re-import sources as agreed with the maintainer

2023-07-10 13:02:29 +02:00 · 2023-07-10 13:02:29 +02:00 · a7b5fbfaff
commit a7b5fbfaff
parent dd475a62c3
24 changed files with 982 additions and 11922 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,33 @@
-SOURCES/freeradius-server-3.0.20.tar.bz2
+# Ignore build artifacts and signatures
 *.sig
 .build*.log
 freeradius-server-*/
 x86_64/
 freeradius-*.src.rpm
 # Automatically added
 /freeradius-server-2.1.9.tar.bz2
 /freeradius-server-2.1.10.tar.bz2
 /freeradius-server-2.1.11.tar.bz2
 /freeradius-server-2.1.12.tar.bz2
 /freeradius-server-2.2.0.tar.bz2
 /freeradius-server-release_3_0_0_rc0.tar.gz
 /freeradius-server-release_3_0_0_rc1.tar.gz
 /freeradius-server-3.0.0.tar.bz2
 /freeradius-server-3.0.1.tar.bz2
 /freeradius-server-3.0.2.tar.bz2
 /freeradius-server-3.0.3.tar.bz2
 /freeradius-server-3.0.4rc2.tar.bz2
 /freeradius-server-3.0.4.tar.bz2
 /freeradius-server-3.0.7.tar.bz2
 /freeradius-server-3.0.8.tar.bz2
 /freeradius-server-3.0.9.tar.bz2
 /freeradius-server-3.0.10.tar.bz2
 /freeradius-server-3.0.11.tar.bz2
 /freeradius-server-3.0.12.tar.bz2
 /freeradius-server-3.0.13.tar.bz2
 /freeradius-server-3.0.14.tar.bz2
 /freeradius-server-3.0.15.tar.bz2
 /release_3_0_17.tar.gz
 /freeradius-server-3.0.17.tar.bz2
 /freeradius-server-3.0.20.tar.bz2
--- a/385
+++ b/385
@ -0,0 +1,385 @@
 #!/usr/bin/env python
 import exceptions
 import getopt
 import os
 import re
 import rpm
 import select
 import subprocess
 import sys
 #------------------------------------------------------------------------------
 def get_rlms(root):
    rlm_re = re.compile(r'^rlm_')
    version_re = re.compile(r'-[0-9.]+\.so$')
    names = os.listdir(root)
    names = [x for x in names if rlm_re.search(x)]
    names = [x for x in names if not version_re.search(x)]
    names.sort()
    return names
 #------------------------------------------------------------------------------
 debug = False
 verbose = False
 exclude_rpms = ['glibc']
 build = '2.0.2-1.fc8'
 root_template = '/var/tmp/freeradius-%s-root-jdennis/usr/lib/freeradius'
 libdirs = ['/lib','/usr/lib']
 #------------------------------------------------------------------------------
 def get_rpm_nvr_from_header(hdr):
    'Given an RPM header return the package NVR as a string'
    name    = hdr['name']
    version = hdr['version']
    release = hdr['release']
    return "%s-%s-%s" % (name, version, release)
 def get_rpm_hdr_by_file_path(path):
    if path is None:
        return None
    hdr = None
    try:
        ts = rpm.ts()
        mi = ts.dbMatch(rpm.RPMTAG_BASENAMES, path)
        for hdr in mi: break
    except Exception, e:
        print >> sys.stderr, "failed to retrieve rpm hdr for %s, %s" %(path, e)
        hdr = None
    return hdr
 def get_rpm_nvr_by_file_path(path):
    if path is None:
        return None
    hdr = get_rpm_hdr_by_file_path(path)
    if not hdr:
        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
    nvr = get_rpm_nvr_from_header(hdr)
    return nvr
 def get_rpm_name_by_file_path(path):
    if path is None:
        return None
    hdr = get_rpm_hdr_by_file_path(path)
    if not hdr:
        print >> sys.stderr, "failed to retrieve rpm info for %s" %(path)
    name = hdr['name']
    return name
 #------------------------------------------------------------------------------
 class CmdError(exceptions.Exception):
    def __init__(self, errno, msg):
        self.errno = errno
        self.msg = msg
 class Command:
    def __init__(self, cmd):
        self.cmd = cmd
        self.sub_process = None
        self.bufsize = 1024
        self.stdout_buf = ''
        self.stderr_buf = ''
        self.stdout_lines = []
        self.stderr_lines = []
    def run(self, stdout_callback=None, stderr_callback=None):
        self.sub_process = subprocess.Popen(self.cmd, \
            stdin=None, stdout=subprocess.PIPE, stderr=subprocess.PIPE, \
            close_fds=True, shell=True)
        self.stdout = self.sub_process.stdout
        self.stderr = self.sub_process.stderr
        read_watch = [self.stdout, self.stderr]
        while read_watch:
            readable = select.select(read_watch, [], [])[0]
            for fd in readable:
                if fd == self.stdout:
                    data = os.read(fd.fileno(), self.bufsize)
                    if not data:
                        read_watch.remove(fd)
                    else:
                        self.stdout_buf += data
                    for line in self.burst_lines('stdout_buf'):
                        if stdout_callback: stdout_callback(line)
                        self.stdout_lines.append(line)
                if fd == self.stderr:
                    data = os.read(fd.fileno(), self.bufsize)
                    if not data:
                        read_watch.remove(fd)
                    else:
                        self.stderr_buf += data
                    for line in self.burst_lines('stderr_buf'):
                        if stdout_callback: stderr_callback(line)
                        self.stderr_lines.append(line)
        self.returncode = self.sub_process.wait()
        if self.returncode:
            raise CmdError(self.returncode, "cmd \"%s\"\nreturned status %d\n%s" % (self.cmd, self.returncode, ''.join(self.stderr_lines)))
        return self.returncode
    def burst_lines(self, what):
        buf = getattr(self, what)
        start = 0
        end = buf.find('\n', start)
        while end >= 0:
            end += 1                # include newline
            line = buf[start:end]
            yield line
            start = end
            end = buf.find('\n', start)
        buf = buf[start:]
        setattr(self, what, buf)
 #------------------------------------------------------------------------------
 def get_so_requires(path):
    requires = {}
    cmd = 'ldd %s' % (path)
    so_re = re.compile(r'^\s*(\S+)\s+=>\s+(\S+)')
    c = Command(cmd)
    status = c.run()
    for line in c.stdout_lines:
        line = line.strip()
        match = so_re.search(line)
        if match:
            so_name = match.group(1)
            if match.group(2).startswith('/'):
                so_path = match.group(2)
            else:
                so_path = None
            requires[so_name] = so_path
    return requires
 def get_so_needed(path):
    needed = []
    cmd = 'readelf -d %s' % (path)
    so_re = re.compile(r'\(NEEDED\)\s+Shared library:\s+\[([^\]]+)\]')
    c = Command(cmd)
    status = c.run()
    for line in c.stdout_lines:
        line = line.strip()
        match = so_re.search(line)
        if match:
            so_name = match.group(1)
            needed.append(so_name)
    return needed
