3.2.3

Configuration changes

• The rlm_ldap and rlm_sql modules now have a max_retries configuration item in the pool section. This sets a limit on how many times an operation will be retried if it fails indicating a connection issue.
• Added check_crl configuration to rlm_ldap. This only works with OpenSSL. Many Linux distributions use other TLS libraries, which won't work.
• Note that rlm_ldap does not support -= operators. The documentation disagreed with the code, so we fixed the documentation.
• If checkrad is called from SQL Simultaneous-Use checks it will now be passed NAS-Port-Id (as stored in the database), rather than NAS-Port.

Feature improvements

• Add max_retries for connection pools. Fixes #4908. Patch from Nick Porter.
• Update dictionary.ciena, dictionary.huawei, dictionary.wifialliance and dictionary.wispr; add dictionary.eleven.
• You can now list eap in the pre-proxy section. If the packet contains a malformed EAP message, then the request will be rejected. The home server will either reject (or discard) this packet anyways, so this change can only help with large proxy scenarios.
• Show warnings if libldap is not using OpenSSL.
• Support RADIUS/1.1. See https://datatracker.ietf.org/doc/draft-dekok-radext-radiusv11/ Disabled by default, can be enabled by passing --with-radiusv11 to the configure script. For now, this is for testing interoperability.
• Add extra sanity checks for malformed EAP attributes.
• More TLS debugging output
• Clear old module instance data before HUP reload. Avoids burst memory use when e.g. using large data files with rlm_files. Patch from Nick Porter.
• rlm_cache_redis is now included in the freeradius-redis packages.
• Separate out python2/python3 in Debian Packages. Previously python 2 or 3 was built depending on the system default which led to confusion. We now build both freeradius-python2 and freeradius-python3 packages where possible.

Bug fixes

• Don't leak MD contexts with OpenSSL 3.0.
• Increase internal buffer size for TLS connections, which can help with high-load proxies.
• Send Status-Server checks for TLS connections
• Give descriptive error if "update CoA" is used with "fake" packets, as it won't work. i.e. inner-tunnel and virtual home servers.
• Many small ASAN / LSAN fixes from Jorge Pereira.
• Close inbound RADIUS/TLS socket on TLS errors. When a home server sees a TLS error, it will now close the socket, so proxies do not have an open (but dead) TLS connection.
• Fix mutex locking issues on inbound RADIUS/TLS connections. This change avoids random issues with "bad record mac".
• Improve REST encoding loop. Patch from Herwin Weststrate. Closes #4950
• Correctly report the LDAP group a user was found in. Fixes #3084. Patch from Nick Porter.
• Force correct packet type when running Post-Auth-Type. Helps with #4980
• Fix small leak in Client-Lost code. Patch from Terry Burton. PR #4996
• Fix TCP socket statistics. Closes #4990
• Use NAS-Port-Id instead of NAS-Port during SQL simultaneous-use checks. Helps with #5010

3.2.2

Configuration changes

• The linelog module now has a header configuration item, which places a header in any new file it creates.
• The ldap module now supports setting cipher_list. See mods-available/ldap.
• Add connect_timeout for outgoing TLS sockets. Helps with #3501.
• Add config section for xlats in rlm_rest and an option to control REST body data encoding. Patches by Nick Porter.
• Allow Operator-Name and Called-Station-Id in attr_filter when proxying. Helps with less work in eduroam configurations.
• Ensure that the AcctUpdateTime field in SQL is always updated. This is so that we can track when the last packet arrived.
• Update the default configuration to reply to NAS when accounting proxying fails, but we still write to the detail file.

