src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c  contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  */
  22 #include "eap_tls.h"
  23 #include "eap_peap.h"
  24
  25 /*
  26  *      Send protected EAP-Failure
  27  *
  28  *       Result-TLV = Failure
  29  */
  30 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  31 {
  32         uint8_t tlv_packet[11];
  33
  34         DEBUG2("  rlm_eap_peap: FAILURE");
  35
  36         tlv_packet[0] = PW_EAP_REQUEST;
  37         tlv_packet[1] = handler->eap_ds->response->id +1;
  38         tlv_packet[2] = 0;
  39         tlv_packet[3] = 11;     /* length of this packet */
  40         tlv_packet[4] = PW_EAP_TLV;
  41         tlv_packet[5] = 0x80;
  42         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  43         tlv_packet[7] = 0;
  44         tlv_packet[8] = 2;      /* length of the data portion */
  45         tlv_packet[9] = 0;
  46         tlv_packet[10] = EAP_TLV_FAILURE;
  47
  48         record_plus(&tls_session->clean_in, tlv_packet, 11);
  49
  50         /*
  51          *      FIXME: Check the return code.
  52          */
  53         tls_handshake_send(tls_session);
  54         record_init(&tls_session->clean_in);
  55
  56         return 1;
  57 }
  58
  59
  60 /*
  61  *      Send protected EAP-Success
  62  *
  63  *       Result-TLV = Success
  64  */
  65 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  66 {
  67         uint8_t tlv_packet[11];
  68
  69         DEBUG2("  rlm_eap_peap: SUCCESS");
  70
  71         tlv_packet[0] = PW_EAP_REQUEST;
  72         tlv_packet[1] = handler->eap_ds->response->id +1;
  73         tlv_packet[2] = 0;
  74         tlv_packet[3] = 11;     /* length of this packet */
  75         tlv_packet[4] = PW_EAP_TLV;
  76         tlv_packet[5] = 0x80;   /* mandatory AVP */
  77         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  78         tlv_packet[7] = 0;
  79         tlv_packet[8] = 2;      /* length of the data portion */
  80         tlv_packet[9] = 0;
  81         tlv_packet[10] = EAP_TLV_SUCCESS;
  82
  83         record_plus(&tls_session->clean_in, tlv_packet, 11);
  84
  85         /*
  86          *      FIXME: Check the return code.
  87          */
  88         tls_handshake_send(tls_session);
  89         record_init(&tls_session->clean_in);
  90
  91         return 1;
  92 }
  93
  94
  95 /*
  96  *      Verify the tunneled EAP message.
  97  */
  98 static int eapmessage_verify(const uint8_t *data, unsigned int data_len)
  99 {
 100         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 101         uint8_t eap_type;
 102         char identity[256];
 103
 104         if (!data || (data_len <= 1)) {
 105                 return 0;
 106         }
 107
 108         eap_type = *data;
 109         switch (eap_type) {
 110         case PW_EAP_IDENTITY:
 111                 memcpy(identity, data + 1, data_len - 1);
 112                 identity[data_len - 1] = '\0';
 113                 DEBUG2("  rlm_eap_peap: Identity - %s", identity);
 114                 return 1;
 115                 break;
 116
 117                 /*
 118                  *      If the first byte of the packet is
 119                  *      EAP-Response, and the EAP data is a TLV,
 120                  *      then it looks OK...
 121                  */
 122         case PW_EAP_RESPONSE:
 123                 if (eap_packet->data[0] == PW_EAP_TLV) {
 124                         DEBUG2("  rlm_eap_peap: Received EAP-TLV response.");
 125                         return 1;
 126                 }
 127                 DEBUG2("  rlm_eap_peap: Got something weird.");
 128                 break;
 129
 130
 131                 /*
 132                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 133                  *      Cisco MS-CHAPv2 (29).
