No, we're not ready to release v4 yet, sorry. But hopefully soon. The good news is that we're done the major re-architecture. That took much longer than planned, but actual paying work kept getting in the way. That's fine, people need to eat. :) We've made good progress in the last month or so. To the point where it's making significant improvements. This message highlights some good and bad things. First the bad: * RADIUS/TLS (radsec) isn't there. It shouldn't be hard, but we've been working on higher priority things * TTLS / PEAP / FAST / TEAP aren't there. These are harder, but not impossible. Then the good: Many things are much much, much simpler than in v4. * update sections are no longer needed. The debug output will even tell you how to convert update sections to the new syntax! &User-Name = "foo" &NAS-Port = 1 &reply.Reply-Message = "Hello %{User-Name}" * math can be done in-place: &NAS-Port = 5 + 2 &reply.Reply-Message = "Hello " + &User-Name if (&User-Name == "foo" + "bar") ... * we no longer need %{expr:...} to do math. We can just do it in place if necessary! &reply.Reply-Message := "We have 1 + 2 = %{1 + 2}" * the dynamic expansion syntax has changed to be more sane. They look like functions with comma-separated arguments v3: %{md5:foo bar baz} v4: %md5(foo, bar, baz) * The horrible alternation syntax is gone. The new syntax is simpler, and easier to read if there are multiple layers of nesting v3: %{${Stripped-User-Name}:-%{User-Name}} v4: %{&Stripped-User-Name || &User-Name} There are many, many, other fixes and features. TACACS+, DHCPv4 is fully supported. DHCPv6 (!), DNS (!!!!). and even listening to an OpenLDAP replication stream (!!!!!) Alan DeKok.
Hi Alan and all developers I for one am grateful for the hard work you guys have been putting into v4. Thank-you. On 2023/10/02 14:57, Alan DeKok wrote:
No, we're not ready to release v4 yet, sorry. But hopefully soon.
The good news is that we're done the major re-architecture. That took much longer than planned, but actual paying work kept getting in the way. That's fine, people need to eat. :)
We've made good progress in the last month or so. To the point where it's making significant improvements. This message highlights some good and bad things.
First the bad:
* RADIUS/TLS (radsec) isn't there. It shouldn't be hard, but we've been working on higher priority things
* TTLS / PEAP / FAST / TEAP aren't there. These are harder, but not impossible.
Then the good: Many things are much much, much simpler than in v4.
* update sections are no longer needed. The debug output will even tell you how to convert update sections to the new syntax!
&User-Name = "foo" &NAS-Port = 1 &reply.Reply-Message = "Hello %{User-Name}"
* math can be done in-place:
&NAS-Port = 5 + 2 &reply.Reply-Message = "Hello " + &User-Name
if (&User-Name == "foo" + "bar") ...
* we no longer need %{expr:...} to do math. We can just do it in place if necessary!
&reply.Reply-Message := "We have 1 + 2 = %{1 + 2}"
* the dynamic expansion syntax has changed to be more sane. They look like functions with comma-separated arguments
v3: %{md5:foo bar baz}
v4: %md5(foo, bar, baz)
* The horrible alternation syntax is gone. The new syntax is simpler, and easier to read if there are multiple layers of nesting
v3: %{${Stripped-User-Name}:-%{User-Name}}
v4: %{&Stripped-User-Name || &User-Name}
There are many, many, other fixes and features. TACACS+, DHCPv4 is fully supported. DHCPv6 (!), DNS (!!!!). and even listening to an OpenLDAP replication stream (!!!!!)
Alan DeKok.
- List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/users.html
On Oct 2, 2023, at 10:17 AM, Conrad Classen <conrad.classen@gmail.com> wrote:
Hi Alan and all developers
I for one am grateful for the hard work you guys have been putting into v4.
Thanks. The end is definitely in sight. Other fun features: * keyed load-balancing: load-balance &User-Name { module1 module2 ... } * local variables file:///Users/alandekok/git/wrapper/freeradius-server/build/docsite/freeradius-server/4.0.0/reference/unlang/local.html { uint32 foo uint32 bar &foo = 1 &bar = 2 ... } Just so many nice things. v3 was a big jump in features over v2. v4 is almost magic in comparison. Alan DeKok.
On Oct 2, 2023, at 10:35 AM, Alan DeKok <aland@deployingradius.com> wrote:
* local variables file:///Users/alandekok/git/wrapper/freeradius-server/build/docsite/freeradius-server/4.0.0/reference/unlang/local.html
Whoops. Here's a public link: https://freeradius.org/documentation/freeradius-server/4.0.0/reference/unlan... Alan DeKok.