 def format_size(size):
    if size > 1000000000:
        return '%.1f GB' % (size/1000000000.0)
    if size > 1000000:
        return '%.1f MB' % (size/1000000.0)
    if size > 1000:
        return '%.1f KB' % (size/1000.0)
    return '%d' % (size)
 #------------------------------------------------------------------------------
 class RPM_Prop:
    def __init__(self, path=None, name=None):
        self.name = name
        self.paths = {}
        self.rpm_hdr = None
        self.used_by = {}
        if path:
            self.register_path(path)
            if not self.rpm_hdr:
                self.rpm_hdr = get_rpm_hdr_by_file_path(path)
            if self.rpm_hdr:
                if not self.name:
                    self.name = self.rpm_hdr[rpm.RPMTAG_NAME]
                self.size = self.rpm_hdr[rpm.RPMTAG_SIZE]
    def __str__(self):
        return "name=%s paths=%s" % (self.name, ','.join(self.paths.keys()))
    def register_path(self, path, name=None):
        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
        return self.paths.setdefault(path, path)
 class RPM_Collection:
    def __init__(self):
        self.names = {}
        self.paths = {}
    def __str__(self):
        text = ''
        names = self.get_names()
        for name in names:
            text += "%s: %s\n" % (name, self.names[name])
        return text
    def register_path(self, path):
        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
        rpm_prop = self.paths.get(path)
        if not rpm_prop:
            rpm_prop = self.paths.setdefault(path, RPM_Prop(path=path))
        self.names.setdefault(rpm_prop.name, rpm_prop)
        return rpm_prop
    def get_names(self):
        names = self.names.keys()
        names.sort()
        return names
    def get_name(self, name):
        return self.names.get(name)
 class SO_File:
    def __init__(self, name=None, path=None):
        self.name = name
        self.path = path
        self.rpm = None
    def __str__(self):
        if self.rpm:
            rpm_name = self.rpm.name
        else:
            rpm_name = None
        return "name=%s rpm=%s" % (self.name, rpm_name)
 class SO_Collection:
    def __init__(self):
        self.names = {}
        self.paths = {}
    def __str__(self):
        text = ''
        names = self.get_names()
        for name in names:
            text += "%s: %s\n" % (name, self.names[name])
        return text
    def register_path(self, path, name=None):
        if debug: print "%s.register_path: path=%s" % (self.__class__.__name__, path)
        so_prop = self.paths.get(path)
        if not so_prop:
            so_prop = self.paths.setdefault(path, SO_File(name, path=path))
        self.names.setdefault(name, so_prop)
        return so_prop
    def get_names(self):
        names = self.names.keys()
        names.sort()
        return names
 class LoadableModule:
    def __init__(self, path, name=None):
        if name is None:
            name = os.path.basename(path)
        self.name = name
        self.path = path
        self.rpm_names = {}
        self.sos = SO_Collection()
        self.get_so_requires()
    def __str__(self):
        text = '%s\n' % (self.name)
        text += "    RPM's: %s\n" % (','.join(self.get_rpm_names()))
        text += "    SO's: %s\n" % (','.join(self.sos.get_names()))
        return text
    def get_so_requires(self):
        requires = get_so_requires(self.path)
        needed = get_so_needed(self.path)
        #print "%s requires=%s" % (self.name, requires)
        #print "%s needed=%s" % (self.name, needed)
        for so_name, so_path in requires.items():
            if so_name not in needed: continue
            if so_path:
                so_prop = self.sos.register_path(so_path, so_name)
                rpm_prop = rpms.register_path(so_prop.path)
                rpm_prop.used_by[self.name] = 1
                self.rpm_names.setdefault(rpm_prop.name, rpm_prop.name)
                so_prop.rpm = rpm_prop
            else:
                so_prop = None
            if verbose: print "found so='%s' %s" % (so_name, so_prop)
    def register_so(self, so):
        if debug: print "%s.register_so: so=%s" % (self.__class__.__name__, so)
        self.sos.setdefault(so, so)
        self.names.setdefault(so.name, so)
        return so
    def get_rpm_names(self):
        rpm_names = self.rpm_names.keys()
        rpm_names.sort()
        return rpm_names
    def get_sos(self):
        sos = self.sos.keys()
        sos.sort(lambda a,b: cmp(a.name, b.name))
        return sos
 #------------------------------------------------------------------------------
 #------------------------------------------------------------------------------
 opts, args = getopt.getopt(sys.argv[1:], "b:v", ['build=','verbose'])
 for o, a in opts:
    if o in ['-b', '--build']:
        build = a
    elif o in ['-v', '--verbose']:
        verbose = True
    else:
        print >> sys.stderr, "Unknown arg: %s" % o
        sys.exit(1)
 root = root_template % build
 modules = get_rlms(root)
 module_paths = [os.path.join(root,x) for x in modules]
 rpms = RPM_Collection()
 lms = []
 for module_path in module_paths[:]:
    lm = LoadableModule(module_path)
    lms.append(lm)
 print "RLM Modules(%s): %s\n" % (len(modules), ','.join(modules))
 for lm in lms:
    rpm_names = [x for x in lm.get_rpm_names() if x not in exclude_rpms]
    if rpm_names:
        print lm.name
        print '    %s' % (','.join(rpm_names))
 print "--------------"
 rpm_props = [x for x in rpms.names.values() if len(x.used_by) and x.name not in exclude_rpms]
 rpm_props.sort(lambda a,b: cmp(a.name, b.name))
 for rpm_prop in rpm_props:
    used_by = rpm_prop.used_by.keys()
    used_by.sort()
    print "%s: %s" % (rpm_prop.name, ','.join(used_by))
 print "--------------"
 rpm_props.sort(lambda a,b: cmp(a.size, b.size))
 for rpm_prop in rpm_props:
    print '%10s %s' % (format_size(rpm_prop.size), rpm_prop.name)
 print "--------------"
 for lm in lms:
    print lm
--- a/freeradius-Add-missing-option-descriptions.patch
+++ b/freeradius-Add-missing-option-descriptions.patch
@ -0,0 +1,97 @@
 From afb196b29606aafb5030e8c7ea414a4bd494cbc0 Mon Sep 17 00:00:00 2001
 From: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
 Date: Fri, 14 Sep 2018 12:20:11 +0300
 Subject: [PATCH] man: Add missing option descriptions
 ---
 man/man8/raddebug.8 | 4 ++++
 man/man8/radiusd.8  | 7 +++++++
 man/man8/radmin.8   | 4 ++++
 3 files changed, 15 insertions(+)
 diff --git a/man/man8/raddebug.8 b/man/man8/raddebug.8
 index 66e80e64fa..6e27e2453c 100644
 --- a/man/man8/raddebug.8
 +++ b/man/man8/raddebug.8
@@ -7,6 +7,8 @@ raddebug - Display debugging output from a running server.
