Documentation
¶
Overview ¶
Package radius decodes RADIUS packets per RFC 2865 (auth) + RFC 2866 (accounting) + supporting RFCs. RADIUS is the dominant AAA protocol on enterprise networks — every Wi-Fi 802.1X / WPA2-Enterprise auth, every VPN concentrator, every NAS / RADIUS-PAM / FreeRADIUS deployment speaks it on UDP/1812 (auth) + UDP/1813 (accounting).
Wrap-vs-native judgement ¶
Native. RADIUS has a fixed 20-byte header (Code + Identifier + Length + 16-byte Authenticator) followed by a TLV list of attributes. The ~80 standard attributes are documented in the IANA RADIUS Types registry; values are typed (string, integer, IPv4, time, binary). Pasting a hex blob from Wireshark / tshark / a tcpdump-of-1812-or-1813 capture is enough — no AAA server, no shared secret, no live network attach.
What this package covers ¶
- **20-byte header**: Code (16-entry name table — Access-Request / Access-Accept / Access-Reject / Accounting-Request / Accounting-Response / Access- Challenge / Status-Server / Status-Client / Disconnect- Request / Disconnect-ACK / Disconnect-NAK / CoA- Request / CoA-ACK / CoA-NAK / Reserved), Identifier, Length (validated against buffer), Authenticator (16 bytes, surfaced as hex).
- **Attribute TLV walker**: type (1 byte) + length (1 byte, includes the 2-byte header) + value. Per RFC 2865 §5 value-formats. Length validated against the remaining buffer.
- **~80-entry attribute name table** covering the IANA RADIUS Types registry: User-Name (1), User-Password (2), CHAP-Password (3), NAS-IP-Address (4), NAS-Port (5), Service-Type (6), Framed-Protocol (7), Framed- IP-Address (8), Framed-IP-Netmask (9), Framed-Routing (10), Filter-Id (11), Framed-MTU (12), Framed- Compression (13), Login-IP-Host (14), Login-Service (15), Login-TCP-Port (16), Reply-Message (18), Callback-Number (19), Callback-Id (20), Framed-Route (22), Framed-IPX-Network (23), State (24), Class (25), Vendor-Specific (26), Session-Timeout (27), Idle- Timeout (28), Termination-Action (29), Called-Station- Id (30), Calling-Station-Id (31), NAS-Identifier (32), Proxy-State (33), Login-LAT-Service (34), Login-LAT- Node (35), Login-LAT-Group (36), Framed-AppleTalk-Link (37), Framed-AppleTalk-Network (38), Framed-AppleTalk- Zone (39), Acct-Status-Type (40), Acct-Delay-Time (41), Acct-Input-Octets (42), Acct-Output-Octets (43), Acct- Session-Id (44), Acct-Authentic (45), Acct-Session- Time (46), Acct-Input-Packets (47), Acct-Output- Packets (48), Acct-Terminate-Cause (49), Acct-Multi- Session-Id (50), Acct-Link-Count (51), Acct-Input- Gigawords (52), Acct-Output-Gigawords (53), Event- Timestamp (55), CHAP-Challenge (60), NAS-Port-Type (61), Port-Limit (62), Login-LAT-Port (63), Tunnel-* (64-67, 81-83), ARAP-* (70-73, 84), Acct-Interim- Interval (85), NAS-Port-Id (87), EAP-Message (79), Message-Authenticator (80), Framed-IPv6-Prefix (97), etc.
- **Vendor-Specific (26)** deep decode: vendor-id (4 bytes) + vendor-attribute sub-TLVs (vendor-type + vendor-length + vendor-value).
- **Type-aware value rendering**: string attributes → UTF-8; integer attributes → uint32 + name-table lookup (Service-Type, Framed-Protocol, Acct-Status- Type, Acct-Terminate-Cause, NAS-Port-Type, Tunnel- Type, etc.); IPv4 attributes → dotted-decimal; time attributes → uint32 seconds + RFC 3339 string when Event-Timestamp.
What this package does NOT cover (deliberately out of scope) ¶
- **User-Password decryption**: the encoded password is surfaced as raw bytes; recovering the cleartext requires the shared secret and the Authenticator hash chain (RFC 2865 §5.2).
- **Message-Authenticator verification**: the HMAC-MD5 value is surfaced but not validated (requires the shared secret).
- **EAP-Message reassembly**: multiple EAP-Message attributes can chain to form a single EAP packet; each attribute is decoded individually, but reassembly is the caller's responsibility.
- **Diameter (RFC 6733)**: the modern successor protocol; entirely different wire format; separate Spec.
- **TACACS+ (RFC 8907)**: a different AAA protocol with its own envelope; separate Spec.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Attribute ¶
type Attribute struct {
Type int `json:"type"`
Name string `json:"name"`
Length int `json:"length"`
DataHex string `json:"data_hex,omitempty"`
// Type-aware decoded value.
String string `json:"string,omitempty"`
Uint32 *uint32 `json:"uint32,omitempty"`
IntName string `json:"int_name,omitempty"`
IPv4 string `json:"ipv4,omitempty"`
TimeUnix *uint32 `json:"time_unix,omitempty"`
TimeRFC3339 string `json:"time_rfc3339,omitempty"`
VendorSpecific *VendorSpecific `json:"vendor_specific,omitempty"`
}
Attribute is one decoded RADIUS attribute.
Only the fields that match the attribute's documented value type are populated; the raw bytes are always available via DataHex.
type Packet ¶
type Packet struct {
HexInput string `json:"hex_input"`
Code int `json:"code"`
CodeName string `json:"code_name"`
Identifier int `json:"identifier"`
Length int `json:"length"`
AuthenticatorHex string `json:"authenticator_hex"`
Attributes []*Attribute `json:"attributes,omitempty"`
}
Packet is the decoded RADIUS packet view.
func DecodeBytes ¶
DecodeBytes parses a raw RADIUS packet.
type VendorSpecific ¶
type VendorSpecific struct {
VendorID uint32 `json:"vendor_id"`
VendorName string `json:"vendor_name,omitempty"`
SubAttributes []*VendorSubAttr `json:"sub_attributes,omitempty"`
RawHex string `json:"raw_hex,omitempty"`
}
VendorSpecific is the decoded body of attribute 26 (a Vendor-Id + a list of vendor sub-attributes).
type VendorSubAttr ¶
type VendorSubAttr struct {
Type int `json:"type"`
Length int `json:"length"`
DataHex string `json:"data_hex"`
}
VendorSubAttr is one entry in a Vendor-Specific TLV list.
Source Files