ignores
unknown attributes, instead of rejecting the TTLS session.
* Use "globfree" in detail file reader. Prevents very slow leak.
Closes bug #207.
* Operator =~ shouldn't copy the attribute, like :=. It should
instead behave more like ==.
* Build main Debian package without SQL dependencies
* Use max_queue_size in threading code
* Update permissions in raddb/sql/postgresql/admin.sql
* Added OpenSSL_add_all_algorithms() to fix issues where OpenSSL
wouldn't use methods it knew about.
* Add more sanity checks in dynamic_clients code so the server won't
crash if it attempts to load a badly formated client definition.
2012-11-23 02:31:18 +01:00
|
|
|
REPLACE_PERL= src/modules/rlm_counter/rad_counter
|
|
|
|
|
REPLACE_PERL+= scripts/radsqlrelay
|
2008-05-15 21:43:47 +02:00
|
|
|
|
Changes 2.1.10:
* Install the "radcrypt" program.
* Enable radclient to send requests containing MS-CHAPv1 Send packets with:
MS-CHAP-Password = "password". It will be automatically converted to the
correct MS-CHAP attributes.
* Added "-t" command-line option to radtest. You can use "-t pap", "-t chap",
"-t mschap", or "-t eap-md5". The default is "-t pap"
* Make the "inner-tunnel" virtual server listen on 127.0.0.1:18120 This change
and the previous one makes PEAP testing much easier.
* Added more documentation and examples for the "passwd" module.
* Added dictionaries for RFC 5607 and RFC 5904.
* Added note in proxy.conf that we recommend setting
"require_message_authenticator = yes" for all home servers.
* Added example of second "files" configuration, with documentation.
This shows how and where to use two instances of a module.
* Updated radsniff to have it write pcap files, too. See '-w'.
* Print out large WARNING message if we send an Access-Challenge for EAP, and
receive no follow-up messages from the client.
* Added Cached-Session-Policy for EAP session resumption. See raddb/eap.conf.
* Added support for TLS-Cert-* attributes. For details, see
raddb/sites-available/default, "post-auth" section.
* Added sample raddb/modules/{opendirectory,dynamic_clients}
* Updated Cisco and Huawei, HP, Redback, and ERX dictionaries.
* Added RFCs 5607, 5904, and 5997.
* For EAP-TLS, client certificates can now be validated using an external
command. See eap.conf, "validate" subsection of "tls".
* Made rlm_pap aware of {nthash} prefix, for compatibility with legacy RADIUS
systems.
* Add Module-Failure-Message for mschap module (ntlm_auth)
* Made rlm_sql_sqlite database configurable. Use "filename" in sql{} section.
* Added %{tolower: ...string ... }, which returns the lowercase version of the
string. Also added %{toupper: ... } for uppercase.
* Bug fixes.
2010-10-29 17:59:00 +02:00
|
|
|
SUBST_CLASSES+= make
|
2008-05-15 21:43:47 +02:00
|
|
|
SUBST_STAGE.make= post-patch
|
2008-12-19 23:49:18 +01:00
|
|
|
SUBST_FILES.make= src/modules/rlm_sql/drivers/rlm_sql_postgresql/Makefile.in
|
2008-05-15 21:43:47 +02:00
|
|
|
SUBST_SED.make+= -e "s|RLM_SQL_LIBS =|RLM_SQL_LIBS = \
|
2009-04-23 20:26:05 +02:00
|
|
|
-L${PREFIX}/lib|g"
|
2008-05-15 21:43:47 +02:00
|
|
|
SUBST_MESSAGE.make= Fixing Makefiles.
|
|
|
|
|
|
|
|
|
|
SUBST_CLASSES+= config
|
|
|
|
|
SUBST_STAGE.config= post-patch
|
|
|
|
|
SUBST_FILES.config= raddb/radiusd.conf.in
|
|
|
|
|
SUBST_SED.config= -e "s|@@RADIUS_USER@@|${RADIUS_USER}|g"
|
|
|
|
|
SUBST_SED.config+= -e "s|@@RADIUS_GROUP@@|${RADIUS_GROUP}|g"
|
|
|
|
|
SUBST_MESSAGE.config= Fixing configuration files.
