src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25 USES_APPLE_DEPRECATED_API       /* OpenSSL API has been deprecated by Apple */
  26
  27 #include "eap_peap.h"
  28
  29 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t);
  30
  31 /*
  32  *      Send protected EAP-Failure
  33  *
  34  *       Result-TLV = Failure
  35  */
  36 static int eappeap_failure(eap_handler_t *handler, tls_session_t *tls_session)
  37 {
  38         uint8_t tlv_packet[11];
  39         REQUEST *request = handler->request;
  40
  41         RDEBUG2("FAILURE");
  42
  43         tlv_packet[0] = PW_EAP_REQUEST;
  44         tlv_packet[1] = handler->eap_ds->response->id +1;
  45         tlv_packet[2] = 0;
  46         tlv_packet[3] = 11;     /* length of this packet */
  47         tlv_packet[4] = PW_EAP_TLV;
  48         tlv_packet[5] = 0x80;
  49         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  50         tlv_packet[7] = 0;
  51         tlv_packet[8] = 2;      /* length of the data portion */
  52         tlv_packet[9] = 0;
  53         tlv_packet[10] = EAP_TLV_FAILURE;
  54
  55         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  56
  57         /*
  58          *      FIXME: Check the return code.
  59          */
  60         tls_handshake_send(request, tls_session);
  61
  62         return 1;
  63 }
  64
  65
  66 /*
  67  *      Send protected EAP-Success
  68  *
  69  *       Result-TLV = Success
  70  */
  71 static int eappeap_success(eap_handler_t *handler, tls_session_t *tls_session)
  72 {
  73         uint8_t tlv_packet[11];
  74         REQUEST *request = handler->request;
  75
  76         RDEBUG2("SUCCESS");
  77
  78         tlv_packet[0] = PW_EAP_REQUEST;
  79         tlv_packet[1] = handler->eap_ds->response->id +1;
  80         tlv_packet[2] = 0;
  81         tlv_packet[3] = 11;     /* length of this packet */
  82         tlv_packet[4] = PW_EAP_TLV;
  83         tlv_packet[5] = 0x80;   /* mandatory AVP */
  84         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  85         tlv_packet[7] = 0;
  86         tlv_packet[8] = 2;      /* length of the data portion */
  87         tlv_packet[9] = 0;
  88         tlv_packet[10] = EAP_TLV_SUCCESS;
  89
  90         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  91
  92         /*
  93          *      FIXME: Check the return code.
  94          */
  95         tls_handshake_send(request, tls_session);
  96
  97         return 1;
  98 }
  99
 100
 101 static int eappeap_identity(eap_handler_t *handler, tls_session_t *tls_session)
 102 {
 103         eap_packet_raw_t eap_packet;
 104
 105         eap_packet.code = PW_EAP_REQUEST;
 106         eap_packet.id = handler->eap_ds->response->id + 1;
 107         eap_packet.length[0] = 0;
 108         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 109         eap_packet.data[0] = PW_EAP_IDENTITY;
 110
 111         (tls_session->record_plus)(&tls_session->clean_in,
 112                                   &eap_packet, sizeof(eap_packet));
 113
 114         tls_handshake_send(handler->request, tls_session);
 115         (tls_session->record_init)(&tls_session->clean_in);
 116
 117         return 1;
 118 }
 119
 120 /*
 121  * Send an MS SoH request
 122  */
 123 static int eappeap_soh(eap_handler_t *handler, tls_session_t *tls_session)
 124 {
 125         uint8_t tlv_packet[20];
 126
 127         tlv_packet[0] = 254;    /* extended type */
 128
 129         tlv_packet[1] = 0;
 130         tlv_packet[2] = 0x01;   /* ms vendor */
 131         tlv_packet[3] = 0x37;
 132
 133         tlv_packet[4] = 0;      /* ms soh eap */
 134         tlv_packet[5] = 0;
 135         tlv_packet[6] = 0;
 136         tlv_packet[7] = 0x21;
 137
 138         tlv_packet[8] = 0;      /* vendor-spec tlv */
 139         tlv_packet[9] = 7;
 140
 141         tlv_packet[10] = 0;
 142         tlv_packet[11] = 8;     /* payload len */
 143
 144         tlv_packet[12] = 0;     /* ms vendor */
 145         tlv_packet[13] = 0;
 146         tlv_packet[14] = 0x01;
 147         tlv_packet[15] = 0x37;
 148
 149         tlv_packet[16] = 0;
 150         tlv_packet[17] = 2;
 151         tlv_packet[18] = 0;
 152         tlv_packet[19] = 0;
 153
 154         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 20);
 155         tls_handshake_send(handler->request, tls_session);
 156         return 1;
 157 }
 158
