It's time for them to die as their functionality can be emulated with unlang.
tls = tls-common
#
- # The tunneled authentication request does not usually contain
- # useful attributes like 'Calling-Station-Id', etc. These
- # attributes are outside of the tunnel, and normally
- # unavailable to the tunneled authentication request.
+ # copy_request_to_tunnel has been removed in 3.2.0
#
- # By setting this configuration entry to 'yes', any attribute
- # which is NOT in the tunneled authentication request, but
- # which IS available outside of the tunnel, is copied to the
- # tunneled request.
+ # Attributes from the outer request may be accessed with:
#
- # allowed values: {no, yes}
+ # &outer:request:<attribute>
#
- copy_request_to_tunnel = no
-
+ # The old behaviour may be emulated by adding the following
+ # to the top of the authorize section of the inner tunnel.
#
- # As of version 3.0.5, this configuration item
- # is deprecated. Instead, you should use copy any required
- # authorizational attributes to outer.session-state.
+ # update {
+ # &request: += &reply:[*]
+ # }
+ #
+
+ #
+ # use_tunneled_reply has been removed in 3.2.0
+ #
+ # Attributes that should be provided in the reply should
+ # be copied to the outer.session-state list.
#
# update outer.session-state {
# ...
#
# }
#
- # In the post-auth section of the outer server, attributes can
- # then be copied to the reply list.
+ # In the post-auth section of the outer server, these attributes
+ # can then be copied to the reply list.
#
# If you want to copy the entire session-state list to the reply
# the following statement may be used:
# &reply: += &session-state:[*]
# }
#
- # The reply attributes sent to the NAS are usually based on the
- # name of the user 'outside' of the tunnel (usually
- # 'anonymous'). If you want to send the reply attributes based
- # on the user name inside of the tunnel, then set this
- # configuration entry to 'yes', and the reply to the NAS will
- # be taken from the reply to the tunneled request.
- #
- # allowed values: {no, yes}
- #
- use_tunneled_reply = no
#
# The inner tunneled request can be sent through a virtual
default_eap_type = mschapv2
#
- # The PEAP module also has these configuration items, which are
- # the same as for TTLS.
+ # copy_request_to_tunnel has been removed in 3.2.0
#
- copy_request_to_tunnel = no
-
- #
- # As of version 3.0.5, this configuration item is deprecated.
- # Instead, you should use
+ # See notes in the ttls section about emulating this behaviour.
#
- # update outer.session-state {
- # ...
+
#
- # }
+ # use_tunneled_reply has been removed in 3.2.0
#
- # This will cache attributes for the final Access-Accept.
+ # See notes in the ttls section about emulating this behaviour.
#
- use_tunneled_reply = no
-
+
#
# When the tunneled session is proxied, the home server may not
# understand EAP-MSCHAP-V2. Set this entry to "no" to proxy the
typedef struct peap_tunnel_t {
VALUE_PAIR *username;
- VALUE_PAIR *state;
- VALUE_PAIR *accept_vps;
peap_status status;
bool home_access_accept;
int default_method;
- bool copy_request_to_tunnel;
- bool use_tunneled_reply;
bool proxy_tunneled_request_as_eap;
char const *virtual_server;
bool soh;
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eap_peap_success(eap_session, tls_session);
rcode = RLM_MODULE_HANDLED;
-
- /*
- * If we've been told to use the attributes from
- * the reply, then do so.
- *
- * WARNING: This may leak information about the
- * tunneled user!
- */
- if (t->use_tunneled_reply) {
- RDEBUG2("Saving tunneled attributes for later");
-
- /*
- * Clean up the tunneled reply.
- */
- fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY);
-
- /*
- * Delete MPPE keys & encryption policy. We don't
- * want these here.