 134                  */
 135         case PW_EAP_MSCHAPV2:
 136         default:
 137                 DEBUG2("  rlm_eap_peap: EAP type %d", eap_type);
 138                 return 1;
 139                 break;
 140         }
 141
 142         return 0;
 143 }
 144
 145 /*
 146  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 147  */
 148 static VALUE_PAIR *eap2vp(EAP_DS *eap_ds,
 149                           const uint8_t *data, unsigned int data_len)
 150 {
 151         VALUE_PAIR *vp = NULL;
 152
 153         /*
 154          *      Sanity check this...
 155          */
 156         if (data_len + EAP_HEADER_LEN > MAX_STRING_LEN) {
 157                 radlog(L_ERR, "rlm_eap_peap: EAP Response packet is too large.  Code must be fixed to handle this.");
 158                 return NULL;
 159         }
 160
 161         vp = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS);
 162         if (!vp) {
 163                 DEBUG2("  rlm_eap_peap: Failure in creating VP");
 164                 return NULL;
 165         }
 166
 167         /*
 168          *      Hand-build an EAP packet from the crap in PEAP version 0.
 169          */
 170         vp->strvalue[0] = PW_EAP_RESPONSE;
 171         vp->strvalue[1] = eap_ds->response->id;
 172         vp->strvalue[2] = 0;
 173         vp->strvalue[3] = EAP_HEADER_LEN + data_len;
 174
 175         memcpy(vp->strvalue + EAP_HEADER_LEN, data, data_len);
 176         vp->length = EAP_HEADER_LEN + data_len;
 177
 178         return vp;
 179 }
 180
 181
 182 /*
 183  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 184  *      simple expedient of dumping the EAP message
 185  */
 186 static int vp2eap(tls_session_t *tls_session, VALUE_PAIR *vp)
 187 {
 188         if (vp->next != NULL) {
 189                 radlog(L_ERR, "rlm_eap_peap: EAP Request packet is too large.  Code must be fixed to handle this.");
 190                 return 0;
 191         }
 192
 193         /*
 194          *      Skip the id, code, and length.  Just write the EAP
 195          *      type & data to the client.
 196          */
 197 #ifndef NDEBUG
 198         if (debug_flag > 2) {
 199                 int i;
 200                 int total = vp->length - 4;
 201
 202                 if (debug_flag > 0) for (i = 0; i < total; i++) {
 203                         if ((i & 0x0f) == 0) printf("  PEAP tunnel data out %04x: ", i);
 204
 205                         printf("%02x ", vp->strvalue[i + 4]);
 206
 207                         if ((i & 0x0f) == 0x0f) printf("\n");
 208                 }
 209                 if ((total & 0x0f) != 0) printf("\n");
 210         }
 211 #endif
 212
 213         /*
 214          *      Send the EAP data, WITHOUT the header.
 215          */
 216 #if 1
 217         record_plus(&tls_session->clean_in, vp->strvalue + EAP_HEADER_LEN,
 218                 vp->length - EAP_HEADER_LEN);
 219 #else
 220         record_plus(&tls_session->clean_in, vp->strvalue, vp->length);
 221 #endif
 222         tls_handshake_send(tls_session);
 223         record_init(&tls_session->clean_in);
 224
 225         return 1;
 226 }
 227
 228
 229 /*
 230  *      See if there's a TLV in the response.
 231  */
 232 static int eappeap_check_tlv(const uint8_t *data)
 233 {
 234         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 235
 236         /*
 237          *      Look for success or failure.
 238          */
 239         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 240             (eap_packet->data[0] == PW_EAP_TLV)) {
 241                 if (data[10] == EAP_TLV_SUCCESS) {
 242                         return 1;
 243                 }
 244
 245                 if (data[10] == EAP_TLV_FAILURE) {
 246                         DEBUG2("  rlm_eap_peap: Client rejected our response.  The password is probably incorrect.");
 247                         return 0;
 248                 }
 249         }
 250
 251         return 0;
 252 }
 253
 254
 255 /*
 256  *      Use a reply packet to determine what to do.
