Define RAD_REQUEST_OPTION_PROXY_EAP, and don't get excited

	if we have an EAP response without Success/Fail when that
	option is set, as the request will be proxied.

diff --git a/src/modules/rlm_eap/eap.c b/src/modules/rlm_eap/eap.c
index f22e0a5..eac0399 100644 (file)
--- a/src/modules/rlm_eap/eap.c
+++ b/src/modules/rlm_eap/eap.c
@@ -224,8 +224,9 @@ int eaptype_select(rlm_eap_t *inst, EAP_HANDLER *handler)
                if ((default_eap_type < PW_EAP_MD5) ||
                    (default_eap_type > PW_EAP_MAX_TYPES) ||
                    (inst->types[default_eap_type] == NULL)) {
-                       DEBUG2(" rlm_eap: No such EAP type %d",
-                              default_eap_type);
+                       DEBUG2(" rlm_eap: No such EAP type %s",
+                              eaptype_type2name(default_eap_type,
+                                                namebuf, sizeof(namebuf)));
                        return EAP_INVALID;
                }
                
@@ -565,6 +566,15 @@ int eap_compose(EAP_HANDLER *handler)
                rcode = RLM_MODULE_HANDLED;
                break;
        default:
+               /*
+                *      When we're pulling MS-CHAPv2 out of EAP-MS-CHAPv2,
+                *      we do so WITHOUT setting a reply code, as the
+                *      request is being proxied.
+                */
+               if (request->options & RAD_REQUEST_OPTION_PROXY_EAP) {
+                       return RLM_MODULE_HANDLED;
+               }
+
                /* Should never enter here */
                radlog(L_ERR, "rlm_eap: reply code %d is unknown, Rejecting the request.", reply->code);
                request->reply->code = PW_AUTHENTICATION_REJECT;

diff --git a/src/modules/rlm_eap/eap.h b/src/modules/rlm_eap/eap.h
index 3029a4b..ef70c50 100644 (file)
--- a/src/modules/rlm_eap/eap.h
+++ b/src/modules/rlm_eap/eap.h
@@ -138,6 +138,7 @@ typedef struct eap_type_t {
 
 #define REQUEST_DATA_EAP_HANDLER        (1)
 #define REQUEST_DATA_EAP_TUNNEL_CALLBACK PW_EAP_MESSAGE
+#define RAD_REQUEST_OPTION_PROXY_EAP   (1 << 16)
 
 /*
  *     This is for tunneled callbacks