Feature improvements
- Many new "unlang" documentation files. See
make docsite
and then seebuild/docsite/freeradius-server/*/index.html
- Limited support for dynamic home servers. See
proxy.conf
anddoc/configuration/dynamic_home_servers.md
- Add support for prepend operator
^=
. See "man unlang" for for details. - Added
rlm_totp
, for use with the Google Authenticator app. Seemods-available/totp
. - The default minimum TLS version is now TLS 1.2, as per RFC 8996. Older versions can be allowed by setting
tls_min_version
, and updatingcipher_list
. - Significantly improve the readability and contents of TLS debug messages.
- Allow CoA and Disconnect messages over TLS sockets. Fixes #3356.
- Automatically set fragment size / MTU, so that PEAP/EAP-TLS works, and no longer requires manual changes to the configuration.
- Allow
configurable_client_cert=yes
for EAP-TLS. This should only be used for a "walled garden". Seemods-available/eap
- Add TLS 1.2 support for EAP-Fast. Patches from Alex Clouter.
- Add
ca_path_reload_interval
option for TLS. Seemods-available/eap
. Fixes #1831. Patch from Boris Lytochkin. - Abfab-tls updates from Alejandro Perez.
- Add
tls_min_version
to ldap module configuration. - We now support running policies when receiving a RadSec connection. See
sites-available/default
, "New-TLS-Connection". - Update TLS "ecdh_curve" code to allow for multiple curves.
- Allow delta CRLs. Fixes #3393.
- add
rlm_sql_map
, which can handle multiple columns from an SQL query. Seeraddb/mods-available/sql_map
. - New xlat for setting status of
rlm_always
instances and new resource-check example virtual server for manipulating control flow in unlang policies based on status of some external resource. Patches from Terry Burton. - Update radmin to show more information about the home servers using
show home_server list all
. - The default configuration now replies with EAP-Key-Name, if it is available, and was requested.
- Include extensions in generated certificates.
- Ignore user-provided dhparams in FIPS mode. Patch from Alexander Scheel.
- Remove native support for Cisco LEAP. It is insecure, and should not be used. Proxying LEAP is still supported.
- Allow use of password preparation methods with
rlm_eap_pwd
. Patch from Michael Braun. - Many, many, improvements for DHCP from Nick Porter and Terry Burton.
- More RFC compliance for various corner cases of DHCP,
- Use DHCP-specific schemas.
- Add stored procedures for DHCP lease allocation
- Add support for DHCP-Decline.
- Added mods-available/dhcp_sql which is a DHCP-specific instance of the SQL module.
- Treat DHCP Discover and Request differently for lease allocation times.
- Add support for PBKDF2 keys. Fixes #2649
- Update dictionary.mikrotik, dictionary.aruba, dictionary.paloalto, dictionary.juniper, dictionary.bskyb (#3339), dictionary.alcatel.sr (#3495).
- Update default PostgreSQL schema to use "text" instead of a fixed-size "varchar".
- Add radmin command
show client list verbose
, which gives a lot more information about each client. - Add support for EAPS-AKA authentication to rlm_wimax. Fixes #3801. Patches from Benjamin Thompson.
- Add
rlm_rest
support for HTTP/2. - Add
REST-HTTP-Status-Code
attribute holding HTTP status code. - Add option to set http_negotiation in rlm_rest. Fixes #2821.
- Encode / decode NAS-Filter-Rule according to RFC 4849. Inside of FreeRADIUS, each NAS-Filter-Rule just looks like a string. But "on the wire", it follows RFC 4849. See
src/tests/unit/rfc4849.txt
- Allow attributes using old names in configuration files, SQL, or modules to match attributes in the packet which use new names.
- Allow querying IPv6 stats via
FreeRADIUS-Stats-Client-IPv6-Address
andFreeRADIUS-Stats-Server-IPv6-Address
- Add warnings if there is no "real"
User-Name
to identify users. - Add sample configuration to update
Stripped-User-Name
and/orClass
for user sessions. Seesites-available/default
- Add configuration to suppress printing values for
User-Name
, etc. Seeradiusd.conf
, "suppress_secrets" - Support dictionary.telrad, which is also in WiMAX format.
- PEAP
proxy_tunneled_request_as_eap
is now configurable at runtime withProxy-Tunneled-Request-As-EAP
. - Debug output now lists client/server proposed TLS ciphers.
- Add support for TLS1.3, patches from Alexander Clouter
Bug fixes
- Fix long-term double free due to PCRE calling our "free" function twice. Fixes #1967, #3188, #3868.
- Respect the
log_reject
configuration item in more places. Fixes #3352. This lowers the number of "Login incorrect" messages when "log_reject = no". - Fix rpmbuild for CentOS > 6. Patch from Matthew Newton.
- Run Post-Proxy-Type Fail... when all home servers are down.
- Note that rlm_replicate can only use UDP, and not TCP or TLS.
- DHCP pool lookup is now keyed by Client Identifier (Option 61) when supplied by client, otherwise the hardware address is used. Compliant with RFC 2132. This change will not affect existing systems on upgrade, but new installations will use the new behavior. Patch from Terry Burton.
- Fix minor spelling mistakes in man pages. Patch from Alexander Scheel.
- Don't print invalid tags in
rlm_cache
, among other places. Fixes #3491 - Do home_server failover immediately when an initial TCP / Radsec connection fails.
- Port EAP-PWD constant time fixes from "master" branch. The issue was verified by Mohamed Sabt, and a patch supplied by Daniel De Almeida Braga.
- Clear error on SQLITE_BUSY to prevent memory leak in corner cases. Patch from Nick Porter.
- Properly add SQL clients to virtual servers.
- Update documentation for cert generation. Patch from Alexander Scheel.
- Use better API when decoding DHCP packets, to avoid unnecessary work. This improves performance noticeably.
- Parse locale-dependent dates. Fixes #3602.
- Strip out
-frecord-gcc-switches
from rlm_python3 configure build. Fixes #3693 - Fix radiusd.conf
ENV LD_PRELOAD
function. - Update the "sql" module so that it uses fewer handles for group selection, which means that it is less likely to complain that the connection pool is exhausted.
- Update the "sql" module to return "ok" when no rows have been updated for accounting on/off.
- Make the "date" module handle UTC more consistently.
- Check for, and complain about, inconsistent use of
tls_min_version
versus disable_tlsv1 - Fix "read client from SQL" code so that it properly ties clients to a virtual server. Also document the behavior.
- Update / correct data types in dictionary.wimax
- Fix edge case in
rlm_rest
post decoder which could lead to the value of a post attribute being lost in the case where the output buffer was completely full after writing an attribute value, and more attributes needed to be encoded. Reported by Adrian Smith. - Fix leak with unknown attributes in detail reader. Fixes #3937.
- Fix parenting issues in
rlm_yubikey
. Fixes #4012. - Update Mongo examples to be correct.
Notices
- CentOS 6, Debian 8 (Jessie) and Ubuntu 14 (Trusty) are EOL and no longer supported. Docker files have been removed.