]> git.ipfire.org Git - thirdparty/freeradius-server.git/commitdiff
Only reject nested TLS if the eap method is TLS
authorNick Porter <nick@portercomputing.co.uk>
Wed, 13 Nov 2024 14:26:27 +0000 (14:26 +0000)
committerNick Porter <nick@portercomputing.co.uk>
Wed, 13 Nov 2024 17:07:47 +0000 (17:07 +0000)
Nested requests are used for PEAP now, so you do get
request->parent->parent when processing the inner tunnel.

src/modules/rlm_eap/rlm_eap.c

index f68982e8e897dfd60ea714546b2008b4040c414c..96e0a6ea4b78414bd3e5a333e1bad5eea7a86caa 100644 (file)
@@ -606,7 +606,7 @@ static unlang_action_t eap_method_select(rlm_rcode_t *p_result, module_ctx_t con
         *      parent.  If the outer session exists, and doesn't have
         *      a home server, then it's multiple layers of tunneling.
         */
-       if (eap_session->request->parent &&
+       if (type->num == FR_EAP_METHOD_TLS && eap_session->request->parent &&
            eap_session->request->parent->parent) {
                RERROR("Multiple levels of TLS nesting are invalid");
                goto is_invalid;