remove inner-tunnel from EAP-PWD

diff --git a/raddb/README.rst b/raddb/README.rst
index 1547e0c96b6e0b3374017fd799b4f0f52e42db83..5dade792ffd11a30efbd50724053f0f8f04f1f59 100644 (file)
--- a/raddb/README.rst
+++ b/raddb/README.rst
@@ -171,6 +171,12 @@ a number of users, and they made the code substantially more
 complicated.  Experience shows that having configurable policies in
 ``unlang`` is preferable to having them hard-coded in C.
 
+rlm_eap_pwd
+~~~~~~~~~~~
+
+The `virtual_server` configuration has been removed from EAP-PWD.  The
+module now looks for &request.control:Cleartext-Password.
+
 rlm_expr
 ~~~~~~~~
 

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 5f3821a30337910980d8c86ab1bac531c938e87f..8fa12c81ba2b123ac3bb49571a3dee5b2ebb1d44 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -63,6 +63,11 @@ eap {
 
        ## EAP-PWD (Secure password-based authentication)
        #
+       #  In v4, the "known good" is taken from the
+       #  &request.control:Cleartext-Password list, as is done by
+       #  other modules.  The "inner-tunnel" virtual server is no
+       #  longer used by EAP-PWD.
+       #
 #      pwd {
 #              group = 19
 
@@ -72,15 +77,6 @@ eap {
                #  This has the same meaning as for TLS.
                #
 #              fragment_size = 1020
-
-               #
-               #  The virtual server which determines the "known good" password
-               #  for the user. Note that unlike TLS, only the "authorize"
-               #  section is processed.  EAP-PWD requests can be distinguished
-               #  by having a User-Name, but no User-Password, CHAP-Password,
-               #  EAP-Message, etc.
-               #
-#              virtual_server = "inner-tunnel"
 #      }
 
        ## Cisco LEAP

diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c
index b50c7d9d0bfc25a6d83dae969ea47c67cb0989c8..34e8f19bb47c51ddc8ab491ce2872124fe206a2c 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c
+++ b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c
@@ -46,8 +46,6 @@ static CONF_PARSER submodule_config[] = {
        { FR_CONF_OFFSET("group", PW_TYPE_INTEGER, rlm_eap_pwd_t, group), .dflt = "19" },
        { FR_CONF_OFFSET("fragment_size", PW_TYPE_INTEGER, rlm_eap_pwd_t, fragment_size), .dflt = "1020" },
        { FR_CONF_OFFSET("server_id", PW_TYPE_STRING | PW_TYPE_REQUIRED, rlm_eap_pwd_t, server_id) },
-       { FR_CONF_OFFSET("virtual_server", PW_TYPE_STRING | PW_TYPE_REQUIRED | PW_TYPE_NOT_EMPTY,
-                        rlm_eap_pwd_t, virtual_server) },
        CONF_PARSER_TERMINATOR
 };
 
@@ -125,7 +123,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(void *instance, eap_session_t *e
 static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
 {
        rlm_eap_pwd_t   *inst = talloc_get_type_abort(instance, rlm_eap_pwd_t);
-       REQUEST         *request, *fake;
+       REQUEST         *request;
 
        pwd_session_t   *session;
 
@@ -133,7 +131,7 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
        pwd_id_packet_t *packet;
        eap_packet_t    *response;
 
-       VALUE_PAIR      *pw, *vp;
+       VALUE_PAIR      *vp;
        eap_round_t     *eap_round;
        size_t          in_len;
        rlm_rcode_t     rcode = RLM_MODULE_OK;
@@ -279,65 +277,20 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
                memcpy(session->peer_id, packet->identity, session->peer_id_len);
                session->peer_id[session->peer_id_len] = '\0';
 
-               /*
-                *      Make fake request to get the password for the usable ID
-                */
-               MEM(fake = request_alloc_fake(eap_session->request));
-
-               fake->username = fr_pair_afrom_num(fake->packet, 0, PW_USER_NAME);
-               if (!fake->username) {
-                       RDEBUG("Failed creating pair for peer id");
-                       talloc_free(fake);
-                       return RLM_MODULE_FAIL;
-               }
-               fr_pair_value_bstrncpy(fake->username, session->peer_id, session->peer_id_len);
-               fr_pair_add(&fake->packet->vps, fake->username);
-
-               if ((vp = fr_pair_find_by_num(request->control, 0, PW_VIRTUAL_SERVER, TAG_ANY)) != NULL) {
-                       fake->server = vp->vp_strvalue;
-               } else if (inst->virtual_server) {
-                       fake->server = inst->virtual_server;
-               } /* else fake->server == request->server */
-
-               RDEBUG("Sending tunneled request");
-               rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
-
-               RDEBUG("server %s {", fake->server);
-
-               /*
-                *      Call authorization recursively, which will
-                *      get the password.
-                */
-               RINDENT();
-               process_authorize(0, fake);
-               REXDENT();
-
-               /*
-                *      Note that we don't do *anything* with the reply
-                *      attributes.
-                */
-               RDEBUG2("} # server %s", fake->server);
-
-               RDEBUG2("Got tunneled reply code %d", fake->reply->code);
-               rdebug_pair_list(L_DBG_LVL_2, request, fake->reply->vps, NULL);
-
-               pw = fr_pair_find_by_num(fake->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
-               if (!pw) {
+               vp = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+               if (!vp) {
                        REDEBUG("Failed to find password for %s to do pwd authentication", session->peer_id);
-                       talloc_free(fake);
                        return RLM_MODULE_REJECT;
                }
 
                if (compute_password_element(session, session->group_num,
-                                            pw->vp_strvalue, pw->vp_length,
+                                            vp->vp_strvalue, vp->vp_length,
                                             inst->server_id, strlen(inst->server_id),
                                             session->peer_id, strlen(session->peer_id),
                                             &session->token)) {
                        REDEBUG("Failed to obtain password element");
-                       talloc_free(fake);
                        return RLM_MODULE_FAIL;
                }
-               TALLOC_FREE(fake);
 
                /*
                 *      Compute our scalar and element
@@ -561,11 +514,6 @@ static int mod_instantiate(UNUSED rlm_eap_config_t const *config, void *instance
                return -1;
        }
 
-       if (!cf_section_sub_find_name2(main_config.config, "server", inst->virtual_server)) {
-               cf_log_err_by_name(cs, "virtual_server", "Unknown virtual server '%s'", inst->virtual_server);
-               return -1;
-       }
-
        switch (inst->group) {
        case 19:
        case 20: