net-dialup/freeradius: Bump v.3.0.19

Package-Manager: Portage-2.3.69, Repoman-2.3.14
Closes: https://github.com/gentoo/gentoo/pull/13463
Signed-off-by: Joonas Niilola <juippis@gentoo.org>

3 files changed, 296 insertions, 0 deletions

diff --git a/net-dialup/freeradius/Manifest b/net-dialup/freeradius/Manifest
index 853b2a895bd9..c997772def96 100644
--- a/net-dialup/freeradius/Manifest
+++ b/net-dialup/freeradius/Manifest
@@ -1,3 +1,4 @@
 DIST freeradius-server-3.0.15.tar.gz 4818244 BLAKE2B 24cded2c4f0c6fc6a6135058c40bb2c9d100a55161f2edfc388efba991ff85ecd0f546bc2008cc0c50f2753cf93ece8e67dc3fc0fe13a8b935193ff1f68514b9 SHA512 9b92045b445032bde9d421499fdc0f6a08d602c501730c31a8d3974b21cc5c12c78abb024ed62a176c7aa7fe260fe1d19386aaf558e0fecfcd3a0ba7aa47499c
 DIST freeradius-server-3.0.17.tar.gz 4843020 BLAKE2B 9e1f54a9f5ad8ede471881ffe4ec987c3ac655a3c39fcd920094760c006102be02f3b7f25b14379a0bac876ac0944e8698c2781bbd804cd22d8b915b6c13a693 SHA512 381222e452288c56a1bf68953be57379a5568f0c92de022abc3004cc6a15078d46535b867b31801de3eb096ba7af92e745e79decfa7cc8151a1ffb371b1aea79
 DIST freeradius-server-3.0.18.tar.gz 4884192 BLAKE2B 21df490f5eba4e0eca42127181fa02a9451abf5fc2b0d7c5e6d0c5c287eda739585500a31f480dccc618c3bbb4096fbe9258c1b2d3a2047951abf85d68784862 SHA512 b81c40cd22170adb1126b9dde6dd84411dfafce33e27da6c4665cb4fc524aab854a7cd4c80757db50899604d7980aec7216e1c53b8184af482c7113692a26458
+DIST freeradius-server-3.0.19.tar.gz 4886632 BLAKE2B 6e9b73eaa29344e4efca6ad19d8e86df8c625921441712b71cb54c2b0db78fc909748da42be837a9170fb6312be22f236956f0d2b169050a37ac8c4de143cc96 SHA512 8a914e2ad1fbeb4cf8c00aaf7eaa154ea17f70e4d58734716bfaf71b3ddef9f8f63a4d3217bdc07dfa776273e5bf090bc98f7bb16f5b565339ddc3b9c13e091f
diff --git a/net-dialup/freeradius/files/freeradius-3.0.19-systemd-service.patch b/net-dialup/freeradius/files/freeradius-3.0.19-systemd-service.patch
new file mode 100644
index 000000000000..37b67dfb21a5
--- /dev/null
+++ b/net-dialup/freeradius/files/freeradius-3.0.19-systemd-service.patch
@@ -0,0 +1,53 @@
+--- a/debian/freeradius.service	2019-12-01 10:02:31.453150556 +0100
++++ b/debian/freeradius.service	2019-12-01 10:08:16.781370632 +0100
+@@ -4,11 +4,10 @@
+ Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/
+ 
+ [Service]
+-Type=notify
+-WatchdogSec=60
+-NotifyAccess=all
+-PIDFile=/run/freeradius/freeradius.pid
+-EnvironmentFile=-/etc/default/freeradius
++# In 3.0.19 SystemD integration is broken.
++# Type=notify
++# WatchdogSec=60
++# NotifyAccess=all
+ 
+ # FreeRADIUS can do static evaluation of policy language rules based
+ # on environmental variables which is very useful for doing per-host
+@@ -26,17 +25,27 @@
+ # Ensure the daemon can still write its pidfile after it drops
+ # privileges. Combination of options that work on a variety of
+ # systems. Test very carefully if you alter these lines.
