servers.radius.eap-message-validation

eap-message-validation

Controls forwarding of unchanged malformed EAP-Message bytes from an authenticated and correlated backend Access-Accept or Access-Reject.

Configure this parameter in the downstream servers radius block and the upstream backends radius server block. For DNS-SD backends, configure it in backends radius-dns-sd server-template.

The example references an existing client list named RADIUS_CLIENTS.

servers {
    radius "DOWNSTREAM" {
        listen {
            protocol udp;
            ip 0.0.0.0;
            port 1812;
        }
        clients "RADIUS_CLIENTS";
        eap-message-validation warn;
    }
}

backends {
    radius "UPSTREAM" {
        server "radius.example.com" {
            secret "shared-secret";
            eap-message-validation warn;
            connect {
                protocol udp;
                host "radius.example.com";
                port 1812;
            }
        }
    }
}

Allowed values:

• enforce: Reject malformed outgoing EAP. This is the default.
• warn: Permit unchanged malformed terminal EAP with a dedicated structured warning event.
• allow: Permit unchanged malformed terminal EAP without that warning event.

Both endpoints must use warn or allow to permit forwarding.

The aggregate EAP bytes remain unchanged. Radiator Server regenerates hop-specific RADIUS authenticators and Message-Authenticator values for the downstream connection. The warning event follows the configured logging promotion policy.

The exception does not apply to requests, challenges, locally processed EAP, or EAP created or modified by policy. Changing unrelated reply attributes preserves eligibility. Replacing EAP with identical bytes does not restore eligibility. RADIUS framing, packet limits, request correlation, authenticators, Message-Authenticator requirements and TLS verification remain enforced.

This parameter is independent of proxy_unknown_attributes.

See RADIUS proxying for proxy behavior and the warning event for troubleshooting.