 257  */
 258 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 259                          REQUEST *request, RADIUS_PACKET *reply)
 260 {
 261         int rcode = RLM_MODULE_REJECT;
 262         VALUE_PAIR *vp;
 263         peap_tunnel_t *t = tls_session->opaque;
 264
 265         switch (reply->code) {
 266         case PW_AUTHENTICATION_ACK:
 267                 DEBUG2("  PEAP: Tunneled authentication was successful.");
 268                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 269                 eappeap_success(handler, tls_session);
 270                 rcode = RLM_MODULE_OK;
 271
 272                 /*
 273                  *      If we've been told to use the attributes from
 274                  *      the reply, then do so.
 275                  *
 276                  *      WARNING: This may leak information about the
 277                  *      tunneled user!
 278                  */
 279                 if (t->use_tunneled_reply) {
 280                         pairadd(&request->reply->vps, reply->vps);
 281                         reply->vps = NULL;
 282                 }
 283                 break;
 284
 285         case PW_AUTHENTICATION_REJECT:
 286                 DEBUG2("  PEAP: Tunneled authentication was rejected.");
 287                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 288                 eappeap_failure(handler, tls_session);
 289                 rcode = RLM_MODULE_HANDLED;
 290                 break;
 291
 292         case PW_ACCESS_CHALLENGE:
 293                 DEBUG2("  PEAP: Got tunneled Access-Challenge");
 294
 295                 /*
 296                  *      Keep the State attribute, if necessary.
 297                  *
 298                  *      Get rid of the old State, too.
 299                  */
 300                 pairfree(&t->state);
 301                 pairmove2(&t->state, &(reply->vps), PW_STATE);
 302
 303                 /*
 304                  *      PEAP takes only EAP-Message attributes inside
 305                  *      of the tunnel.  Any Reply-Message in the
 306                  *      Access-Challenge is ignored.
 307                  */
 308                 vp = NULL;
 309                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE);
 310
 311                 /*
 312                  *      Handle the ACK, by tunneling any necessary reply
 313                  *      VP's back to the client.
 314                  */
 315                 if (vp) {
 316                         vp2eap(tls_session, vp);
 317                         pairfree(&vp);
 318                 }
 319
 320                 rcode = RLM_MODULE_HANDLED;
 321                 break;
 322
 323         default:
 324                 DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 325                 rcode = RLM_MODULE_REJECT;
 326                 break;
 327         }
 328
 329         return rcode;
 330 }
 331
 332
 333 /*
 334  *      Do post-proxy processing,
 335  */
 336 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 337 {
 338         int rcode;
 339         tls_session_t *tls_session = (tls_session_t *) data;
 340
 341         DEBUG2("  PEAP: Passing reply from proxy back into the tunnel.");
 342
 343         /*
 344          *      Process the reply from the home server.
 345          */
 346         rcode = process_reply(handler, tls_session, handler->request,
 347                               handler->request->proxy_reply);
 348
 349         /*
 350          *      The proxy code uses the reply from the home server as
 351          *      the basis for the reply to the NAS.  We don't want that,
 352          *      so we toss it, after we've had our way with it.
 353          */
 354         pairfree(&handler->request->proxy_reply->vps);
 355
 356         switch (rcode) {
 357         case RLM_MODULE_REJECT:
 358                 DEBUG2("  PEAP: Reply was rejected");
 359                 eaptls_fail(handler->eap_ds, 0);
 360                 return 0;
 361
 362         case RLM_MODULE_HANDLED:
 363                 DEBUG2("  PEAP: Reply was handled");
 364                 eaptls_request(handler->eap_ds, tls_session);
 365                 return 1;
 366
 367         case RLM_MODULE_OK:
 368                 DEBUG2("  PEAP: Reply was OK");
 369                 eaptls_success(handler->eap_ds, 0);
 370                 eaptls_gen_mppe_keys(&handler->request->reply->vps,
 371                                      tls_session->ssl,
 372                                      "client EAP encryption");
 373                 return 1;
 374
 375         default:
 376                 DEBUG2("  PEAP: Reply was unknown.");
 377                 break;
 378         }
 379
 380         eaptls_fail(handler->eap_ds, 0);
 381         return 0;
 382 }
 383
 384
 385 /*
 386  *      Process the pseudo-EAP contents of the tunneled data.
 387  */
 388 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 389 {
 390         int err;
 391         peap_tunnel_t *t = tls_session->opaque;
 392         REQUEST *fake;
 393         VALUE_PAIR *vp;
 394         int rcode = RLM_MODULE_REJECT;
 395         const uint8_t *data;
 396         unsigned int data_len;
 397         unsigned char buffer[1024];
 398 #ifndef NDEBUG
 399         int i;
 400 #endif
 401
 402         REQUEST *request = handler->request;
 403         EAP_DS *eap_ds = handler->eap_ds;
 404
 405         /*
 406          *      Grab the dirty data, and copy it to our buffer.
 407          *
 408          *      I *really* don't like these 'record_t' things...
 409          */
 410         data_len = record_minus(&tls_session->dirty_in, buffer, sizeof(buffer));
 411         data = buffer;
 412
 413         /*
 414          *      Write the data from the dirty buffer (i.e. packet
 415          *      data) into the buffer which we will give to SSL for
 416          *      decoding.
 417          *
 418          *      Some of this code COULD technically go into the TLS
 419          *      module, in eaptls_process(), where it returns EAPTLS_OK.
 420          *
 421          *      Similarly, the writing of data to the SSL context could
 422          *      go there, too...
 423          */
 424         BIO_write(tls_session->into_ssl, buffer, data_len);
 425         record_init(&tls_session->clean_out);
 426
 427         /*
 428          *      Read (and decrypt) the tunneled data from the SSL session,
 429          *      and put it into the decrypted data buffer.
 430          */
 431         err = SSL_read(tls_session->ssl, tls_session->clean_out.data,
 432                        sizeof(tls_session->clean_out.data));
 433         if (err < 0) {
 434                 /*
 435                  *      FIXME: Call SSL_get_error() to see what went
 436                  *      wrong.
 437                  */
 438                 radlog(L_INFO, "rlm_eap_peap: SSL_read Error");
 439                 return RLM_MODULE_REJECT;
 440         }
 441
 442         /*
 443          *      If there's no data, maybe this is an ACK to an
 444          *      MS-CHAP2-Success.
 445          */
 446         if (err == 0) {
 447                 /*
 448                  *      FIXME: Call SSL_get_error() to see what went
 449                  *      wrong.
 450                  */
 451                 radlog(L_INFO, "rlm_eap_peap: No data inside of the tunnel.");
 452                 return RLM_MODULE_REJECT;
 453         }
 454
 455         data_len = tls_session->clean_out.used = err;
 456         data = tls_session->clean_out.data;
 457
 458 #ifndef NDEBUG
 459         if (debug_flag > 2) for (i = 0; i < data_len; i++) {
 460                 if ((i & 0x0f) == 0) printf("  PEAP tunnel data in %04x: ", i);
 461
 462                 printf("%02x ", data[i]);
 463
 464                 if ((i & 0x0f) == 0x0f) printf("\n");
 465         }
 466         if ((data_len & 0x0f) != 0) printf("\n");
 467 #endif
 468
 469         if (!eapmessage_verify(data, data_len)) {
 470                 return RLM_MODULE_REJECT;
 471         }
 472
 473         DEBUG2("  rlm_eap_peap: Tunneled data is valid.");
 474
 475         /*
 476          *      If we authenticated the user, then it's OK.