Feature improvements

• The configure process now gives a much clearer report when it's finished. Patches by Matthew Newton.
• Fallback to uname -n on missing hostname. Fixes #4771
• Export thread details in radmin stats threads. Fixes #4770
• Improve queries for processing radacct into periodic usage data. Fix from Nick Porter.
• Update dictionary.juniper
• Add dictionary.calix
• Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be octets
• Update documentation for robust-proxy-accounting, and be more aggressive about sending packets.
• Add per-module README.md files in the source.
• Add default Visual Studio configuration for developers.
• Postgres can now automatically use alternate queries for errors other than duplicate keys.
• %{listen:TLS-PSK-Identity} is now set when using PSK and psk_query. This helps the server track the identity of the client which is connecting.
• Include thread stats in Status-Server attributes. Fixes #4870.
• Mark rlm_unbound stable and add to packages. Patches by Nick Porter.
• Remove broken/unsupported Dockerfiles for centos8 and debian9.
• Ensure Docker containers have stable uid/gid. Patches from Terry Burton.

Bug fixes

• Preliminary support for non-blocking TLS sockets. Helps with #3501.
• Fix support for partial certificate chains after adding reload support. Fixes #4753
• Fix handling of debug_condition.
• Clean up home server states, and re-sync with the dictionaries.
• Correct certificate order when creating TLS-* attributes. Fixes #4785
• Update use of isalpha() etc. so broken configurations have less impact on the server.
• Outgoing TLS sockets now set SNI correctly from the "hostname" configuration item.
• Support Apple Homebrew on the M1. Fixes #4754
• Better error messages when %{listen:TLS-...} is used.
• Getting statistics via Status-Server can now be done within a virtual server. Fixes #4868
• Make TTLS+MS-CHAP work with TLS 1.3. Fixes #4878.
• Fix md5 xlat memory leak when using OpenSSL 3. Fix by Terry Burton.

3.2.1

Feature improvements

• Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries,
• Add simultaneous-use queries for MS SQL.
• Add radmin command for stats pool <module-name> which prints out statistics about the connection pools.
• Client statistics now shows "conflicts", to count conflicting packets.
• New optional "lightweight accounting-on/off" strategy. When refreshing queries.conf you should also add the new nasreload table and corresponding GRANTs to your DB schema.
• Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with eduroam. Suggested by Stefan Winter.
• Allow auth+acct for TCP sockets, too.
• Add rlm_cache_redis. See raddb/mods-available/cache for details.
• Allow radmin to look up home servers by name, too.
• Ensure that dynamic clients don't create loops on duplicates. Reported by Sam Yee.
• Removed rlm_sqlhpwippool. There was no documentation, no configuration, and the module was ~15 years old with no one using it.
• Marked rlm_python3 as stable.
• Add sigalgs_list. See raddb/mods-available/eap. Patch from Boris Lytochkin.
• For rlm_linelog, when opening files in /dev, look at "permissions" to see whether to open them r/w.
• More flexibility for dynamic home servers. See doc/configuration/dynamic_home_servers.md and raddb/home_servers/README.md.
• Allow setting of application_name for PostgreSQL. See mods-available/sql.

Bug fixes

• Correct test for open sessions in radacct for MS SQL.
• The linelog module now opens /dev/stdout in "write-only" mode if the permissions are set to "u+w" (0002).
• Various fixes to rlm_unbound from Nick Porter.
• PEAP now correctly runs Post-Auth-Type Accept.
• Create TLS-Cert-* for outbound RadSec, instead of TLS-Client-Cert-*. Fixes #4698. See sites-available/tls, and fix_cert_order.
• Minor updates and fixes to CI, Dockerfiles and packaging.
• Fix rlm_python3 build with Python >= 3.10. Fixes #4441

3.0.26

Feature improvements

• Add support for OpenSSL3
• Add dictionary.mellanox, dictionary.netelastic, dictionary.ciena, dictionary.nile
• Update dictionary.aruba, dictionary.roaringpenguin
• Removed haproxy support. It's new and experimental, and belongs in the v3.2 release, where it will be fully supported.
• Support PEAP and TTLS with TLS 1.3. This has been tested with wpa_supplicant and Windows 11.
• Add %{concat:foo[*] ;}, which concatenates a set of attributes, separated by a character.
• Added sample configuration for using Google LDAP. See sites-available/google-ldap-auth, and mods-available/google_ldap, and mods-available/cache_auth.
• Add Dockerfiles for Rocky8.
• Add raduat script to the freeradius-utils package.
• Add Debian freeradius-freetds package.
• Add client short name to "dropping packet" message,
• Update MS-SQL queries to avoid using column which was deleted years ago.
• Add configure-time FIPS workaround to use internal MD4/MD5 implementations when disabled in OpenSSL.

Bug fixes

• Ensure PBKDF2 always uses at least one iteration
• Actually use the certificate in "realm_dir" hinted at by SNI.
• Removed the use of "locate" during the "configure" phase. Fixes #4318
• Fix for showing incomplete home server list after deleting a home server via radmin.
• Call closedir() when reading certificates from a directory. Found by Antonio Torres. Fixes #4378.
• If we read more than 16K of data in RadSec, then read it all. Fixes #4388, patch from Aren Sandersen.
• Fix information leak in compute_password_element() function of EAP-PWD. Found by Mohamed Sabt.
• Fix crash in EAP-SIM when unknown attributes are sent.
• Update linelog, etc. to allow the use of /dev/stdout
• Fix crash in race condition when 500+ sockets are open.
• Remove sample "cache_eap" module. It does not work, and offers no benefit.
• Fix crash in RadSec with expired server certificate. #4447.
• PEAP now correctly runs Post-Auth-Type Accept.
• Build fixes for OS X
• Minor updates and fixes to CI, Dockerfiles and packaging.

3.2.0

Configuration changes

• correct_escapes has been removed, and is always set to "true" internally. Configuration changes may be required if you are using configurations from before 3.0.5. Other than this difference, 3.2.x is compatible with 3.0.x, and configurations from 3.0.x can be simply copied into a system running 3.2.x.

Feature improvements

• All features from 3.0.x are included in the 3.2.x releases. In addition:
• Add reset_day and %%r parameter for rlm_sqlcounter to specify which day of the month the counter should be reset.
• Partial backport of rlm_json from v4, providing the json_encode xlat. See mods-available/json for documentation.
• Support for haproxy "PROXY" protocol. See sites-available/tls, proxy_protocol and doc/antora/modules/howto/pages/protocols/proxy/
• Support for sending CoA-Request and Disconnect-Request packets in "reverse" down RadSec tunnels. Experimental for now, and undocumented.
• It is now possible to run a virtual server when saving / loading TLS cache attributes. See sites-available/tls-cache for more information.
• Removed the cram module. It was undocumented, and used old and insecure authentication methods.
• Remove the otp module. The otpd program it needs is no longer available, and the module has not been usable since at least 2015.
• 3.2.0 requires OpenSSL 1.0.2 or greater.

Bug fixes

• All bug fixes from 3.0.x are included in the 3.2.x releases.

3.0.25

Feature improvements

• Better debug output when proxying is disabled
• Updates to support PostgreSQL 14 (#4251)

Bug fixes

• Add correct_escapes back into default configuration
• Fix undeclared variable with some compile options (#4246)
• Quiet erroneous debug output
• Fix segfault when proxying to zombie home server
• Fix resolving values to enum strings in rlm_rest (#4167)
• Fix printing raw values rather than enum strings in rlm_couchbase (#4167)

3.0.24

Feature improvements

• Add sanitizer options to configure script.
• Log information needed by Wireshark to decode TLS sessions.
• Allow more liberal SQL commands in rlm_sql_map.
• Update dictionary.apc, dictionary.h3c
• Add new Acct-Status-Type Subsystem-On and Subsystem-Off. See dictionary.iana and https://freeradius.org/rfc/acct_status_type_subsystem.html
• Add reject_unknown_intermediate_ca. See mods-available/eap
• Add dynamic loading of certificates via TLS-Session-Cert-File. See raddb/certs/realms/README.md
• Add Server Name Indication (SNI) for outbound RadSec connections. See raddb/sites-available/tls, and the home server tls configuration.
• Support SNI for inbound RadSec connections. Certificates will be loaded from "realm_dir" in the "tls" section. SNI will be cached in the TLS-Server-Name-Indication attribute.
• Preliminary support for haproxy "PROXY" protocol. See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/
• Generate parse errors in more circumstances when we know that the configuration is wrong.
• Add "weeklycounter" to sample sqlcounter configuration
• Add certificate attributes to the request list, even if the certificates have expired.
• The Simultaneous-Use code is now IPv6 aware, and can deal with NAS-IPv6-Address.
• Add dictionary.cambium

