1 FreeRADIUS 2.2.5 Wednesday 19 Mar 2014 13:20:00 EDT, urgency=medium
3 * Update dictionary.terena.
4 * expose server version via %v. Patch from Alan Buxey.
5 * Forbid running with vulnerable versions of OpenSSL.
6 See "allow_vulnerable_openssl" in the "security"
7 subsection of "radiusd.conf"
8 * Catch underlying "heartbleed" problem, so that nothing bad
9 happens even when using a vulnerable version of OpenSSL.
12 * Minor changes to build on Sun.
13 * Print non-ASCII characters as octal in linelog. Closes #578
14 * close stdout in daemon mode.
15 * Fix zombie period calculation. Closes #579
17 FreeRADIUS 2.2.4 Wednesday 19 Mar 2014 13:20:00 EDT, urgency=medium
19 * A "panic_action" can be set to have the server dump a gdb
20 log on SEGV or other fatal error.
21 * allow radmin command "set module status <module> <code>"
22 which can be used to forcibly enable/disable modules.
25 * If the server fails to bind() after fork(), that is now
26 reported to the parent, which exits with an error.
27 * Session / delay times in MySQL are unsigned int.
28 * Use --tag=CC for libtool. Closes #497. Because libtool
29 is too stupid to notice that compiling means compilation.
30 * Fix bug when copying attributes for vendors > 32767
31 * Fix behaviour on FreeBSD where sending packets from an interface
32 bound to an IP address would fail when the server was built with
34 * Don't fail config check if were listening on an IP which is
35 also a home server. Some deployments have valid reasons
36 to loop packets back to another virtual server.
37 * Use correct port when DHCP relaying.
38 * Set source IP address for DHCP packets from DHCP-Server-IP-Address,
39 or DHCP-DHCP-Server-Identifier, if we're unable to otherwise
40 determine the source IP.
42 FreeRADIUS 2.2.3 Wednesday 11 Dec 2013 15:00:00 EST, urgency=medium
44 * Added dictionary.efficientip, dictionary.alcatel-lucent-aaa
45 * Allow zero length DN strings in rlm_ldap.
46 * If Password-With-Header has no header, assume it is
50 * Make the server build when DHCP is enabled
51 * Don't crash if there's no Post-Proxy-Type Reject.
52 * Use correct fields for X509 attributes in certificates
53 * Install threads.h making it possible to link against the
54 installed headers again.
55 * Initialize SSL once in "main", instead of rlm_eap_tls.
56 Some client libraries may need SSL.
58 FreeRADIUS 2.2.2 Wednesday 30 Oct 2013 9:30:00 DST, urgency=medium
60 * Add "timeout" to exec, and "ntlm_auth_timeout" to mschap.
61 So that run-away child processes are caught earlier.
62 * Print out thread number for "unresponsive child".
65 * Fix erroneous fall-through in "case" statements
66 * Fix priority handling in new module handling code
67 * Fix threading issue with Perl. Closes #436
68 * Fix EAP-TLS check_cert_issuer when X509v2 extensions
69 existed. Patch from David Wood.
70 * Fix pointer references in rlm_python.
71 * Fix "unresponsive child" issue when proxying.
72 * Set log output correctly when using -l.
73 Fix ported from 3.0.0.
74 * Buffer debug output when threaded, so that text from
75 different threads isn't interspersed.
76 * Fix SEGV in rlm_perl when using dynamic expansions.
77 * Fix build for OSX Mavericks, which hid the header files
79 * Port DHCP fixes from 3.0.
81 FreeRADIUS 2.2.1 Tuesday 17 Sep 2013 12:00:00 CEST, urgency=medium
83 * Updated dictionaries for alcatel, broadsoft, bskyb, dlink, meru,
84 telkom, trapeze, proxim, zeus, rfc6677, 6911, and rfc6930.
85 * Added %{randstr:..} support. Creates random strings in a
87 * Added operator support to rlm_python
88 * Added %{hex:...} for hex version of raw attribute data
89 * Added %{sha1:...} for SHA1 hashing of data
90 * Added %{base64:...} for raw attribute data (e.g. 32-bit IP addr),
91 and %{tobase64:...} for the printable string form (e.g. 1.2.3.4),
92 and %{base64tohex:...} to convert a base64 string to a hex string.
93 * rlm_expr is now responsible for registering many of the xlat
94 expansions. This is cleaner than bundling them all in the server
95 core. You should ensure 'expr' is listed in instantiate to ensure
96 correct operation of xlat expansions.