We're eying the ability to launch radius client requests while serving other requests to eliminate the need for looping entire EAP flows through our clearpass servers. Hopefully we can just send accounting plus a simple 2-packet macauth to Clearpass to get policy/posture advice, and clearpass and it's CoA mechanisms will be happy and never know the difference. It's never that simple of course but we look forward to trying it out. ________________________________________ From: Freeradius-Users <freeradius-users-bounces+bjulin=clarku.edu@lists.freeradius.org> on behalf of Alan DeKok <aland@deployingradius.com> Sent: Monday, October 2, 2023 10:35 AM To: FreeRadius users mailing list Subject: [EXT] Re: What's new in v4 On Oct 2, 2023, at 10:17 AM, Conrad Classen <conrad.classen@gmail.com> wrote:
Hi Alan and all developers
I for one am grateful for the hard work you guys have been putting into v4.
Thanks. The end is definitely in sight. Other fun features: * keyed load-balancing: load-balance &User-Name { module1 module2 ... } * local variables file:///Users/alandekok/git/wrapper/freeradius-server/build/docsite/freeradius-server/4.0.0/reference/unlang/local.html { uint32 foo uint32 bar &foo = 1 &bar = 2 ... } Just so many nice things. v3 was a big jump in features over v2. v4 is almost magic in comparison. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Oct 2, 2023, at 11:42 AM, Brian Julin <BJulin@clarku.edu> wrote:
We're eying the ability to launch radius client requests while serving other requests to eliminate the need for looping entire EAP flows through our clearpass servers. Hopefully we can just send accounting plus a simple 2-packet macauth to Clearpass to get policy/posture advice, and clearpass and it's CoA mechanisms will be happy and never know the difference.
You should be able to do that in v3, mostly. But v4 makes it easier. Configure a "radius" module to talk to the Clearpass server. Run the module twice for challenge / response. Maybe 20 lines of "unlang".
It's never that simple of course but we look forward to trying it out.
It's a _lot_ simpler in v4. Alan DeKok.
vale nÄdalat vaatasin a. Sent from my iPhone
On 2. Oct 2023, at 19:34, Alan DeKok <aland@deployingradius.com> wrote:
On Oct 2, 2023, at 11:42 AM, Brian Julin <BJulin@clarku.edu> wrote:
We're eying the ability to launch radius client requests while serving other requests to eliminate the need for looping entire EAP flows through our clearpass servers. Hopefully we can just send accounting plus a simple 2-packet macauth to Clearpass to get policy/posture advice, and clearpass and it's CoA mechanisms will be happy and never know the difference.
You should be able to do that in v3, mostly. But v4 makes it easier.
Configure a "radius" module to talk to the Clearpass server. Run the module twice for challenge / response. Maybe 20 lines of "unlang".
It's never that simple of course but we look forward to trying it out.
It's a _lot_ simpler in v4.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, On Mon, Oct 02, 2023 at 04:17:47PM +0200, Conrad Classen wrote:
Hi Alan and all developers
I for one am grateful for the hard work you guys have been putting into v4.
me too - thanks a lot, guys!
There are many, many, other fixes and features. TACACS+, DHCPv4 is fully supported.
What are the improvements in DHCPv4? I'm looking currently into PXE booting in 3.2.1 to understand the differences to ISC DHCP Server - some attributes used in PXE may be magic. Thanks again and greetings Hermann -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer@iwr.uni-heidelberg.de
On Oct 9, 2023, at 9:28 AM, Hermann Lauer <Hermann.Lauer@uni-heidelberg.de> wrote:
What are the improvements in DHCPv4?'
Mainly that it's no longer a hack pretending to be RADIUS. It's just 100% DHCPv4. Other improvements are that complex structures are now trivial. They're used much more in DHCP than in RADIUS. The server now supports structures in dictionaries (it's not perfect, but it works). It will then automatically decode the structures into attributes. The structures can contain bit fields, too. It all Just Works. https://freeradius.org/documentation/freeradius-server/4.0.0/reference/dicti...
I'm looking currently into PXE booting in 3.2.1 to understand the differences to ISC DHCP Server - some attributes used in PXE may be magic.
Not in v4. Pretty much everything easy. v4 also supports an experimental ISC DHCP module. It will read common (i.e. simple) ISC files to define options, and implement the policies: https://freeradius.org/documentation/freeradius-server/4.0.0/raddb/mods-avai... I did a check against Kea DHCP the other day. FreeRADIUS v4 is 2/3 the size of Kea in code. But it supports more protocols, more databases, it has a real policy language, and it's more configurable. Alan DeKok.
participants (5)
-
Alan DeKok -
Andres Septer -
Brian Julin -
Conrad Classen -
Hermann Lauer