Call old/new servers sections in eap methods

diff --git a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c
index 8106894e64490c455cead000822a60e59a239a78..7fe288e599b5111a393d117183d707f4a0b92c4a 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c
+++ b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c
@@ -40,8 +40,7 @@ RCSID("$Id$")
 typedef struct rlm_eap_gtc_t {
        char const      *challenge;
        char const      *auth_type_name;
-       int             auth_type;
-       fr_dict_enum_t const *dval;
+       uint32_t        auth_type;
 } rlm_eap_gtc_t;
 
 static CONF_PARSER submodule_config[] = {
@@ -128,12 +127,12 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
         */
        request->password = vp;
 
-       unlang = cf_section_find(request->server_cs, "authenticate", inst->dval->alias);
+       unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type_name);
        if (!unlang) {
                /*
                 *      Call the authenticate section of the *current* virtual server.
                 */
-               rcode = process_authenticate(inst->dval->value->vb_uint32, request);
+               rcode = process_authenticate(inst->auth_type, request);
                if (rcode != RLM_MODULE_OK) {
                        eap_round->request->code = FR_EAP_CODE_FAILURE;
                        return rcode;
@@ -208,7 +207,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs)
                cf_log_err_by_name(cs, "auth_type", "Unknown Auth-Type %s", inst->auth_type_name);
                return -1;
        }
-       inst->dval = dval;
+       inst->auth_type = dval->value->vb_uint32;
+       inst->auth_type_name = dval->alias;     /* Corrects case mismatches */
 
        return 0;
 }

diff --git a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
index 6ac7570ae94239092f5e442582c542f92af10641..9ad7eb65f68674b2d3e4f26f7fd94b00a85ebe40 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
+++ b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c
@@ -30,10 +30,11 @@ RCSID("$Id$")
 #include <freeradius-devel/rad_assert.h>
 
 typedef struct rlm_eap_mschapv2_t {
-       bool with_ntdomain_hack;
-       bool send_error;
-       char const *identity;
-       int auth_type_mschap;
+       bool                    with_ntdomain_hack;
+       bool                    send_error;
+       char const              *identity;
+       int                     auth_type_mschap;
+       char                    const *auth_type_mschap_name;
 } rlm_eap_mschapv2_t;
 
 static CONF_PARSER submodule_config[] = {
@@ -280,6 +281,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(void *arg, eap_session_t *eap_se
        VALUE_PAIR              *auth_challenge, *response, *name;
        rlm_eap_mschapv2_t      *inst = (rlm_eap_mschapv2_t *) arg;
        REQUEST                 *request = eap_session->request;
+       CONF_SECTION            *unlang;
 
        if (!rad_cond_assert(eap_session->inst)) return 0;
 
@@ -573,7 +575,14 @@ packet_ready:
        /*
         *      This is a wild & crazy hack.
         */
-       rcode = process_authenticate(inst->auth_type_mschap, request);
+
+       unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type_mschap_name);
+       if (!unlang) {
+               rcode = process_authenticate(inst->auth_type_mschap, request);
+       } else {
+               unlang_push_section(request, unlang, RLM_MODULE_FAIL);
+               rcode = unlang_interpret_continue(request);
+       }
 
        /*
         *      Delete MPPE keys & encryption policy.  We don't
@@ -745,7 +754,7 @@ static rlm_rcode_t mod_session_init(void *instance, eap_session_t *eap_session)
 static int mod_instantiate(void *instance, CONF_SECTION *cs)
 {
        rlm_eap_mschapv2_t *inst = talloc_get_type_abort(instance, rlm_eap_mschapv2_t);
-       fr_dict_enum_t const *dv;
+       fr_dict_enum_t const *enumv;
 
        if (inst->identity && (strlen(inst->identity) > 255)) {
                cf_log_err(cs, "identity is too long");
@@ -754,13 +763,14 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs)
 
        if (!inst->identity) inst->identity = talloc_asprintf(inst, "freeradius-%s", RADIUSD_VERSION_STRING);
 
