SavageZA.Radius.Client 1.1.0

RadiusClient

A high-performance, thread-safe .NET 8 client library for communicating with RADIUS servers, implementing RFC 2865 (Authentication) and RFC 2866 (Accounting).

Features

• Full RADIUS protocol support — Access-Request, Access-Accept/Reject/Challenge, Accounting-Request/Response, CoA, Disconnect, and Status-Server (RFC 5997)
• High throughput — Maintains a single pre-connected UDP socket per instance, eliminating per-request socket creation overhead, ephemeral port exhaustion, and TIME_WAIT accumulation
• Thread-safe — All public members are safe for concurrent use; responses are correlated by RADIUS Identifier
• IPv4 and IPv6 — Dual-stack support with automatic address family detection
• Async/await — Fully asynchronous send/receive with CancellationToken support
• Configurable retries — Per-request retry count and socket timeout
• Comprehensive attribute support — Standard attributes, Vendor-Specific Attributes (VSA) with 9 encoding formats, Tunnel attributes, and more
• Vendor format presets — Built-in RadiusVendorFormats constants for Cisco, Microsoft, Juniper, Aruba, Huawei, Ruckus, Fortinet, US Robotics, and WiMAX
• Authentication protocols — PAP, CHAP, and EAP (Message-Authenticator) support
• Security — Sensitive key material is zeroed after use via CryptographicOperations.ZeroMemory; constant-time authenticator comparison prevents timing side-channel attacks
• Trimming and AOT compatible — Annotated for .NET trimming and Native AOT scenarios

Installation

Clone the repository and add a project reference:

git clone https://github.com/enteriaza/RadiusClient.git

In your project file, add the following reference:

<ProjectReference Include="..\RadiusClient\RadiusClient.csproj" />

Quick Start

PAP Authentication

using Radius;

using var client = new RadiusClient("radius.example.com", "MySharedSecret");

// Build the Access-Request packet
RadiusPacket request = client.CreatePacket(RadiusCode.ACCESS_REQUEST);
request.SetAttribute(new RadiusAttributes(RadiusAttributeType.USER_NAME, "alice"));

// Encode the password using PAP (RFC 2865 §5.2)
byte[] encodedPassword = RadiusUtils.EncodePapPassword(
    System.Text.Encoding.ASCII.GetBytes("password123"),
    request.Authenticator,
    System.Text.Encoding.ASCII.GetBytes("MySharedSecret"));
request.SetAttribute(new RadiusAttributes(RadiusAttributeType.USER_PASSWORD, encodedPassword));

// Sign and send
request.SetAuthenticator(System.Text.Encoding.ASCII.GetBytes("MySharedSecret"));

RadiusPacket? response = await client.SendAndReceivePacketAsync(request);

if (response is not null && client.VerifyAuthenticator(request, response))
{
    Console.WriteLine($"Response: {response.PacketType}");
}

Accounting

using Radius;

using var client = new RadiusClient("radius.example.com", "MySharedSecret");

RadiusPacket acctRequest = client.CreatePacket(RadiusCode.ACCOUNTING_REQUEST);
acctRequest.SetAttribute(new RadiusAttributes(RadiusAttributeType.USER_NAME, "alice"));
acctRequest.SetAttribute(new RadiusAttributes(RadiusAttributeType.ACCT_STATUS_TYPE, (int)ACCT_STATUS_TYPE.START));
acctRequest.SetAttribute(new RadiusAttributes(RadiusAttributeType.ACCT_SESSION_ID, "session-001"));

// Accounting packets use a zeroed-then-hashed authenticator
acctRequest.SetAuthenticator(System.Text.Encoding.ASCII.GetBytes("MySharedSecret"));

RadiusPacket? response = await client.SendAndReceivePacketAsync(acctRequest);

Server Ping (Status-Server)

using Radius;

using var client = new RadiusClient("radius.example.com", "MySharedSecret");
RadiusPacket? pong = await client.PingAsync();

Console.WriteLine(pong is not null ? "Server is reachable" : "Server did not respond");

Vendor-Specific Attributes (VSA)

// Append a vendor-specific attribute (e.g., Cisco AV-Pair)
var vsa = new VendorSpecificAttributes(
    vendorId: 9,           // Cisco
    vendorSpecificType: 1, // AV-Pair
    vendorSpecificData: System.Text.Encoding.UTF8.GetBytes("shell:priv-lvl=15"));

request.SetAttribute(vsa);

Vendor-Specific Attribute (VSA) Format Support

The VendorSpecificAttributes class supports all known VSA sub-attribute encoding formats used by RADIUS vendors, as specified in RFC 2865 §5.26, RFC 6929 §2.4, and real-world vendor dictionaries:

Standard VSA (format=1,1)

// Most vendors use standard format — the byte constructor selects it   automatically.
var vsa = new VendorSpecificAttributes(
    vendorId: 9,           // Cisco
    vendorSpecificType: 1, // AV-Pair
    vendorSpecificData: Encoding.UTF8.GetBytes("shell:priv-lvl=15"));

Extended 4-byte Type VSA (format=4,0)

// US Robotics / 3Com uses 4-byte vendor types with no length field.
var vsa = new VendorSpecificAttributes(
    vendorId: 429,
    vendorSpecificType: 0xBE45,
    vendorSpecificData: Encoding.UTF8.GetBytes("+15551234567"),
    format: VendorSpecificFormat.Type4Len0);

WiMAX Continuation VSA (format=1,1,c)

// WiMAX attributes include a continuation byte (RFC 6929 §2.4).
var vsa = new VendorSpecificAttributes(
    vendorId: 24757,
    vendorSpecificType: 1,
    vendorSpecificData: myData,
    format: VendorSpecificFormat.Type1Len1Continuation,
    continuationFlag: 0x00); // 0x80 = more fragments follow

API Overview

Core Classes

RadiusClient Constructor

public RadiusClient(
    string hostName,
    string sharedSecret,
    int sockTimeout = 3000,
    int authPort = 1812,
    int acctPort = 1813,
    IPEndPoint? localEndPoint = null)

Key Methods

Packet Construction Sequence

1. Create a packet via CreatePacket() or new RadiusPacket(RadiusCode).
2. Add attributes via SetAttribute().
3. (Optional) Call SetMessageAuthenticator() for EAP or enhanced security (RFC 3579 §3.2).
4. Call SetAuthenticator() to finalize the packet.
5. Send via SendAndReceivePacketAsync().

RFC Compliance

Requirements

• .NET 8.0 or later

License

This project is licensed under the MIT License.