Log message:
*: recursive bump for perl 5.40

Log message:
freeradius: updated to 3.2.4

3.2.4

Configuration changes

Better handle backslashes in strings in the configuration files. If the \ 
configuration items contain backslashes, then behavior may change. However, the \ 
previous behavior didn't work as expected, and therefore is not likely to be \ 
used.
reject_delay no longer applies to proxied packets. All servers should now set \ 
reject_delay = 1 for security and scalability.
%{randstr:...} now returns the requested amount of data, instead of one too many \ 
bytes.

Feature improvements

Preliminary support for TEAP.
Update EAP module pre_proxy checks to make them less restrictive. This prevents \ 
the "middle box" effect from affecting future traffic.
Many fixes and updates for Docker images
Add dpsk module. See mods-available/dpsk
Print out what cause the TLS operations to be made, such as the EAP method name \ 
(peap, ttls, etc), or RADIUS/TLS listen / proxy socket.
Add auto_escape to sample SQL module config
Add 'if not exists' to mysql create table queries.
Update dictionary.aruba; add dictionary.tplink, dictionary.alphion
Allow for encrypt=1 attributes to be longer than 128 characters.
Added radsecret program which generates strong secrets. See the top of the \ 
clients.conf file for more information.
radclient now prints packets as hex when using -xxx.
Added -t timeout to radsniff. It will stop processing packets after seconds.
Support interface = ... on OSX and other *BSD which have IP_BOUND_IF.
The detail module now has a dates_as_integer configuration item. See \ 
mods-available/detail for more information.
Add lookback/lookforward steps and more configuration to totp. See \ 
mods-available/totp.
Add time_since xlat to calculate elapsed time in seconds, milliseconds and \ 
microseconds.
Support "Post-Auth-Type Challenge" in the inner tunnel. Patch from \ 
Alexander Clouter.
Add "proxy_dedup_window". See radiusd.conf.
Document KRB5_CLIENT_KTNAME in the "env" section of radiusd.conf.
Add dedup_key for misbehaving supplicants. See mods-available/eap

Bug fixes

Fix corner case with empty defaults in rlm_files.
When we have multiple attributes of the same name, always use the canonical attribute
Make FreeRADIUS-Server-EMA* attributes work again for home server exponential \ 
moving average statistics.
Don't send the global server stats when asked for client stats. They use the \ 
same attributes, so the result is confusing.
Fix multiple typos in MongoDB query.conf
Add define for illumos.
Add client configuration for TLS PSK.
Permit originate CoA after proxying to an internal virtual server
Use virtual server default when passed -i and -p on the command line.
Fix locking issues with rlm_python3.
The detail file reader will catch bad times in the file, and will not update \ 
Acct-Delay-Time with extreme values.
Fix issue where Message-Authenticator was calculated incorrectly for CoA / \ 
Disconnect ACK and NAK packets.
Update Python thread and error handling.
Fix handling of Session-State when proxying.
Run relevant post-proxy Fail-* section on CoA / Disconnect timeout.
Add limit section to AWS health check configurtion. Fixes 35300.
Use MAX in sqlite queries instead of GREATEST.
Fix typo in Mongo queries.
Fix occasional crash with bad home servers.
Minor bug fixes to the SQL freetds modules.
Fix blocking issue with RADIUS/TLS connection checks.
Fix run-time crash on configuration typos of %{substr ...} instead of %{substr:...}
Fix crash with TLS Status-Server requests.

Log message:
*: recursive bump for perl 5.38

Log message:
freeradius: updated to 3.2.2

Version 3.2.2

FEATURE IMPROVEMENTS

The "configure" process now gives a much clearer report when it's \ 
finished. Patches by Matthew Newton.
Fallback to "uname -n" on missing "hostname".
Export thread details in radmin "stats threads".
Improve queries for processing radacct into periodic usage data Fix from Nick Porter.
Update dictionary.juniper.
Add dictionary.calix.
Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be "octets".
Update documentation for robust-proxy-accounting, and be more aggressive about \ 
sending packets.
Add per-module README.md files in the source.
Add default Visual Studio configuration for developers.
Postgres can now automatically use alternate queries for errors other than \ 
duplicate keys.
%{listen:TLS-PSK-Identity} is now set when using PSK and psk_query This helps \ 
the server track the identity of the client which is connecting.
Include thread stats in Status-Server attributes.
Mark rlm_unbound stable and add to packages. Patches by Nick Porter.
Remove broken/unsupported Dockerfiles for centos8 and debian9.
Ensure Docker containers have stable uid/gid. Patches from Terry Burton.

BUG FIXES

Preliminary support for non-blocking TLS sockets.
Fix support for partial certificate chains after adding reload support.
Fix handling of debug_condition.
Clean up home server states, and re-sync with the dictionaries.
Correct certificate order when creating TLS-* attributes
Update use of isalpha() etc. so broken configurations have less impact on the server.
Outgoing TLS sockets now set SNI correctly from the "hostname" \ 
configuration item.
Support Apple Homebrew on the M1.
Better error messages when %{listen:TLS-...} is used.
Getting statistics via Status-Server can now be done within a virtual server.
Make TTLS+MS-CHAP work with TLS 1.3.
Fix md5 xlat memory leak when using OpenSSL 3. Fix by Terry Burton.

