Is the bundled FreeRADIUS built with --with-radiusv11 (ALPN / RFC 9765)?

[Colin Gordon]

Hello,

Radius Bridge already terminates RADIUS/TLS on tcp/1812, 1813 and 18120. Does the bundled FreeRADIUS also support ALPN, i.e. the RADIUS/1.1 profile from RFC 9765?

Upstream has shipped this since 3.2.3, but only if the server was compiled with ./configure --with-radiusv11. Once built in, it's a forbid / allow / require flag on the listen, client and home_server sections, and it falls back to plain RFC 6614 when the peer doesn't offer it.

Two questions:

1. Is the build compiled with that flag? If so, how do I enable it without editing lib/radiusd.ini, which I assume is replaced on upgrade?

2. If not, could you add it in a future or beta release, exposed per listener and per client? I would be happy to test this functionality.

RFC 9765 keeps the RADIUS packet format but drops the shared secret and all MD5 use, which matters for us under a FIPS-140 crypto policy. Not asking for it on by default — just present and configurable.

Thanks!

[Yoann Traut (RCDevs)]

Hello, 

I don't think our Radius Bridge has been compiled this way. 

I will check that with dev team next week and come back to you. 

Regards