radius

Configures RADIUS dictionary within the dictionary block.

Example configuration

One or more filename entries can be specified. When multiple files are specified, they are loaded in the order listed and merged together. If no dictionary is specified there will not be a dictionary. There is no automatic loading of default dictionary.

Single dictionary file:

radius {
    filename "dictionary/dictionary";
}

Multiple dictionary files:

radius {
    filename "/opt/radiator/server/dictionary";
    filename "/etc/radiator/conf.d/dictionary.vendor";
    filename "/etc/radiator/conf.d/dictionary.custom";
}

Dictionary File Format

The RADIUS dictionary is an ASCII text file where each definition occupies one line. A hash mark # marks the beginning of a comment. Comment and blank lines are ignored.

Example dictionary file content:

# Standard RADIUS attributes
ATTRIBUTE User-Name           1  string
ATTRIBUTE User-Password       2  binary encrypt=1
ATTRIBUTE NAS-IP-Address      4  ipaddr
ATTRIBUTE Service-Type        6  integer
ATTRIBUTE Framed-IP-Address   8  ipaddr

# Attribute values
VALUE Service-Type Login-User          1
VALUE Service-Type Framed-User         2
VALUE Service-Type Administrative-User 6

# Vendor-specific attributes
VENDOR Cisco 9

VENDORATTR 9 Cisco-AVPair 1 string

Supported Data Types

The following data types are supported for attribute definitions:

Integer Types:

• boolean - One-octet boolean
• byte / integer8 - Unsigned 8-bit integer
• short / integer16 - Unsigned 16-bit integer
• integer - Unsigned 32-bit integer
• signed / signed-integer - Signed 32-bit integer
• integer64 - 64-bit integer
• uint32 - Unsigned 32-bit integer (alias for integer)
• uint64 - Unsigned 64-bit integer (alias for integer64)
• enum - Enumerated 32-bit integer (with VALUE definitions)

String and Binary Types:

• string - Variable-length UTF-8 string
• string[N] - Fixed-length string (N bytes)
• binary - Binary data
• octets - Binary octets
• octets[N] - Fixed-length binary (N bytes)
• abinary - Ascend binary wire format
• hexadecimal - Hexadecimal text converted to and from wire octets

Network Address Types:

• ipaddr - IPv4 address
• combo-ip / ipaddrv4v6 - Length-dependent IPv4 or IPv6 address
• ipv4prefix - IPv4 prefix (address/mask)
• ipv6addr - IPv6 address
• ipv6prefix - IPv6 prefix
• ifid - Interface identifier (64-bit)
• ether - Ethernet MAC address

Time Types:

• date - Unix timestamp (seconds since 1970-01-01 00:00:00 GMT)
• time_delta - Unsigned 32-bit time interval

Structure Types:

• tlv - Nested Type-Length-Value container with named child access
• vsa - Vendor-Specific Attribute
• evs - Extended-Vendor-Specific
• struct - Structured wire data retained byte-exactly

Tagged Types:

• tagged-integer - Integer with RFC 2868 tag field
• tagged-string - String with RFC 2868 tag field
• tagged-enum - Enumerated value with RFC 2868 tag field

Other:

• group - Group wire data retained byte-exactly

Attribute Flags

Attributes can have optional flags specified as a comma-separated list after the data type. These flags modify how the attribute is processed:

Encryption Flags:

• encrypt=1 - User-Password style encryption (RFC 2865)
• encrypt=2 - Tunnel-Password style encryption (RFC 2868)
• encrypt=3 - Ascend-Send-Secret style encryption

Processing Flags:

• array - Multiple values are packed into one attribute
• concat - Multiple attributes should be concatenated together
• has_tag - Attribute can have an RFC 2868 style tag
• virtual - Attribute is server-internal and special

Extended Attribute Flags:

• extended - Extended attribute type
• long-extended - Long extended attribute type

Binary Format:

• abinary - Ascend binary format

Example with flags:

ATTRIBUTE User-Password 2 binary encrypt=1
ATTRIBUTE Tunnel-Password 69 string has_tag,encrypt=2
ATTRIBUTE Custom-Array-Attr 100 integer array

RFC 6929 Extended Attributes

Use a two-part numeric type path to define an RFC 6929 Extended or Long-Extended attribute. The first number selects the outer attribute type. The second number selects the Extended-Type within that space.

