rc_read_config3

Usage

#include <radcli/radcli.h>

rc_handle * rc_read_config(
    char const  *filename
);

Overview

This is the primary way to initialise radcli. Loads the configuration file, initialises the transport (including TLS/DTLS handshake when applicable), and returns an opaque handle for use in subsequent calls. The format is compatible with radiusclient-ng and freeradius-client.

Standard RFC 2865/2866/2869 attributes are built into the library; the dictionary option is only needed for vendor-specific attributes.

Recognised configuration options:

secret: shared secret applied to authserver/acctserver when they don't already carry an inline :secret the config-file equivalent of radcli_ctx_set_secret() (radcli2.h). Ignored when serv-type is tls or dtls: that transport uses its own fixed RFC 6614/7360 secret instead, so this option is never consulted.

namespace: Linux network namespace name to use for socket operations.

tls-psk-identity / tls-psk-key: Pre-Shared Key identity (plain text) and key (hex text), used instead of X.509 credentials; both must be set together. The config-file equivalent of radcli_ctx_set_tls_psk() (radcli2.h), and preferred over a psk@username@hexkey embedded in authserver's value.

require-message-authenticator: set to no to accept responses that lack the Message-Authenticator attribute. Enabled by default per draft-ietf-radext-deprecating-radius-10 (CVE-2024-3596 / BLAST RADIUS); only disable for legacy servers that predate RFC 3579. Has no effect over RADIUS/TLS or RADIUS/DTLS, where this mitigation is never enforced, per draft-ietf-radext-deprecating-radius-10 Section 4.

clientdebug: debug verbosity level (integer; 0 = off).

Parameters

filename

path to the configuration file.

Return value

new rc_handle on success, NULL on failure.