 .IR condition ]
 .RB [ \-d
 .IR config_directory ]
 +.RB [ \-D
 +.IR dictionary_directory ]
 .RB [ \-n
 .IR name ]
 .RB [ \-i
@@ -73,6 +75,8 @@ option is equivalent to using:
 .IP "\-d \fIconfig directory\fP"
 The radius configuration directory, usually /etc/raddb.  See the
 \fIradmin\fP manual page for more description of this option.
 +.IP "\-D \fIdictionary directory\fP"
 +Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
 .IP "\-n \fImname\fP"
 Read \fIraddb/name.conf\fP instead of \fIraddb/radiusd.conf\fP.
 .IP \-I\ \fIipv6-address\fP
 diff --git a/man/man8/radiusd.8 b/man/man8/radiusd.8
 index c825f22d0d..98aef5e1be 100644
 --- a/man/man8/radiusd.8
 +++ b/man/man8/radiusd.8
@@ -6,6 +6,8 @@ radiusd - Authentication, Authorization and Accounting server
 .RB [ \-C ]
 .RB [ \-d
 .IR config_directory ]
 +.RB [ \-D
 +.IR dictionary_directory ]
 .RB [ \-f ]
 .RB [ \-h ]
 .RB [ \-i
@@ -17,6 +19,7 @@ radiusd - Authentication, Authorization and Accounting server
 .IR name ]
 .RB [ \-p
 .IR port ]
 +.RB [ \-P ]
 .RB [ \-s ]
 .RB [ \-t ]
 .RB [ \-v ]
@@ -55,6 +58,8 @@ configuration, and which modules are skipped, and therefore not checked.
 .IP "\-d \fIconfig directory\fP"
 Defaults to \fI/etc/raddb\fP. \fBRadiusd\fP looks here for its configuration
 files such as the \fIdictionary\fP and the \fIusers\fP files.
 +.IP "\-D \fIdictionary directory\fP"
 +Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
 .IP \-f
 Do not fork, stay running as a foreground process.
 .IP \-h
@@ -84,6 +89,8 @@ When this command-line option is given, all "listen" sections in
 \fIradiusd.conf\fP are ignored.
 This option MUST be used in conjunction with "-i".
 +.IP "\-P
 +Always write out PID, even with -f.
 .IP \-s
 Run in "single server" mode.  The server normally runs with multiple
 threads and/or processes, which can lower its response time to
 diff --git a/man/man8/radmin.8 b/man/man8/radmin.8
 index 5ecc963d81..5bf661fa71 100644
 --- a/man/man8/radmin.8
 +++ b/man/man8/radmin.8
@@ -5,6 +5,8 @@ radmin - FreeRADIUS Administration tool
 .B radmin
 .RB [ \-d
 .IR config_directory ]
 +.RB [ \-D
 +.IR dictionary_directory ]
 .RB [ \-e
 .IR command ]
 .RB [ \-E ]
@@ -34,6 +36,8 @@ The following command-line options are accepted by the program.
 Defaults to \fI/etc/raddb\fP. \fBradmin\fP looks here for the server
 configuration files to find the "listen" section that defines the
 control socket filename.
 +.IP "\-D \fIdictionary directory\fP"
 +Set main dictionary directory. Defaults to \fI/usr/share/freeradius\fP.
 .IP "\-e \fIcommand\fP"
 Run \fIcommand\fP and exit.
 .IP \-E
 -- 
 2.18.0
--- a/freeradius-Backport-OpenSSL3-fixes.patch
+++ b/freeradius-Backport-OpenSSL3-fixes.patch
--- a/freeradius-EAP-PWD-curve-handling.patch
+++ b/freeradius-EAP-PWD-curve-handling.patch
@ -0,0 +1,45 @@
 diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
 index 7f91e4b230..848ca2055e 100644
 --- a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
 +++ b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
@@ -373,11 +373,26 @@ int process_peer_commit (pwd_session_t *session, uint8_t *in, size_t in_len, BN_
 	data_len = BN_num_bytes(session->order);
 	BN_bin2bn(ptr, data_len, session->peer_scalar);
 +	/* validate received scalar */
 +	if (BN_is_zero(session->peer_scalar) ||
 +	    BN_is_one(session->peer_scalar) ||
 +	    BN_cmp(session->peer_scalar, session->order) >= 0) {
 +		ERROR("Peer's scalar is not within the allowed range");
 +		goto finish;
 +	}
 +
 	if (!EC_POINT_set_affine_coordinates_GFp(session->group, session->peer_element, x, y, bnctx)) {
 		DEBUG2("pwd: unable to get coordinates of peer's element");
 		goto finish;
 	}
 +	/* validate received element */
 +	if (!EC_POINT_is_on_curve(session->group, session->peer_element, bnctx) ||
 +	    EC_POINT_is_at_infinity(session->group, session->peer_element)) {
 +		ERROR("Peer's element is not a point on the elliptic curve");
 +		goto finish;
 +	}
 +
 	/* check to ensure peer's element is not in a small sub-group */
 	if (BN_cmp(cofactor, BN_value_one())) {
 		if (!EC_POINT_mul(session->group, point, NULL, session->peer_element, cofactor, NULL)) {
@@ -391,6 +406,13 @@ int process_peer_commit (pwd_session_t *session, uint8_t *in, size_t in_len, BN_
 		}
 	}
 +	/* detect reflection attacks */
 +	if (BN_cmp(session->peer_scalar, session->my_scalar) == 0 ||
 +	    EC_POINT_cmp(session->group, session->peer_element, session->my_element, bnctx) == 0) {
 +		ERROR("Reflection attack detected");
 +		goto finish;
 +	}
 +
 	/* compute the shared key, k */
 	if ((!EC_POINT_mul(session->group, K, NULL, session->pwe, session->peer_scalar, bnctx)) ||
 	    (!EC_POINT_add(session->group, K, K, session->peer_element, bnctx)) ||
--- a/freeradius-EAP-PWD-information-leak-10-iterations.patch
+++ b/freeradius-EAP-PWD-information-leak-10-iterations.patch
@ -0,0 +1,38 @@
 From 3ea2a5a026e73d81cd9a3e9bbd4300c433004bfa Mon Sep 17 00:00:00 2001
 From: Mathy Vanhoef <mathy.vanhoef@nyu.edu>
 Date: Wed, 5 Jun 2019 19:21:06 +0000
 Subject: [PATCH] EAP-pwd: fix side-channel leak where 1 in 2018 handshakes
 fail
 Previously the Hunting and Pecking algorithm of EAP-pwd aborted when
 more than 10 iterations are needed. Every iteration has a 50% chance
 of finding the password element. This means one in every 2048 handshakes
 will fail, in which case an error frame is sent to the client. This
 event leaks information that can be abused in an offline password
 brute-force attack. More precisely, the adversary learns that all 10
 iterations failed for the given random EAP-pwd token. Using the same
 techniques as in the Dragonblood attack, this can be used to brute-force
 the password.