- */
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP_MPPE_ENCRYPTION_POLICY, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP_MPPE_ENCRYPTION_TYPES, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP_MPPE_SEND_KEY, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP_MPPE_RECV_KEY, TAG_ANY);
-
- fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
- fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
- rad_assert(!reply->vps);
- }
break;
case PW_CODE_ACCESS_REJECT:
case PW_CODE_ACCESS_CHALLENGE:
RDEBUG2("Got tunneled Access-Challenge");
- /*
- * Keep the State attribute, if necessary.
- *
- * Get rid of the old State, too.
- */
- fr_pair_list_free(&t->state);
- fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, 0, PW_STATE, TAG_ANY);
-
/*
* PEAP takes only EAP-Message attributes inside
* of the tunnel. Any Reply-Message in the
vp = NULL;
fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
- /*
- * Handle EAP-MSCHAP-V2, where Access-Accept's
- * from the home server may contain MS-CHAP2-Success,
- * which the module turns into challenges, so that
- * the client may respond to the challenge with
- * an "ack" packet.
- */
- if (t->home_access_accept && t->use_tunneled_reply) {
- RDEBUG2("Saving tunneled attributes for later");
-
- /*
- * Clean up the tunneled reply.
- */
- fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY);
-
- rad_assert(!t->accept_vps);
- fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
- rad_assert(!reply->vps);
- }
-
/*
* Handle the ACK, by tunneling any necessary reply
* VP's back to the client.
RDEBUG2("No tunnel username (SSL resumption?)");
}
-
- /*
- * Add the State attribute, too, if it exists.
- */
- if (t->state) {
- vp = fr_pair_list_copy(fake->packet, t->state);
- if (vp) fr_pair_add(&fake->packet->vps, vp);
- }
-
- /*
- * If this is set, we copy SOME of the request attributes
- * from outside of the tunnel to inside of the tunnel.
- *
- * We copy ONLY those attributes which do NOT already
- * exist in the tunneled request.
- *
- * This code is copied from ../rlm_eap_ttls/ttls.c
- */
- if (t->copy_request_to_tunnel) {
- VALUE_PAIR *copy;
- vp_cursor_t cursor;
-
- for (vp = fr_cursor_init(&cursor, &request->packet->vps);
- vp;
- vp = fr_cursor_next(&cursor)) {
- /*
- * The attribute is a server-side thingy,
- * don't copy it.
- */
- if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
- continue;
- }
-
- /*
- * The outside attribute is already in the
- * tunnel, don't copy it.
- *
- * This works for BOTH attributes which
- * are originally in the tunneled request,
- * AND attributes which are copied there
- * from below.
- */
- if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue;
-
- /*
- * Some attributes are handled specially.
- */
- if (!vp->da->vendor) switch (vp->da->attr) {
- /*
- * NEVER copy Message-Authenticator,
- * EAP-Message, or State. They're
- * only for outside of the tunnel.
- */
- case PW_USER_NAME:
- case PW_USER_PASSWORD:
- case PW_CHAP_PASSWORD:
- case PW_CHAP_CHALLENGE:
- case PW_PROXY_STATE:
- case PW_MESSAGE_AUTHENTICATOR:
- case PW_EAP_MESSAGE:
- case PW_STATE:
- continue;
-
- /*
- * By default, copy it over.
- */
- default:
- break;
- }
-
- /*
- * Don't copy from the head, we've already
- * checked it.