 477          */
 478         if (t->status == PEAP_STATUS_SENT_TLV_SUCCESS) {
 479                 if (eappeap_check_tlv(data)) {
 480                         DEBUG2("  rlm_eap_peap: Success");
 481                         return RLM_MODULE_OK;
 482                 }
 483
 484                 return RLM_MODULE_REJECT;
 485
 486         } else if (t->status == PEAP_STATUS_SENT_TLV_FAILURE) {
 487                 DEBUG2("  rlm_eap_peap:  Had sent TLV failure, rejecting.");
 488                 return RLM_MODULE_REJECT;
 489         }
 490
 491         fake = request_alloc_fake(request);
 492
 493         rad_assert(fake->packet->vps == NULL);
 494
 495         fake->packet->vps = eap2vp(eap_ds, data, data_len);
 496         if (!fake->packet->vps) {
 497                 DEBUG2("  rlm_eap_peap: Unable to convert tunneled EAP packet to internal server data structures");
 498                 return PW_AUTHENTICATION_REJECT;
 499         }
 500
 501 #ifndef NDEBUG
 502         if (debug_flag > 0) {
 503           printf("  PEAP: Got tunneled EAP-Message\n");
 504
 505           for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 506             putchar('\t');vp_print(stdout, vp);putchar('\n');
 507           }
 508         }
 509 #endif
 510
 511         /*
 512          *      Tell the request that it's a fake one.
 513          */
 514         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 515         if (vp) {
 516                 pairadd(&fake->packet->vps, vp);
 517         }
 518
 519         /*
 520          *      Update other items in the REQUEST data structure.
 521          */
 522         if (!t->username) {
 523                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 524                         t->username = pairmake("User-Name", "", T_OP_EQ);
 525                         rad_assert(t->username != NULL);
 526
 527                         memcpy(t->username->strvalue, data+1, data_len - 1);
 528                         t->username->length = data_len -1;
 529                         t->username->strvalue[t->username->length] = 0;
 530                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->strvalue);
 531
 532                         /*
 533                          *      If there's a default EAP type,
 534                          *      set it here.
 535                          */
 536                         if (t->default_eap_type != 0) {
 537                           DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
 538                           vp = pairmake("EAP-Type", "0", T_OP_EQ);
 539                           vp->lvalue = t->default_eap_type;
 540                           pairadd(&fake->config_items, vp);
 541                         }
 542                 }
 543         } /* else there WAS a t->username */
 544
 545         if (t->username) {
 546                 vp = paircopy(t->username);
 547                 pairadd(&fake->packet->vps, vp);
 548                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME);
 549         }
 550
 551         /*
 552          *      Add the State attribute, too, if it exists.
 553          */
 554         if (t->state) {
 555                 DEBUG2("  PEAP: Adding old state with %02x %02x",
 556                        t->state->strvalue[0], t->state->strvalue[1]);
 557                 vp = paircopy(t->state);
 558                 if (vp) pairadd(&fake->packet->vps, vp);
 559         }
 560
 561         /*
 562          *      If this is set, we copy SOME of the request attributes
 563          *      from outside of the tunnel to inside of the tunnel.
 564          *
 565          *      We copy ONLY those attributes which do NOT already
 566          *      exist in the tunneled request.
 567          *
 568          *      This code is copied from ../rlm_eap_ttls/ttls.c
 569          */
 570         if (t->copy_request_to_tunnel) {
 571                 VALUE_PAIR *copy;
 572
 573                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
 574                         /*
 575                          *      The attribute is a server-side thingy,
 576                          *      don't copy it.
 577                          */
 578                         if ((vp->attribute > 255) &&
 579                             (((vp->attribute >> 16) & 0xffff) == 0)) {
 580                                 continue;
 581                         }
 582
 583                         /*
 584                          *      The outside attribute is already in the
 585                          *      tunnel, don't copy it.
 586                          *
 587                          *      This works for BOTH attributes which
 588                          *      are originally in the tunneled request,
 589                          *      AND attributes which are copied there
 590                          *      from below.
 591                          */
 592                         if (pairfind(fake->packet->vps, vp->attribute)) {
 593                                 continue;
 594                         }
 595
 596                         /*
 597                          *      Some attributes are handled specially.