Bug fixes

• Fix crash in trustrouter module (#4115). Patch from Alejandro Perez
• Fix crash in state handling.
• Don't alter global options in redhat logrotate scripts.
• EAP-FAST will print errors and continue, rather than exiting when OpenSSL fails various internal sanity checks.
• Allow admin to manually change core limits, even when core limits are disabled. Patch from Antonio Torres.
• Fix chunked rlm_rest HTTP body. Closes #4131. Patch from Nathan Ward.
• Many fixes around the SQL ippool queries.conf and schema. Patches from Jorge Periera.
• Fix MySQL stored procedures. PR #4170 from Terry Burton.
• Rework connection pool management for corner cases. Fixes #4161, #4162, #4163.
• Final fix for double free in #3188.
• Fix sqlcounter wrong memory free. PR #4192 from Jorge Pereira
• Accept slow writes from proxies over TCP, which allows the server to make more progress when it receives partial packets.
• Add 'weeklycounter' for rlm_sqlcounter.
• Outbound proxying over TCP / TLS is better able to deal with partial TCP reads, and has fewer issues with slow networks.
• Fix wrong data-type of Acct-Delay-Time in rlm_unix.
• Fix EAP-FAST PAC lifetime calculation.
• Print correct encoded packet length when debugging

3.0.23

Feature improvements

• Update dictionary.aruba
• Add set home_server state ... down in order to mark the home server as administratively down. Use alive to bring it back to life.
• Add Post-Auth-Type Client-Lost which should make it easier to log when clients stop responding.
• Add sites-available/totp as an example of how to use TOTP.
• Add %{mschap:Domain-Name}, fixes #3944.
• Cache TLS messages in &session-state, for more debugging.
• Notes in eap configuration about TLS 1.0 / TLS 1.1, and setting cipher_list = "DEFAULT@SECLEVEL=1"
• Added many warning messages about using TLS 1.3 with EAP. In short, don't use it. Microsoft will support it in fall 2021.

Bug fixes

• Fix crash in some cases when home server is down, in debug mode.
• Fix (again) "read clients from SQL" functionality.
• Fix sql_map to return values in more situations.
• Silently ignore LEAP configuration instead of erroring out.