- */
- copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->vendor, vp->da->attr, TAG_ANY);
- fr_pair_add(&fake->packet->vps, copy);
- }
- }
-
return 0;
}
{ FR_CONF_OFFSET("inner_eap_module", PW_TYPE_STRING, rlm_eap_peap_t, inner_eap_module), },
- { FR_CONF_OFFSET("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_peap_t, copy_request_to_tunnel), .dflt = "no" },
+ { FR_CONF_DEPRECATED("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_peap_t, NULL), .dflt = "no" },
- { FR_CONF_OFFSET("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_peap_t, use_tunneled_reply), .dflt = "no" },
+ { FR_CONF_DEPRECATED("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_peap_t, NULL), .dflt = "no" },
#ifdef WITH_PROXY
{ FR_CONF_OFFSET("proxy_tunneled_request_as_eap", PW_TYPE_BOOLEAN, rlm_eap_peap_t, proxy_tunneled_request_as_eap), .dflt = "yes" },
t = talloc_zero(ctx, peap_tunnel_t);
- t->copy_request_to_tunnel = inst->copy_request_to_tunnel;
- t->use_tunneled_reply = inst->use_tunneled_reply;
#ifdef WITH_PROXY
t->proxy_tunneled_request_as_eap = inst->proxy_tunneled_request_as_eap;
#endif
* our Access-Accept.
*/
peap = tls_session->opaque;
- if (peap->soh_reply_vps) {
- RDEBUG2("Using saved attributes from the SoH reply");
- rdebug_pair_list(L_DBG_LVL_2, request, peap->soh_reply_vps, NULL);
- fr_pair_list_mcopy_by_num(eap_session->request->reply, &eap_session->request->reply->vps,
- &peap->soh_reply_vps, 0, 0, TAG_ANY);
- }
- if (peap->accept_vps) {
- RDEBUG2("Using saved attributes from the original Access-Accept");
- rdebug_pair_list(L_DBG_LVL_2, request, peap->accept_vps, NULL);
- fr_pair_list_mcopy_by_num(eap_session->request->reply, &eap_session->request->reply->vps,
- &peap->accept_vps, 0, 0, TAG_ANY);
- } else if (peap->use_tunneled_reply) {
- RDEBUG2("No saved attributes in the original Access-Accept");
- }
/*
* Success: Automatically return MPPE keys.
typedef struct ttls_tunnel_t {
VALUE_PAIR *username;
- VALUE_PAIR *state;
- VALUE_PAIR *accept_vps;
bool authenticated;
- bool copy_request_to_tunnel;
- bool use_tunneled_reply;
char const *virtual_server;
} ttls_tunnel_t;
char const *tls_conf_name;
fr_tls_conf_t *tls_conf;
- /*
- * Use the reply attributes from the tunneled session in
- * the non-tunneled reply to the client.
- */
- bool use_tunneled_reply;
-
- /*
- * Use SOME of the request attributes from outside of the
- * tunneled session in the tunneled request
- */
- bool copy_request_to_tunnel;
-
/*
* RFC 5281 (TTLS) says that the length field MUST NOT be
* in fragments after the first one. However, we've done
static CONF_PARSER module_config[] = {
{ FR_CONF_OFFSET("tls", PW_TYPE_STRING, rlm_eap_ttls_t, tls_conf_name) },
- { FR_CONF_OFFSET("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, copy_request_to_tunnel), .dflt = "no" },
- { FR_CONF_OFFSET("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, use_tunneled_reply), .dflt = "no" },
+ { FR_CONF_DEPRECATED("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, NULL), .dflt = "no" },
+ { FR_CONF_DEPRECATED("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, NULL), .dflt = "no" },
{ FR_CONF_OFFSET("virtual_server", PW_TYPE_STRING | PW_TYPE_REQUIRED | PW_TYPE_NOT_EMPTY, rlm_eap_ttls_t, virtual_server) },
{ FR_CONF_OFFSET("include_length", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, include_length), .dflt = "yes" },
{ FR_CONF_OFFSET("require_client_cert", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, req_client_cert), .dflt = "no" },
ttls_tunnel_t *t;
t = talloc_zero(ctx, ttls_tunnel_t);
- t->copy_request_to_tunnel = inst->copy_request_to_tunnel;
- t->use_tunneled_reply = inst->use_tunneled_reply;
t->virtual_server = inst->virtual_server;
return t;
}
if (tunnel && tunnel->authenticated) {
- if (tunnel->accept_vps) {
- RDEBUG2("Using saved attributes from the original Access-Accept");
- rdebug_pair_list(L_DBG_LVL_2, request, tunnel->accept_vps, NULL);
- fr_pair_list_mcopy_by_num(eap_session->request->reply,
- &eap_session->request->reply->vps, &tunnel->accept_vps, 0, 0,
- TAG_ANY);
- } else if (tunnel->use_tunneled_reply) {
- RDEBUG2("No saved attributes in the original Access-Accept");
- }
-
do_keys:
/*
* Success: Automatically return MPPE keys.