|
|
|
|
|
|
|
|
|
|
.include "options.mk"
|
|
|
|
|
|
2009-04-23 20:26:05 +02:00
|
|
|
EGFILES=acct_users attrs attrs.access_reject attrs.accounting_response \
|
|
|
|
|
attrs.pre-proxy certs/README certs/bootstrap certs/ca.cnf \
|
|
|
|
|
certs/client.cnf certs/demoCA/cacert.pem certs/server.cnf \
|
|
|
|
|
certs/xpextensions clients.conf dictionary eap.conf experimental.conf \
|
|
|
|
|
hints huntgroups ldap.attrmap modules/acct_unique modules/always \
|
|
|
|
|
modules/attr_filter modules/attr_rewrite modules/chap modules/checkval \
|
|
|
|
|
modules/counter modules/detail modules/detail.example.com \
|
|
|
|
|
modules/detail.log modules/digest modules/echo modules/etc_group \
|
|
|
|
|
modules/exec modules/expiration modules/expr modules/files \
|
|
|
|
|
modules/inner-eap modules/ippool modules/krb5 modules/ldap \
|
|
|
|
|
modules/linelog modules/logintime modules/mac2ip modules/mac2vlan \
|
|
|
|
|
modules/mschap modules/otp modules/pam modules/pap modules/passwd \
|
|
|
|
|
modules/perl modules/policy modules/preprocess modules/radutmp \
|
|
|
|
|
modules/realm modules/smbpasswd modules/smsotp modules/sql_log \
|
|
|
|
|
modules/sqlcounter_expire_on_login modules/sradutmp modules/unix \
|
|
|
|
|
modules/wimax policy.conf policy.txt preproxy_users proxy.conf \
|
|
|
|
|
radiusd.conf sites-available/README sites-available/buffered-sql \
|
|
|
|
|
sites-available/control-socket \
|
|
|
|
|
sites-available/copy-acct-to-home-server \
|
|
|
|
|
sites-available/decoupled-accounting sites-available/default \
|
|
|
|
|
sites-available/dhcp sites-available/dynamic-clients \
|
|
|
|
|
sites-available/example sites-available/inner-tunnel \
|
|
|
|
|
sites-available/originate-coa sites-available/proxy-inner-tunnel \
|
|
|
|
|
sites-available/robust-proxy-accounting sites-available/status \
|
|
|
|
|
sites-available/virtual.example.com sites-available/vmps sql.conf \
|
|
|
|
|
sql/mssql/dialup.conf sql/mssql/schema.sql sql/mysql/admin.sql \
|
|
|
|
|
sql/mysql/counter.conf sql/mysql/dialup.conf sql/mysql/ippool.conf \
|
|
|
|
|
sql/mysql/ippool.sql sql/mysql/nas.sql sql/mysql/schema.sql \
|
|
|
|
|
sql/mysql/wimax.conf sql/mysql/wimax.sql sql/oracle/dialup.conf \
|
|
|
|
|
sql/oracle/ippool.conf sql/oracle/ippool.sql sql/oracle/msqlippool.txt \
|
|
|
|
|
sql/oracle/nas.sql sql/oracle/schema.sql sql/postgresql/admin.sql \
|
|
|
|
|
sql/postgresql/cisco_h323_db_schema.sql sql/postgresql/counter.conf \
|
|
|
|
|
sql/postgresql/dialup.conf sql/postgresql/ippool.conf \