 159 static void eapsoh_verify(REQUEST *request, RADIUS_PACKET *packet,
 160                           uint8_t const *data, unsigned int data_len) {
 161
 162         VALUE_PAIR *vp;
 163         uint8_t eap_method_base;
 164         uint32_t eap_vendor;
 165         uint32_t eap_method;
 166         int rv;
 167
 168         vp = fr_pair_make(packet, &packet->vps, "SoH-Supported", "no", T_OP_EQ);
 169         if (data && data[0] == PW_EAP_NAK) {
 170                 RDEBUG("SoH - client NAKed");
 171                 return;
 172         }
 173
 174         if (!data || data_len < 8) {
 175                 RDEBUG("SoH - eap payload too short");
 176                 return;
 177         }
 178
 179         eap_method_base = *data++;
 180         if (eap_method_base != 254) {
 181                 RDEBUG("SoH - response is not extended EAP: %i", eap_method_base);
 182                 return;
 183         }
 184
 185         eap_vendor = soh_pull_be_24(data); data += 3;
 186         if (eap_vendor != 0x137) {
 187                 RDEBUG("SoH - extended eap vendor %08x is not Microsoft", eap_vendor);
 188                 return;
 189         }
 190
 191         eap_method = soh_pull_be_32(data); data += 4;
 192         if (eap_method != 0x21) {
 193                 RDEBUG("SoH - response eap type %08x is not EAP-SoH", eap_method);
 194                 return;
 195         }
 196
 197
 198         rv = soh_verify(request, data, data_len - 8);
 199         if (rv<0) {
 200                 RDEBUG("SoH - error decoding payload: %s", fr_strerror());
 201         } else {
 202                 vp->vp_integer = 1;
 203         }
 204 }
 205
 206 /*
 207  *      Verify the tunneled EAP message.
 208  */
 209 static int eapmessage_verify(REQUEST *request,
 210                              uint8_t const *data, unsigned int data_len)
 211 {
 212         eap_packet_raw_t const *eap_packet = (eap_packet_raw_t const *) data;
 213         eap_type_t eap_method;
 214
 215         /*
 216          *      No data, OR only 1 byte of EAP type.
 217          */
 218         if (!data || (data_len == 0) ||
 219             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 220                 return 0;
 221         }
 222
 223         eap_method = *data;
 224         switch (eap_method) {
 225         case PW_EAP_IDENTITY:
 226                 if (data_len == 1) {
 227                         RDEBUG2("Identity - ");
 228                         return 1;
 229                 }
 230                 RDEBUG2("Identity - %*s",
 231                        data_len - 1, data + 1);
 232                 return 1;
 233
 234                 /*
 235                  *      If the first byte of the packet is
 236                  *      EAP-Response, and the EAP data is a TLV,
 237                  *      then it looks OK...
 238                  */
 239         case PW_EAP_RESPONSE:
 240                 if (eap_packet->data[0] == PW_EAP_TLV) {
 241                         RDEBUG2("Received EAP-TLV response");
 242                         return 1;
 243                 }
 244                 RDEBUG2("Got something weird");
 245                 break;
 246
 247
 248                 /*
 249                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 250                  *      Cisco MS-CHAPv2 (29).
 251                  */
 252         case PW_EAP_MSCHAPV2:
 253         default:
 254                 RDEBUG2("EAP method %s (%d)", eap_type2name(eap_method),
 255                         eap_method);
 256                 return 1;
 257         }
 258
 259         return 0;
 260 }
 261
 262 /*
 263  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 264  */
 265 static VALUE_PAIR *eap2vp(UNUSED REQUEST *request, RADIUS_PACKET *packet,
 266                           EAP_DS *eap_ds,
 267                           uint8_t const *data, size_t data_len)
 268 {
 269         size_t total;
 270         uint8_t *p;
 271         VALUE_PAIR *vp = NULL, *head = NULL;
 272         vp_cursor_t cursor;
 273
 274         if (data_len > 65535) return NULL; /* paranoia */
 275
 276         vp = fr_pair_afrom_num(packet, PW_EAP_MESSAGE, 0);
 277         if (!vp) {
 278                 return NULL;
 279         }
 280
 281         total = data_len;
 282         if (total > 249) total = 249;
 283
 284         /*
 285          *      Hand-build an EAP packet from the crap in PEAP version 0.
 286          */
 287         vp->vp_length = EAP_HEADER_LEN + total;
 288         vp->vp_octets = p = talloc_array(vp, uint8_t, vp->vp_length);
 289
 290         p[0] = PW_EAP_RESPONSE;
 291         p[1] = eap_ds->response->id;
 292         p[2] = (data_len + EAP_HEADER_LEN) >> 8;
 293         p[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 294
 295         memcpy(p + EAP_HEADER_LEN, data, total);
 296
 297         fr_cursor_init(&cursor, &head);
 298         fr_cursor_insert(&cursor, vp);
 299         while (total < data_len) {
 300                 vp = fr_pair_afrom_num(packet, PW_EAP_MESSAGE, 0);
 301                 if (!vp) {
 302                         fr_pair_list_free(&head);
 303                         return NULL;
 304                 }
 305
 306                 fr_pair_value_memcpy(vp, data + total, (data_len - total));
 307
 308                 total += vp->vp_length;
 309
 310                 fr_cursor_insert(&cursor, vp);
 311         }
 312
 313         return head;
 314 }
 315
 316
 317 /*
 318  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 319  *      simple expedient of dumping the EAP message
 320  */
 321 static int vp2eap(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR *vp)
 322 {
 323         rad_assert(vp != NULL);
 324         VALUE_PAIR *this;
 325         vp_cursor_t cursor;
 326
 327         /*
 328          *      Skip the id, code, and length.  Just write the EAP
 329          *      type & data to the client.
 330          */
 331 #ifndef NDEBUG
 332         if ((rad_debug_lvl > 2) && fr_log_fp) {
 333                 size_t i, total, start = EAP_HEADER_LEN;
 334                 total = 0;
 335
 336                 for (this = fr_cursor_init(&cursor, &vp); this; this = fr_cursor_next(&cursor)) {
 337                         for (i = start; i < vp->vp_length; i++) {
 338                                 if ((total & 0x0f) == 0) {
 339                                         fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 340                                 }
 341                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 342
 343                                 if ((total & 0x0f) == 0x0f) {
 344                                         fprintf(fr_log_fp, "\n");
 345                                 }
 346
 347                                 total++;
 348                         }
 349
 350                         start = 0;
 351                 }
 352
 353                 if ((total & 0x0f) != 0) {
 354                         fprintf(fr_log_fp, "\n");
 355                 }
 356         }
 357 #endif
 358
 359         /*
 360          *      Send the EAP data in the first attribute, WITHOUT the
 361          *      header.
 362          */
 363         (tls_session->record_plus)(&tls_session->clean_in, vp->vp_octets + EAP_HEADER_LEN, vp->vp_length - EAP_HEADER_LEN);
 364
 365         /*
 366          *      Send the rest of the EAP data, but skipping the first VP.
 367          */
 368         fr_cursor_init(&cursor, &vp);
 369         for (this = fr_cursor_next(&cursor);
 370              this;
 371              this = fr_cursor_next(&cursor)) {
 372                 (tls_session->record_plus)(&tls_session->clean_in, this->vp_octets, this->vp_length);
 373         }
 374
 375         tls_handshake_send(request, tls_session);
 376
 377         return 1;
 378 }
 379
 380
 381 /*
 382  *      See if there's a TLV in the response.
 383  */
 384 static int eappeap_check_tlv(REQUEST *request, uint8_t const *data,
 385                              size_t data_len)
 386 {
 387         eap_packet_raw_t const *eap_packet = (eap_packet_raw_t const *) data;
 388
 389         if (data_len < 11) return 0;
 390
 391         /*
 392          *      Look for success or failure.
 393          */
 394         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 395             (eap_packet->data[0] == PW_EAP_TLV)) {
 396                 if (data[10] == EAP_TLV_SUCCESS) {
 397                         return 1;
 398                 }
 399
 400                 if (data[10] == EAP_TLV_FAILURE) {
 401                         RDEBUG2("Client rejected our response.  The password is probably incorrect");
 402                         return 0;
 403                 }
 404         }
 405
 406         RDEBUG("Unknown TLV %02x", data[10]);
 407
 408         return 0;
 409 }
 410
 411
 412 /*
 413  *      Use a reply packet to determine what to do.
