1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
|
FreeRADIUS 3.2.5 Tue 09 Jul 2024 12:00:00 UTC urgency=high
Configuration changes
* BlastRADIUS mitigations have been added to the "security"
section. See "require_message_authenticator" and also
"limit_proxy_state".
* BlastRADIUS mitigations have been added to radclient.
See "man radclient", and the "-b" option.
Feature improvements
* TOTP now supports TOTP-Time-Offset for tokens with times that
are out of sync. See mods-available/totp
* radclient now supports forcing the Request Authenticator and ID
for Access-Request packets.
* Update dictionary.3gpp.
* Update advice on shared secrets, including suggesting a secure
method for generating useful secrets.
Bug fixes
* Allow proxying by pool / home server name to work with auth+acct servers
* Fix OpenSSL API usage which sometimes caused crash in MS-CHAP
Previously it would either always crash immediately, or never crash.
* Fix packet statistics. Stop double counting some packets,
and track packet statistics even if a socket is closed.
* Reverted patch in TTLS which broke compatibility with some systems.
* Don't crash in debug mode when multiple intermediate certs are used
Patch from Alexander Chernikov.
FreeRADIUS 3.2.4 Wed 29 May 2024 12:00:00 EDT urgency=low
Configuration changes
* Better handle backslashes in strings in the configuration files.
If the configuration items contain backslashes, then behavior may change.
However, the previous behavior didn't work as expected, and therefore is not
likely to be used.
* reject_delay no longer applies to proxied packets. All servers should now
set "reject_delay = 1" for security and scalability.
* %{randstr:...} now returns the requested amount of data, instead of
one too many bytes.
Feature improvements
* Preliminary support for TEAP.
* Update EAP module pre_proxy checks to make them less restrictive.
This prevents the "middle box" effect from affecting future traffic.
* Many fixes and updates for Docker images
* Add dpsk module. See mods-available/dpsk
* Print out what cause the TLS operations to be made, such as the EAP
method name (peap, ttls, etc), or RADIUS/TLS listen / proxy socket.
* Add auto_escape to sample SQL module config
* Add 'if not exists' to mysql create table queries. ref #5032 (#5137)
* Update dictionary.aruba; add dictionary.tplink, dictionary.alphion
* Allow for 'encrypt=1' attributes to be longer than 128 characters.
* Added "radsecret" program which generates strong secrets. See the
top of the "clients.conf" file for more information.
* radclient now prints packets as hex when using -xxx.
* Added "-t timeout" to radsniff. It will stop processing packets
after <timeout> seconds.
* Support "interface = ..." on OSX and other *BSD which have IP_BOUND_IF.
* The detail module now has a "dates_as_integer" configuration item.
See mods-available/detail for more information.
* Add lookback/lookforward steps and more configuration to totp. See
mods-available/totp.
* Add "time_since" xlat to calculate elapsed time in seconds, milliseconds
and microseconds.
* Support "Post-Auth-Type Challenge" in the inner tunnel. Patch from
Alexander Clouter. PR #5320.
* Add "proxy_dedup_window". See radiusd.conf.
* Document KRB5_CLIENT_KTNAME in the "env" section of radiusd.conf.
* Add "dedup_key" for misbehaving supplicants. See mods-available/eap
Bug fixes
* Fix corner case with empty defaults in rlm_files. Fixes #5035
* When we have multiple attributes of the same name, always use the
canonical attribute
* Make FreeRADIUS-Server-EMA* attributes work again for home server
exponential moving average statistics.
* Don't send the global server stats when asked for client stats. They
use the same attributes, so the result is confusing.
* Fix multiple typos in MongoDB query.conf (#5130)
* Add define for illumos. Fixes #5135
* Add client configuration for TLS PSK.
* Permit originate CoA after proxying to an internal virtual server
* Use virtual server "default" when passed "-i" and "-p" on the command line.
* Fix locking issues with rlm_python3.
* The detail file reader will catch bad times in the file, and will not
update Acct-Delay-Time with extreme values.
* Fix issue where Message-Authenticator was calculated incorrectly for
CoA / Disconnect ACK and NAK packets.
* Update Python thread and error handling. Fixes #5208.
* Fix handling of Session-State when proxying. Fixes #5288.
* Run relevant post-proxy Fail-* section on CoA / Disconnect timeout.
* Add "limit" section to AWS health check configurtion. Fixes 35300.
* Use MAX in sqlite queries instead of GREATEST.
* Fix typo in Mongo queries. Fixes #5301.
* Fix occasional crash with bad home servers. Fixes #5308.
* Minor bug fixes to the SQL freetds modules.
* Fix blocking issue with RADIUS/TLS connection checks.
* Fix run-time crash on configuration typos of %{substr ...} instead
of %{substr:...} Fixes #5321.
