Skip to content

Commit ba0d59a

Browse files
marc-casavantmarc-casavant
committed
Merge branch 'master' into multi-server-tests
2 parents 6ef31e8 + 47a0d04 commit ba0d59a

121 files changed

Lines changed: 2597 additions & 277 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎debian/freeradius-config.postinst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ case "$1" in
4949
# install or an upgrade from before there were links; users may
5050
# want to remove them...
5151
if [ -z "$2" ] || dpkg --compare-versions "$2" lt 2.0.4+dfsg-4; then
52-
for site in default inner-tunnel; do
52+
for site in default inner-tunnel proxy; do
5353
if test ! -h /etc/freeradius/sites-enabled/$site && \
5454
test ! -e /etc/freeradius/sites-enabled/$site; then
5555
ln -s ../sites-available/$site /etc/freeradius/sites-enabled/$site

‎doc/antora/modules/developers/nav.adoc‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,15 @@
1515
*** xref:sbuff.adoc[String buffers] (`sbuff` s)
1616
*** xref:sbuff-parsing.adoc[Parsing with string buffers]
1717
*** xref:sbuff-ng.adoc[Sbuff issues]
18+
** xref:rfc/index.adoc[Supported RFCs]
19+
*** xref:rfc/radius.adoc[RADIUS]
20+
**** xref:rfc/design.adoc[Creating new Attributes]
21+
**** xref:rfc/compliance.adoc[Compliance]
22+
**** xref:rfc/radius_attributes.adoc[RADIUS Attribute List]
23+
*** xref:rfc/dhcpv4.adoc[DHCPv4]
24+
*** xref:rfc/dhcpv6.adoc[DHCPv6]
25+
*** xref:rfc/dns.adoc[DNS]
26+
*** xref:rfc/tacacs.adoc[TACACS+]
1827
** xref:guidelines.adoc[Documentation Guidelines]
1928
2029
// Copyright (C) 2025 Network RADIUS SAS. Licenced under CC-by-NC 4.0.