 This patch fixes the above issue by executing enough iterations such that
 the password element is always found eventually.
 Note that timing and cache leaks remain a risk against the current
 implementation of EAP-pwd.
 ---
 src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
 index c54f08c030..d94851c3aa 100644
 --- a/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
 +++ b/src/modules/rlm_eap/types/rlm_eap_pwd/eap_pwd.c
@@ -192,7 +192,7 @@ int compute_password_element (pwd_session_t *session, uint16_t grp_num,
 	}
 	ctr = 0;
 	while (1) {
 -		if (ctr > 10) {
 +		if (ctr > 100) {
 			DEBUG("unable to find random point on curve for group %d, something's fishy", grp_num);
 			goto fail;
 		}
--- a/freeradius-OpenSSL-HMAC-MD5.patch
+++ b/freeradius-OpenSSL-HMAC-MD5.patch
@ -0,0 +1,68 @@
 From b93796b1890b35a0922bfba9cd08e8a1a5f956cf Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
 Date: Fri, 28 Sep 2018 09:54:46 -0400
 Subject: [PATCH 1/2] Replace HMAC-MD5 implementation with OpenSSL's
 If OpenSSL EVP is not found, fallback to internal implementation of
 HMAC-MD5.
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 src/lib/hmacmd5.c | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)
 diff --git a/src/lib/hmacmd5.c b/src/lib/hmacmd5.c
 index 2c662ff368..1cca00fa2a 100644
 --- a/src/lib/hmacmd5.c
 +++ b/src/lib/hmacmd5.c
@@ -27,10 +27,41 @@
 RCSID("$Id: 2c662ff368e46556edd2cfdf408bd0fca0ab5f18 $")
 +#ifdef HAVE_OPENSSL_EVP_H
 +#include <openssl/hmac.h>
 +#include <openssl/evp.h>
 +#endif
 +
 #include <freeradius-devel/libradius.h>
 #include <freeradius-devel/md5.h>
 -/** Calculate HMAC using MD5
 +#ifdef HAVE_OPENSSL_EVP_H
 +/** Calculate HMAC using OpenSSL's MD5 implementation
 + *
 + * @param digest Caller digest to be filled in.
 + * @param text Pointer to data stream.
 + * @param text_len length of data stream.
 + * @param key Pointer to authentication key.
 + * @param key_len Length of authentication key.
 + *
 + */
 +void fr_hmac_md5(uint8_t digest[MD5_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
 +		 uint8_t const *key, size_t key_len)
 +{
 +	HMAC_CTX *ctx  = HMAC_CTX_new();
 +
 +#ifdef EVP_MD_CTX_FLAG_NON_FIPS_ALLOW
 +	/* Since MD5 is not allowed by FIPS, explicitly allow it. */
 +	HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
 +#endif /* EVP_MD_CTX_FLAG_NON_FIPS_ALLOW */
 +
 +	HMAC_Init_ex(ctx, key, key_len, EVP_md5(), NULL);
 +	HMAC_Update(ctx, text, text_len);
 +	HMAC_Final(ctx, digest, NULL);
 +	HMAC_CTX_free(ctx);
 +}
 +#else
 +/** Calculate HMAC using internal MD5 implementation
  *
  * @param digest Caller digest to be filled in.
  * @param text Pointer to data stream.
@@ -101,6 +132,7 @@
 					      * hash */
 	fr_md5_final(digest, &context);	  /* finish up 2nd pass */
 }
 +#endif /* HAVE_OPENSSL_EVP_H */
 /*
 Test Vectors (Trailing '\0' of a character string not included in test):
--- a/freeradius-OpenSSL-HMAC-SHA1.patch
+++ b/freeradius-OpenSSL-HMAC-SHA1.patch
@ -0,0 +1,73 @@
 From 91f663ce1b46ecd99399023ad539f158419272e7 Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
 Date: Fri, 28 Sep 2018 11:03:52 -0400
 Subject: [PATCH 2/2] Replace HMAC-SHA1 implementation with OpenSSL's
 If OpenSSL EVP is not found, fallback to internal implementation of
 HMAC-SHA1.
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 src/lib/hmacsha1.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)
 diff --git a/src/lib/hmacsha1.c b/src/lib/hmacsha1.c
 index c3cbd87a2c..211470ea35 100644
 --- a/src/lib/hmacsha1.c
 +++ b/src/lib/hmacsha1.c
@@ -10,13 +10,19 @@
 RCSID("$Id: c3cbd87a2c13c47da93fdb1bdfbf6da4c22aaac5 $")
 +#ifdef HAVE_OPENSSL_EVP_H
 +#include <openssl/hmac.h>
 +#include <openssl/evp.h>
 +#endif
 +
 #include <freeradius-devel/libradius.h>
 #ifdef HMAC_SHA1_DATA_PROBLEMS
 unsigned int sha1_data_problems = 0;
 #endif
 -/** Calculate HMAC using SHA1
 +#ifdef HAVE_OPENSSL_EVP_H
 +/** Calculate HMAC using OpenSSL's SHA1 implementation
  *
  * @param digest Caller digest to be filled in.