 598                          */
 599                         switch (vp->attribute) {
 600                                 /*
 601                                  *      NEVER copy Message-Authenticator,
 602                                  *      EAP-Message, or State.  They're
 603                                  *      only for outside of the tunnel.
 604                                  */
 605                         case PW_USER_NAME:
 606                         case PW_USER_PASSWORD:
 607                         case PW_CHAP_PASSWORD:
 608                         case PW_CHAP_CHALLENGE:
 609                         case PW_PROXY_STATE:
 610                         case PW_MESSAGE_AUTHENTICATOR:
 611                         case PW_EAP_MESSAGE:
 612                         case PW_STATE:
 613                                 continue;
 614                                 break;
 615
 616                                 /*
 617                                  *      By default, copy it over.
 618                                  */
 619                         default:
 620                                 break;
 621                         }
 622
 623                         /*
 624                          *      Don't copy from the head, we've already
 625                          *      checked it.
 626                          */
 627                         copy = paircopy2(vp, vp->attribute);
 628                         pairadd(&fake->packet->vps, copy);
 629                 }
 630         }
 631
 632 #ifndef NDEBUG
 633         if (debug_flag > 0) {
 634                 printf("  PEAP: Sending tunneled request\n");
 635
 636                 for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 637                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 638                 }
 639         }
 640 #endif
 641
 642         /*
 643          *      Call authentication recursively, which will
 644          *      do PAP, CHAP, MS-CHAP, etc.
 645          */
 646         rad_authenticate(fake);
 647
 648         /*
 649          *      Note that we don't do *anything* with the reply
 650          *      attributes.
 651          */
 652 #ifndef NDEBUG
 653         if (debug_flag > 0) {
 654                 printf("  PEAP: Got tunneled reply RADIUS code %d\n",
 655                  fake->reply->code);
 656
 657                 for (vp = fake->reply->vps; vp != NULL; vp = vp->next) {
 658                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 659                 }
 660         }
 661 #endif
 662
 663         /*
 664          *      Decide what to do with the reply.
 665          */
 666         switch (fake->reply->code) {
 667         case 0:                 /* No reply code, must be proxied... */
 668                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM);
 669                 if (vp) {
 670                         eap_tunnel_data_t *tunnel;
 671                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->strvalue);
 672
 673                         /*
 674                          *      Tell the original request that it's going
 675                          *      to be proxied.
 676                          */
 677                         pairmove2(&(request->config_items),
 678                                   &(fake->config_items),
 679                                   PW_PROXY_TO_REALM);
 680
 681                         /*
 682                          *      Seed the proxy packet with the
 683                          *      tunneled request.
 684                          */
 685                         rad_assert(request->proxy == NULL);
 686                         request->proxy = fake->packet;
 687                         fake->packet = NULL;
 688
 689                         /*
 690                          *      Set up the callbacks for the tunnel
 691                          */
 692                         tunnel = rad_malloc(sizeof(*tunnel));
 693                         memset(tunnel, 0, sizeof(*tunnel));
 694
 695                         tunnel->tls_session = tls_session;
 696                         tunnel->callback = eappeap_postproxy;
 697
 698                         /*
 699                          *      Associate the callback with the request.
 700                          */
 701                         rcode = request_data_add(request,
 702                                                  request->proxy,
 703                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
 704                                                  tunnel, free);
 705                         rad_assert(rcode == 0);
 706
 707                         /*
 708                          *      Didn't authenticate the packet, but
 709                          *      we're proxying it.
 710                          */
 711                         rcode = RLM_MODULE_UPDATED;
 712
 713                 } else {
 714                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
 715                         rcode = RLM_MODULE_REJECT;
 716                 }
 717                 break;
 718
 719         default:
 720                 rcode = process_reply(handler, tls_session, request,
 721                                       fake->reply);
 722                 break;
 723         }
 724
 725         request_free(&fake);
 726
 727         return rcode;
 728 }