 414  */
 415 static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_handler_t *handler, tls_session_t *tls_session,
 416                                           REQUEST *request, RADIUS_PACKET *reply)
 417 {
 418         rlm_rcode_t rcode = RLM_MODULE_REJECT;
 419         VALUE_PAIR *vp;
 420         peap_tunnel_t *t = tls_session->opaque;
 421
 422         if ((rad_debug_lvl > 0) && fr_log_fp) {
 423                 RDEBUG("Got tunneled reply RADIUS code %d", reply->code);
 424                 rdebug_pair_list(L_DBG_LVL_1, request, reply->vps, NULL);
 425         }
 426
 427         switch (reply->code) {
 428         case PW_CODE_ACCESS_ACCEPT:
 429                 RDEBUG2("Tunneled authentication was successful");
 430                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 431                 eappeap_success(handler, tls_session);
 432                 rcode = RLM_MODULE_HANDLED;
 433
 434                 /*
 435                  *      If we've been told to use the attributes from
 436                  *      the reply, then do so.
 437                  *
 438                  *      WARNING: This may leak information about the
 439                  *      tunneled user!
 440                  */
 441                 if (t->use_tunneled_reply) {
 442                         RDEBUG2("Saving tunneled attributes for later");
 443
 444                         /*
 445                          *      Clean up the tunneled reply.
 446                          */
 447                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 448                         fr_pair_delete_by_num(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 449                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 450
 451                         /*
 452                          *      Delete MPPE keys & encryption policy.  We don't
 453                          *      want these here.
 454                          */
 455                         fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 456                         fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 457                         fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 458                         fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 459
 460                         fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
 461                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 462                         rad_assert(!reply->vps);
 463                 }
 464                 break;
 465
 466         case PW_CODE_ACCESS_REJECT:
 467                 RDEBUG2("Tunneled authentication was rejected");
 468                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 469                 eappeap_failure(handler, tls_session);
 470                 rcode = RLM_MODULE_HANDLED;
 471                 break;
 472
 473         case PW_CODE_ACCESS_CHALLENGE:
 474                 RDEBUG2("Got tunneled Access-Challenge");
 475
 476                 /*
 477                  *      Keep the State attribute, if necessary.
 478                  *
 479                  *      Get rid of the old State, too.
 480                  */
 481                 fr_pair_list_free(&t->state);
 482                 fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 483
 484                 /*
 485                  *      PEAP takes only EAP-Message attributes inside
 486                  *      of the tunnel.  Any Reply-Message in the
 487                  *      Access-Challenge is ignored.
 488                  */
 489                 vp = NULL;
 490                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 491
 492                 /*
 493                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 494                  *      from the home server may contain MS-CHAP2-Success,
 495                  *      which the module turns into challenges, so that
 496                  *      the client may respond to the challenge with
 497                  *      an "ack" packet.
 498                  */
 499                 if (t->home_access_accept && t->use_tunneled_reply) {
 500                         RDEBUG2("Saving tunneled attributes for later");
 501
 502                         /*
 503                          *      Clean up the tunneled reply.
 504                          */
 505                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 506                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 507
 508                         rad_assert(!t->accept_vps);
 509                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 510                         rad_assert(!reply->vps);
 511                 }
 512
 513                 /*
 514                  *      Handle the ACK, by tunneling any necessary reply
 515                  *      VP's back to the client.
 516                  */
 517                 if (vp) {
 518                         vp2eap(request, tls_session, vp);
 519                         fr_pair_list_free(&vp);
 520                 }
 521
 522                 rcode = RLM_MODULE_HANDLED;
 523                 break;
 524
 525         default:
 526                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 527                 rcode = RLM_MODULE_REJECT;
 528                 break;
 529         }
 530
 531         return rcode;
 532 }
 533
 534 #ifdef WITH_PROXY
 535 /*
 536  *      Do post-proxy processing,
 537  */
 538 static int CC_HINT(nonnull) eappeap_postproxy(eap_handler_t *handler, void *data)
 539 {
 540         int rcode;
 541         tls_session_t *tls_session = (tls_session_t *) data;
 542         REQUEST *fake, *request = handler->request;
 543
 544         RDEBUG2("Passing reply from proxy back into the tunnel");
 545
 546         /*
 547          *      If there was a fake request associated with the proxied
 548          *      request, do more processing of it.
