[PATCH] Support for Protocol-Error

Alan DeKok aland at deployingradius.com
Thu Nov 6 07:04:22 PST 2025


  This is a series of tiny patches which adds Protocol-Error support to hostap.  This is a RADIUS packet type which is defined in RFC7930.  It is allowed as a response to any request packet.

  The RADEXT working group at the IETF is updating the Protocol-Error specification with more explanations as to how it's used in a RADIUS environment.  The intent is that it is a "hop by hop" signal which indicates that the server received the request from the client, but cannot process it.

  The patches add Protocol-Error support to hostap, and treat it largely as an Access-Reject.  The main benefit is that the RADIUS client will now accept Protocol-Error as a valid response, and will stop retransmitting the request.

  This change allows hostap to accept Protocol-Error as a valid response for Access-Request.  I've also updated eapol_test.

   I did not update the accounting code to support Protocol-Error.  Doing that would involve more work.  The code would have to accept Protocol-Error as a valid response, but also check the Error-Cause attribute contained in it.  If the Error-Cause indicates a temporary failure, the Accounting-Request packet can eventually be retransmitted.  If the Error-Cause indicates a permanent failure, then hostap has to stop sending Accounting-Request packets for that session.

  Alan DeKok.




More information about the Hostap mailing list