‎doc/antora/modules/developers/pages/rfc/compliance.adoc‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
= RFC Compliance
2+
3+
RFC compliance is critical for ensuring that production systems are
4+
secure, interoperable, and scalable in modern environments. Adhering
5+
to the IETF standards provides a common language for diverse
6+
networking hardware and software to communicate reliably. The
7+
importance of RADIUS RFC compliance centers on four key areas:
8+
9+
== Interoperability in Multi-Vendor Environments
10+
11+
* De Facto Standard: RADIUS is the industry standard for centralizing
12+
Authentication, Authorization, and Accounting (AAA). Compliance
13+
ensures that a RADIUS server can communicate with network access
14+
servers (NAS) like Wi-Fi access points, VPN gateways, and switches
15+
from different manufacturers (e.g., Cisco, Aruba, Fortinet).
16+
17+
* Consistent Behavior: RFCs provide documented, predictable behavior,
18+
reducing unexpected issues when integrating new equipment into an
19+
existing infrastructure.
20+
21+
* Standardized Attributes: Standards like
22+
https://datatracker.ietf.org/doc/html/rfc2865[RFC 2865] and
23+
https://datatracker.ietf.org/doc/html/rfc2868[RFC 2868] define how
24+
user attributes (e.g., VLAN assignments, tunnel protocols) are
25+
formatted, ensuring they are correctly interpreted across the
26+
network.
27+
28+
== Security and Vulnerability Mitigation
29+
30+
* Addressing Cryptographic Weaknesses: Legacy RADIUS (RFC 2865) relies
31+
on MD5 hashing, which is now considered insecure. Recent critical
32+
vulnerabilities like
33+
https://www.inkbridgenetworks.com/blastradius[BlastRADIUS]
34+
(identified in 2024) exploit these MD5 weaknesses to forge
35+
authentication responses.
36+
37+
* Protocol Evolution: Modern compliance often requires moving toward
38+
newer standards like RadSec (RADIUS over TLS, RFC 6614), which
39+
replaces unencrypted UDP transport with encrypted TLS. This protects
40+
sensitive data, such as usernames and location information, from
41+
eavesdropping and tampering.
42+
43+
* Mandatory Integrity Checks: Updated standards mandate features like
44+
the `Message-Authenticator` attribute to prevent packet forgery
45+
attacks that were previously optional.
46+
47+
== Scalability and Reliability
48+
49+
* Centralised Management: Compliance allows organizations to manage
50+
millions of users from a single point, making it suitable for large
51+
ISPs and global enterprises.
52+
53+
* Backward Compatibility: RFC-compliant systems are designed to evolve
54+
while maintaining connections with older infrastructure, allowing
55+
for gradual network upgrades without total system overhauls.
56+
57+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
58+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/design.adoc‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
= Designing and Using Attributes
2+
3+
The standard RADIUS attributes are listed in the
4+
xref:rfc/radius_attributes.adoc[Attribute Definitions] page.
5+
6+
When creating new RADIUS dictionaries or standards, you must follow
7+
the *RADIUS Design Guidelines* document
8+
(https://datatracker.ietf.org/doc/html/rfc6158[RFC 6158]), and the
9+
*Data Types in RADIUS* document
10+
(https://datatracker.ietf.org/doc/html/rfc8044[RFC 8044]).
11+
12+
Unfortunately, the RFCs are imperfect, and they have many issues and
13+
ambiguities. The *Common Remote Authentication Dial In User Service
14+
(RADIUS) Implementation Issues and Suggested Fixes* document
15+
(https://datatracker.ietf.org/doc/html/rfc5080[RFC 5080]), resolves
16+
some of these discrepencies.
17+
18+
However, that document does not cover all the known issues with
19+
RADIUS. The RFCs are unclear in some areas, and does not always
20+
explicitly allowed or forbid behavior. Developers should not assume
21+
something is allowed just because it is not prohibited. Any new
22+
behavior that you invent is likely to conflict with After 20 years of
23+
RADIUS deployments. We recommend that you follow the RFC
24+
specifications closely for the best results. If you're unsure about
25+
the RFCs, follow existing best practices, or ask on the
26+
freeradius-users mailing list.
27+
28+
Additional problems with the RADIUS standards and implementations are listed on the
29+
https://github.com/radext-wg/issues-and-fixes-2/wiki/[IETF RADEXT
30+
Wiki], and in the https://www.freeradius.org/rfc/issues.html[open
31+
issues] page.
32+
33+
== More Information
34+
35+
https://www.inkbridgenetworks.com/blog/blog-10/the-freeradius-auth-type-attribute-103[The FreeRADIUS Auth-Type attribute]
36+
37+
https://www.inkbridgenetworks.com/blog/blog-10/radius-standards-compliance-from-rfc-to-wifi-alliance-135[RADIUS standards compliance: from RFC to WiFi Alliance]
38+
39+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
40+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/dhcpv4.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
= DHCPv4 RFCs
2+
3+
The following is a comprehensive set of tables that list all the
4+
related RFCs. Depending on the section or feature that you are
5+
developing, will determine which documents you need to review.
6+
7+
8+
.Dynamic Host Control Protocol (DHCP)
9+
include::partial$dict_dhcpv4.adoc[]
10+
11+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