 549          */
 550         fake = (REQUEST *) request_data_get(handler->request,
 551                                             handler->request->proxy,
 552                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 553
 554         /*
 555          *      Do the callback, if it exists, and if it was a success.
 556          */
 557         if (fake && (handler->request->proxy_reply->code == PW_CODE_ACCESS_ACCEPT)) {
 558                 peap_tunnel_t *t = tls_session->opaque;
 559
 560                 t->home_access_accept = true;
 561
 562                 /*
 563                  *      Terrible hacks.
 564                  */
 565                 rad_assert(!fake->packet);
 566                 fake->packet = talloc_steal(fake, request->proxy);
 567                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 568                 request->proxy = NULL;
 569
 570                 rad_assert(!fake->reply);
 571                 fake->reply = talloc_steal(fake, request->proxy_reply);
 572                 request->proxy_reply = NULL;
 573
 574                 if ((rad_debug_lvl > 0) && fr_log_fp) {
 575                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 576                 }
 577
 578                 /*
 579                  *      Perform a post-auth stage, which will get the EAP
 580                  *      handler, too...
 581                  */
 582                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 583                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 584                 process_post_proxy(0, fake);
 585
 586                 /*
 587                  *      FIXME: If rcode returns fail, do something
 588                  *      intelligent...
 589                  */
 590                 rcode = rad_postauth(fake);
 591
 592                 if ((rad_debug_lvl > 0) && fr_log_fp) {
 593                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 594
 595                         RDEBUG("Final reply from tunneled session code %d", fake->reply->code);
 596                         rdebug_pair_list(L_DBG_LVL_1, request, fake->reply->vps, NULL);
 597                 }
 598
 599                 /*
 600                  *      Terrible hacks.
 601                  */
 602                 request->proxy = talloc_steal(request, fake->packet);
 603                 fake->packet = NULL;
 604                 request->proxy_reply = talloc_steal(request, fake->reply);
 605                 fake->reply = NULL;
 606
 607                 /*
 608                  *      And we're done with this request.
 609                  */
 610
 611                 switch (rcode) {
 612                 case RLM_MODULE_FAIL:
 613                         talloc_free(fake);
 614                         eaptls_fail(handler, 0);
 615                         return 0;
 616
 617                 default:  /* Don't Do Anything */
 618                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 619                         break;
 620                 }
 621         }
 622         talloc_free(fake);      /* robust if !fake */
 623
 624         /*
 625          *      If there was no EAP-Message in the reply packet, then
 626          *      we know that we're supposed to re-run the "authenticate"
 627          *      stage, in order to get the right kind of handling...
 628          */
 629
 630         /*
 631          *      Process the reply from the home server.
 632          */
 633
 634         rcode = process_reply(handler, tls_session, handler->request,
 635                               handler->request->proxy_reply);
 636
 637         /*
 638          *      The proxy code uses the reply from the home server as
 639          *      the basis for the reply to the NAS.  We don't want that,
 640          *      so we toss it, after we've had our way with it.
 641          */
 642         fr_pair_list_free(&handler->request->proxy_reply->vps);
 643
 644         switch (rcode) {
 645         case RLM_MODULE_REJECT:
 646                 RDEBUG2("Reply was rejected");
 647                 eaptls_fail(handler, 0);
 648                 return 0;
 649
 650         case RLM_MODULE_HANDLED:
 651                 RDEBUG2("Reply was handled");
 652                 eaptls_request(handler->eap_ds, tls_session);
 653                 request->proxy_reply->code = PW_CODE_ACCESS_CHALLENGE;
 654                 return 1;
 655
 656         case RLM_MODULE_OK:
 657                 RDEBUG2("Reply was OK");
 658
 659                 /*
 660                  *      Success: Automatically return MPPE keys.