* Fix crash with TLS Status-Server requests. Fixes #5326.
FreeRADIUS 3.2.3 Fri 26 May 2023 12:00:00 EDT urgency=low
Configuration changes
* The rlm_ldap and rlm_sql modules now have a "max_retries" configuration
item in the pool section. This sets a limit on how many times an operation
will be retried if it fails indicating a connection issue.
* Added "check_crl" configuration to rlm_ldap. This only works with OpenSSL.
Many Linux distributions use other TLS libraries, which won't work.
* Note that rlm_ldap does not support "-=" operators. The documentation
disagreed with the code, so we fixed the documentation.
* If checkrad is called from SQL Simultaneous-Use checks it will now be
passed NAS-Port-Id (as stored in the database), rather than NAS-Port.
Feature improvements
* Add "max_retries" for connection pools. Fixes #4908. Patch from Nick Porter.
* Update dictionary.ciena, dictionary.huawei, dictionary.wifialliance and
dictionary.wispr; add dictionary.eleven.
* You can now list "eap" in the "pre-proxy" section. If the packet
contains a malformed EAP message, then the request will be rejected.
The home server will either reject (or discard) this packet anyways,
so this change can only help with large proxy scenarios.
* Show warnings if libldap is not using OpenSSL.
* Support RADIUS/1.1. See https://datatracker.ietf.org/doc/draft-dekok-radext-radiusv11/
Disabled by default, can be enabled by passing `--with-radiusv11` to the
configure script. For now, this is for testing interoperability.
* Add extra sanity checks for malformed EAP attributes.
* More TLS debugging output
* Clear old module instance data before HUP reload. Avoids burst memory use
when e.g. using large data files with rlm_files. Patch from Nick Porter.
* `rlm_cache_redis` is now included in the freeradius-redis packages.
* Separate out python2/python3 in Debian Packages. Previously python 2 or 3
was built depending on the system default which led to confusion. We now build
both freeradius-python2 and freeradius-python3 packages where possible.
Bug fixes
* Don't leak MD contexts with OpenSSL 3.0.
* Increase internal buffer size for TLS connections, which
can help with high-load proxies.
* Send Status-Server checks for TLS connections
* Give descriptive error if "update CoA" is used with "fake" packets,
as it won't work. i.e. inner-tunnel and virtual home servers.
* Many small ASAN / LSAN fixes from Jorge Pereira.
* Close inbound RADIUS/TLS socket on TLS errors. When a home server
sees a TLS error, it will now close the socket, so proxies do not
have an open (but dead) TLS connection.
* Fix mutex locking issues on inbound RADIUS/TLS connections.
This change avoids random issues with "bad record mac".
* Improve REST encoding loop. Patch from Herwin Weststrate. Closes #4950
* Correctly report the LDAP group a user was found in. Fixes #3084.
Patch from Nick Porter.
* Force correct packet type when running Post-Auth-Type. Helps with #4980
* Fix small leak in Client-Lost code. Patch from Terry Burton. PR #4996
* Fix TCP socket statistics. Closes #4990
* Use NAS-Port-Id instead of NAS-Port during SQL simultaneous-use
checks. Helps with #5010
FreeRADIUS 3.2.2 Thu 16 Feb 2023 12:00:00 EDT urgency=low
Configuration changes
* The linelog module now has a "header" configuration item,
which places a header in any new file it creates.
* The ldap module now supports setting "cipher_list". See
mods-available/ldap.
* Add "connect_timeout" for outgoing TLS sockets. Helps with #3501.
* Add config section for xlats in rlm_rest and an option to
control REST body data encoding. Patches by Nick Porter.
* Allow Operator-Name and Called-Station-Id in attr_filter when
proxying. Helps with less work in Eduroam configurations.
* Ensure that the AcctUpdateTime field in SQL is always updated.
This is so that we can track when the last packet arrived.
* Update the default configuration to reply to NAS when accounting
proxying fails, but we still write to the detail file.
Feature improvements
* The "configure" process now gives a much clearer report
when it's finished. Patches by Matthew Newton.
* Fallback to "uname -n" on missing "hostname". Fixes #4771
* Export thread details in radmin "stats threads". Fixes #4770
* Improve queries for processing radacct into periodic usage data.
Fix from Nick Porter.
* Update dictionary.juniper
* Add dictionary.calix
* Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be "octets"
* Update documentation for robust-proxy-accounting, and be more
aggressive about sending packets.
* Add per-module README.md files in the source.
* Add default Visual Studio configuration for developers.
* Postgres can now automatically use alternate queries for errors
other than duplicate keys.
* %{listen:TLS-PSK-Identity} is now set when using PSK and psk_query
This helps the server track the identity of the client which is
connecting.