3.0.22

Feature improvements

• Many new "unlang" documentation files. See make docsite and then see build/docsite/freeradius-server/*/index.html
• Limited support for dynamic home servers. See proxy.conf and doc/configuration/dynamic_home_servers.md
• Add support for prepend operator ^=. See "man unlang" for for details.
• Added rlm_totp, for use with the Google Authenticator app. See mods-available/totp.
• The default minimum TLS version is now TLS 1.2, as per RFC 8996. Older versions can be allowed by setting tls_min_version, and updating cipher_list.
• Significantly improve the readability and contents of TLS debug messages.
• Allow CoA and Disconnect messages over TLS sockets. Fixes #3356.
• Automatically set fragment size / MTU, so that PEAP/EAP-TLS works, and no longer requires manual changes to the configuration.
• Allow configurable_client_cert=yes for EAP-TLS. This should only be used for a "walled garden". See mods-available/eap
• Add TLS 1.2 support for EAP-Fast. Patches from Alex Clouter.
• Add ca_path_reload_interval option for TLS. See mods-available/eap. Fixes #1831. Patch from Boris Lytochkin.
• Abfab-tls updates from Alejandro Perez.
• Add tls_min_version to ldap module configuration.
• We now support running policies when receiving a RadSec connection. See sites-available/default, "New-TLS-Connection".
• Update TLS "ecdh_curve" code to allow for multiple curves.
• Allow delta CRLs. Fixes #3393.
• add rlm_sql_map, which can handle multiple columns from an SQL query. See raddb/mods-available/sql_map.
• New xlat for setting status of rlm_always instances and new resource-check example virtual server for manipulating control flow in unlang policies based on status of some external resource. Patches from Terry Burton.
• Update radmin to show more information about the home servers using show home_server list all.
• The default configuration now replies with EAP-Key-Name, if it is available, and was requested.
• Include extensions in generated certificates.
• Ignore user-provided dhparams in FIPS mode. Patch from Alexander Scheel.
• Remove native support for Cisco LEAP. It is insecure, and should not be used. Proxying LEAP is still supported.
• Allow use of password preparation methods with rlm_eap_pwd. Patch from Michael Braun.
• Many, many, improvements for DHCP from Nick Porter and Terry Burton.
• More RFC compliance for various corner cases of DHCP,
• Use DHCP-specific schemas.
• Add stored procedures for DHCP lease allocation
• Add support for DHCP-Decline.
• Added mods-available/dhcp_sql which is a DHCP-specific instance of the SQL module.
• Treat DHCP Discover and Request differently for lease allocation times.
• Add support for PBKDF2 keys. Fixes #2649
• Update dictionary.mikrotik, dictionary.aruba, dictionary.paloalto, dictionary.juniper, dictionary.bskyb (#3339), dictionary.alcatel.sr (#3495).
• Update default PostgreSQL schema to use "text" instead of a fixed-size "varchar".
• Add radmin command show client list verbose, which gives a lot more information about each client.
• Add support for EAPS-AKA authentication to rlm_wimax. Fixes #3801. Patches from Benjamin Thompson.
• Add rlm_rest support for HTTP/2.
• Add REST-HTTP-Status-Code attribute holding HTTP status code.
• Add option to set http_negotiation in rlm_rest. Fixes #2821.
• Encode / decode NAS-Filter-Rule according to RFC 4849. Inside of FreeRADIUS, each NAS-Filter-Rule just looks like a string. But "on the wire", it follows RFC 4849. See src/tests/unit/rfc4849.txt
• Allow attributes using old names in configuration files, SQL, or modules to match attributes in the packet which use new names.
• Allow querying IPv6 stats via FreeRADIUS-Stats-Client-IPv6-Address and FreeRADIUS-Stats-Server-IPv6-Address
• Add warnings if there is no "real" User-Name to identify users.
• Add sample configuration to update Stripped-User-Name and/or Class for user sessions. See sites-available/default
• Add configuration to suppress printing values for User-Name, etc. See radiusd.conf, "suppress_secrets"
• Support dictionary.telrad, which is also in WiMAX format.
• PEAP proxy_tunneled_request_as_eap is now configurable at runtime with Proxy-Tunneled-Request-As-EAP.
• Debug output now lists client/server proposed TLS ciphers.
• Add support for TLS1.3, patches from Alexander Clouter