  * @param text Pointer to data stream.
@@ -28,6 +34,26 @@
 void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
 		  uint8_t const *key, size_t key_len)
 {
 +	HMAC_CTX *ctx  = HMAC_CTX_new();
 +	HMAC_Init_ex(ctx, key, key_len, EVP_sha1(), NULL);
 +	HMAC_Update(ctx, text, text_len);
 +	HMAC_Final(ctx, digest, NULL);
 +	HMAC_CTX_free(ctx);
 +}
 +
 +#else
 +
 +/** Calculate HMAC using internal SHA1 implementation
 + *
 + * @param digest Caller digest to be filled in.
 + * @param text Pointer to data stream.
 + * @param text_len length of data stream.
 + * @param key Pointer to authentication key.
 + * @param key_len Length of authentication key.
 + */
 +void fr_hmac_sha1(uint8_t digest[SHA1_DIGEST_LENGTH], uint8_t const *text, size_t text_len,
 +		  uint8_t const *key, size_t key_len)
 +{
 	fr_sha1_ctx context;
 	uint8_t k_ipad[65];    /* inner padding - key XORd with ipad */
 	uint8_t k_opad[65];    /* outer padding - key XORd with opad */
@@ -142,6 +168,7 @@
 	}
 #endif
 }
 +#endif /* HAVE_OPENSSL_EVP_H */
 /*
 Test Vectors (Trailing '\0' of a character string not included in test):
--- a/freeradius-autogen.sh
+++ b/freeradius-autogen.sh
@ -0,0 +1,21 @@
 #!/bin/sh -e
 parentdir=`dirname $0`
 cd $parentdir
 parentdir=`pwd`
 libtoolize -f -c
 #aclocal
 autoheader
 autoconf
 mysubdirs="$mysubdirs `find src/modules/ -name configure -print | sed 's%/configure%%'`"
 mysubdirs=`echo $mysubdirs`
 for F in $mysubdirs
 do
 	echo "Configuring in $F..."
 	(cd $F && grep "^AC_CONFIG_HEADER" configure.in > /dev/null && autoheader -I$parentdir)
 	(cd $F && autoconf -I$parentdir)
 done
--- a/freeradius-bootstrap-pass-noenc-to-certificate-generation.patch
+++ b/freeradius-bootstrap-pass-noenc-to-certificate-generation.patch
@ -1,136 +0,0 @@
 From e089777942552c4fe3e58aa328566e7bb745dbf8 Mon Sep 17 00:00:00 2001
 From: Antonio Torres <antorres@redhat.com>
 Date: Fri, 22 Apr 2022 12:27:43 +0200
 Subject: [PATCH] bootstrap: pass -noenc to certificate generation
 Bootstrap script would fail to generate certificates if run on systems
 with FIPS enabled. By passing the -noenc option, we can skip the usage
 of unsupported algorithms on these systems.
 After generating the certificates, correct permissions are set.
 Signed-off-by: Antonio Torres <antorres@redhat.com>
 [antorres@redhat.com]: patch adapted to work together with freeradius-bootstrap-create-only.patch.
 In bootstrap diff, -f is changed to -e in conditionals.
 ---
 raddb/certs/Makefile  | 20 ++++++++++++++++----
 raddb/certs/bootstrap |  6 +++---
 2 files changed, 19 insertions(+), 7 deletions(-)
 diff --git a/raddb/certs/Makefile b/raddb/certs/Makefile
 index 5cbfd467ce..cb10394ec3 100644
 --- a/raddb/certs/Makefile
 +++ b/raddb/certs/Makefile
@@ -60,6 +60,8 @@ passwords.mk: server.cnf ca.cnf client.cnf inner-server.cnf
 ######################################################################
 dh:
 	$(OPENSSL) dhparam -out dh -2 $(DH_KEY_SIZE)
 +	chown root:radiusd dh
 +	chmod 640 dh
 ######################################################################
 #
@@ -71,8 +73,10 @@ ca.key ca.pem: ca.cnf
 	@[ -f serial ] || $(MAKE) serial
 	$(OPENSSL) req -new -x509 -keyout ca.key -out ca.pem \
 		-days $(CA_DEFAULT_DAYS) -config ./ca.cnf \
 -		-passin pass:$(PASSWORD_CA) -passout pass:$(PASSWORD_CA)
 +		-passin pass:$(PASSWORD_CA) -passout pass:$(PASSWORD_CA) -noenc
 	chmod g+r ca.key
 +	chown root:radiusd ca.*
 +	chmod 640 ca.*
 ca.der: ca.pem
 	$(OPENSSL) x509 -inform PEM -outform DER -in ca.pem -out ca.der
@@ -81,6 +85,8 @@ ca.crl: ca.pem
 	$(OPENSSL) ca -gencrl -keyfile ca.key -cert ca.pem -config ./ca.cnf -out ca-crl.pem -key $(PASSWORD_CA)
 	$(OPENSSL) crl -in ca-crl.pem -outform der -out ca.crl
 	rm ca-crl.pem
 +	chown root:radiusd ca.*
 +	chmod 640 ca.*
 ######################################################################
 #
@@ -88,7 +94,7 @@ ca.crl: ca.pem
 #
 ######################################################################
 server.csr server.key: server.cnf
 -	$(OPENSSL) req -new  -out server.csr -keyout server.key -config ./server.cnf
 +	$(OPENSSL) req -new  -out server.csr -keyout server.key -config ./server.cnf -noenc
 	chmod g+r server.key
 server.crt: server.csr ca.key ca.pem
@@ -101,6 +107,8 @@ server.p12: server.crt
 server.pem: server.p12
 	$(OPENSSL) pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
 	chmod g+r server.pem
 +	chown root:radiusd server.*
 +	chmod 640 server.*
 .PHONY: server.vrfy
 server.vrfy: ca.pem
@@ -113,7 +121,7 @@ server.vrfy: ca.pem
 #
 ######################################################################
 client.csr client.key: client.cnf
 -	$(OPENSSL) req -new  -out client.csr -keyout client.key -config ./client.cnf
 +	$(OPENSSL) req -new  -out client.csr -keyout client.key -config ./client.cnf -noenc
 	chmod g+r client.key
