From: Alan T. DeKok <aland@freeradius.org>
Date: Sat, 30 Aug 2014 14:34:43 +0000 (-0400)
Subject: Clarify behavior of inner-tunnel replies
X-Git-Tag: release_3_0_5~669
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7916ef65d0d80c96a5c83030a725612772e6ebb7;p=thirdparty%2Ffreeradius-server.git

Clarify behavior of inner-tunnel replies
---

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index 2b650d2a6e7..660fc29d89c 100644
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -253,6 +253,16 @@ session {
 #  Post-Authentication
 #  Once we KNOW that the user has been authenticated, there are
 #  additional steps we can take.
+#
+#  Note that the last packet of the inner-tunnel authentication
+#  MAY NOT BE the last packet of the outer session.  So updating
+#  the outer reply MIGHT work, and sometimes MIGHT NOT.  The
+#  exact functionality depends on both the inner and outer
+#  authentication methods.
+#
+#  If you need to send a reply attribute in the outer session,
+#  the ONLY safe way is to set "use_tunneled_reply = yes", and
+#  then update the inner-tunnel reply.
 post-auth {
 	#  If you want privacy to remain, see the
 	#  Chargeable-User-Identity attribute from RFC 4372.
@@ -296,43 +306,6 @@ post-auth {
 		-sql
 		attr_filter.access_reject
 	}
-
-	#
-	#  The example policy below updates the outer tunnel reply
-	#  (usually Access-Accept) with the User-Name from the inner
-	#  tunnel User-Name.  Since this section is processed in the
-	#  context of the inner tunnel, "request" here means "inner
-	#  tunnel request", and "outer.reply" means "outer tunnel
-	#  reply attributes".
-	#
-	#  Updating the outer reply works ONLY when you have set
-	#  "use_tunneled_reply = no".  If you set that to "yes",
-	#  then the outer reply will be replaced by the inner
-	#  tunneled reply.  Any modifications you made to the outer
-	#  reply will be lost.
-	#
-	#  This example is most useful when the outer session contains
-	#  a User-Name of "anonymous@....", or a MAC address.  If it
-	#  is enabled, the NAS SHOULD use the inner tunnel User-Name
-	#  in subsequent accounting packets.  This makes it easier to
-	#  track user sessions, as they will all be based on the real
-	#  name, and not on "anonymous".
-	#
-	#  The problem with doing this is that it ALSO exposes the
-	#  real user name to any intermediate proxies.  People use
-	#  "anonymous" identifiers outside of the tunnel for a very
-	#  good reason: it gives them more privacy.  Setting the reply
-	#  to contain the real user name removes ALL privacy from
-	#  their session.
-	#
-	#  If you still want to use the inner tunnel User-Name then
-	#  uncomment the section below, otherwise you may want
-	#  to use  Chargeable-User-Identity attribute from RFC 4372.
-	#  See further on.
-	#update outer.reply {
-	#	&User-Name = &request:User-Name
-	#}
-	#
 }
 
 #
diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index 6f89de8109f..d4d3147a2d8 100644
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -328,6 +328,8 @@ static int mod_authenticate(void *arg, eap_handler_t *handler)
 			pairfilter(handler->request->reply,
 				  &handler->request->reply->vps,
 				  &peap->accept_vps, 0, 0, TAG_ANY);
+		} else if (peap->use_tunneled_reply) {
+			RDEBUG2("No saved attributes in the original Access-Accept");
 		}
 
 		/*
diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
index c9fec78a5a6..d7f0753bb0f 100644
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
@@ -245,11 +245,16 @@ static int mod_authenticate(void *arg, eap_handler_t *handler)
 		}
 
 		if (t && t->authenticated) {
-			RDEBUG2("Using saved attributes from the original Access-Accept");
-			debug_pair_list(t->accept_vps);
-			pairfilter(handler->request->reply,
-				  &handler->request->reply->vps,
-				  &t->accept_vps, 0, 0, TAG_ANY);
+			if (t->accept_vps) {
+				RDEBUG2("Using saved attributes from the original Access-Accept");
+				debug_pair_list(t->accept_vps);
+				pairfilter(handler->request->reply,
+					   &handler->request->reply->vps,
+					   &t->accept_vps, 0, 0, TAG_ANY);
+			} else if (t->use_tunneled_reply) {
+				RDEBUG2("No saved attributes in the original Access-Accept");
+			}
+
 		do_keys:
 			/*
 			 *	Success: Automatically return MPPE keys.