---
name: "radcli_dae_process"
section: "3"
platform: "linux"
package: "radcli"
version: "2.0.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/radcli_dae_process"
---

# radcli\_dae\_process(3)

Validate a caller-supplied packet, without a radcli-owned socket the L0 counterpart of radcli\_ctx\_dispatch(), running the identical validation pipeline (REQ-DAE-NET-003) on a buffer and source address the caller supplies instead of reading them from radcli\_dae\_start()'s socket. A request this produces is otherwise indistinguishable from one radcli\_ctx\_dispatch() would have delivered to a handler.

## NAME

radcli\_dae\_process - Validate a caller-supplied packet, without a radcli-owned socket  the L0 counterpart of radcli\_ctx\_dispatch(), running the identical validation pipeline (REQ-DAE-NET-003) on a buffer and source address the caller supplies instead of reading them from radcli\_dae\_start()'s socket. A request this produces is otherwise indistinguishable from one radcli\_ctx\_dispatch() would have delivered to a handler.

## SYNOPSIS

```
#include <radcli/>

int radcli_dae_process(
    radcli_dae             *dae,
    const void             *buf,
    size_t                  len,
    const struct sockaddr  *from,
    socklen_t               fromlen,
    radcli_dae_request    **req
);
```

## DESCRIPTION

## PARAMETERS

- **dae**

  a listener from radcli\_dae\_new() (radcli\_dae\_start() need never have been called: this function reads no socket). Rejected outright (-1) if dae is following serv-type=tls/dtls (RadSec): that transport trusts the record's origin entirely to the already-verified TLS/DTLS session (REQ-DAE-SEC-015), which this buffer/address pair is not, and has no source-address check of its own to apply to it.

- **buf**

  the received packet, header included.

- **len**

  buf's length.

- **from**

  the packet's source address, for the dae-server authorization check.

- **fromlen**

  from's length. Must be at least sizeof(struct sockaddr\_in) and at most sizeof(struct sockaddr\_storage), and consistent with the family from-\>sa\_family declares (AF\_INET or AF\_INET6 only, matching what dae-server can authorize)  an application relaying from and fromlen from an untrusted producer (e.g. over IPC from a privileged listener) must not assume this function corrects a mismatch; it only rejects one.

- **req**

  set to the validated request on success (RADCLI\_DAE\_NEW or RADCLI\_DAE\_DUPLICATE), left NULL on failure.

## RETURN VALUE

RADCLI\_DAE\_NEW or RADCLI\_DAE\_DUPLICATE on success, -1 if the packet failed validation (discarded silently, exactly as radcli\_ctx\_dispatch() would), dae is a RadSec listener, or any argument is invalid.

## SEE ALSO

[*radcli\_ctx\_dispatch*(3)](/radcli_ctx_dispatch/3.md), [*radcli\_ctx\_get\_poll*(3)](/radcli_ctx_get_poll/3.md), [*radcli\_dae\_free*(3)](/radcli_dae_free/3.md), [*radcli\_dae\_new*(3)](/radcli_dae_new/3.md), [*radcli\_dae\_reply*(3)](/radcli_dae_reply/3.md), [*radcli\_dae\_reply\_error*(3)](/radcli_dae_reply_error/3.md), [*radcli\_dae\_reply\_to\_buffer*(3)](/radcli_dae_reply_to_buffer/3.md), [*radcli\_dae\_req\_attrs*(3)](/radcli_dae_req_attrs/3.md), [*radcli\_dae\_req\_code*(3)](/radcli_dae_req_code/3.md), [*radcli\_dae\_req\_framed\_ip*(3)](/radcli_dae_req_framed_ip/3.md), [*radcli\_dae\_req\_nas\_port*(3)](/radcli_dae_req_nas_port/3.md), [*radcli\_dae\_req\_session\_id*(3)](/radcli_dae_req_session_id/3.md), [*radcli\_dae\_req\_user\_name*(3)](/radcli_dae_req_user_name/3.md), [*radcli\_dae\_request\_free*(3)](/radcli_dae_request_free/3.md), [*radcli\_dae\_set\_handler*(3)](/radcli_dae_set_handler/3.md), [*radcli\_dae\_start*(3)](/radcli_dae_start/3.md)