Created patched freeradius-3.0.25-r2.

2022-09-24 07:42:19 +02:00 · 2022-09-24 07:42:19 +02:00 · fb8cf4b5f3
parent 692c3163fe
commit fb8cf4b5f3
6 changed files with 550 additions and 0 deletions
--- a/net-dialup/freeradius/Manifest
+++ b/net-dialup/freeradius/Manifest
@ -0,0 +1,6 @@
+AUX freeradius-3.0.20-systemd-service.patch 2162 BLAKE2B 3aa32e5a15efa223aab7880b0cb651edca6695a3727b4df7692f656d1f34366a2a16c364c2a5b544a0ad04bca795be269d4d7dc37bc4c3c6d28387bc3e411ad8 SHA512 8a9f5ecaf559132932ed2e46151ff41e5570df3e844f33ee49004ace0aa7b458a6000ec0d1ed01c34b6236c3dde2ca72cb1031b4badcfa4d6826dbf16ca28259
+AUX freeradius-3.0.25-samba.patch 5797 BLAKE2B 94d15420062288e38757a31386ffea9b2284da2276f4c3bafd0e0f247de7a9bc5d0ea0a3e8c15ae59ad79b20dd2e46dcb4f1aac643d09d63953ba40c16636bef SHA512 af0d2aa54c3bbafaf4bef226842be611f024afc54659cec3c8e8c54c140bd50b9380d63cdeec8d79f04e9f8be6467bd83d12516c6db12a4fc57a8c1f3d61a586
+AUX radius.conf-r6 599 BLAKE2B 35c97ec8a31577afc89bc4f6d7a1310624bea46c2a12ea3cc010fda237b47d5a543225f54d7d4a8b00c1e15f904b149414c597525dd8b6425f20785ca636798d SHA512 acc9b0b178096e44ebfb84228caab1c82bf2f7bb38be386755169bbfb628165b6ac57194ed5a35e566dd0a2d8425f6790b43228a715e633ae8f59e2ab2b574da
+AUX radius.init-r4 753 BLAKE2B 18c83f704ac30d14d56ce8a2f5e3176dcd1aab83cc4525b728e3080e81470a9b4124af49459c69070d9c3ed67a95c7593b6d01f0259403fa9ceee43abd541f7c SHA512 8b05604a72a6a0dea3e654f36b13e1ed517d0c277d128475bcca768204d720b3cd9730e5776371818b8deb0f9fd099458bf5a3276ea9b61e3dbacafaaa527892
+DIST freeradius-3.0.25.tar.gz 5300245 BLAKE2B bf8908aa7bfabb9e15fa841457f176a4f2697bdec7994485516ef338908b46f2168260b7acf1a7120a687e543f0381bb787567bb4d564b9d14a3eb464a0e9ed6 SHA512 13382a53e6a1a4495c6f53e662ce21b80d73b6134a72f099f05495b64c56ae1a6c1cd1281311f1c3695d8532207fe5bd3d2026ed2c45f3cb5adb1011f1505ee7
+EBUILD freeradius-3.0.25-r2.ebuild 7629 BLAKE2B c155d2da0f1699c5ec24bbd8f81392e6b7c6ffa2298337fbc9da36faefb6d33eaf50bf01ba1250a8228f90f23216d665b5185f0539a4c971536e78724e903144 SHA512 d46a40b9e6920393c4a0d6443b7b991e5a4ff915e04be341c9942de5712f9a7e61b68d21926419d96fb5de0fa90088e3eeeb24245123ae5dbdb8d31c4ec60192
--- a/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch
+++ b/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch
@ -0,0 +1,57 @@
+diff --git a/debian/freeradius.service b/debian/freeradius.service
+index 378702d184..ee33c2a294 100644
+--- a/debian/freeradius.service
+++ b/debian/freeradius.service
+@@ -7,7 +7,6 @@ Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ htt
+ Type=notify
+ WatchdogSec=60
+ NotifyAccess=all
+-EnvironmentFile=-/etc/default/freeradius
+ 
+ # FreeRADIUS can do static evaluation of policy language rules based
+ # on environmental variables which is very useful for doing per-host
+@@ -25,16 +24,15 @@ MemoryLimit=2G
+ # Ensure the daemon can still write its pidfile after it drops
+ # privileges. Combination of options that work on a variety of
+ # systems. Test very carefully if you alter these lines.