-       dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MS-CHAP");
-       if (!dv) dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MSCHAP");
-       if (!dv) {
+       enumv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MS-CHAP");
+       if (!enumv) enumv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MSCHAP");
+       if (!enumv) {
                cf_log_err(cs, "Failed to find 'Auth-Type MS-CHAP' section.  Cannot authenticate users.");
                return -1;
        }
-       inst->auth_type_mschap = dv->value->vb_uint32;
+       inst->auth_type_mschap = enumv->value->vb_uint32;
+       inst->auth_type_mschap_name = enumv->alias;
 
        return 0;
 }

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h
index 236510dbdf6bdc3a87ad5583046f0e7d5dcc8c66..f9f9bcf907805ee63b0e1299e988adfba8584bf7 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h
@@ -68,5 +68,5 @@ typedef struct peap_tunnel_t {
 /*
  *     Process the PEAP portion of an EAP-PEAP request.
  */
-rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, int auth_type_eap) CC_HINT(nonnull);
+rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, fr_dict_enum_t const *enumv) CC_HINT(nonnull(1,2));
 #endif /* _EAP_PEAP_H */

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
index 5428d2a7c2de69d83b021d23d3270be96ca9eb69..f09bc057404d6bd01278a4f74fd94cdcd0960fb9 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
@@ -618,7 +618,7 @@ static char const *peap_state(peap_tunnel_t *t)
 /*
  *     Process the pseudo-EAP contents of the tunneled data.
  */
-rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, int auth_type_eap)
+rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, fr_dict_enum_t const *enumv)
 {
        peap_tunnel_t   *t = tls_session->opaque;
        REQUEST         *fake = NULL;
@@ -914,6 +914,7 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess
                         *      done, THEN we proxy it...
                         */
                        if (!t->proxy_tunneled_request_as_eap) {
+                               CONF_SECTION *unlang;
                                fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
 
                                /*
@@ -921,7 +922,7 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess
                                 *      Auth-Type & EAP-Message here?
                                 */
 
-                               if (!auth_type_eap) {
+                               if (!enumv) {
                                        RERROR("You must set 'inner_eap_module' in the 'peap' configuration");
                                        RERROR("This is required in order to proxy the inner EAP session.");
                                        rcode = RLM_MODULE_REJECT;
@@ -932,7 +933,15 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess
                                 *      Run the EAP authentication.
                                 */
                                RDEBUG2("Calling authenticate in order to initiate tunneled EAP session");
-                               rcode = process_authenticate(auth_type_eap, fake);
+
+                               unlang = cf_section_find(request->server_cs, "authenticate", enumv->alias);
+                               if (!unlang) {
+                                       rcode = process_authenticate(enumv->value->vb_uint32, fake);
+                               } else {
+                                       unlang_push_section(request, unlang, RLM_MODULE_FAIL);
+                                       rcode = unlang_interpret_continue(request);
+                               }
+
                                if (rcode == RLM_MODULE_OK) {
                                        /*
                                         *      Authentication succeeded! Rah!

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index 4bc17f51584333d25519be9615eebdfc26d3a034..8ee8a822d2f48bfd83e97400dc0d789206f0bb5a 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -31,7 +31,7 @@ typedef struct rlm_eap_peap_t {
        fr_tls_conf_t   *tls_conf;
 
        char const              *inner_eap_module;      //!< module name for inner EAP
-       int                     auth_type_eap;
+       fr_dict_enum_t          *auth_type_eap;
        bool                    use_tunneled_reply;     //!< Use the reply attributes from the tunneled session in
                                                        //!< the non-tunneled reply to the client.
 
@@ -319,7 +319,7 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs)
                     "The server cannot proxy inner-tunnel EAP packets",
                     inst->inner_eap_module, inst->virtual_server);
        } else {
-               inst->auth_type_eap = dv->value->vb_uint32;
+               inst->auth_type_eap = dv;
        }
 
        return 0;