Add support for Protocol-Error

aland at deployingradius.com aland at deployingradius.com
Wed Oct 21 07:46:55 PDT 2026


This is a series of small patches which adds Protocol-Error support to
hostap.  Protocol-Error is a RADIUS packet type which is defined in
RFC7930.  It is allowed as a response to any request packet.

Protocol-Error is a "NAK" message which indicates that the server
received the request from the client, but cannot process it.  It
indicates that the client should send the request to another server.

The RADEXT working group at the IETF is updating the Protocol-Error
specification with more explanations as to how it's used in a RADIUS
environment.  The draft has been accepted as a working group document,
so it will be (eventually) published as an RFC.

The patches add Protocol-Error support to hostap, and treats it as an
Access-Reject.  Nothing else is done.  The RADIUS client will now
accept Protocol-Error as a valid response, and will stop
retransmitting the request.  Without the patch, the client will ignore
the Protocol-Error response, and keep sending the request.

eapol_test is also updated.

I did add Protocol-Error support to accounting / CoA / Disconnect
packets.  Doing that would be more work.

For accounting, it would have to check the Error-Cause attribute in
the repsonse.  If the Error-Cause indicates a temporary failure, the
Accounting-Request packet can eventually be retransmitted.  If the
Error-Cause indicates a permanent failure, then hostap has to stop
sending Accounting-Request packets for that session.

Alan DeKok.




More information about the Hostap mailing list