|
|
|
|
|
sql/postgresql/ippool.sql sql/postgresql/nas.sql \
|
|
|
|
|
sql/postgresql/schema.sql \
|
|
|
|
|
sql/postgresql/update_radacct_group_trigger.sql \
|
|
|
|
|
sql/postgresql/voip-postpaid.conf sqlippool.conf templates.conf users
|
|
|
|
|
EGDIRS= certs certs/demoCA modules sql sql/mssql sql/mysql sql/oracle \
|
2012-03-21 17:48:17 +01:00
|
|
|
sql/postgresql sites-available sites-enabled
|
2008-05-15 21:43:47 +02:00
|
|
|
|
|
|
|
|
.for f in ${EGFILES}
|
|
|
|
|
CONF_FILES_PERMS+= ${EGDIR}/${f} ${PKG_SYSCONFDIR}/${f} \
|
|
|
|
|
${RADIUS_USER} ${RADIUS_GROUP} 0640
|
|
|
|
|
.endfor
|
|
|
|
|
|
2010-05-23 19:28:44 +02:00
|
|
|
.for d in ${EGDIRS}
|
2012-04-03 03:38:18 +02:00
|
|
|
INSTALLATION_DIRS+= ${EGDIR}/${d}
|
2015-03-30 11:21:24 +02:00
|
|
|
OWN_DIRS_PERMS+= ${PKG_SYSCONFDIR}/${d} ${RADIUS_USER} \
|
2012-03-21 19:02:21 +01:00
|
|
|
${RADIUS_GROUP} 750
|
2015-03-30 11:21:24 +02:00
|
|
|
.endfor
|
2010-05-23 19:28:44 +02:00
|
|
|
|
2008-05-15 21:43:47 +02:00
|
|
|
.include "../../mk/pthread.buildlink3.mk"
|
|
|
|
|
|
|
|
|
|
.if defined(PTHREAD_TYPE) && ${PTHREAD_TYPE} == "none"
|
|
|
|
|
CONFIGURE_ARGS+= --without-threads
|
|
|
|
|
.endif
|
|
|
|
|
|
|
|
|
|
.if defined(PTHREAD_TYPE) && ${PTHREAD_TYPE} == "pth"
|
|
|
|
|
.include "../../devel/pthread-sem/buildlink3.mk"
|
|
|
|
|
SUBST_SED.make+= -e 's|@ldap_ldflags@|@ldap_ldflags@ \
|
|
|
|
|
${PTHREAD_LDFLAGS:M*:Q} ${PTHREAD_LIBS:M*:Q} -lsemaphore|g'
|
|
|
|
|
.endif
|
|
|
|
|
|
|
|
|
|
.if defined(PTHREAD_TYPE) && ${PTHREAD_TYPE} == "native"
|
|
|
|
|
SUBST_SED.make+= -e 's|@ldap_ldflags@|@ldap_ldflags@ \
|
|
|
|
|
${PTHREAD_LDFLAGS:M*:Q} ${PTHREAD_LIBS:M*:Q}|g'
|
|
|
|
|
.endif
|
|
|
|
|
|
|
|
|
|
post-install:
|
2009-04-23 20:26:05 +02:00
|
|
|
.for f in ${EGFILES}
|
2012-04-03 03:22:02 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/raddb/${f} ${DESTDIR}${EGDIR}/${f}
|
2009-04-23 20:26:05 +02:00
|
|
|
.endfor
|
2012-04-03 03:22:02 +02:00
|
|
|
${INSTALL_DATA} ${WRKSRC}/src/modules/rlm_perl/example.pl ${DESTDIR}${EGDIR}
|
2008-05-15 21:43:47 +02:00
|
|
|
|
2009-04-23 20:26:05 +02:00
|
|
|
.include "../../devel/libltdl/buildlink3.mk"
|
2016-10-11 16:12:41 +02:00
|
|
|
.include "../../devel/libexecinfo/buildlink3.mk"
|
2010-05-29 13:47:37 +02:00
|
|
|
.include "../../net/libpcap/buildlink3.mk"
|
2009-04-23 20:26:05 +02:00
|
|
|
.include "../../security/openssl/buildlink3.mk"
|
2008-05-15 21:43:47 +02:00
|
|
|
.include "../../mk/bsd.pkg.mk"
|