+-RuntimeDirectory=freeradius
+RuntimeDirectory=radiusd
+ RuntimeDirectoryMode=0775
+ # This does not work on Debian Jessie:
+-User=freerad
+-Group=freerad
+-# This does not work on Ubuntu Bionic:
+-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
+User=radius
+Group=radius
+ 
+-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
+-ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS
+ExecStartPre=/usr/sbin/radiusd $RADIUSD_OPTIONS -Cx -lstdout
+ExecStart=/usr/sbin/radiusd -f $RADIUSD_OPTIONS
+ExecReload=/bin/kill -HUP $MAINPID
+ Restart=on-failure
+ RestartSec=5
+ 
+@@ -42,7 +40,7 @@ RestartSec=5
+ NoNewPrivileges=true
+ 
+ # Allow binding to secure ports, broadcast addresses, and raw interfaces.
+-#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
+ 
+ # Private /tmp that isn't shared by other processes
+ PrivateTmp=true
+@@ -60,10 +58,10 @@ ProtectKernelTunables=true
+ SystemCallArchitectures=native
+ 
+ # We shouldn't be writing to the configuration directory
+-ReadOnlyDirectories=/etc/freeradius/
+ReadOnlyDirectories=/etc/raddb/
+ 
+ # We can read and write to the log directory.
+-ReadWriteDirectories=/var/log/freeradius/
+ReadWriteDirectories=/var/log/radius/
+ 
+ [Install]
+ WantedBy=multi-user.target
--- a/net-dialup/freeradius/files/freeradius-3.0.25-samba.patch
+++ b/net-dialup/freeradius/files/freeradius-3.0.25-samba.patch
@ -0,0 +1,160 @@
+--- a/src/modules/rlm_mschap/configure.ac	2021-10-07 21:46:04.000000000 +0200
+++ b/src/modules/rlm_mschap/configure.ac	2022-09-24 05:22:47.398688867 +0200
+@@ -15,13 +15,14 @@
+     dnl ############################################################
+ 
+     dnl extra argument: --with-winbind-include-dir=DIR
+    winbind_omit=
+     winbind_include_dir=
+     AC_ARG_WITH(winbind-include-dir,
+ 	[AS_HELP_STRING([--with-winbind-include-dir=DIR],
+ 		[Directory where the winbind includes may be found])],
+ 	[case "$withval" in
+ 	    no)
+-		AC_MSG_ERROR(Need winbind-include-dir)
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -37,7 +38,7 @@
+ 		[Directory where the winbind libraries may be found])],
+ 	[case "$withval" in
+ 	    no)
+-		AC_MSG_ERROR(Need winbind-lib-dir)
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -52,7 +53,7 @@
+ 		[Base directory where winbind is installed])],
+ 	[case "$withval" in
+ 	    no)
+-		AC_MSG_ERROR(Need winbind-dir)
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -67,44 +68,48 @@
+     dnl # Check for header files
+     dnl ############################################################
+ 
+-    mschap_sources=
+-    FR_SMART_CHECK_INCLUDE(membership.h)
+-    if test "x$ac_cv_header_membership_h" = "xyes"; then
+    if test "x$winbind_omit" = "xyes"; then
+      AC_MSG_WARN([building without support for direct authentication via winbind])
+    else
+      mschap_sources=
+      FR_SMART_CHECK_INCLUDE(membership.h)
+      if test "x$ac_cv_header_membership_h" = "xyes"; then
+         AC_DEFINE([HAVE_MEMBERSHIP_H],[1],[Build with Apple Open Directory support])
+         mschap_sources="$mschap_sources opendir.c"
+         mod_ldflags="-framework DirectoryService"
+-    fi
+      fi
+ 
+-    smart_try_dir="$winbind_include_dir /usr/include/samba-4.0"
+-    FR_SMART_CHECK_INCLUDE(wbclient.h, [#include <stdint.h>
+      smart_try_dir="$winbind_include_dir /usr/include/samba-4.0"
+      FR_SMART_CHECK_INCLUDE(wbclient.h, [#include <stdint.h>
+ 					#include <stdbool.h>])
+-    if test "x$ac_cv_header_wbclient_h" != "xyes"; then
+      if test "x$ac_cv_header_wbclient_h" != "xyes"; then
+         AC_MSG_WARN([wbclient.h not found. Use --with-winbind-include-dir=<path>.])
