From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sun, 1 Jun 2025 01:38:01 +0000 (-0600)
Subject: Set priority of the process_reply function high enough to bubble up
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1ec60de22af368efd1cb537e3f15937e5293af74;p=thirdparty%2Ffreeradius-server.git

Set priority of the process_reply function high enough to bubble up
---

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
index c8ba8dac95f..23d33d766ee 100644
--- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c
@@ -275,7 +275,7 @@ static int eap_peap_check_tlv(request_t *request, uint8_t const *data, size_t da
  */
 static unlang_action_t process_reply(unlang_result_t *p_result, request_t *request, UNUSED void *uctx)
 {
-	eap_session_t		*eap_session = eap_session_get(request->parent);
+	eap_session_t		*eap_session = talloc_get_type_abort(uctx, eap_session_t);
 	eap_tls_session_t	*eap_tls_session = talloc_get_type_abort(eap_session->opaque, eap_tls_session_t);
 	fr_tls_session_t	*tls_session = eap_tls_session->tls_session;
 	fr_pair_list_t		vps;
@@ -283,6 +283,11 @@ static unlang_action_t process_reply(unlang_result_t *p_result, request_t *reque
 	request_t		*parent = request->parent;
 	fr_packet_t		*reply = request->reply;
 
+	/*
+	 *	Bubble this rcode up to become the result of the subrequest
+	 */
+	p_result->priority = MOD_PRIORITY_MAX;
+
 	if (RDEBUG_ENABLED2) {
 
 		/*
@@ -578,17 +583,31 @@ unlang_action_t eap_peap_process(unlang_result_t *p_result, request_t *request,
 		RDEBUG2("No tunnel username (SSL resumption?)");
 	}
 
-	if (unlang_subrequest_child_push(child, &eap_session->submodule_result,
+	if (unlang_subrequest_child_push(&eap_session->submodule_result, child,
 					 child,
 					 false, UNLANG_SUB_FRAME) < 0) goto finish;
+
+	/*
+	 *	Setup a function in thie child to process the
+	 *	result of the subrequest.
+	 */
 	if (unlang_function_push(NULL, child, NULL, process_reply, NULL, 0,
 				 UNLANG_SUB_FRAME, eap_session) != UNLANG_ACTION_PUSHED_CHILD) goto finish;
 
 	/*
-	 *	Call authentication recursively, which will
-	 *	do PAP, CHAP, MS-CHAP, etc.
+	 *	Run inner tunnel in the context of the child
+	 */
+	if (eap_virtual_server(child, eap_session, t->server_cs) == UNLANG_ACTION_FAIL) {
+		rcode = RLM_MODULE_FAIL;
+		goto finish;
+	}
+
+	/*
+	 *	We now yield to the subrequest.  unlang_subrequest_child_push
+	 *	pushed a new frame in the context of the parent which'll start
+	 *	the subrequest.
 	 */
-	return eap_virtual_server(child, eap_session, t->server_cs);
+	return UNLANG_ACTION_PUSHED_CHILD;
 
 finish:
 	if (child) request_detach(child);