Clarify behavior of inner-tunnel replies

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index 2b650d2a6e780cd9b09b357a7d637729b84dd855..660fc29d89cfd8a2c2a5d3e52dd3bb7fc283c907 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -253,6 +253,16 @@ session {
 #  Post-Authentication
 #  Once we KNOW that the user has been authenticated, there are
 #  additional steps we can take.
+#
+#  Note that the last packet of the inner-tunnel authentication
+#  MAY NOT BE the last packet of the outer session.  So updating
+#  the outer reply MIGHT work, and sometimes MIGHT NOT.  The
+#  exact functionality depends on both the inner and outer
+#  authentication methods.
+#
+#  If you need to send a reply attribute in the outer session,
+#  the ONLY safe way is to set "use_tunneled_reply = yes", and
+#  then update the inner-tunnel reply.
 post-auth {
        #  If you want privacy to remain, see the
        #  Chargeable-User-Identity attribute from RFC 4372.
@@ -296,43 +306,6 @@ post-auth {
                -sql
                attr_filter.access_reject
        }
-
-       #
-       #  The example policy below updates the outer tunnel reply
-       #  (usually Access-Accept) with the User-Name from the inner
-       #  tunnel User-Name.  Since this section is processed in the
-       #  context of the inner tunnel, "request" here means "inner
-       #  tunnel request", and "outer.reply" means "outer tunnel
-       #  reply attributes".
-       #
-       #  Updating the outer reply works ONLY when you have set
-       #  "use_tunneled_reply = no".  If you set that to "yes",
-       #  then the outer reply will be replaced by the inner
-       #  tunneled reply.  Any modifications you made to the outer
-       #  reply will be lost.
-       #
-       #  This example is most useful when the outer session contains
-       #  a User-Name of "anonymous@....", or a MAC address.  If it
-       #  is enabled, the NAS SHOULD use the inner tunnel User-Name
-       #  in subsequent accounting packets.  This makes it easier to
-       #  track user sessions, as they will all be based on the real
-       #  name, and not on "anonymous".
-       #
-       #  The problem with doing this is that it ALSO exposes the
-       #  real user name to any intermediate proxies.  People use
-       #  "anonymous" identifiers outside of the tunnel for a very
-       #  good reason: it gives them more privacy.  Setting the reply
-       #  to contain the real user name removes ALL privacy from
-       #  their session.
-       #
-       #  If you still want to use the inner tunnel User-Name then
-       #  uncomment the section below, otherwise you may want
-       #  to use  Chargeable-User-Identity attribute from RFC 4372.
-       #  See further on.
-       #update outer.reply {
-       #       &User-Name = &request:User-Name
-       #}
-       #
 }
 
 #

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index 6f89de8109fd73d6f0a454feef811506c23ae793..d4d3147a2d8c4be701e891ca8c2d388e62a8c7fd 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -328,6 +328,8 @@ static int mod_authenticate(void *arg, eap_handler_t *handler)
                        pairfilter(handler->request->reply,
                                  &handler->request->reply->vps,
                                  &peap->accept_vps, 0, 0, TAG_ANY);
+               } else if (peap->use_tunneled_reply) {
+                       RDEBUG2("No saved attributes in the original Access-Accept");
                }
 
                /*

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
index c9fec78a5a6346c4c80fc48554a8f474ef2484f9..d7f0753bb0f77113080dd365ecb5ff27c2ebe626 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
@@ -245,11 +245,16 @@ static int mod_authenticate(void *arg, eap_handler_t *handler)
                }
 
                if (t && t->authenticated) {
-                       RDEBUG2("Using saved attributes from the original Access-Accept");
-                       debug_pair_list(t->accept_vps);
-                       pairfilter(handler->request->reply,
-                                 &handler->request->reply->vps,
-                                 &t->accept_vps, 0, 0, TAG_ANY);
+                       if (t->accept_vps) {
+                               RDEBUG2("Using saved attributes from the original Access-Accept");
+                               debug_pair_list(t->accept_vps);
+                               pairfilter(handler->request->reply,
+                                          &handler->request->reply->vps,
+                                          &t->accept_vps, 0, 0, TAG_ANY);
+                       } else if (t->use_tunneled_reply) {
+                               RDEBUG2("No saved attributes in the original Access-Accept");
+                       }
+
                do_keys:
                        /*
                         *      Success: Automatically return MPPE keys.