limit_proxy_state

Use limit_proxy_state in a RADIUS client block to require Message-Authenticator when a RADIUS/1.0 Access-Request contains Proxy-State.

clients {
    radius "NAS_CLIENTS" {
        client "NAS" {
            source {
                ip 192.0.2.10;
            }
            secret "shared-secret";
            limit_proxy_state true;
        }
    }
}

The value is a boolean. The default is false for compatibility with clients that send Proxy-State without Message-Authenticator.

When set to true, Radiator rejects a RADIUS/1.0 Access-Request that contains Proxy-State but omits Message-Authenticator. Radiator validates the attribute when present. The setting applies over UDP, TCP, and TLS.

The setting does not apply to Accounting-Request. Its Request Authenticator protects the complete packet, and RFC 2866 permits Proxy-State.

The setting does not apply to RADIUS/1.1. RADIUS/1.1 authenticates the connection with TLS and forbids Message-Authenticator.

An @pre-client pipeline can set radius.client.limit_proxy_state when the client is selected dynamically.

Use require_message_authenticator when every RADIUS/1.0 request from the client must contain the attribute.