Bug fixes

• Fix long-term double free due to PCRE calling our "free" function twice. Fixes #1967, #3188, #3868.
• Respect the log_reject configuration item in more places. Fixes #3352. This lowers the number of "Login incorrect" messages when "log_reject = no".
• Fix rpmbuild for CentOS > 6. Patch from Matthew Newton.
• Run Post-Proxy-Type Fail... when all home servers are down.
• Note that rlm_replicate can only use UDP, and not TCP or TLS.
• DHCP pool lookup is now keyed by Client Identifier (Option 61) when supplied by client, otherwise the hardware address is used. Compliant with RFC 2132. This change will not affect existing systems on upgrade, but new installations will use the new behavior. Patch from Terry Burton.
• Fix minor spelling mistakes in man pages. Patch from Alexander Scheel.
• Don't print invalid tags in rlm_cache, among other places. Fixes #3491
• Do home_server failover immediately when an initial TCP / Radsec connection fails.
• Port EAP-PWD constant time fixes from "master" branch. The issue was verified by Mohamed Sabt, and a patch supplied by Daniel De Almeida Braga.
• Clear error on SQLITE_BUSY to prevent memory leak in corner cases. Patch from Nick Porter.
• Properly add SQL clients to virtual servers.
• Update documentation for cert generation. Patch from Alexander Scheel.
• Use better API when decoding DHCP packets, to avoid unnecessary work. This improves performance noticeably.
• Parse locale-dependent dates. Fixes #3602.
• Strip out -frecord-gcc-switches from rlm_python3 configure build. Fixes #3693
• Fix radiusd.conf ENV LD_PRELOAD function.
• Update the "sql" module so that it uses fewer handles for group selection, which means that it is less likely to complain that the connection pool is exhausted.
• Update the "sql" module to return "ok" when no rows have been updated for accounting on/off.
• Make the "date" module handle UTC more consistently.
• Check for, and complain about, inconsistent use of tls_min_version versus disable_tlsv1
• Fix "read client from SQL" code so that it properly ties clients to a virtual server. Also document the behavior.
• Update / correct data types in dictionary.wimax
• Fix edge case in rlm_rest post decoder which could lead to the value of a post attribute being lost in the case where the output buffer was completely full after writing an attribute value, and more attributes needed to be encoded. Reported by Adrian Smith.
• Fix leak with unknown attributes in detail reader. Fixes #3937.
• Fix parenting issues in rlm_yubikey. Fixes #4012.
• Update Mongo examples to be correct.

Notices

• CentOS 6, Debian 8 (Jessie) and Ubuntu 14 (Trusty) are EOL and no longer supported. Docker files have been removed.

3.0.21

Feature improvements

• New stored procedure for allocating IPs with PostgreSQL. Rates of 1500 IPs per second are now possible. See raddb/mods-config/sql/ippool/postgresql/procedure.sql Patch from Terry Burton.
• Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ Patch from Terry Burton.
• Added RCNTEC dictionary. Closes #3168.
• Added Pica8 dictionary. Closes #3179.
• Add TLS-Client-Cert-Valid-Since attribute holding notBefore date. Patch from Boris Lytochkin. Fixes #3157.
• Generate attributes containing unknown OIDs. See raddb/sites-available/tls. Patch from Boris Lytochkin.
• Update the WiMAX dictionary.
• Added ability to rlm_python (Python2) show a stacktrace from errors. #2979
• Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions Patch from Stefan Winter.
• radmin now shows coa stats, too.
• Sample schema extensions for summarizing data in SQL. See mods-config/sql/main/*/process-radacct.sql Many patches from Terry Burton.
• Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx
• Added VAS Experts dictionary.
• Many updates to RPM and jenkins builds from Matthew Newton
• Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch.
• Add reload capability to systemd unit file in Debian and RedHat.
• Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. Patches from Terry Burton.
• Option to set dictionary path in raduat script. Patch from Terry Burton.

Bug fixes

• Various fixes found by PVS-Studio.
• Set permissions of certificates in bootstrap shell script. Fixes #3132.
• Increase the nasportid SQL field for varchar(32). #3141
• Skip processing proxy reply if there are no home servers available.
• Update SQLite IPPool queries. Fixes #3177. Patch from Terry Burton.
• rlm_sql_unixodbc fixes. Patches from Terry Burton. Fixes #2822
• Fixes when building with LibreSSL. Patch from Nathan Owens.
• Fix the rlm_python3 build. Note that this module is experimental. #3183
• The rlm_python should append the python_path paths in sys.path, It fixes the expected behaviour to use the existing Python modules. Fixes #3180
• Fix rlm_python to print the script errors properly.
• Bound total query time for PostgreSQL. Fixes #3253
• Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270.
• Reference sqlippool by it's correct name. Fixes #3272
• Revert 3.0.20 patch which caused crashes on duplicate clients.
• Update WiMAX-MSK attribute. Fixes #3280.
• Fix crash when trying to access non-existant regex capture group.
• Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. Patches from Terry Burton.