+         AC_MSG_WARN([silently building without support for direct authentication via winbind. requires: libwbclient])
+-    fi
+      fi
+ 
+-    FR_SMART_CHECK_INCLUDE(core/ntstatus.h, [#include <stdint.h>
+      FR_SMART_CHECK_INCLUDE(core/ntstatus.h, [#include <stdint.h>
+ 					     #include <stdbool.h>])
+-    if test "x$ac_cv_header_core_ntstatus_h" != "xyes"; then
+      if test "x$ac_cv_header_core_ntstatus_h" != "xyes"; then
+         AC_MSG_WARN([core/ntstatus.h not found. Use --with-winbind-include-dir=<path>.])
+         AC_MSG_WARN([silently building without support for direct authentication via winbind. requires: libwbclient])
+-    fi
+-
+-    dnl ############################################################
+-    dnl # Check for libraries
+-    dnl ############################################################
+-
+-    if test "x$ac_cv_header_wbclient_h" = "xyes" && \
+-       test "x$ac_cv_header_core_ntstatus_h" = "xyes"; then
+      fi
+ 
+-      smart_try_dir="$winbind_lib_dir"
+-      FR_SMART_CHECK_LIB(wbclient, wbcCtxAuthenticateUserEx)
+-      if test "x$ac_cv_lib_wbclient_wbcCtxAuthenticateUserEx" != "xyes"; then
+-        AC_MSG_WARN([winbind libraries not found. Use --with-winbind-lib-dir=<path>.])
+-        AC_MSG_WARN([Samba must be version 4.2.1 or higher to use this feature.])
+-      else
+-        mschap_sources="$mschap_sources auth_wbclient.c"
+-        AC_DEFINE([WITH_AUTH_WINBIND],[1],[Build with direct winbind auth support])
+      dnl ############################################################
+      dnl # Check for libraries
+      dnl ############################################################
+
+      if test "x$ac_cv_header_wbclient_h" = "xyes" && \
+        test "x$ac_cv_header_core_ntstatus_h" = "xyes"; then
+
+        smart_try_dir="$winbind_lib_dir"
+        FR_SMART_CHECK_LIB(wbclient, wbcCtxAuthenticateUserEx)
+        if test "x$ac_cv_lib_wbclient_wbcCtxAuthenticateUserEx" != "xyes"; then
+          AC_MSG_WARN([winbind libraries not found. Use --with-winbind-lib-dir=<path>.])
+          AC_MSG_WARN([Samba must be version 4.2.1 or higher to use this feature.])