 client.crt: client.csr ca.pem ca.key
@@ -127,6 +135,8 @@ client.pem: client.p12
 	$(OPENSSL) pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
 	chmod g+r client.pem
 	cp client.pem $(USER_NAME).pem
 +	chown root:radiusd client.*
 +	chmod 640 client.*
 .PHONY: client.vrfy
 client.vrfy: ca.pem client.pem
@@ -139,7 +149,7 @@ client.vrfy: ca.pem client.pem
 #
 ######################################################################
 inner-server.csr inner-server.key: inner-server.cnf
 -	$(OPENSSL) req -new  -out inner-server.csr -keyout inner-server.key -config ./inner-server.cnf
 +	$(OPENSSL) req -new  -out inner-server.csr -keyout inner-server.key -config ./inner-server.cnf -noenc
 	chmod g+r inner-server.key
 inner-server.crt: inner-server.csr ca.key ca.pem
@@ -152,6 +162,8 @@ inner-server.p12: inner-server.crt
 inner-server.pem: inner-server.p12
 	$(OPENSSL) pkcs12 -in inner-server.p12 -out inner-server.pem -passin pass:$(PASSWORD_INNER) -passout pass:$(PASSWORD_INNER)
 	chmod g+r inner-server.pem
 +	chown root:radiusd inner-server.*
 +	chmod 640 inner-server.*
 .PHONY: inner-server.vrfy
 inner-server.vrfy: ca.pem
 diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
 index 57de8cf0d7..c258ec45e0 100755
 --- a/raddb/certs/bootstrap
 +++ b/raddb/certs/bootstrap
@@ -41,12 +41,12 @@ if [ ! -f dh ]; then
 fi
 if [ ! -e server.key ]; then
 -  openssl req -new  -out server.csr -keyout server.key -config ./server.cnf || exit 1
 +  openssl req -new  -out server.csr -keyout server.key -config ./server.cnf -noenc || exit 1
   chmod g+r server.key
 fi
 if [ ! -e ca.key ]; then
 -  openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
 +  openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf -noenc || exit 1
 fi
 if [ ! -e index.txt ]; then
@@ -77,7 +77,7 @@ if [ ! -f ca.der ]; then
 fi
 if [ ! -e client.key ]; then
 -  openssl req -new  -out client.csr -keyout client.key -config ./client.cnf
 +  openssl req -new  -out client.csr -keyout client.key -config ./client.cnf -noenc
   chmod g+r client.key
 fi
--- a/freeradius-ldap-infinite-timeout-on-starttls.patch
+++ b/freeradius-ldap-infinite-timeout-on-starttls.patch
@ -1,31 +0,0 @@
 From: Antonio Torres <antorres@redhat.com>
 Date: Fri, 28 Jan 2022
 Subject: Use infinite timeout when using LDAP+start-TLS
 This will ensure that the TLS connection to the LDAP server will complete
 before starting FreeRADIUS, as it forces libldap to use a blocking socket during 
 the process. Infinite timeout is the OpenLDAP default.
 Avoids this: https://git.openldap.org/openldap/openldap/-/blob/87ffc60006298069a5a044b8e63dab27a61d3fdf/libraries/libldap/tls2.c#L1134
 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1992551
 Signed-off-by: Antonio Torres <antorres@redhat.com>
 ---
 src/modules/rlm_ldap/ldap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
 diff --git a/src/modules/rlm_ldap/ldap.c b/src/modules/rlm_ldap/ldap.c
 index cf7a84e069..841bf888a1 100644
 --- a/src/modules/rlm_ldap/ldap.c
 +++ b/src/modules/rlm_ldap/ldap.c
@@ -1472,7 +1472,10 @@ void *mod_conn_create(TALLOC_CTX *ctx, void *instance)
 	}
 #ifdef LDAP_OPT_NETWORK_TIMEOUT
 -	if (inst->net_timeout) {
 +	bool using_tls = inst->start_tls ||
 +					 inst->port == 636 ||
 +					 strncmp(inst->server, "ldaps://", strlen("ldaps://")) == 0;
 +	if (inst->net_timeout && !using_tls) {
 		memset(&tv, 0, sizeof(tv));
 		tv.tv_sec = inst->net_timeout;
--- a/freeradius-listen-ipv6-fix.patch
+++ b/freeradius-listen-ipv6-fix.patch
@ -0,0 +1,42 @@
 From 98510efd0e2930d8924b47009945a0fb1bd75a29 Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
 Date: Mon, 22 Apr 2019 14:38:19 -0400
 Subject: [PATCH] Allow listen.ipaddr to reference an IPv6-only host
 In 5452b13cefa3b30f1da467ff5d68b3c1aa471188, these lines were added
 which effectively result in a listen.ipaddr only allowing hostnames to
 resolve to IPv4 addresses. With a hostname with only a IPv6 address,
 it'll bail with the error message:
 radiusd: #### Opening IP addresses and Ports ####
 listen {
        type = "auth"
 Failed resolving "ipv6.cipherboy.com" to IPv4 address:
    Name or service not known
 This directly contradicts the language in the default configuration
 file, so support resolving both IPv4-only and IPv6-only hostnames.
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 src/lib/misc.c | 7 -------
 1 file changed, 7 deletions(-)
 diff --git a/src/lib/misc.c b/src/lib/misc.c
 index dff21e33f7..5520d8a0a4 100644
 --- a/src/lib/misc.c
 +++ b/src/lib/misc.c
@@ -607,13 +607,6 @@ int fr_pton(fr_ipaddr_t *out, char const *value, ssize_t inlen, int af, bool res
 			fr_strerror_printf("Invalid address");
 			return -1;
 		}
 -
 -		/*
 -		 *	Fall through to resolving the address, using
 -		 *	whatever address family they prefer.  If they
 -		 *	don't specify an address family, force IPv4.
