From: Arran Cudbard-Bell Date: Thu, 26 May 2016 22:09:06 +0000 (-0400) Subject: Remove support for use_tunneled_reply and copy_request_to_tunnel X-Git-Tag: branch_3_1_x~312 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d4d38d5e2b6ffd2f6b5076fb9cbf70b3c2c3525;p=thirdparty%2Ffreeradius-server.git Remove support for use_tunneled_reply and copy_request_to_tunnel It's time for them to die as their functionality can be emulated with unlang. --- diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 8e685fa5433..d431c714f53 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap @@ -741,32 +741,33 @@ eap { tls = tls-common # - # The tunneled authentication request does not usually contain - # useful attributes like 'Calling-Station-Id', etc. These - # attributes are outside of the tunnel, and normally - # unavailable to the tunneled authentication request. + # copy_request_to_tunnel has been removed in 3.2.0 # - # By setting this configuration entry to 'yes', any attribute - # which is NOT in the tunneled authentication request, but - # which IS available outside of the tunnel, is copied to the - # tunneled request. + # Attributes from the outer request may be accessed with: # - # allowed values: {no, yes} + # &outer:request: # - copy_request_to_tunnel = no - + # The old behaviour may be emulated by adding the following + # to the top of the authorize section of the inner tunnel. # - # As of version 3.0.5, this configuration item - # is deprecated. Instead, you should use copy any required - # authorizational attributes to outer.session-state. + # update { + # &request: += &reply:[*] + # } + # + + # + # use_tunneled_reply has been removed in 3.2.0 + # + # Attributes that should be provided in the reply should + # be copied to the outer.session-state list. # # update outer.session-state { # ... # # } # - # In the post-auth section of the outer server, attributes can - # then be copied to the reply list. + # In the post-auth section of the outer server, these attributes + # can then be copied to the reply list. # # If you want to copy the entire session-state list to the reply # the following statement may be used: @@ -775,16 +776,6 @@ eap { # &reply: += &session-state:[*] # } # - # The reply attributes sent to the NAS are usually based on the - # name of the user 'outside' of the tunnel (usually - # 'anonymous'). If you want to send the reply attributes based - # on the user name inside of the tunnel, then set this - # configuration entry to 'yes', and the reply to the NAS will - # be taken from the reply to the tunneled request. - # - # allowed values: {no, yes} - # - use_tunneled_reply = no # # The inner tunneled request can be sent through a virtual @@ -887,24 +878,17 @@ eap { default_eap_type = mschapv2 # - # The PEAP module also has these configuration items, which are - # the same as for TTLS. + # copy_request_to_tunnel has been removed in 3.2.0 # - copy_request_to_tunnel = no - - # - # As of version 3.0.5, this configuration item is deprecated. - # Instead, you should use + # See notes in the ttls section about emulating this behaviour. # - # update outer.session-state { - # ... + # - # } + # use_tunneled_reply has been removed in 3.2.0 # - # This will cache attributes for the final Access-Accept. + # See notes in the ttls section about emulating this behaviour. # - use_tunneled_reply = no - + # # When the tunneled session is proxied, the home server may not # understand EAP-MSCHAP-V2. Set this entry to "no" to proxy the diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h index d6f6ec3deb6..7488a2f56da 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h +++ b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h @@ -47,13 +47,9 @@ typedef enum { typedef struct peap_tunnel_t { VALUE_PAIR *username; - VALUE_PAIR *state; - VALUE_PAIR *accept_vps; peap_status status; bool home_access_accept; int default_method; - bool copy_request_to_tunnel; - bool use_tunneled_reply; bool proxy_tunneled_request_as_eap; char const *virtual_server; bool soh; diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c index 37103413364..2f43181fa7f 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c @@ -397,41 +397,6 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_session_t *eap_session, tl t->status = PEAP_STATUS_SENT_TLV_SUCCESS; eap_peap_success(eap_session, tls_session); rcode = RLM_MODULE_HANDLED; - - /* - * If we've been told to use the attributes from - * the reply, then do so. - * - * WARNING: This may leak information about the - * tunneled user! - */ - if (t->use_tunneled_reply) { - RDEBUG2("Saving tunneled attributes for later"); - - /* - * Clean up the tunneled reply. - */ - fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY); - - /* - * Delete MPPE keys & encryption policy. We don't - * want these here. - */ - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, - PW_MSCHAP_MPPE_ENCRYPTION_POLICY, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, - PW_MSCHAP_MPPE_ENCRYPTION_TYPES, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, - PW_MSCHAP_MPPE_SEND_KEY, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, - PW_MSCHAP_MPPE_RECV_KEY, TAG_ANY); - - fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */ - fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY); - rad_assert(!reply->vps); - } break; case PW_CODE_ACCESS_REJECT: @@ -444,14 +409,6 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_session_t *eap_session, tl case PW_CODE_ACCESS_CHALLENGE: RDEBUG2("Got tunneled Access-Challenge"); - /* - * Keep the State attribute, if necessary. - * - * Get rid of the old State, too. - */ - fr_pair_list_free(&t->state); - fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, 0, PW_STATE, TAG_ANY); - /* * PEAP takes only EAP-Message attributes inside * of the tunnel. Any Reply-Message in the @@ -460,27 +417,6 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_session_t *eap_session, tl vp = NULL; fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY); - /* - * Handle EAP-MSCHAP-V2, where Access-Accept's - * from the home server may contain MS-CHAP2-Success, - * which the module turns into challenges, so that - * the client may respond to the challenge with - * an "ack" packet. - */ - if (t->home_access_accept && t->use_tunneled_reply) { - RDEBUG2("Saving tunneled attributes for later"); - - /* - * Clean up the tunneled reply. - */ - fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY); - - rad_assert(!t->accept_vps); - fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY); - rad_assert(!reply->vps); - } - /* * Handle the ACK, by tunneling any necessary reply * VP's back to the client. @@ -1135,84 +1071,5 @@ static int CC_HINT(nonnull) setup_fake_request(REQUEST *request, REQUEST *fake, RDEBUG2("No tunnel username (SSL resumption?)"); } - - /* - * Add the State attribute, too, if it exists. - */ - if (t->state) { - vp = fr_pair_list_copy(fake->packet, t->state); - if (vp) fr_pair_add(&fake->packet->vps, vp); - } - - /* - * If this is set, we copy SOME of the request attributes - * from outside of the tunnel to inside of the tunnel. - * - * We copy ONLY those attributes which do NOT already - * exist in the tunneled request. - * - * This code is copied from ../rlm_eap_ttls/ttls.c - */ - if (t->copy_request_to_tunnel) { - VALUE_PAIR *copy; - vp_cursor_t cursor; - - for (vp = fr_cursor_init(&cursor, &request->packet->vps); - vp; - vp = fr_cursor_next(&cursor)) { - /* - * The attribute is a server-side thingy, - * don't copy it. - */ - if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) { - continue; - } - - /* - * The outside attribute is already in the - * tunnel, don't copy it. - * - * This works for BOTH attributes which - * are originally in the tunneled request, - * AND attributes which are copied there - * from below. - */ - if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue; - - /* - * Some attributes are handled specially. - */ - if (!vp->da->vendor) switch (vp->da->attr) { - /* - * NEVER copy Message-Authenticator, - * EAP-Message, or State. They're - * only for outside of the tunnel. - */ - case PW_USER_NAME: - case PW_USER_PASSWORD: - case PW_CHAP_PASSWORD: - case PW_CHAP_CHALLENGE: - case PW_PROXY_STATE: - case PW_MESSAGE_AUTHENTICATOR: - case PW_EAP_MESSAGE: - case PW_STATE: - continue; - - /* - * By default, copy it over. - */ - default: - break; - } - - /* - * Don't copy from the head, we've already - * checked it. - */ - copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->vendor, vp->da->attr, TAG_ANY); - fr_pair_add(&fake->packet->vps, copy); - } - } - return 0; } diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c index b097149799e..2e53cb1534f 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c @@ -54,9 +54,9 @@ static CONF_PARSER module_config[] = { { FR_CONF_OFFSET("inner_eap_module", PW_TYPE_STRING, rlm_eap_peap_t, inner_eap_module), }, - { FR_CONF_OFFSET("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_peap_t, copy_request_to_tunnel), .dflt = "no" }, + { FR_CONF_DEPRECATED("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_peap_t, NULL), .dflt = "no" }, - { FR_CONF_OFFSET("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_peap_t, use_tunneled_reply), .dflt = "no" }, + { FR_CONF_DEPRECATED("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_peap_t, NULL), .dflt = "no" }, #ifdef WITH_PROXY { FR_CONF_OFFSET("proxy_tunneled_request_as_eap", PW_TYPE_BOOLEAN, rlm_eap_peap_t, proxy_tunneled_request_as_eap), .dflt = "yes" }, @@ -137,8 +137,6 @@ static peap_tunnel_t *peap_alloc(TALLOC_CTX *ctx, rlm_eap_peap_t *inst) t = talloc_zero(ctx, peap_tunnel_t); - t->copy_request_to_tunnel = inst->copy_request_to_tunnel; - t->use_tunneled_reply = inst->use_tunneled_reply; #ifdef WITH_PROXY t->proxy_tunneled_request_as_eap = inst->proxy_tunneled_request_as_eap; #endif @@ -316,20 +314,6 @@ static int mod_process(void *arg, eap_session_t *eap_session) * our Access-Accept. */ peap = tls_session->opaque; - if (peap->soh_reply_vps) { - RDEBUG2("Using saved attributes from the SoH reply"); - rdebug_pair_list(L_DBG_LVL_2, request, peap->soh_reply_vps, NULL); - fr_pair_list_mcopy_by_num(eap_session->request->reply, &eap_session->request->reply->vps, - &peap->soh_reply_vps, 0, 0, TAG_ANY); - } - if (peap->accept_vps) { - RDEBUG2("Using saved attributes from the original Access-Accept"); - rdebug_pair_list(L_DBG_LVL_2, request, peap->accept_vps, NULL); - fr_pair_list_mcopy_by_num(eap_session->request->reply, &eap_session->request->reply->vps, - &peap->accept_vps, 0, 0, TAG_ANY); - } else if (peap->use_tunneled_reply) { - RDEBUG2("No saved attributes in the original Access-Accept"); - } /* * Success: Automatically return MPPE keys. diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h b/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h index f7940732c82..1e4f518848b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h +++ b/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h @@ -29,11 +29,7 @@ RCSIDH(eap_ttls_h, "$Id$") typedef struct ttls_tunnel_t { VALUE_PAIR *username; - VALUE_PAIR *state; - VALUE_PAIR *accept_vps; bool authenticated; - bool copy_request_to_tunnel; - bool use_tunneled_reply; char const *virtual_server; } ttls_tunnel_t; diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c index 298e28073bb..2dd13adfe7d 100644 --- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c +++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c @@ -35,18 +35,6 @@ typedef struct rlm_eap_ttls_t { char const *tls_conf_name; fr_tls_conf_t *tls_conf; - /* - * Use the reply attributes from the tunneled session in - * the non-tunneled reply to the client. - */ - bool use_tunneled_reply; - - /* - * Use SOME of the request attributes from outside of the - * tunneled session in the tunneled request - */ - bool copy_request_to_tunnel; - /* * RFC 5281 (TTLS) says that the length field MUST NOT be * in fragments after the first one. However, we've done @@ -72,8 +60,8 @@ typedef struct rlm_eap_ttls_t { static CONF_PARSER module_config[] = { { FR_CONF_OFFSET("tls", PW_TYPE_STRING, rlm_eap_ttls_t, tls_conf_name) }, - { FR_CONF_OFFSET("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, copy_request_to_tunnel), .dflt = "no" }, - { FR_CONF_OFFSET("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, use_tunneled_reply), .dflt = "no" }, + { FR_CONF_DEPRECATED("copy_request_to_tunnel", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, NULL), .dflt = "no" }, + { FR_CONF_DEPRECATED("use_tunneled_reply", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, NULL), .dflt = "no" }, { FR_CONF_OFFSET("virtual_server", PW_TYPE_STRING | PW_TYPE_REQUIRED | PW_TYPE_NOT_EMPTY, rlm_eap_ttls_t, virtual_server) }, { FR_CONF_OFFSET("include_length", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, include_length), .dflt = "yes" }, { FR_CONF_OFFSET("require_client_cert", PW_TYPE_BOOLEAN, rlm_eap_ttls_t, req_client_cert), .dflt = "no" }, @@ -124,8 +112,6 @@ static ttls_tunnel_t *ttls_alloc(TALLOC_CTX *ctx, rlm_eap_ttls_t *inst) ttls_tunnel_t *t; t = talloc_zero(ctx, ttls_tunnel_t); - t->copy_request_to_tunnel = inst->copy_request_to_tunnel; - t->use_tunneled_reply = inst->use_tunneled_reply; t->virtual_server = inst->virtual_server; return t; @@ -221,16 +207,6 @@ static int mod_process(void *arg, eap_session_t *eap_session) } if (tunnel && tunnel->authenticated) { - if (tunnel->accept_vps) { - RDEBUG2("Using saved attributes from the original Access-Accept"); - rdebug_pair_list(L_DBG_LVL_2, request, tunnel->accept_vps, NULL); - fr_pair_list_mcopy_by_num(eap_session->request->reply, - &eap_session->request->reply->vps, &tunnel->accept_vps, 0, 0, - TAG_ANY); - } else if (tunnel->use_tunneled_reply) { - RDEBUG2("No saved attributes in the original Access-Accept"); - } - do_keys: /* * Success: Automatically return MPPE keys. diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c index abb49c9a496..49ee6e9344a 100644 --- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c @@ -466,9 +466,12 @@ static int vp2diameter(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *eap_session, tls_session_t *tls_session, REQUEST *request, RADIUS_PACKET *reply) { - rlm_rcode_t rcode = RLM_MODULE_REJECT; - VALUE_PAIR *vp; - ttls_tunnel_t *t = tls_session->opaque; + rlm_rcode_t rcode = RLM_MODULE_REJECT; + VALUE_PAIR *vp, *tunnel_vps = NULL; + vp_cursor_t cursor; + vp_cursor_t to_tunnel; + + ttls_tunnel_t *t = tls_session->opaque; rad_assert(eap_session->request == request); @@ -495,97 +498,43 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e */ switch (reply->code) { case PW_CODE_ACCESS_ACCEPT: + { RDEBUG("Got tunneled Access-Accept"); + fr_cursor_init(&to_tunnel, &tunnel_vps); rcode = RLM_MODULE_OK; /* - * Always delete MPPE keys & encryption policy - * from the tunneled reply. These never get sent - * back to the user. - */ - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_ENCRYPTION_POLICY, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_ENCRYPTION_TYPES, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_SEND_KEY, TAG_ANY); - fr_pair_delete_by_num(&reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_RECV_KEY, TAG_ANY); - - /* - * MS-CHAP2-Success means that we do NOT return - * an Access-Accept, but instead tunnel that - * attribute to the client, and keep going with - * the TTLS session. Once the client accepts - * our identity, it will respond with an empty - * packet, and we will send EAP-Success. + * Copy what we need into the TTLS tunnel and leave + * the rest to be cleaned up. */ - vp = NULL; - fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_SUCCESS, - TAG_ANY); - if (vp) { - RDEBUG("Got MS-CHAP2-Success, tunneling it to the client in a challenge"); - rcode = RLM_MODULE_HANDLED; - t->authenticated = true; + for (vp = fr_cursor_init(&cursor, &reply->vps); + vp; + vp = fr_cursor_next(&cursor)) { + switch (vp->da->vendor) { + case VENDORPEC_MICROSOFT: + if (vp->da->attr == PW_MSCHAP2_SUCCESS) { + RDEBUG("Got MS-CHAP2-Success, tunneling it to the client in a challenge"); - /* - * Use the tunneled reply, but not now. - */ - if (t->use_tunneled_reply) { - rad_assert(!t->accept_vps); - fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY); - rad_assert(!reply->vps); - } + rcode = RLM_MODULE_HANDLED; + t->authenticated = true; + fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp)); + } + break; - } else { /* no MS-CHAP2-Success */ - /* - * Can only have EAP-Message if there's - * no MS-CHAP2-Success. - * - * We also do NOT tunnel the EAP-Success - * attribute back to the client, as the client - * can figure it out, from the non-tunneled - * EAP-Success packet. - */ - fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY); - fr_pair_list_free(&vp); - } + case