+        else
+          mschap_sources="$mschap_sources auth_wbclient.c"
+          AC_DEFINE([WITH_AUTH_WINBIND],[1],[Build with direct winbind auth support])
+        fi
+       fi
+     fi
+ 
+--- a/src/modules/rlm_mschap/configure	2021-10-07 21:46:04.000000000 +0200
+++ b/src/modules/rlm_mschap/configure	2022-09-24 07:03:53.673208336 +0200
+@@ -2773,7 +2773,7 @@
+ if test "${with_winbind_include_dir+set}" = set; then :
+   withval=$with_winbind_include_dir; case "$withval" in
+ 	    no)
+-		as_fn_error $? "Need winbind-include-dir" "$LINENO" 5
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -2790,7 +2790,7 @@
+ if test "${with_winbind_lib_dir+set}" = set; then :
+   withval=$with_winbind_lib_dir; case "$withval" in
+ 	    no)
+-		as_fn_error $? "Need winbind-lib-dir" "$LINENO" 5
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -2806,7 +2806,7 @@
+ if test "${with_winbind_dir+set}" = set; then :
+   withval=$with_winbind_dir; case "$withval" in
+ 	    no)
+-		as_fn_error $? "Need winbind-dir" "$LINENO" 5
+		winbind_omit="yes"
+ 		;;
+ 	    yes)
+ 		;;
+@@ -2819,6 +2819,10 @@
+ 
+ 
+ 
+  if test "x$winbind_omit" = "xyes"; then
+        { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: building without support for direct authentication via winbind" >&5
+$as_echo "$as_me: WARNING: building without support for direct authentication via winbind" >&2;}
+  else
+ 
+     mschap_sources=
+ 
+@@ -3723,6 +3727,8 @@
+       fi
+     fi
+ 
+fi
+
+     targetname=rlm_mschap
+ else
+     targetname=
--- a/net-dialup/freeradius/files/radius.conf-r6
+++ b/net-dialup/freeradius/files/radius.conf-r6
@ -0,0 +1,22 @@
+# Config file for /etc/init.d/radiusd
+
+# see man pages for radiusd run `radiusd -h`
+# for valid cmdline options
+#RADIUSD_OPTS=""
+
+# Change this value if you change it in /etc/raddb/radiusd.conf
+pidfile=/run/radiusd/radiusd.pid
+
+# Change these values if you change them in /etc/raddb/radiusd.conf
+RADIUSD_USER=radius
+RADIUSD_GROUP=radius
+
+RADIUSD_LOGPATH=/var/log/radius
+
+# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want
+# to uncomment the following line.
+#rc_use="logger"
+
+# If you use ldap, start the ldap server prior to FreeRADIUS to avoid
+# startup crashes.
+#rc_use="ldap"
--- a/net-dialup/freeradius/files/radius.init-r4
+++ b/net-dialup/freeradius/files/radius.init-r4
@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+command=/usr/sbin/radiusd
+command_args="${RADIUSD_OPTS}"
+pidfile="${pidfile:-/run/radiusd/radiusd.pid}"
+extra_started_commands="reload"
+
+depend() {
+	need localmount
+	use dns
+}
+
+start_pre() {
+	if [ ! -f /etc/raddb/radiusd.conf ] ; then
+		eerror "No /etc/raddb/radiusd.conf file exists!"
+		return 1
+	fi
+
+	checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
+		$(dirname ${pidfile}) "${RADIUSD_LOGPATH:-/var/log/radius}"
+	checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
+		$(dirname ${pidfile}) /run/radiusd
+}
+
+reload() {
+	ebegin "Reloading radiusd"
+	kill -HUP $(cat ${pidfile})
+	eend $?
+}
--- a/net-dialup/freeradius/freeradius-3.0.25-r2.ebuild
+++ b/net-dialup/freeradius/freeradius-3.0.25-r2.ebuild
@ -0,0 +1,274 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{8..10} )
+inherit autotools pam python-single-r1 systemd
+
+MY_PV=$(ver_rs 1- "_")
+
+DESCRIPTION="Highly configurable free RADIUS server"
+HOMEPAGE="https://freeradius.org/"
+SRC_URI="https://github.com/FreeRADIUS/freeradius-server/archive/release_${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/freeradius-server-release_${MY_PV}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
+
+IUSE="
+	debug firebird iodbc kerberos ldap memcached mysql mongodb odbc oracle pam
+	pcap postgres python readline redis rest samba sqlite ssl systemd
+"
+
+RESTRICT="test firebird? ( bindist )"
+
+# NOTE: Temporary freeradius doesn't support linking with mariadb client
+#       libs also if code is compliant, will be available in the next release.
+#       (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a
+
+# TODO: rlm_mschap works with both samba library or without. I need to avoid
+#       linking of samba library if -samba is used.
