Port "use_tunneled_reply" fix for MS-CHAP from branch_1_1

[freeradius.git] / src / modules / rlm_eap / types / rlm_eap_ttls / ttls.c

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
index 735d129..bd5d270 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
@@ -18,7 +18,12 @@
  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  *
  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
+ *   Copyright 2006 The FreeRADIUS server project
  */
+
+#include <freeradius-devel/ident.h>
+RCSID("$Id$")
+
 #include "eap_ttls.h"
 
 /*
@@ -608,19 +613,27 @@ static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
                vp = NULL;
                pairmove2(&vp, &reply->vps, PW_MSCHAP2_SUCCESS);
                if (vp) {
-#if 1
-                       /*
-                        *      FIXME: Tunneling MS-CHAP2-Success causes
-                        *      the only client we have access to, to die.
-                        *
-                        *      We don't want that...
-                        */
-                       pairfree(&vp);
-#else
                        DEBUG2("  TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge.");
                        rcode = RLM_MODULE_HANDLED;
                        t->authenticated = TRUE;
-#endif
+                       
+                       /*
+                        *      Delete MPPE keys & encryption policy.  We don't
+                        *      want these here.
+                        */
+                       pairdelete(&reply->vps, ((311 << 16) | 7));
+                       pairdelete(&reply->vps, ((311 << 16) | 8));
+                       pairdelete(&reply->vps, ((311 << 16) | 16));
+                       pairdelete(&reply->vps, ((311 << 16) | 17));
+                       
+                       /*
+                        *      Use the tunneled reply, but not now.
+                        */
+                       if (t->use_tunneled_reply) {
+                               t->reply = reply->vps;
+                               reply->vps = NULL;
+                       }
+
                } else { /* no MS-CHAP2-Success */
                        /*
                         *      Can only have EAP-Message if there's
@@ -988,7 +1001,7 @@ int eapttls_process(EAP_HANDLER *handler, tls_session_t *tls_session)
         *      Update other items in the REQUEST data structure.
         */
        fake->username = pairfind(fake->packet->vps, PW_USER_NAME);
-       fake->password = pairfind(fake->packet->vps, PW_PASSWORD);
+       fake->password = pairfind(fake->packet->vps, PW_USER_PASSWORD);
 
        /*
         *      No User-Name, try to create one from stored data.