Version 3.2.1

FEATURE IMPROVEMENTS

Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries,.
Add simultaneous-use queries for MS SQL.
Add radmin command for "stats pool <module-name>" Which prints \ 
out statistics about the connection pools.
Client statistics now shows "conflicts", to count conflicting packets.
New optional "lightweight accounting-on/off" strategy. When refreshing \ 
queries.conf you should also add the new nasreload table and corresponding \ 
GRANTs to your DB schema.
Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with Eduroam. \ 
Suggested by Stefan Winter.
Allow auth+acct for TCP sockets, too.
Add rlm_cache_redis. See raddb/mods-available/cache for details.
Allow radmin to look up home servers by name, too.
Ensure that dynamic clients don't create loops on duplicates Reported by Sam Yee.
Removed rlm_sqlhpwippool. There was no documentation, no configuration, and the \ 
module was ~15 years old with no one using it.
Marked rlm_python3 as stable.
Add sigalgs_list. See raddb/mods-available/eap. Patch from Boris Lytochkin.
For rlm_linelog, when opening files in /dev, look at "permissions" to \ 
see whether to open them r/w.
More flexibility for dynamic home servers. See \ 
doc/configuration/dynamic_home_servers.md and raddb/home_servers/README.md.
Allow setting of application_name for PostgreSQL. See mods-available/sql.

BUG FIXES

Correct test for open sessions in radacct for MS SQL.
The linelog module now opens /dev/stdout in "write-only" mode if the \ 
permissions are set to "u+w" (0002).
Various fixes to rlm_unbound from Nick Porter.
PEAP now correctly runs Post-Auth-Type Accept.
Create "TLS-Cert-*" for outbound Radsec, instead of TLS-Client-Cert-*. \ 
See sites-available/tls, and fix_cert_order.
Minor updates and fixes to CI, Dockerfiles and packaging.
Fix rlm_python3 build with python >= 3.10.

Log message:
*: recursive bump for perl 5.36

Log message:
freeradius: updated to 3.0.23

FreeRADIUS 3.0.23

Feature improvements
* Update dictionary.aruba
* Add "set home_server state ... down" in order to mark the
  home server as administratively down.  Use "alive" to bring
  it back to life.
* Add Post-Auth-Type "Client-Lost" which should make it easier
  to log when clients stop responding.
* Add sites-available/totp as an example of how to use TOTP.
* Add %{mschap:Domain-Name}.
* Cache TLS messages in &session-state, for more debugging.
* Notes in eap configuration about TLS 1.0 / TLS 1.1, and setting
  cipher_list = "DEFAULT@SECLEVEL=1"
* Added MANY warning messages about using TLS 1.3 with EAP.
  In short, don't use it.  Microsoft will support it in fall 2021.

Bug fixes
* Fix crash in some cases when home server is down, in debug mode.
* Fix (again) "read clients from SQL" functionality.
* Fix sql_map to return values in more situations.
* Silently ignore LEAP configuration instead of erroring out.