+-RuntimeDirectory=freeradius
++RuntimeDirectory=radiusd
+ RuntimeDirectoryMode=0775
+ # This does not work on Debian Jessie:
+-Group=freerad
+-# This does not work on Ubuntu Bionic:
+-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
+-
+-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
+-ExecStart=/usr/sbin/freeradius $FREERADIUS_OPTIONS
++Group=radius
++User=radius
++ExecStartPre=/usr/sbin/radiusd $RADIUSD_OPTS -Cx -lstdout
++ExecStart=/usr/sbin/radiusd -f $RADIUSD_OPTS
++ExecReload=/usr/sbin/radiusd -C $RADIUSD_OPTS
++ExecReload=/bin/kill -HUP $MAINPID
+ Restart=on-failure
+ RestartSec=5
++ReadOnlyDirectories=/etc/raddb/
++ReadWriteDirectories=/var/log/radius/
++# Security options (https://github.com/FreeRADIUS/freeradius-server/issues/2637)
++NoNewPrivileges=true
++CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
++PrivateTmp=true
++ProtectControlGroups=true
++ProtectKernelModules=true
++ProtectKernelTunables=true
++SystemCallArchitectures=native
+ 
+ [Install]
+ WantedBy=multi-user.target
diff --git a/net-dialup/freeradius/freeradius-3.0.19.ebuild b/net-dialup/freeradius/freeradius-3.0.19.ebuild
new file mode 100644
index 000000000000..ce636555ba0a
--- /dev/null
+++ b/net-dialup/freeradius/freeradius-3.0.19.ebuild
@@ -0,0 +1,242 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python2_7 )
+inherit autotools pam python-single-r1 systemd
+
+MY_P="${PN}-server-${PV}"
+
+DESCRIPTION="Highly configurable free RADIUS server"
+SRC_URI="
+	ftp://ftp.freeradius.org/pub/radius/${MY_P}.tar.gz
+	ftp://ftp.freeradius.org/pub/radius/old/${MY_P}.tar.gz
+"
+HOMEPAGE="http://www.freeradius.org/"
+
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~sparc ~x86"
+LICENSE="GPL-2"
+SLOT="0"
+
+IUSE="
+	debug firebird iodbc kerberos ldap libressl memcached mysql odbc oracle pam
+	pcap postgres python readline rest samba sqlite ssl redis
+"
+RESTRICT="test firebird? ( bindist )"
+
+# NOTE: Temporary freeradius doesn't support linking with mariadb client
+#       libs also if code is compliant, will be available in the next release.
+#       (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a
+
+# TODO: rlm_mschap works with both samba library or without. I need to avoid
+#       linking of samba library if -samba is used.
+RDEPEND="acct-group/radius
+	acct-user/radius
+	!net-dialup/cistronradius
+	dev-lang/perl:=
+	sys-libs/gdbm:=
+	sys-libs/talloc
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	pcap? ( net-libs/libpcap )
+	memcached? ( dev-libs/libmemcached )
+	mysql? ( dev-db/mysql-connector-c )
+	postgres? ( dev-db/postgresql:= )
+	firebird? ( dev-db/firebird )
+	pam? ( sys-libs/pam )
+	rest? ( dev-libs/json-c:= )
+	samba? ( net-fs/samba )
+	redis? ( dev-libs/hiredis:= )
+	ssl? (
+		!libressl? ( dev-libs/openssl:0=[-bindist] )
+		libressl? ( dev-libs/libressl:0= )
+	)
+	ldap? ( net-nds/openldap )
+	kerberos? ( virtual/krb5 )
+	sqlite? ( dev-db/sqlite:3 )
+	odbc? ( dev-db/unixODBC )
+	iodbc? ( dev-db/libiodbc )
+	oracle? ( dev-db/oracle-instantclient-basic )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+S="${WORKDIR}/${MY_P}"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.0.18-libressl.patch
+	"${FILESDIR}"/${P}-systemd-service.patch
+)
+
+pkg_setup() {
+	if use python ; then
+		python-single-r1_pkg_setup
+		export PYTHONBIN="${EPYTHON}"
+	fi
+}
+
+src_prepare() {
+	# most of the configuration options do not appear as ./configure
+	# switches. Instead it identifies the directories that are available
+	# and run through them. These might check for the presence of
+	# various libraries, in which case they are not built.  To avoid
+	# automagic dependencies, we just remove all the modules that we're
+	# not interested in using.
+
+	use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; }
+	use ldap || { rm -r src/modules/rlm_ldap || die ; }
+	use kerberos || { rm -r src/modules/rlm_krb5 || die ; }
+	use memcached || { rm -r src/modules/rlm_cache/drivers/rlm_cache_memcached || die ; }
+	use pam || { rm -r src/modules/rlm_pam || die ; }
+	use python || { rm -r src/modules/rlm_python || die ; }
+	use rest || { rm -r src/modules/rlm_rest || die ; }
+	use redis || { rm -r src/modules/rlm_redis{,who} || die ; }
+	# Do not install ruby rlm module, bug #483108
+	rm -r src/modules/rlm_ruby || die
+
+	# these are all things we don't have in portage/I don't want to deal
+	# with myself
+	rm -r src/modules/rlm_eap/types/rlm_eap_tnc || die # requires TNCS library
+	rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die # requires libeap-ikev2
+	rm -r src/modules/rlm_opendirectory || die # requires some membership.h
+	rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die
+
+	# sql drivers that are not part of experimental are loaded from a
+	# file, so we have to remove them from the file itself when we
+	# remove them.