VENDORPEC_UKERNA: + if (vp->da->attr == PW_UKERNA_CHBIND) { + rcode = RLM_MODULE_HANDLED; + t->authenticated = true; + fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp)); + } + break; - /* move channel binding responses; we need to send them */ - fr_pair_list_mcopy_by_num(tls_session, &vp, &reply->vps, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY); - if (fr_pair_find_by_num(vp, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY) != NULL) { - t->authenticated = true; - /* - * Use the tunneled reply, but not now. - */ - if (t->use_tunneled_reply) { - rad_assert(!t->accept_vps); - fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY); - rad_assert(!reply->vps); + default: + break; } - rcode = RLM_MODULE_HANDLED; - } - - /* - * Handle the ACK, by tunneling any necessary reply - * VP's back to the client. - */ - if (vp) { - RDEBUG("Sending tunneled reply attributes"); - rdebug_pair_list(L_DBG_LVL_1, request, vp, NULL); - - vp2diameter(request, tls_session, vp); - fr_pair_list_free(&vp); - } - - /* - * If we've been told to use the attributes from - * the reply, then do so. - * - * WARNING: This may leak information about the - * tunneled user! - */ - if (t->use_tunneled_reply) { - fr_pair_delete_by_num(&reply->vps, 0, PW_PROXY_STATE, TAG_ANY); - fr_pair_list_mcopy_by_num(request->reply, &request->reply->vps, &reply->vps, 0, 0, TAG_ANY); } + } break; @@ -594,53 +543,46 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e rcode = RLM_MODULE_REJECT; break; - /* - * Handle Access-Challenge, but only if we - * send tunneled reply data. This is because - * an Access-Challenge means that we MUST tunnel - * a Reply-Message to the client. - */ + /* + * Handle Access-Challenge, but only if we + * send tunneled reply data. This is because + * an Access-Challenge means that we MUST tunnel + * a Reply-Message to the client. + */ case PW_CODE_ACCESS_CHALLENGE: RDEBUG("Got tunneled Access-Challenge"); - /* - * Keep the State attribute, if necessary. - * - * Get rid of the old State, too. - */ - fr_pair_list_free(&t->state); - fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, 0, PW_STATE, TAG_ANY); + fr_cursor_init(&to_tunnel, &tunnel_vps); /* - * We should really be a bit smarter about this, - * and move over only those attributes which - * are relevant to the authentication request, - * but that's a lot more work, and this "dumb" - * method works in 99.9% of the situations. + * Copy what we need into the TTLS tunnel and leave + * the rest to be cleaned up. */ - vp = NULL; - fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY); + for (vp = fr_cursor_init(&cursor, &reply->vps); + vp; + vp = fr_cursor_next(&cursor)) { + switch (vp->da->vendor) { + case VENDORPEC_UKERNA: + if (vp->da->attr == PW_UKERNA_CHBIND) { + fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp)); + } + break; - /* - * There MUST be a Reply-Message in the challenge, - * which we tunnel back to the client. - * - * If there isn't one in the reply VP's, then - * we MUST create one, with an empty string as - * it's value. - */ - fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_REPLY_MESSAGE, TAG_ANY); + case 0: + switch (vp->da->attr) { + case PW_EAP_MESSAGE: + case PW_REPLY_MESSAGE: + fr_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp)); + break; - /* also move chbind messages, if any */ - fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY); + default: + break; - /* - * Handle the ACK, by tunneling any necessary reply - * VP's back to the client. - */ - if (vp) { - vp2diameter(request, tls_session, vp); - fr_pair_list_free(&vp); + } + + default: + continue; + } } rcode = RLM_MODULE_HANDLED; break; @@ -651,6 +593,19 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(NDEBUG_UNUSED eap_session_t *e break; } + + /* + * Pack any tunnelled VPs and send them back + * to the supplicant. + */ + if (tunnel_vps) { + RDEBUG("Sending tunneled reply attributes"); + rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL); + + vp2diameter(request, tls_session, tunnel_vps); + fr_pair_list_free(&tunnel_vps); + } + return rcode; } @@ -900,83 +855,6 @@ PW_CODE eap_ttls_process(eap_session_t *eap_session, tls_session_t *tls_session) } } /* else the request ALREADY had a User-Name */ - /* - * Add the State attribute, too, if it exists. - */ - if (t->state) { - vp = fr_pair_list_copy(fake->packet, t->state); - if (vp) fr_pair_add(&fake->packet->vps, vp); - } - - /* - * If this is set, we copy SOME of the request attributes - * from outside of the tunnel to inside of the tunnel. - * - * We copy ONLY those attributes which do NOT already - * exist in the tunneled request. - */ - if (t->copy_request_to_tunnel) { - VALUE_PAIR *copy; - vp_cursor_t cursor; - - for (vp = fr_cursor_init(&cursor, &request->packet->vps); vp; vp = fr_cursor_next(&cursor)) { - /* - * The attribute is a server-side thingy, - * don't copy it. - */ - if ((vp->da->attr > 255) && - (vp->da->vendor == 0)) { - continue; - } - - /* - * The outside attribute is already in the - * tunnel, don't copy it. - * - * This works for BOTH attributes which - * are originally in the tunneled request, - * AND attributes which are copied there - * from below. - */ - if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) { - continue; - } - - /* - * Some attributes are handled specially. - */ - if (!vp->da->vendor) switch (vp->da->attr) { - /* - * NEVER copy Message-Authenticator, - * EAP-Message, or State. They're - * only for outside of the tunnel. - */ - case PW_USER_NAME: - case PW_USER_PASSWORD: - case PW_CHAP_PASSWORD: - case PW_CHAP_CHALLENGE: - case PW_PROXY_STATE: - case PW_MESSAGE_AUTHENTICATOR: - case PW_EAP_MESSAGE: - case PW_STATE: - continue; - - /* - * By default, copy it over. - */ - default: - break; - } - - /* - * Don't copy from the head, we've already - * checked it. - */ - copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->vendor, vp->da->attr, TAG_ANY); - fr_pair_add(&fake->packet->vps, copy); - } - } - /* * Process channel binding. */ diff --git a/src/tests/eapol_test/config/methods-available/peap b/src/tests/eapol_test/config/methods-available/peap index 836810ef421..a6e22cfd0f9 100644 --- a/src/tests/eapol_test/config/methods-available/peap +++ b/src/tests/eapol_test/config/methods-available/peap @@ -19,24 +19,6 @@ peap { # default_eap_type = mschapv2 - # The PEAP module also has these configuration - # items, which are the same as for TTLS. - # - copy_request_to_tunnel = no - - # - # As of version 3.0.5, this configuration item - # is deprecated. Instead, you should use - # - # update outer.session-state { - # ... - # - # } - # - # This will cache attributes for the final Access-Accept. - # - use_tunneled_reply = no - # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled diff --git a/src/tests/eapol_test/config/methods-available/ttls b/src/tests/eapol_test/config/methods-available/ttls index 4ed93b60745..7498caa3678 100644 --- a/src/tests/eapol_test/config/methods-available/ttls +++ b/src/tests/eapol_test/config/methods-available/ttls @@ -28,45 +28,6 @@ ttls { # default_eap_type = md5 - # The tunneled authentication request does not usually - # contain useful attributes like 'Calling-Station-Id', - # etc. These attributes are outside of the tunnel, - # and normally unavailable to the tunneled - # authentication request. - # - # By setting this configuration entry to 'yes', - # any attribute which is NOT in the tunneled - # authentication request, but which IS available - # outside of the tunnel, is copied to the tunneled - # request. - # - # allowed values: {no, yes} - # - copy_request_to_tunnel = no - - # - # As of version 3.0.5, this configuration item - # is deprecated. Instead, you should use - # - # update outer.session-state { - # ... - # - # } - # - # This will cache attributes for the final Access-Accept. - # - # The reply attributes sent to the NAS are usually - # based on the name of the user 'outside' of the - # tunnel (usually 'anonymous'). If you want to send - # the reply attributes based on the user name inside - # of the tunnel, then set this configuration entry to - # 'yes', and the reply to the NAS will be taken from - # the reply to the tunneled request. - # - # allowed values: {no, yes} - # - use_tunneled_reply = no - # # The inner tunneled request can be sent # through a virtual server constructed