FreeRADIUS 3.0.22

Feature improvements
* Many new "unlang" documentation files.  See "make docsite"
  and then see build/docsite/freeradius-server/*/index.html
* Limited support for dynamic home servers.  See proxy.conf
  and doc/configuration/dynamic_home_servers.md
* Add support for prepend operator ^=.  See "man unlang" for
  for details.
* Added rlm_totp, for use with the Google Authenticator app.
  See mods-available/totp.
* The default minimum TLS version is now TLS 1.2, as per RFC 8996.
  Older versions can be allowed by setting tls_min_version, and
  updating "cipher_list".
* Significantly improve the readability and contents of TLS
  debug messages.
* Allow CoA and Disconnect messages over TLS sockets.
* Automatically set fragment size / MTU, so that PEAP/EAP-TLS
  works, and no longer requires manual changes to the configuration.
* Allow "configurable_client_cert=yes" for EAP-TLS.  This should
  only be used for a "walled garden".  See mods-available/eap
* Add TLS 1.2 support for EAP-Fast.  Patches from Alex Clouter.
* Add ca_path_reload_interval option for tls.  See mods-available/eap.
* Abfab-tls updates from Alejandro Perez.
* Add "tls_min_version" to ldap module configuration.
* We now support running policies when receiving a RadSec connection.
  See sites-available/default, "New-TLS-Connection".
* Update TLS "ecdh_curve" code to allow for multiple curves.
* Allow delta CRLs.
* add rlm_sql_map, which can handle multiple columns from an SQL
  query.  See raddb/mods-available/sql_map.
* New xlat for setting status of rlm_always instances and new
  resource-check example virtual server for manipulating control flow
  in unlang policies based on status of some external resource.
  Patches from Terry Burton.
* Update radmin to show more information about the home servers
  using "show home_server list all".
* The default configuration now replies with EAP-Key-Name, if it
  is available, and was requested.
* Include extensions in generated certificates.
* Ignore user-provided dhparams in FIPS mode.
  Patch from Alexander Scheel.
* Remove native support for Cisco LEAP.  It is insecure, and
  should not be used.  Proxying LEAP is still supported.
* Allow use of password preparation methods with rlm_eap_pwd.
  Patch from Michael Braun.
* Many, many, improvements for DHCP from Nick Porter and Terry Burton.
* More RFC compliance for various corner cases of DHCP,
* Use DHCP-specific schemas.
* Add stored procedures for DHCP lease allocation
* Add support for DHCP-Decline.
* Added mods-available/dhcp_sql which is a DHCP-specific instance
  of the SQL module.
* Treat DHCP Discover and Request differently for lease allocation times.
* Add support for PBKDF2 keys.
* Update dictionary.mikrotik, dictionary.aruba, dictionary.paloalto,
   dictionary.juniper, dictionary.bskyb,
  dictionary.alcatel.sr.
* Update default PostgreSQL schema to use "text" instead of
  a fixed-size "varchar".
* Add radmin command "show client list verbose", which gives a lot
  more information about each client.
* Add support for EAPS-AKA authentication to rlm_wimax.
* Add rlm_rest support for HTTP/2.
* Add REST-HTTP-Status-Code attribute holding HTTP status code.
* Add option to set http_negotiation in rlm_rest.
* Encode / decode NAS-Filter-Rule according to RFC 4849.
  Inside of FreeRADIUS, each NAS-Filter-Rule just looks like
  a string.  But "on the wire", it follows RFC 4849.
  See src/tests/unit/rfc4849.txt
* Allow attributes using old names in configuration files, SQL,
  or modules to match attributes in the packet which use
  new names.
* Allow querying IPv6 stats via FreeRADIUS-Stats-Client-IPv6-Address
  and FreeRADIUS-Stats-Server-IPv6-Address
* Add warnings if there is no "real" User-Name to identify users.
* Add sample configuration to update Stripped-User-Name and/or
  Class for user sessions. See sites-available/default
* Add configuration to suppress printing values for User-Name, etc.
  See radiusd.conf, "suppress_secrets"
* Support dictionary.telrad, which is also in WiMAX format.
* PEAP 'proxy_tunneled_request_as_eap' is now configurable
  at runtime with Proxy-Tunneled-Request-As-EAP.
* Debug output now lists client/server proposed TLS ciphers.
* Add support for TLS1.3, patches from Alexander Clouter

Bug fixes
* Fix long-term double free due to PCRE calling our "free"
  function twice.
* Respect the "log_reject" configuration item in more places.
  This lowers the number of "Login incorrect"
  messages when "log_reject = no".
* Fix rpmbuild for Centos > 6.  Patch from Matthew Newton.
* Run Post-Proxy-Type Fail... when all home servers are down.
* Note that rlm_replicate can only use UDP, and not TCP or TLS.
* DHCP pool lookup is now keyed by Client Identifier (Option 61) when
  supplied by client, otherwise the hardware address is used. Compliant
  with RFC 2132. This change will not affect existing systems on upgrade,
  but new installations will use the new behavior.
  Patch from Terry Burton.
* Fix minor spelling mistakes in man pages.  Patch from
  Alexander Scheel.
* Don't print invalid tags in rlm_cache, among other places.
* Do home_server failover immediately when an initial TCP / Radsec
  connection fails.
* Port EAP-PWD constant time fixes from "master" branch.  The issue
  was verified by Mohamed Sabt, and a patch supplied by
  Daniel De Almeida Braga.
* Clear error on SQLITE_BUSY to prevent memory leak in corner cases.
  Patch from Nick Porter.
* Properly add SQL clients to virtual servers.
* Update documentation for cert generation.  Patch from Alexander Scheel.
* Use better API when decoding DHCP packets, to avoid unnecessary work.
  This improves performance noticeably.
* Parse locale-dependent dates.
* Strip out "-frecord-gcc-switches" from rlm_python3 configure build.
* Fix radiusd.conf ENV LD_PRELOAD function.
* Update the "sql" module so that it uses fewer handles for group \ 
selection,
  which means that it is less likely to complain that the
  connection pool is exhausted.
* Update the "sql" module to return "ok" when no rows have \ 
been updated
  for accounting on/off.
* Make the "date" module handle UTC more consistently.
* Check for, and complain about, inconsistent use of tls_min_version
  versus disable_tlsv1
* Fix "read client from SQL" code so that it properly ties clients
  to a virtual server.  Also document the behavior.
* Update / correct data types in dictionary.wimax
* Fix edge case in rlm_rest post decoder which could lead to the value of
  a post attribute being lost in the case where the output buffer was completely
  full after writing an attribute value, and more attributes needed to be encoded.
  Reported by Adrian Smith.
* Fix leak with unknown attributes in detail reader.
* Fix parenting issues in rlm_yubikey.
* Update Mongo examples to be correct.

Notices
* CentOS 6, Debian 8 (Jessie) and Ubuntu 14 (Trusty) are EOL and no
  longer supported. Docker files have been removed.

Log message:
*: recursive bump for perl 5.34

Log message:
*: bump PKGREVISION for perl-5.32.