+RDEPEND="acct-group/radius
+	acct-user/radius
+	!net-dialup/cistronradius
+	dev-lang/perl:=
+	sys-libs/gdbm:=
+	sys-libs/talloc
+	virtual/libcrypt:=
+	firebird? ( dev-db/firebird )
+	iodbc? ( dev-db/libiodbc )
+	kerberos? ( virtual/krb5 )
+	ldap? ( net-nds/openldap:= )
+	memcached? ( dev-libs/libmemcached )
+	mysql? ( dev-db/mysql-connector-c:= )
+	mongodb? ( >=dev-libs/mongo-c-driver-1.13.0-r1 )
+	odbc? ( dev-db/unixODBC )
+	oracle? ( dev-db/oracle-instantclient[sdk] )
+	pam? ( sys-libs/pam )
+	pcap? ( net-libs/libpcap )
+	postgres? ( dev-db/postgresql:= )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:0= )
+	redis? ( dev-libs/hiredis:= )
+	rest? ( dev-libs/json-c:= )
+	samba? ( net-fs/samba )
+	sqlite? ( dev-db/sqlite:3 )
+	ssl? (
+		dev-libs/openssl:0=[-bindist(-)]
+	)
+	systemd? ( sys-apps/systemd )"
+DEPEND="${RDEPEND}"
+
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# 721040
+QA_SONAME="usr/lib.*/libfreeradius-.*.so"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.0.20-systemd-service.patch
+	"${FILESDIR}"/${PN}-3.0.25-samba.patch
+)
+
+pkg_setup() {
+	if use python ; then
+		python-single-r1_pkg_setup
+		export PYTHONBIN="${EPYTHON}"
+	fi
+}
+
+src_prepare() {
+	# most of the configuration options do not appear as ./configure
+	# switches. Instead it identifies the directories that are available
+	# and run through them. These might check for the presence of
+	# various libraries, in which case they are not built.  To avoid
+	# automagic dependencies, we just remove all the modules that we're
+	# not interested in using.
+
+	eapply_user
+	default
+
+	use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; }
+	use ldap || { rm -r src/modules/rlm_ldap || die ; }
+	use kerberos || { rm -r src/modules/rlm_krb5 || die ; }
+	use memcached || { rm -r src/modules/rlm_cache/drivers/rlm_cache_memcached || die ; }
+	use pam || { rm -r src/modules/rlm_pam || die ; }
+	# Drop support of python2
+	rm -r src/modules/rlm_python || die
+	use python || { rm -r src/modules/rlm_python3 || die ; }
+	use rest || { rm -r src/modules/rlm_rest || die ; }
+	use redis || { rm -r src/modules/rlm_redis{,who} || die ; }
+	# Do not install ruby rlm module, bug #483108
+	rm -r src/modules/rlm_ruby || die
+
+	# these are all things we don't have in portage/I don't want to deal
+	# with myself
+	rm -r src/modules/rlm_eap/types/rlm_eap_tnc || die # requires TNCS library
+	rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die # requires libeap-ikev2
+	rm -r src/modules/rlm_opendirectory || die # requires some membership.h
+	rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die
+
+	# sql drivers that are not part of experimental are loaded from a
+	# file, so we have to remove them from the file itself when we
+	# remove them.
+	usesqldriver() {
+		local flag=$1
+		local driver=rlm_sql_${2:-${flag}}
+
+		if ! use ${flag}; then
+			rm -r src/modules/rlm_sql/drivers/${driver} || die
+			sed -i -e /${driver}/d src/modules/rlm_sql/stable || die
+		fi
+	}
+
+	sed -i \
+		-e 's:^#\tuser = :\tuser = :g' \
+		-e 's:^#\tgroup = :\tgroup = :g' \
+		-e 's:/var/run/radiusd:/run/radiusd:g' \
+		-e '/^run_dir/s:${localstatedir}::g' \
+		raddb/radiusd.conf.in || die
+
+	# verbosity
+	# build shared libraries using jlibtool -shared
+	sed -i \
+		-e '/$(LIBTOOL)/s|--quiet ||g' \
+		-e 's:--mode=\(compile\|link\):& -shared:g' \
+		Make.inc.in || die
+
+	sed -i \
+		-e 's|--silent ||g' \
+		-e 's:--mode=\(compile\|link\):& -shared:g' \
+		scripts/libtool.mk || die
+
+	# crude measure to stop jlibtool from running ranlib and ar
+	sed -i \
+		-e '/LIBRARIAN/s|".*"|"true"|g' \
+		-e '/RANLIB/s|".*"|"true"|g' \
+		scripts/jlibtool.c || die
+
+	usesqldriver mysql
+	usesqldriver postgres postgresql
+	usesqldriver firebird
+	usesqldriver iodbc
+	usesqldriver odbc unixodbc
+	usesqldriver oracle
+	usesqldriver sqlite
+	usesqldriver mongodb mongo
+
+	eautoreconf
+}
+
+src_configure() {
+	# do not try to enable static with static-libs; upstream is a
+	# massacre of libtool best practices so you also have to make sure
+	# to --enable-shared explicitly.