97 * Use correct terminology when printing errors regarding request/
98 response/message authenticators.
99 * Added keytab support to Heimdal Kerberos. Patch from Ryan Steinmetz.
100 * radsqlrelay does multiple INSERTs in one transaction.
101 Patch from Uwe Meyer-Gruhl.
102 * Run Post-Proxy-Type Reject {} if the upstream server rejected the
104 * On startup, the server checks if it was linked with the correct
105 OpenSSL libraries. If not, it errors out. This prevents later
106 crashes in OpenSSL, due to library incompatibilities.
107 * Added radmin command "hup main.log", to re-open the log files,
108 without HUPing any other part of the server.
109 * Added support for EAP-Key-Name. See raddb/sites-available/default,
110 and look for comments mentioning EAP-Key-Name. MacSec now works.
111 * Added support for hex numbers (0x...) to %{expr: ...}
112 * Backported TLS client certificate validation from 3.0.0.
113 * Run Post-Auth for EAP inner-tunnel methods.
115 * Added "show config <path>" to radmin. You can now examine any
116 configuration item in a running server.
117 * Added TLS-Client-Cert-X509v3-Extended-Key-Usage for TLS-based EAP
118 methods. It is set automatically from the fields in the certificate.
119 * Add CRLCP attribute in certificate creation script. Windows phones
120 require it. Patch from Alan Buxey.
123 * Skip OCSP if there's no host / port / url, with soft_fail
124 * Properly decode AT_IDENTITY in EAP-SIM. Patch from Iliya Peregoudov
125 * Thread max_queue_size has better bounds checking.
126 * Use correct variable for warning message if the user misconfigures
128 * radtest is more generous about parsing ppphint
129 * radeapclient now accepts -4 and -6, just like radclient.
130 Patch from John Dennis.
131 * Ignore ".rpmnew" and a bunch of other files when loading config
132 files from a directory.
133 * Wait for child threads before exiting. This prevents errors on
134 exit, but may increase exit time if databases are blocked!
135 Patch from Iliya Peregoudov.
136 * Wrap rbtree calls in mutexes in rlm_cache to prevent memory
137 corruption. Patch from Phil Mayers.
138 * Port fix for %{3GPP-*} expansion from master branch.
139 * Fix sample certificate scripts when multiple client certs are
141 * Track return code priorities across if/else/elsif in unlang.
143 * In debug mode, print out DHCP options when sending a DHCP packet.
144 * Fixes to the redis modules from Brian Candler
145 * Print better debug message for LDAP "operations error"
146 * Fix a number of minor issues as found by Coverity
147 * Frees module config in order to prevent occasional crash on exit
148 * Update DHCP debugging messages to make it clearer what's
150 * Print multiple DHCP options the correct number of times in
152 * On debug builds, don't dlclose() modules when '-m' is used.
153 This allows valgrind to show module symbols.
154 * Don't count Status-Server packets in Access-Request statistics
155 * Minor cleanups to debug output
156 * Be more careful handling module configurations to avoid crash
157 on otherwise clean exit.
158 * For raddebug, correctly set the group of the output file.
159 * renamed dhclient to dhcpclient. People who install it
160 shouldn't have their systems broken.
161 * for EAP-TLS methods, random_file is no longer required.
162 OpenSSL already reads /dev/urandom.
163 * Fix Suse and Redhat scripts. Patches from Fajar Nugraha.
164 * Minor bug fix for base64 decoding.
165 * Allow two consecutive WiMAX TLVs of the same number.
166 * Remove requirement that User-Name has to match MS-CHAP-User-Name.
167 I18n issues means that the character sets could be different.
168 * Don't use ephemeral thread states from PyGILState_Ensure(), use
169 our own, generated one per thread and stored in TLS.
170 * Port module processing fixes from v3. The code is simpler,
171 and one or two esoteric bugs are now gone.
172 * update code handling max_requests_per_server. It should now
174 * wrap ASCTIME_R for systems not supporting the standard API.
176 FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium
178 * 100% configuration file compatible with 2.1.x.
179 The only fix needed is to disallow "hashsize=0" for rlm_passwd
180 * Update Aruba, Alcatel Lucent, APC, BT, PaloAlto, Pureware,
181 Redback, and Mikrotik dictionaries
182 * Switch to using SHA1 for certificate digests instead of MD5.
