v1.1.0

Highlights

v1.1.0 adds four new feature areas on top of v1.0.0, all backwards-compatible:

• TLS and DTLS transports (RFC 6614, RFC 7360) — transport.ListenTLS/DialTLS and transport.ListenDTLS/DialDTLS with shared Length-framed read/write helpers. DTLS uses github.com/pion/dtls/v3.
• FreeRADIUS dictionary parser + code generator — dictionary/parser parses $INCLUDE/ATTRIBUTE/VALUE/VENDOR/BEGIN-VENDOR/ALIAS/BEGIN-TLV/BEGIN-ENUM with cycle detection; dictionary/gen and the cmd/dict-gen CLI emit typed Go source (constants + accessor pairs).
• Vendor-Specific Attribute sub-packages — vendors/cisco, vendors/h3c, vendors/juniper, vendors/alcatel, vendors/redback, vendors/microsoft with typed constructors. Microsoft sub-package wires the crypto package's MS-CHAPv2 / Authenticator Response helpers into the RFC 2548 VSA format.
• Runtime dictionary registration — (*Dictionary).RegisterFromDict bridges parsed dictionaries into the runtime registry; dictionary.TypeRaw handles attributes whose wire codec is not implemented.

Security

Upgraded github.com/pion/dtls from v2.2.12 to v3.1.4 to fix GO-2026-4479 / CVE-2026-26014 (AES-GCM nonce leakage). The v2 line is permanently affected; only v3.0.11+/v3.1.1+ have the fix. The vulnerability only affects the new DTLS transport introduced in this release; v1.0.0 did not ship DTLS and is not affected.

Supported RFCs

New in this release: RFC 6614 (RADIUS/TLS), RFC 7360 (RADIUS/DTLS).

Full changelog: https://github.com/wxccs/radius/blob/main/CHANGELOG.md

v1.0.0

First stable release. The public API follows semantic versioning from
this point forward; breaking changes will be reserved for v2.

Supported RFCs

RFC	Title
2865	RADIUS (core authentication)
2866	RADIUS Accounting
2867	Accounting Modifications for Tunnel Protocol Support
2868	RADIUS Attributes for Tunnel Protocol Support
2869	RADIUS Extensions
3162	RADIUS and IPv6
5176	Dynamic Authorization Extensions (CoA/DM)
6613	RADIUS over TCP
6929	RADIUS Protocol Extensions
9445	RADIUS Extensions for DHCP-Configured Services

Highlights

• Packet codec with response authenticator verification (RFC 2865 §3).
• Crypto primitives: User-Password (RFC 2865 §5.2), Tunnel-Password
  (RFC 2868 §3.3), Message-Authenticator HMAC-MD5 (RFC 2869 §5.14).
• Transports: UDP with retransmission and per-attempt timeouts;
  TCP (RFC 6613) with single-attempt semantics.
• High-level Client (client.UDPClient / client.TCPClient) with
  retransmission policy, identifier pool, and Config.Timeout fallback.
• Server with Handler interface, SecretLookup, and per-request
  context.
• RFC 6929 extended attributes: types 241/243/244 (3-byte header)
  and 242 long-extended (4-byte header with More flag, fragmenting up
  to 4111 bytes).
• RFC 2868 tunnel attributes: tag prefix encoding/decoding and
  Tunnel-Password encryption with salt + RA-seeded MD5 chain.
• CLI tool (radius-tool) for client mode (auth/acct/coa/dm) and
  a lightweight test server mode.

Installation

go get github.com/wxccs/radius@v1.0.0

See README for
usage examples.

Test plan

• go test -race ./... — all packages green
• golangci-lint run — 0 issues
• go-licenses check — all deps MIT/BSD-3-Clause/ISC/Apache-2.0
• Coverage: 72.9% total (library code >90%)
• CI: https://github.com/wxccs/radius/actions/runs/28089244403