# Extended-Type-1, Extended-Type 10
ATTRIBUTE Example-Extended 241.10 string

# Long-Extended-Type-1, Extended-Type 20
ATTRIBUTE Example-Long-Extended 245.20 octets

Use outer types 241 through 244 for Extended attributes. Use outer types 245 and 246 for Long-Extended attributes. The Extended-Type must be from 1 through 240. Value 0 is invalid, and RFC 6929 reserves values 241 through 255.

The path must contain exactly the outer type and Extended-Type. For example, 241.10.1 is not supported. An undotted type such as 241 names only the outer container and does not define an Extended-Type value.

Do not use tagged data types or the has_tag flag with RFC 6929 Extended attributes. Extended and Long-Extended attributes do not carry an RFC 2868 Tunnel-Tag octet.

Practical Usage Example

The dictionary enables you to reference RADIUS attributes and their values by name in your configuration. Radiator uses the dictionary definition to locate and decode each attribute.

Dictionary definitions:

ATTRIBUTE Service-Type 6 integer
VALUE Service-Type Login-User 1
VALUE Service-Type Framed-User 2

Use two dots followed by a numeric attribute type to inspect an attribute when its dictionary name is not available. Numeric access performs best-effort decoding: Radiator uses a matching dictionary definition when possible and otherwise preserves the value as bytes. String and JSON output format these bytes as hexadecimal text.

log "AUTH" {
    json {
        # Outputs 2 with the definition above, or "00000002" without it.
        "service-type-by-number" radius.request.attr..6;
    }
}

Numeric attribute access is read-only. Use the dictionary name to modify an attribute or translate an enumerated value to its dictionary name. One dot always selects a dictionary name, even when that name contains only digits. For example, radius.request.attr.6 selects an attribute named 6.

log "AUTH" {
    json {
        "service-type" radius.request.attr.Service-Type;           # 2 (numeric value)
        "service-type-name" "%{radius.request.attr.Service-Type}"; # "Framed-User" (translated)
        "service-type-value" radius.dict.Service-Type.Framed-User; # 2 (constant lookup)
    }
}

The dictionary provides:

• Numeric decoding: Decode radius.request.attr..6 using the definition for attribute type 6
• Name-based access: Use Service-Type instead of memorizing number 6
• Value translation: Use format strings "%{...}" to convert numeric values to readable strings like "Framed-User"
• Constants: Access enumeration values as constants (radius.dict.Service-Type.Framed-User = 2)

Without a matching dictionary definition, numeric access returns the raw value bytes. Dictionary names are especially useful for vendor-specific attributes, where numeric identifiers and wire formats can be difficult to interpret.

FreeRADIUS Dictionary Format Support

Radiator supports FreeRADIUS dictionary format, allowing you to use FreeRADIUS dictionary files directly. The file parser is format-agnostic and just parses whatever dictionary syntax it finds. Supported features include:

• ATTRIBUTE - Define standard attributes
• VALUE - Define enumeration values for attributes
• VENDOR - Define vendor identifiers
• VENDORATTR - Define vendor-specific attributes
• BEGIN-VENDOR / END-VENDOR - Vendor attribute blocks
• BEGIN-TLV / END-TLV - Type-Length-Value structured attributes
• $INCLUDE - Include other dictionary files (processed inline)
• Various vendor formats: format=1,1, format=2,1, format=2,2, format=4,0, format=1,1,c
• Attribute flags: encrypt=1, encrypt=2, encrypt=3, has_tag, array, concat

Not currently supported:

• ALIAS - Attribute aliasing (parsed but ignored)
• STRUCT / MEMBER - Named member declarations are parsed but are not expanded; an ATTRIBUTE with the struct data type remains available byte-exactly
• PROTOCOL / BEGIN-PROTOCOL / END-PROTOCOL - Protocol namespace blocks (parsed but ignored)
• $INCLUDE-DIR - Directory inclusion