12+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/dhcpv6.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
= DHCPv4 RFCs
2+
3+
The following is a comprehensive set of tables that list all the
4+
related RFCs. Depending on the section or feature that you are
5+
developing, will determine which documents you need to review.
6+
7+
.Dynamic Host Control Protocol for IPv6 (DHCPv6)
8+
include::partial$dict_dhcpv6.adoc[]
9+
10+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
11+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/dns.adoc‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
= DNS RFCs
2+
3+
The following is a comprehensive set of tables that list all the
4+
related RFCs. Depending on the section or feature that you are
5+
developing, will determine which documents you need to review.
6+
7+
.Dynamic Name Service (DNS)
8+
include::partial$dict_dns.adoc[]
9+
10+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
11+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/index.adoc‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
= Supported RFCs
2+
3+
FreeRADIUS supports a large number of protocols, and therefore a large
4+
number of standards. This pages documents the RFC compliance of the
5+
server, for each protocol.
6+
7+
* xref:rfc/compliance.adoc[Comments on RFC Compliance]
8+
9+
* xref:rfc/radius.adoc[RADIUS]
10+
** xref:rfc/radius_attributes.adoc[List of Attributes]
11+
** xref:rfc/design.adoc[Designing and creating new attributes]
12+
13+
* xref:rfc/dns.adoc[DNS]
14+
15+
* xref:rfc/dhcpv4.adoc[DHCPv4]
16+
17+
* xref:rfc/dhcpv6.adoc[DHCPv4]
18+
19+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
20+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/radius.adoc‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
= RADIUS RFCs
2+
3+
The following is a comprehensive set of tables that list all the
4+
related RFCs. Depending on the section or feature that you are
5+
developing, will determine which documents you need to review.
6+
7+
.RADIUS
8+
include::partial$dict_dhcpv4.adoc[]
9+
10+
NOTE: More authentication methods are supported, and this list has to be updated.
11+
12+
.Authentication Methods
13+
[options=header, cols="20,~", autowidth]
14+
|====
15+
|RFC |Description
16+
17+
|https://datatracker.ietf.org/doc/html/rfc1994[RFC 1994]
18+
|PPP Challenge Handshake Authentication Protocol (CHAP).
19+
20+
|https://datatracker.ietf.org/doc/html/rfc2285[RFC 2284]
21+
|PPP Extensible Authentication Protocol (EAP)
22+
23+
|https://datatracker.ietf.org/doc/html/rfc2759[RFC 2759]
24+
|Microsoft PPP CHAP Extensions, Version 2.
25+
26+
|https://datatracker.ietf.org/doc/html/rfc3748[RFC 3748]
27+
|Extensible Authentication Protocol (EAP).
28+
29+
|https://datatracker.ietf.org/doc/html/rfc5716[RFC 5716]
30+
|PPP EAP TLS Authentication Protocol.
31+
32+
|https://datatracker.ietf.org/doc/html/rfc9190[RFC 9190]
33+
|EAP-TLS 1.3: Using the Extensible Authentication Protocol with TLS 1.3
34+
35+
|====
36+
37+
NOTE: More SNMP MIBS are supported, and this list has to be updated.
38+
39+
.SNMP Related
40+
[options=header, cols="20,~",autowidth]
41+
|====
42+
43+
|RFC |Description
44+
45+
|https://datatracker.ietf.org/doc/html/rfc1227[RFC 1227] | SNMP MUX Protocol and MIB.
46+
47+
|https://datatracker.ietf.org/doc/html/rfc2169[RFC 2619] | RADIUS Authentication Server MIB.
48+
49+
|https://datatracker.ietf.org/doc/html/rfc2621[RFC 2621] | RADIUS Accounting Server MIB.
50+
51+
|====
52+
53+
.Additional RADIUS related RFCs
54+
[options=header, cols="20,~",autowidth]
55+
|====
56+
| RFC |Description
57+
58+
|https://datatracker.ietf.org/doc/html/rfc6677[RFC 6677] | Channel-Binding Support for Extensible Authentication Protocol (EAP) Methods
59+
60+
|https://datatracker.ietf.org/doc/html/rfc7055[RFC 7055] | A GSS-API Mechanism or the Extensible Authentication Protocol
61+
62+
|https://datatracker.ietf.org/doc/html/rfc7155[RFC 7155] | Diameter Network Access Server Application
63+
64+
|https://datatracker.ietf.org/doc/html/rfc7499[RFC 7499] | Support of Fragmentation of RADIUS Packets
65+
66+
|https://datatracker.ietf.org/doc/html/rfc7930[RFC 7930] | Larger Packets for RADIUS over TCP
67+
68+
|https://datatracker.ietf.org/doc/rfc5080/[RFC 5080] | Common Remote Authentication Dial In User Service (RADIUS) Implementation Issues and Suggested Fixes (information)
69+
70+
|https://datatracker.ietf.org/doc/rfc5997/[RFC 5997] | Use of Status-Server Packets in the Remote Authentication Dial In User Service (RADIUS) Protocol (information)
71+
72+
|https://datatracker.ietf.org/doc/html/rfc6929[RFC 6929] | Remote Authentication Dial In User Service (RADIUS) Protocol Extensions
73+
74+
|https://datatracker.ietf.org/doc/html/rfc8044[RFC 8044] | Data Types in RADIUS
75+
76+
77+
|====
78+
79+
.Unpublished drafts
80+
[options=header, cols="20,~",autowidth]
81+
|====
82+
|Document|Description
83+
84+
|http://tools.ietf.org/wg/eap/draft-funk-eap-ttls-v1-01.txt[draft-funk-eap-ttls]
85+
|EAP Tunneled TLS Authentication Protocol Version 1 (EAP-TTLSv1).
86+
87+
|http://www.freeradius.org/rfc/draft-schulzrinne-sipping-radius-accounting-00.txt[draft-schulzrinne-sipping-radius-accounting]
88+
|RADIUS accounting for SIP servers.
89+
|====
90+
91+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
92+
// This documentation was developed by Network RADIUS SAS.