+	local myeconfargs=(
+		--enable-shared
+		--disable-static
+		--disable-ltdl-install
+		--with-system-libtool
+		--with-system-libltdl
+		--with-ascend-binary
+		--with-udpfromto
+		--with-dhcp
+		--with-iodbc-include-dir=/usr/include/iodbc
+		--with-experimental-modules
+		--with-docdir=/usr/share/doc/${PF}
+		--with-logdir=/var/log/radius
+		$(use_enable debug developer)
+		$(use_with ldap edir)
+		$(use_with ssl openssl)
+		$(use_with systemd systemd)
+	)
+	# fix bug #77613
+	if has_version app-crypt/heimdal; then
+		myeconfargs+=( --enable-heimdal-krb5 )
+	fi
+
+	if use python ; then
+		myeconfargs+=(
+			--with-rlm-python3-bin=${EPYTHON}
+			--with-rlm-python3-config-bin=${EPYTHON}-config
+		)
+	fi
+
+	if ! use samba ; then
+		myeconfargs+=(
+			--without-winbind-dir
+		)
+	fi
+
+	use readline || export ac_cv_lib_readline=no
+	use pcap || export ac_cv_lib_pcap_pcap_open_live=no
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	# verbose, do not generate certificates
+	emake \
+		Q='' ECHO=true \
+		LOCAL_CERT_PRODUCTS=''
+}
+
+src_install() {
+	dodir /etc
+	diropts -m0750 -o root -g radius
+	dodir /etc/raddb
+	diropts -m0750 -o radius -g radius
+	dodir /var/log/radius
+	keepdir /var/log/radius/radacct
+	diropts
+
+	# verbose, do not install certificates
+	# Parallel install fails (#509498)
+	emake -j1 \
+		Q='' ECHO=true \
+		LOCAL_CERT_PRODUCTS='' \
+		R="${D}" \
+		install
+
+	if use pam; then
+		pamd_mimic_system radiusd auth account password session
+	fi
+
+	# fix #711756
+	fowners -R radius:radius /etc/raddb
+	fowners -R radius:radius /var/log/radius
+
+	dodoc CREDITS
+
+	rm "${ED}/usr/sbin/rc.radiusd" || die
+
+	newinitd "${FILESDIR}/radius.init-r4" radiusd
+	newconfd "${FILESDIR}/radius.conf-r6" radiusd
+
+	if ! use systemd ; then
+		# If systemd builtin is not enabled we need use Type=Simple
+		# as systemd .service
+		sed -i -e 's:^Type=.*::g' \
+			-e 's:^WatchdogSec=.*::g' -e 's:^NotifyAccess=all.*::g' \
+			"${S}"/debian/freeradius.service
+	fi
+	systemd_dounit "${S}"/debian/freeradius.service
+
+	find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die
+}
+
+pkg_config() {
+	if use ssl; then
+		cd "${ROOT}"/etc/raddb/certs || die
+		./bootstrap || die "Error while running ./bootstrap script."
+		chown root:radius "${ROOT}"/etc/raddb/certs || die
+		chown root:radius "${ROOT}"/etc/raddb/certs/ca.pem || die
+		chown root:radius "${ROOT}"/etc/raddb/certs/server.{key,crt,pem} || die
+	fi
+}
+
+pkg_preinst() {
+	if ! has_version ${CATEGORY}/${PN} && use ssl; then
+		elog "You have to run \`emerge --config =${CATEGORY}/${PF}\` to be able"
+		elog "to start the radiusd service."
+	fi
+}