 -		 */
 -		if (af == AF_UNSPEC) af = AF_INET;
 	}
 	/*
--- a/freeradius-python2-shebangs.patch
+++ b/freeradius-python2-shebangs.patch
@ -0,0 +1,64 @@
 From b8a6ac05977845851f02151ca35c3a51e88bd534 Mon Sep 17 00:00:00 2001
 From: Alexander Scheel <ascheel@redhat.com>
 Date: Thu, 18 Oct 2018 12:40:53 -0400
 Subject: [PATCH] Clarify shebangs to be python2
 Signed-off-by: Alexander Scheel <ascheel@redhat.com>
 ---
 scripts/radtee                         | 2 +-
 src/modules/rlm_python/example.py      | 2 +-
 src/modules/rlm_python/prepaid.py      | 2 +-
 src/modules/rlm_python/radiusd.py      | 2 +-
 src/modules/rlm_python/radiusd_test.py | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)
 diff --git a/scripts/radtee b/scripts/radtee
 index 123769d244..78b4bcbe0b 100755
 --- a/scripts/radtee
 +++ b/scripts/radtee
@@ -1,4 +1,4 @@
 -#!/usr/bin/env python
 +#!/usr/bin/env python2
 from __future__ import with_statement 
 # RADIUS comparison tee v1.0
 diff --git a/src/modules/rlm_python/example.py b/src/modules/rlm_python/example.py
 index 5950a07678..eaf456e349 100644
 --- a/src/modules/rlm_python/example.py
 +++ b/src/modules/rlm_python/example.py
@@ -1,4 +1,4 @@
 -#! /usr/bin/env python
 +#! /usr/bin/env python2
 #
 # Python module example file
 # Miguel A.L. Paraz <mparaz@mparaz.com>
 diff --git a/src/modules/rlm_python/prepaid.py b/src/modules/rlm_python/prepaid.py
 index c3cbf57b8f..3b1dc2e2e8 100644
 --- a/src/modules/rlm_python/prepaid.py
 +++ b/src/modules/rlm_python/prepaid.py
@@ -1,4 +1,4 @@
 -#! /usr/bin/env python
 +#! /usr/bin/env python2
 #
 # Example Python module for prepaid usage using MySQL
 diff --git a/src/modules/rlm_python/radiusd.py b/src/modules/rlm_python/radiusd.py
 index c535bb3caf..7129923994 100644
 --- a/src/modules/rlm_python/radiusd.py
 +++ b/src/modules/rlm_python/radiusd.py
@@ -1,4 +1,4 @@
 -#! /usr/bin/env python
 +#! /usr/bin/env python2
 #
 # Definitions for RADIUS programs
 #
 diff --git a/src/modules/rlm_python/radiusd_test.py b/src/modules/rlm_python/radiusd_test.py
 index 13b7128b29..97b5b64f08 100644
 --- a/src/modules/rlm_python/radiusd_test.py
 +++ b/src/modules/rlm_python/radiusd_test.py
@@ -1,4 +1,4 @@
 -#! /usr/bin/env python
 +#! /usr/bin/env python2
 #
 # Python module test
 # Miguel A.L. Paraz <mparaz@mparaz.com>
--- a/113
+++ b/113
@ -0,0 +1,113 @@
 #!/bin/sh
 #
 # radiusd Start/Stop the FreeRADIUS daemon
 #
 # chkconfig: - 88 10
 # description: Extensible, configurable, high performance RADIUS server.
 ### BEGIN INIT INFO
 # Provides: radiusd
 # Required-Start: $network
 # Required-Stop:
 # Default-Start:
 # Default-Stop:
 # Should-Start: $time $syslog mysql ldap postgresql samba krb5-kdc
 # Should-Stop:
 # Short-Description: FreeRADIUS server
 # Description: Extensible, configurable, high performance RADIUS server.
 ### END INIT INFO
 # Source function library.
 . /etc/rc.d/init.d/functions
 prog=radiusd
 [ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
 exec=${exec:=/usr/sbin/$prog}
 config_dir=${config_dir:=/etc/raddb}
 config=${config:=$config_dir/radiusd.conf}
 pidfile=${pidfile:=/var/run/$prog/$prog.pid}
 lockfile=${lockfile:=/var/lock/subsys/radiusd}
 start() {
    [ -x $exec ] || exit 5
    [ -f $config ] || exit 6
    echo -n $"Starting $prog: "
    daemon --pidfile $pidfile $exec -d $config_dir
    retval=$?
    echo
    [ $retval -eq 0 ] && touch $lockfile
    return $retval
 }
 stop() {
    echo -n $"Stopping $prog: "
    killproc -p $pidfile $prog
    retval=$?
    echo
    [ $retval -eq 0 ] && rm -f $lockfile
    return $retval
 }
 restart() {
    stop
    start
 }
 reload() {
    # radiusd may not be capable of a 100% configuration reload depending
    # on which loadable modules are in use, if sending the server a
    # HUP is not sufficient then use restart here instead. However, we
    # prefer by default to use HUP since it's what is usually desired.
    #    
    # restart
    kill -HUP `pidofproc -p $pidfile $prog`
 }
 force_reload() {
    restart
 }
 rh_status() {
    # run checks to determine if the service is running or use generic status
    status -p $pidfile $prog
 }
 rh_status_q() {
    rh_status >/dev/null 2>&1
 }
 case "$1" in
    start)
        rh_status_q && exit 0
        $1
        ;;
    stop)
        rh_status_q || exit 0
        $1
        ;;
    restart)
        $1
        ;;
    reload)
        rh_status_q || exit 7
        $1
        ;;
    force-reload)
        force_reload
        ;;
    status)
        rh_status
        ;;
    condrestart|try-restart)
        rh_status_q || exit 0
        restart
        ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
        exit 2
 esac
 exit $?