+	usesqldriver() {
+		local flag=$1
+		local driver=rlm_sql_${2:-${flag}}
+
+		if ! use ${flag}; then
+			rm -r src/modules/rlm_sql/drivers/${driver} || die
+			sed -i -e /${driver}/d src/modules/rlm_sql/stable || die
+		fi
+	}
+
+	sed -i \
+		-e 's:^#\tuser = :\tuser = :g' \
+		-e 's:^#\tgroup = :\tgroup = :g' \
+		-e 's:/var/run/radiusd:/run/radiusd:g' \
+		-e '/^run_dir/s:${localstatedir}::g' \
+		raddb/radiusd.conf.in || die
+
+	# verbosity
+	# build shared libraries using jlibtool --shared
+	sed -i \
+		-e '/$(LIBTOOL)/s|--quiet ||g' \
+		-e 's:--mode=\(compile\|link\):& --shared:g' \
+		Make.inc.in || die
+
+	sed -i \
+		-e 's|--silent ||g' \
+		-e 's:--mode=\(compile\|link\):& --shared:g' \
+		scripts/libtool.mk || die
+
+	# crude measure to stop jlibtool from running ranlib and ar
+	sed -i \
+		-e '/LIBRARIAN/s|".*"|"true"|g' \
+		-e '/RANLIB/s|".*"|"true"|g' \
+		scripts/jlibtool.c || die
+
+	usesqldriver mysql
+	usesqldriver postgres postgresql
+	usesqldriver firebird
+	usesqldriver iodbc
+	usesqldriver odbc unixodbc
+	usesqldriver oracle
+	usesqldriver sqlite
+
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	# do not try to enable static with static-libs; upstream is a
+	# massacre of libtool best practices so you also have to make sure
+	# to --enable-shared explicitly.
+	local myeconfargs=(
+		--enable-shared
+		--disable-static
+		--disable-ltdl-install
+		--with-system-libtool
+		--with-system-libltdl
+		--with-ascend-binary
+		--with-udpfromto
+		--with-dhcp
+		--with-iodbc-include-dir=/usr/include/iodbc
+		--with-experimental-modules
+		--with-docdir=/usr/share/doc/${PF}
+		--with-logdir=/var/log/radius
+		$(use_enable debug developer)
+		$(use_with ldap edir)
+		$(use_with ssl openssl)
+	)
+	# fix bug #77613
+	if has_version app-crypt/heimdal; then
+		myeconfargs+=( --enable-heimdal-krb5 )
+	fi
+
+	use readline || export ac_cv_lib_readline=no
+	use pcap || export ac_cv_lib_pcap_pcap_open_live=no
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	# verbose, do not generate certificates
+	emake \
+		Q='' ECHO=true \
+		LOCAL_CERT_PRODUCTS=''
+}
+
+src_install() {
+	dodir /etc
+	diropts -m0750 -o root -g radius
+	dodir /etc/raddb
+	diropts -m0750 -o radius -g radius
+	dodir /var/log/radius
+	keepdir /var/log/radius/radacct
+	diropts
+
+	# verbose, do not install certificates
+	# Parallel install fails (#509498)
+	emake -j1 \
+		Q='' ECHO=true \
+		LOCAL_CERT_PRODUCTS='' \
+		R="${D}" \
+		install
+
+	pamd_mimic_system radiusd auth account password session
+
+	dodoc CREDITS
+
+	rm "${ED}/usr/sbin/rc.radiusd" || die
+
+	newinitd "${FILESDIR}/radius.init-r3" radiusd
+	newconfd "${FILESDIR}/radius.conf-r4" radiusd
+
+	systemd_newtmpfilesd "${FILESDIR}"/freeradius.tmpfiles freeradius.conf
+	systemd_dounit "${S}"/debian/freeradius.service
+
+	find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die
+}
+
+pkg_config() {
+	if use ssl; then
+		cd "${ROOT}"/etc/raddb/certs || die
+		./bootstrap || die "Error while running ./bootstrap script."
+		fowners root:radius "${ROOT}"/etc/raddb/certs
+		fowners root:radius "${ROOT}"/etc/raddb/certs/ca.pem
+		fowners root:radius "${ROOT}"/etc/raddb/certs/server.{key,crt,pem}
+	fi
+}
+
+pkg_preinst() {
+	if ! has_version ${CATEGORY}/${PN} && use ssl; then
+		elog "You have to run \`emerge --config =${CATEGORY}/${PF}\` to be able"
+		elog "to start the radiusd service."
+	fi
+}