183 See raddb/certs/*.cnf
184 * Added copyright statements to the dictionaries, so that we know
185 when people are using them.
186 * Better documentation for radrelay and detail file writer.
187 See raddb/modules/radrelay and raddb/radrelay.conf
188 * Added TLS-Cert-Subject-Alt-Name-Email from patch by Luke Howard
189 * Added -F <file> to radwho
190 * Added query timeouts to MySQL driver. Patch from Brian De Wolf.
191 * Add /etc/default/freeradius to debian package.
192 Patch from Matthew Newton
193 * Finalize DHCP and DHCP relay code. It should now work everywhere.
194 See raddb/sites-available/dhcp, src_ipaddr and src_interface.
195 * DHCP capabilitiies are now compiled in by default.
196 It runs as a DHCP server ONLY when manually enabled.
197 * Added one letter expansions: %G - request minute and %I request
199 * Added script to convert ISC DHCP lease files to SQL pools.
200 See scripts/isc2ippool.pl
201 * Added rlm_cache to cache arbitrary attributes.
202 * Added max_use to rlm_ldap to force connection to be re-established
203 after a given number of queries.
204 * Added configtest option to Debian init scripts, and automatic
205 config test on restart.
206 * Added cache config item to rlm_krb5. When set to "no" ticket
207 caching is disabled which may increase performance.
210 * Fix CVE-2012-3547. All users of 2.1.10, 2.1.11, 2.1.12,
211 and 802.1X should upgrade immediately.
212 * Fix typo in detail file writer, to skip writing if the packet
213 was read from this detail file.
214 * Free cached replies when closing resumed SSL sessions.
215 * Fix a number of issues found by Coverity.
216 * Fix memory leak and race condition in the EAP-TLS session cache.
217 Thanks to Phil Mayers for tracking down OpenSSL APIs.
218 * Restrict ATTRIBUTE names to character sets that make sense.
219 * Fix EAP-TLS session Id length so that OpenSSL doesn't get
221 * Fix SQL IPPool logic for non-timer attributes. Closes bug #181
222 * Change some informational messages to DEBUG rather than error.
223 * Portability fixes for FreeBSD. Closes bug #177
224 * A much better fix for the _lt__PROGRAM__LTX_preloaded_symbols
226 * Safely handle extremely long lines in conf file variable expansion
227 * Fix for Debian bug #606450
228 * Mutex lock around rlm_perl Clone routines. Patch from Eike Dehling
229 * The passwd module no longer permits "hashsize = 0". Setting that
230 is pointless for a host of reasons. It will also break the server.
231 * Fix proxied inner-tunnel packets sometimes having zero authentication
232 vector. Found by Brian Julin.
233 * Added $(EXEEXT) to Makefiles for portability. Closes bug #188.
234 * Fix minor build issue which would cause rlm_eap to be built twice.
235 * When using "status_check=request" for a home server, the username
236 and password must be specified, or the server will not start.
237 * EAP-SIM now calculates keys from the SIM identity, not from the
238 EAP-Identity. Changing the EAP type via NAK may result in
239 identities changing. Bug reported by Microsoft EAP team.
240 * Use home server src_ipaddr when sending Status-Server packets
241 * Decrypt encrypted ERX attributes in CoA packets.
242 * Fix registration of internal xlat's so %{mschap:...} doesn't
243 disappear after a HUP.
244 * Can now reference tagged attributes in expansions.
245 e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work.
246 * Correct calculation of Message-Authenticator for CoA and Disconnect
247 replies. Patch from Jouni Malinen
248 * Install rad_counter, for managing rlm_counter files.
249 * Add unique index constraint to all SQL flavours so that alternate
250 queries work correctly.
251 * The TTLS diameter decoder is now more lenient. It ignores
252 unknown attributes, instead of rejecting the TTLS session.
253 * Use "globfree" in detail file reader. Prevents very slow leak.
255 * Operator =~ shouldn't copy the attribute, like :=. It should
256 instead behave more like ==.
257 * Build main Debian package without SQL dependencies
258 * Use max_queue_size in threading code
259 * Update permissions in raddb/sql/postgresql/admin.sql
260 * Added OpenSSL_add_all_algorithms() to fix issues where OpenSSL
261 wouldn't use methods it knew about.
262 * Add more sanity checks in dynamic_clients code so the server won't
263 crash if it attempts to load a badly formated client definition.