add 'copy_request_to_tunnel' and 'use_tunneled_reply' policies (ref 9fa3e6f8)

Tidy up some of the documentation around these, so it's mostly in
one place, and remove some stuff that's just wrong.

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 777a2b57f86f3ed0012c521496b25d310a85c336..0deee9e64ba819173fd717fa8619f32e7e55f6d6 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -790,40 +790,10 @@ eap {
                tls = tls-common
 
                #
-               #  copy_request_to_tunnel has been removed in 3.2.0
+               #  Both copy_request_to_tunnel and use_tunneled_reply have been
+               #  removed in v4.0.
                #
-               #  Attributes from the outer request may be accessed with:
-               #
-               #       &outer:request:<attribute>
-               #
-               #  The old behaviour may be emulated by adding the following
-               #  to the top of the authorize section of the inner tunnel.
-               #
-               #       update {
-               #               &request: += &reply:[*]
-               #       }
-               #
-
-               #
-               #  use_tunneled_reply has been removed in 3.2.0
-               #
-               #  Attributes that should be provided in the reply should
-               #  be copied to the outer.session-state list.
-               #
-               #       update outer.session-state {
-               #               ...
-               #
-               #       }
-               #
-               #  In the post-auth section of the outer server, these attributes
-               #  can then be copied to the reply list.
-               #
-               #  If you want to copy the entire session-state list to the reply
-               #  the following statement may be used:
-               #
-               #       update {
-               #               &reply: += &session-state:[*]
-               #       }
+               #  See sites-available/inner-tunnel for details.
                #
 
                #
@@ -931,15 +901,10 @@ eap {
                default_eap_type = mschapv2
 
                #
-               #  copy_request_to_tunnel has been removed in 3.2.0
-               #
-               #  See notes in the ttls section about emulating this behaviour.
-               #
-
-               #
-               #  use_tunneled_reply has been removed in 3.2.0
+               #  Both copy_request_to_tunnel and use_tunneled_reply have been
+               #  removed in v4.0.
                #
-               #  See notes in the ttls section about emulating this behaviour.
+               #  See sites-available/inner-tunnel for details.
                #
 
                #

diff --git a/raddb/policy.d/eap b/raddb/policy.d/eap
index 0718eab511759648d7b326a0c3f15c42fd73673f..466fe87e00a898a5859e0715c5b17da34c41b475 100644 (file)
--- a/raddb/policy.d/eap
+++ b/raddb/policy.d/eap
@@ -83,3 +83,50 @@ remove_reply_message_if_eap {
        }
 }
 
+#
+#      Copy outer request attributes to the inner tunnel
+#
+#      Similar to the behaviour of the old PEAP and TTLS
+#      configuration option of the same name, but attributes
+#      to copy now have to be explicitly listed.
+#
+copy_request_to_tunnel {
+       update request {
+               Calling-Station-Id = &outer.request:Calling-Station-Id
+               Called-Station-Id = &outer.request:Called-Station-Id
+       }
+}
+
+#
+#      Copy reply attributes to the outer session state
+#
+#      Emulates the behaviour of the old PEAP and TTLS
+#      configuration option of the same name. See
+#      sites-available/inner-tunnel for more details.
+#
+use_tunneled_reply {
+       #
+       #  These attributes are for the inner-tunnel only,
+       #  and MUST NOT be copied to the outer reply.
+       #
+       update reply {
+               User-Name !* ANY
+               Message-Authenticator !* ANY
+               EAP-Message !* ANY
+               Proxy-State !* ANY
+               MS-MPPE-Encryption-Types !* ANY
+               MS-MPPE-Send-Key !* ANY
+               MS-MPPE-Recv-Key !* ANY
+       }
+
+       #
+       #  Copy the inner reply attributes to the outer
+       #  session-state list.  The post-auth policy will take
+       #  care of copying the outer session-state list to the
+       #  outer reply.
+       #
+       update {
+               &outer.session-state: += &reply:
+       }
+}
+

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index cca3f8828b286e18a3e4c7846a2d2162531a5fe9..e6a06ccb8494ff36f2e7e8653a4cdf7c4eb96380 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -46,6 +46,20 @@ listen {
 #  Authorization
 #
 recv Access-Request {
+       #
+       #  The 'copy_request_to_tunnel' option has been removed
+       #  from from v4.0.
+       #
+       #  Individual attributes from the outer request may be
+       #  accessed with:
+       #
+       #      &outer.request:<attribute>
+       #
+       #  The following policy in raddb/policy.d/eap can be used
+       #  to copy attributes over.
+       #
+#      copy_request_to_tunnel
+
        #
        #  Take a User-Name, and perform some checks on it, for spaces and other
        #  invalid characters.  If the User-Name appears invalid, reject the
@@ -224,8 +238,18 @@ authenticate eap {
 #  authentication methods.
 #
 #  If you need to send a reply attribute in the outer session,
-#  the ONLY safe way is to set "use_tunneled_reply = yes", and
-#  then update the inner-tunnel reply.
+#  the ONLY safe way is to update the outer session-state.
+#  Attributes that should be provided in the reply should be
+#  copied to the outer.session-state list:
+#
+#      update outer.session-state {
+#          ...
+#      }
+#
+#  The default configuration in the outer post-auth "send" section
+#  will copy this to the reply. To copy the entire reply see
+#  "use_tunneled_reply" below.
+#
 send Access-Accept {
        #  If you want privacy to remain, see the
        #  Chargeable-User-Identity attribute from RFC 4372.
@@ -257,36 +281,15 @@ send Access-Accept {
        #
 #      ldap
 
-
        #
-       #  Instead of "use_tunneled_reply", change this "if (0)" to an
-       #  "if (1)".
-       #
-       if (0) {
-               #
-               #  These attributes are for the inner-tunnel only,
-               #  and MUST NOT be copied to the outer reply.
-               #
-               update reply {
-                       User-Name !* ANY
-                       Message-Authenticator !* ANY
-                       EAP-Message !* ANY
-                       Proxy-State !* ANY
-                       MS-MPPE-Encryption-Types !* ANY
-                       MS-MPPE-Send-Key !* ANY
-                       MS-MPPE-Recv-Key !* ANY
-               }
-
-               #
-               #  Copy the inner reply attributes to the outer
-               #  session-state list.  The post-auth policy will take
-               #  care of copying the outer session-state list to the
-               #  outer reply.
-               #
-               update {
-                       &outer.session-state: += &reply:
-               }
-       }
+       #  Instead of the "use_tunneled_reply" option in previous
+       #  versions of the server, uncomment the following line to
+       #  copy reply attributes from the inner-tunnel back to the
+       #  outer session-state. The outer "send Access-Accept"
+       #  section will then copy them from the session-state into
+       #  the reply.
+       #
+#      use_tunneled_reply
 }
 
 #