static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *eap_session, tls_session_t *tls_session,
REQUEST *request, RADIUS_PACKET *reply)
{
- rlm_rcode_t rcode = RLM_MODULE_REJECT;
- VALUE_PAIR *vp;
- ttls_tunnel_t *t = tls_session->opaque;
+ rlm_rcode_t rcode = RLM_MODULE_REJECT;
+ VALUE_PAIR *vp, *tunnel_vps = NULL;
+ vp_cursor_t cursor;
+ vp_cursor_t to_tunnel;
+
+ ttls_tunnel_t *t = tls_session->opaque;
rad_assert(eap_session->request == request);
*/
switch (reply->code) {
case PW_CODE_ACCESS_ACCEPT:
+ {
RDEBUG("Got tunneled Access-Accept");
+ fr_cursor_init(&to_tunnel, &tunnel_vps);
rcode = RLM_MODULE_OK;
/*
- * Always delete MPPE keys & encryption policy
- * from the tunneled reply. These never get sent
- * back to the user.
- */
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_ENCRYPTION_POLICY, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_ENCRYPTION_TYPES, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_SEND_KEY, TAG_ANY);
- fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_RECV_KEY, TAG_ANY);
-
- /*
- * MS-CHAP2-Success means that we do NOT return
- * an Access-Accept, but instead tunnel that
- * attribute to the client, and keep going with
- * the TTLS session. Once the client accepts
- * our identity, it will respond with an empty
- * packet, and we will send EAP-Success.
+ * Copy what we need into the TTLS tunnel and leave
+ * the rest to be cleaned up.
*/
- vp = NULL;
- fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_SUCCESS,
- TAG_ANY);
- if (vp) {
- RDEBUG("Got MS-CHAP2-Success, tunneling it to the client in a challenge");
- rcode = RLM_MODULE_HANDLED;
- t->authenticated = true;
+ for (vp = fr_cursor_init(&cursor, &reply->vps);
+ vp;
+ vp = fr_cursor_next(&cursor)) {
+ switch (vp->da->vendor) {
+ case VENDORPEC_MICROSOFT:
+ if (vp->da->attr == PW_MSCHAP2_SUCCESS) {
+ RDEBUG("Got MS-CHAP2-Success, tunneling it to the client in a challenge");
- /*
- * Use the tunneled reply, but not now.
- */
- if (t->use_tunneled_reply) {
- rad_assert(!t->accept_vps);
- fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
- rad_assert(!reply->vps);
- }
+ rcode = RLM_MODULE_HANDLED;
+ t->authenticated = true;
+ fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
+ }
+ break;
- } else { /* no MS-CHAP2-Success */
- /*
- * Can only have EAP-Message if there's
- * no MS-CHAP2-Success.
- *
- * We also do NOT tunnel the EAP-Success
- * attribute back to the client, as the client
- * can figure it out, from the non-tunneled
- * EAP-Success packet.
- */
- fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
- fr_pair_list_free(&vp);
- }
+ case VENDORPEC_UKERNA:
+ if (vp->da->attr == PW_UKERNA_CHBIND) {
+ rcode = RLM_MODULE_HANDLED;
+ t->authenticated = true;
+ fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
+ }
+ break;
- /* move channel binding responses; we need to send them */
- fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY);
- if (fr_pair_find_by_num(vp, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY) != NULL) {
- t->authenticated = true;
- /*
- * Use the tunneled reply, but not now.