--- a/freeradius.sysusers
+++ b/freeradius.sysusers
@ -1,3 +0,0 @@
 #Type Name     ID  GECOS           Home directory        Shell
 u     radiusd  95  "radiusd user"  /var/lib/radiusd      /sbin/nologin
 g     radiusd  95  -               -                     -
--- a/gating.yaml
+++ b/gating.yaml
@ -1,6 +1,6 @@
 --- !Policy
 product_versions:
-  - rhel-9
+  - rhel-8
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,3 +1,6 @@
 ---
 inspections:
    badfuncs: off
 runpath:
    allowed_paths:
        - /usr/lib64
--- a/tests/auth-tests/Makefile
+++ b/tests/auth-tests/Makefile
@ -1,36 +0,0 @@
 # SPDX-License-Identifier: LGPL-2.1+
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   Makefile of /CoreOS/freeradius
 #   Description: Test if freeradius authentication workd ok
 #   Author: Susant Sahani<susant@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 export TEST=/CoreOS/freeradius
 export TESTVERSION=1.0
 BUILT_FILES=
 FILES=$(METADATA) runtest.sh Makefile PURPOSE
 .PHONY: all install download clean
 run: $(FILES) build
 	./runtest.sh
 build: $(BUILT_FILES)
 	test -x runtest.sh || chmod a+x runtest.sh
 clean:
 	rm -f *~ $(BUILT_FILES)
 include /usr/share/rhts/lib/rhts-make.include
 $(METADATA): Makefile
 	@echo "Owner:           Susant Sahani<susant@redhat.com>" > $(METADATA)
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
 	@echo "Description:     Test if the ABI hasn't changed" >> $(METADATA)
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          freeradius" >> $(METADATA)
 	@echo "Requires:        freeradius freeradius-utils python3 python3-psutil" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -Fedora 28" >> $(METADATA)
 	rhts-lint $(METADATA)
--- a/tests/auth-tests/PURPOSE
+++ b/tests/auth-tests/PURPOSE
@ -1,3 +0,0 @@
 PURPOSE of /CoreOS/freeradius
 Description: tests for freeradius
 Author: Susant Sahani<susant@redhat.com>
--- a/tests/auth-tests/authorize
+++ b/tests/auth-tests/authorize
@ -1,2 +0,0 @@
 fedora-ci Cleartext-Password := "password"
       Reply-Message = "Hello, %{User-Name}"
--- a/tests/auth-tests/clients.conf
+++ b/tests/auth-tests/clients.conf
@ -1,6 +0,0 @@
 client localhost {
     ipaddr = 127.0.0.1
     secret = testing123
     require_message_authenticator = no
     nastype = other
 }
--- a/tests/auth-tests/freeradius-tests.py
+++ b/tests/auth-tests/freeradius-tests.py
@ -1,68 +0,0 @@
 #!/usr/bin/env python3
 # SPDX-License-Identifier: LGPL-2.1+
 # ~~~
 #   Description: Tests for freeradius
 #
 #   Author: Susant Sahani <susant@redhat.com>
 #   Copyright (c) 2018 Red Hat, Inc.
 # ~~~
 import errno
 import os
 import sys
 import time
 import unittest
 import subprocess
 import signal
 import shutil
 import psutil
 import socket
 RADIUSD_PID_FILE='/var/run/radiusd/radiusd.pid'
 def setUpModule():
    """Initialize the environment, and perform sanity checks on it."""
    if shutil.which('radiusd') is None:
        raise OSError(errno.ENOENT, 'radiusd not found')
    if shutil.which('radtest') is None:
        raise OSError(errno.ENOENT, 'radtest not found')
    if subprocess.call(['systemctl', 'is-active', '--quiet',
                        'radiusd.service']) == 0:
        raise unittest.SkipTest('radiusd.service is already active')
 def tearDownModule():
        pass
 class GenericUtilities():
    """Provide a set of utility functions start stop daemons. write config files etc """
    def StartRadiusServer(self):
        """Start radiusd"""
        subprocess.check_output(['systemctl', 'start', 'radiusd'])
    def StopRadiusServer(self):
        """stop radiusd"""
        subprocess.check_output(['systemctl', 'stop', 'radiusd'])
 class RadiousTests(unittest.TestCase, GenericUtilities):
    def setUp(self):
        self.StartRadiusServer()
    def tearDown(self):
        self.StopRadiusServer()
    def test_radius_plaintext_auth(self):
        time.sleep(1)
        output=subprocess.check_output(['radtest', 'fedora-ci', 'password', '127.0.0.1',  '100', 'testing123']).rstrip().decode('utf-8')
        print(output)
        self.assertRegex(output, "Received Access-Accept")
        self.assertRegex(output, "Reply-Message = \"Hello, fedora-ci\"")
 if __name__ == '__main__':
    unittest.main(testRunner=unittest.TextTestRunner(stream=sys.stdout,
                                                     verbosity=3))
--- a/tests/auth-tests/runtest.sh
+++ b/tests/auth-tests/runtest.sh
@ -1,70 +0,0 @@
 #!/bin/bash
 # SPDX-License-Identifier: LGPL-2.1+
 # ~~~
 #   runtest.sh of freeradius
 #   Description:  RADIUS server
 #
 #   Author: Susant Sahani <susant@redhat.com>
 #   Copyright (c) 2018 Red Hat, Inc.
 # ~~~
 # Include Beaker environment
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 PACKAGE="freeradius"
 RADIUS_CLIENT_CONF="/etc/raddb/clients.conf"
 RADIUD_PALIN_TEXT_AUTH_FILE="/etc/raddb/mods-config/files/authorize"
 generate_cert(){
    pushd /etc/raddb/certs/
    #remove certificates if exists;generate new certificates
    if [[ -f /etc/raddb/certs/bootstrap ]]; then
        rlLog "Destroy and create new default certificates via bootstrap script"
        rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt* dh
        rlRun "sh /etc/raddb/certs/bootstrap" 0 "Gnenerating certificates"
    else
        rlLogWarning "!!! WARNING bootsrap file does not exist !!!"
        rlLog "Destroy and create new default certificates via make scripts"
        make destroycerts -C /etc/raddb/certs/
        #create new certificates
        make -C /etc/raddb/certs/
        chown root:radiusd dh ca.* client.* server.*
        chmod 640 dh ca.* client.* server.*
    fi
    popd
 }
 rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm $PACKAGE
        rlRun "systemctl stop firewalld" 0,5
        rlRun "systemctl stop radiusd.service"
        rlRun "setenforce 0"
        rlFileBackup "$RADIUS_CLIENT_CONF"
        rlFileBackup "$RADIUD_PALIN_TEXT_AUTH_FILE"
        rlRun "cp freeradius-tests.py /usr/bin/"
        rlRun "cp clients.conf $RADIUS_CLIENT_CONF"
        rlRun "cp authorize $RADIUD_PALIN_TEXT_AUTH_FILE"
        rlRun "systemctl daemon-reload"
        #manually generate default certificates
        generate_cert
    rlPhaseEnd
    rlPhaseStartTest
        rlLog "Starting radius auth tests ..."
        rlRun "/usr/bin/python3 /usr/bin/freeradius-tests.py"
    rlPhaseEnd
    rlPhaseStartCleanup
        rlRun "rm /usr/bin/freeradius-tests.py"
        rlRun "systemctl start firewalld" 0,5
        rlRun "setenforce 1"
        rlFileRestore
        rlLog "freeradius tests done"
    rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd
 rlGetTestState
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -1,12 +0,0 @@
 - hosts: localhost
  roles:
    - role: standard-test-beakerlib
      tags:
      - classic
      tests:
      - auth-tests
      required_packages:
      - python3
      - systemd
      - freeradius
      - freeradius-utils
		`@ -1,2 +0,0 @@`
			`fedora-ci Cleartext-Password := "password"`
			`Reply-Message = "Hello, %{User-Name}"`