* Include thread stats in Status-Server attributes. Fixes #4870.
* Mark rlm_unbound stable and add to packages. Patches by Nick Porter.
* Remove broken/unsupported Dockerfiles for centos8 and
debian9.
* Ensure Docker containers have stable uid/gid. Patches
from Terry Burton.
Bug fixes
* Preliminary support for non-blocking TLS sockets. Helps with #3501.
* Fix support for partial certificate chains after adding reload
support. Fixes #4753
* Fix handling of debug_condition.
* Clean up home server states, and re-sync with the dictionaries.
* Correct certificate order when creating TLS-* attributes.
Fixes #4785
* Update use of isalpha() etc. so broken configurations have less
impact on the server.
* Outgoing TLS sockets now set SNI correctly from the "hostname"
configuration item.
* Support Apple Homebrew on the M1. Fixes #4754
* Better error messages when %{listen:TLS-...} is used.
* Getting statistics via Status-Server can now be done within a
virtual server. Fixes #4868
* Make TTLS+MS-CHAP work with TLS 1.3. Fixes #4878.
* Fix md5 xlat memory leak when using OpenSSL 3. Fix by Terry Burton.
FreeRADIUS 3.2.1 Mon 03 Oct 2022 12:00:00 EDT urgency=low
Feature improvements
* Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries.
* Add simultaneous-use queries for MS SQL.
* Add radmin command for "stats pool <module-name>"
Which prints out statistics about the connection pools
* Client statistics now shows "conflicts", to count conflicting
packets.
* New optional "lightweight accounting-on/off" strategy. When
refreshing queries.conf you should also add the new nasreload table
and corresponding GRANTs to your DB schema.
* Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with
Eduroam. Suggested by Stefan Winter.
* Allow auth+acct for TCP sockets, too.
* Add rlm_cache_redis. See raddb/mods-available/cache for details
* Allow radmin to look up home servers by name, too.
* Ensure that dynamic clients don't create loops on duplicates.
Reported by Sam Yee.
* Removed rlm_sqlhpwippool. There was no documentation, no configuration,
and the module was ~15 years old with no one using it.
* Marked rlm_python3 as stable.
* Add sigalgs_list. See raddb/mods-available/eap. Patch from
Boris Lytochkin.
* For rlm_linelog, when opening files in /dev, look at "permissions" to see
whether to open them r/w.
* More flexibility for dynamic home servers. See doc/configuration/dynamic_home_servers.md
and raddb/home_servers/README.md
* Allow setting of application_name for PostgreSQL. See mods-available/sql.
Bug fixes
* Correct test for open sessions in radacct for MS SQL.
* The linelog module now opens /dev/stdout in "write-only" mode
if the permissions are set to "u+w" (0002).
* Various fixes to rlm_unbound from Nick Porter.
* PEAP now correctly runs Post-Auth-Type Accept
* Create "TLS-Cert-*" for outbound Radsec, instead of TLS-Client-Cert-*
Fixes #4698. See sites-available/tls, and fix_cert_order.
* Minor updates and fixes to CI, Dockerfiles and packaging.
* Fix rlm_python3 build with python >= 3.10. Fixes #4441
FreeRADIUS 3.2.0 Thu 21 Apr 2022 12:00:00 EDT urgency=low
Configuration changes
* "correct_escapes" has been removed, and is always set to "true"
internally. Configuration changes may be required if you are
using configurations from before 3.0.5. Other than this
difference, 3.2.x is compatible with 3.0.x, and configurations
from 3.0.x can be simply copied into a system running 3.2.x.
Feature improvements
* All features from 3.0.x are included in the 3.2.x releases. In addition:
* Support PEAP and TTLS with TLS 1.3. This has been
tested with wpa_supplicant and Windows 11.
* Add 'reset_day' and '%%r' parameter for rlm_sqlcounter to specify which
day of the month the counter should be reset.
* Partial backport of rlm_json from v4, providing the json_encode xlat.
See mods-available/json for documentation.
* Support for haproxy "PROXY" protocol.
See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/
* Support for sending CoA-Request and Disconnect-Request packets
in "reverse" down RadSec tunnels. Experimental for now, and
undocumented.
* It is now possible to run a virtual server when saving / loading
TLS cache attributes. See sites-available/tls-cache for
more information.
* Removed the "cram" module. It was undocumented, and used old
and insecure authentication methods.
* Remove the "otp" module. The "otpd" program it needs is no longer available,
and the module has not been usable since at least 2015.
* All features from 3.0.x are included in the 3.2.x releases.
* 3.2.0 requires OpenSSL 1.0.2 or greater.
Bug fixes
* All bug fixes from 3.0.x are included in the 3.2.x releases.
|