- */
- if (t->use_tunneled_reply) {
- rad_assert(!t->accept_vps);
- fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
- rad_assert(!reply->vps);
+ default:
+ break;
}
- rcode = RLM_MODULE_HANDLED;
- }
-
- /*
- * Handle the ACK, by tunneling any necessary reply
- * VP's back to the client.
- */
- if (vp) {
- RDEBUG("Sending tunneled reply attributes");
- rdebug_pair_list(L_DBG_LVL_1, request, vp, NULL);
-
- vp2diameter(request, tls_session, vp);
- fr_pair_list_free(&vp);
- }
-
- /*
- * If we've been told to use the attributes from
- * the reply, then do so.
- *
- * WARNING: This may leak information about the
- * tunneled user!
- */
- if (t->use_tunneled_reply) {
- fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY);
- fr_pair_list_mcopy_by_num(request->reply, &request->reply->vps, &reply->vps, 0, 0, TAG_ANY);
}
+ }
break;
rcode = RLM_MODULE_REJECT;
break;
- /*
- * Handle Access-Challenge, but only if we
- * send tunneled reply data. This is because
- * an Access-Challenge means that we MUST tunnel
- * a Reply-Message to the client.
- */
+ /*
+ * Handle Access-Challenge, but only if we
+ * send tunneled reply data. This is because
+ * an Access-Challenge means that we MUST tunnel
+ * a Reply-Message to the client.
+ */
case PW_CODE_ACCESS_CHALLENGE:
RDEBUG("Got tunneled Access-Challenge");
- /*
- * Keep the State attribute, if necessary.
- *
- * Get rid of the old State, too.
- */
- fr_pair_list_free(&t->state);
- fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, 0, PW_STATE, TAG_ANY);
+ fr_cursor_init(&to_tunnel, &tunnel_vps);
/*
- * We should really be a bit smarter about this,
- * and move over only those attributes which
- * are relevant to the authentication request,
- * but that's a lot more work, and this "dumb"
- * method works in 99.9% of the situations.
+ * Copy what we need into the TTLS tunnel and leave
+ * the rest to be cleaned up.
*/
- vp = NULL;
- fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ for (vp = fr_cursor_init(&cursor, &reply->vps);
+ vp;
+ vp = fr_cursor_next(&cursor)) {
+ switch (vp->da->vendor) {
+ case VENDORPEC_UKERNA:
+ if (vp->da->attr == PW_UKERNA_CHBIND) {
+ fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
+ }
+ break;
- /*
- * There MUST be a Reply-Message in the challenge,
- * which we tunnel back to the client.
- *
- * If there isn't one in the reply VP's, then
- * we MUST create one, with an empty string as
- * it's value.
- */
- fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_REPLY_MESSAGE, TAG_ANY);
+ case 0:
+ switch (vp->da->attr) {
+ case PW_EAP_MESSAGE:
+ case PW_REPLY_MESSAGE:
+ fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
+ break;
- /* also move chbind messages, if any */
- fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY);
+ default:
+ break;
- /*
- * Handle the ACK, by tunneling any necessary reply
- * VP's back to the client.
- */
- if (vp) {
- vp2diameter(request, tls_session, vp);
- fr_pair_list_free(&vp);
+ }
+
+ default:
+ continue;
+ }
}
rcode = RLM_MODULE_HANDLED;
break;
break;
}
+
+ /*
+ * Pack any tunnelled VPs and send them back
+ * to the supplicant.
+ */
+ if (tunnel_vps) {
+ RDEBUG("Sending tunneled reply attributes");
+ rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL);
+
+ vp2diameter(request, tls_session, tunnel_vps);
+ fr_pair_list_free(&tunnel_vps);
+ }
+
return rcode;
}
}
} /* else the request ALREADY had a User-Name */
- /*
- * Add the State attribute, too, if it exists.