‎doc/antora/modules/developers/pages/rfc/radius_attributes.adoc‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
= RADIUS Attribute Definitions
2+
3+
This page contains a list of RADIUS attribute definitions, with links
4+
to the relevant standards.
5+
6+
It is critical that all vendors and administrators follow the RFC
7+
definitions of attributes. Standardization enables devices from
8+
different manufacturers to communicate using shared protocols and
9+
frameworks. RFC-compliant systems have consistent behaviour, which
10+
prevents interoperability issues that can cause problems in production
11+
networks.
12+
13+
In addition to interoperability issues, FreeRADIUS depends on the data
14+
types which are defined in
15+
https://datatracker.ietf.org/doc/html/rfc8044[RFC 8044]. Many modules
16+
in the server use specific RFC attributes, and rely on using their
17+
defined data types. Changing the definitions of those attributes in
18+
the dictionaries _will_ cause problems. Since the server needs a
19+
specific definition for these attributes, it will detect edits to the
20+
dictionaries, and refuse to start if the dictionary definitions for
21+
standard attributes have been modified.
22+
23+
RADIUS also has a finite range (1-255) available for standard
24+
attributes. Defining a custom attribute with a number already used by
25+
an RFC can cause a collision. Vendors who need custom attributes
26+
*must* use
27+
https://datatracker.ietf.org/doc/html/rfc6929#section-4[Vendor-Specific]
28+
attributes.
29+
30+
For local site policy, administrators can define local attributes in
31+
the xref:reference:raddb/dictionary.adoc[local dictionary]. These
32+
attributes should use the
33+
xref:reference:dictionary/define.adoc[DEFINE] keyword, which avoids
34+
all issues with assigning attribute numbers. Policies in `unlang` can
35+
also use xref:reference:unlang/local.adoc[local variables]. All of
36+
these local attributes are never sent over the network.
37+
38+
== Attribute RFCs and Definitions
39+
40+
The following tables list the RADIUS attributes which are defined in
41+
the RFCs. Each attribute includes a brief explanation and a direct
42+
link to its definition in the RFCs.
43+
44+
== A
45+
include::partial$a_attributelist.adoc[]
46+
== C
47+
include::partial$c_attributelist.adoc[]
48+
== D
49+
include::partial$d_attributelist.adoc[]
50+
== E
51+
include::partial$e_attributelist.adoc[]
52+
== F
53+
include::partial$f_attributelist.adoc[]
54+
== I
55+
include::partial$i_attributelist.adoc[]
56+
== K
57+
include::partial$k_attributelist.adoc[]
58+
== L
59+
include::partial$l_attributelist.adoc[]
60+
== M
61+
include::partial$m_attributelist.adoc[]
62+
== N
63+
include::partial$n_attributelist.adoc[]
64+
== P
65+
include::partial$p_attributelist.adoc[]
66+
== R
67+
include::partial$r_attributelist.adoc[]
68+
== S
69+
include::partial$s_attributelist.adoc[]
70+
== T
71+
include::partial$t_attributelist.adoc[]
72+
== U
73+
include::partial$u_attributelist.adoc[]
74+
== V
75+
include::partial$v_attributelist.adoc[]
76+
77+
// Copyright (C) 2026 Network RADIUS SAS. Licenced under CC-by-NC 4.0.
78+
// This documentation was developed by Network RADIUS SAS.

0 commit comments

Comments
 (0)
⚡