[PATCH] Support for Protocol-Error
Alan DeKok
aland at deployingradius.com
Thu Nov 6 07:04:22 PST 2025
This is a series of tiny patches which adds Protocol-Error support to hostap. This is a RADIUS packet type which is defined in RFC7930. It is allowed as a response to any request packet.
The RADEXT working group at the IETF is updating the Protocol-Error specification with more explanations as to how it's used in a RADIUS environment. The intent is that it is a "hop by hop" signal which indicates that the server received the request from the client, but cannot process it.
The patches add Protocol-Error support to hostap, and treat it largely as an Access-Reject. The main benefit is that the RADIUS client will now accept Protocol-Error as a valid response, and will stop retransmitting the request.
This change allows hostap to accept Protocol-Error as a valid response for Access-Request. I've also updated eapol_test.
I did not update the accounting code to support Protocol-Error. Doing that would involve more work. The code would have to accept Protocol-Error as a valid response, but also check the Error-Cause attribute contained in it. If the Error-Cause indicates a temporary failure, the Accounting-Request packet can eventually be retransmitted. If the Error-Cause indicates a permanent failure, then hostap has to stop sending Accounting-Request packets for that session.
Alan DeKok.
More information about the Hostap
mailing list