- */
- if (t->state) {
- vp = fr_pair_list_copy(fake->packet, t->state);
- if (vp) fr_pair_add(&fake->packet->vps, vp);
- }
-
- /*
- * If this is set, we copy SOME of the request attributes
- * from outside of the tunnel to inside of the tunnel.
- *
- * We copy ONLY those attributes which do NOT already
- * exist in the tunneled request.
- */
- if (t->copy_request_to_tunnel) {
- VALUE_PAIR *copy;
- vp_cursor_t cursor;
-
- for (vp = fr_cursor_init(&cursor, &request->packet->vps); vp; vp = fr_cursor_next(&cursor)) {
- /*
- * The attribute is a server-side thingy,
- * don't copy it.
- */
- if ((vp->da->attr > 255) &&
- (vp->da->vendor == 0)) {
- continue;
- }
-
- /*
- * The outside attribute is already in the
- * tunnel, don't copy it.
- *
- * This works for BOTH attributes which
- * are originally in the tunneled request,
- * AND attributes which are copied there
- * from below.
- */
- if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) {
- continue;
- }
-
- /*
- * Some attributes are handled specially.
- */
- if (!vp->da->vendor) switch (vp->da->attr) {
- /*
- * NEVER copy Message-Authenticator,
- * EAP-Message, or State. They're
- * only for outside of the tunnel.
- */
- case PW_USER_NAME:
- case PW_USER_PASSWORD:
- case PW_CHAP_PASSWORD:
- case PW_CHAP_CHALLENGE:
- case PW_PROXY_STATE:
- case PW_MESSAGE_AUTHENTICATOR:
- case PW_EAP_MESSAGE:
- case PW_STATE:
- continue;
-
- /*
- * By default, copy it over.
- */
- default:
- break;
- }
-
- /*
- * Don't copy from the head, we've already
- * checked it.
- */
- copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->vendor, vp->da->attr, TAG_ANY);
- fr_pair_add(&fake->packet->vps, copy);
- }
- }
-
/*
* Process channel binding.
*/
#
default_eap_type = mschapv2
- # The PEAP module also has these configuration
- # items, which are the same as for TTLS.
- #
- copy_request_to_tunnel = no
-
- #
- # As of version 3.0.5, this configuration item
- # is deprecated. Instead, you should use
- #
- # update outer.session-state {
- # ...
- #
- # }
- #
- # This will cache attributes for the final Access-Accept.
- #
- use_tunneled_reply = no
-
# When the tunneled session is proxied, the
# home server may not understand EAP-MSCHAP-V2.
# Set this entry to "no" to proxy the tunneled
#
default_eap_type = md5
- # The tunneled authentication request does not usually
- # contain useful attributes like 'Calling-Station-Id',
- # etc. These attributes are outside of the tunnel,
- # and normally unavailable to the tunneled
- # authentication request.
- #
- # By setting this configuration entry to 'yes',
- # any attribute which is NOT in the tunneled
- # authentication request, but which IS available
- # outside of the tunnel, is copied to the tunneled
- # request.
- #
- # allowed values: {no, yes}
- #
- copy_request_to_tunnel = no
-
- #
- # As of version 3.0.5, this configuration item
- # is deprecated. Instead, you should use
- #
- # update outer.session-state {
- # ...
- #
- # }
- #
- # This will cache attributes for the final Access-Accept.
- #
- # The reply attributes sent to the NAS are usually
- # based on the name of the user 'outside' of the
- # tunnel (usually 'anonymous'). If you want to send
- # the reply attributes based on the user name inside
- # of the tunnel, then set this configuration entry to
- # 'yes', and the reply to the NAS will be taken from
- # the reply to the tunneled request.
- #
- # allowed values: {no, yes}
- #
- use_tunneled_reply = no
-
#
# The inner tunneled request can be sent
# through a virtual server constructed
projects / thirdparty / freeradius-server.git / commitdiff