 661                  */
 662                 return eaptls_success(handler, 0);
 663
 664         default:
 665                 RDEBUG2("Reply was unknown");
 666                 break;
 667         }
 668
 669         eaptls_fail(handler, 0);
 670         return 0;
 671 }
 672 #endif
 673
 674
 675 static char const *peap_state(peap_tunnel_t *t)
 676 {
 677         switch (t->status) {
 678         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 679                 return "TUNNEL ESTABLISHED";
 680
 681         case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 682                 return "WAITING FOR SOH RESPONSE";
 683
 684         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 685                 return "WAITING FOR INNER IDENTITY";
 686
 687         case PEAP_STATUS_SENT_TLV_SUCCESS:
 688                 return "send tlv success";
 689
 690         case PEAP_STATUS_SENT_TLV_FAILURE:
 691                 return "send tlv failure";
 692
 693         case PEAP_STATUS_PHASE2_INIT:
 694                 return "phase2_init";
 695
 696         case PEAP_STATUS_PHASE2:
 697                 return "phase2";
 698
 699         default:
 700                 break;
 701         }
 702         return "?";
 703 }
 704
 705 static void print_tunneled_data(uint8_t const *data, size_t data_len)
 706 {
 707         size_t i;
 708
 709         if ((rad_debug_lvl > 2) && fr_log_fp) {
 710                 for (i = 0; i < data_len; i++) {
 711                   if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %02x: ", (int) i);
 712
 713                         fprintf(fr_log_fp, "%02x ", data[i]);
 714
 715                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 716                 }
 717                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 718         }
 719 }
 720
 721
 722 /*
 723  *      Process the pseudo-EAP contents of the tunneled data.
 724  */
 725 rlm_rcode_t eappeap_process(eap_handler_t *handler, tls_session_t *tls_session, int auth_type_eap)
 726 {
 727         peap_tunnel_t   *t = tls_session->opaque;
 728         REQUEST         *fake;
 729         VALUE_PAIR      *vp;
 730         rlm_rcode_t     rcode = RLM_MODULE_REJECT;
 731         uint8_t const   *data;
 732         unsigned int    data_len;
 733
 734         REQUEST *request = handler->request;
 735         EAP_DS *eap_ds = handler->eap_ds;
 736
 737         /*
 738          *      Just look at the buffer directly, without doing
 739          *      record_minus.  This lets us avoid another data copy.
 740          */
 741         data_len = tls_session->clean_out.used;
 742         tls_session->clean_out.used = 0;
 743         data = tls_session->clean_out.data;
 744
 745         RDEBUG2("PEAP state %s", peap_state(t));
 746
 747         if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
 748             !eapmessage_verify(request, data, data_len)) {
 749                 REDEBUG("Tunneled data is invalid");
 750                 if (rad_debug_lvl > 2) print_tunneled_data(data, data_len);
 751                 return RLM_MODULE_REJECT;
 752         }
 753
 754         switch (t->status) {
 755         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 756                 /* FIXME: should be no data in the buffer here, check & assert? */
 757
 758                 if (SSL_session_reused(tls_session->ssl)) {
 759                         RDEBUG2("Skipping Phase2 because of session resumption");
 760                         t->session_resumption_state = PEAP_RESUMPTION_YES;
 761                         if (t->soh) {
 762                                 t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 763                                 RDEBUG2("Requesting SoH from client");
 764                                 eappeap_soh(handler, tls_session);
 765                                 return RLM_MODULE_HANDLED;
 766                         }
 767                         /* we're good, send success TLV */
 768                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 769                         eappeap_success(handler, tls_session);
 770
 771                 } else {
 772                         /* send an identity request */
 773                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 774                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 775                         eappeap_identity(handler, tls_session);
 776                 }
 777                 return RLM_MODULE_HANDLED;
 778
 779         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 780                 /* we're expecting an identity response */
 781                 if (data[0] != PW_EAP_IDENTITY) {
 782                         REDEBUG("Expected EAP-Identity, got something else");
 783                         return RLM_MODULE_REJECT;
 784                 }
 785
 786                 /*
 787                  *      Save it for later.
 788                  */
 789                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 790                 rad_assert(t->username != NULL);
 791
 792                 fr_pair_value_bstrncpy(t->username, data + 1, data_len - 1);
 793
 794                 RDEBUG("Got inner identity '%s'", t->username->vp_strvalue);
 795                 if (t->soh) {
 796                         t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 797                         RDEBUG2("Requesting SoH from client");
 798                         eappeap_soh(handler, tls_session);
 799                         return RLM_MODULE_HANDLED;
 800                 }
 801                 t->status = PEAP_STATUS_PHASE2_INIT;
 802                 break;
 803
 804         case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 805                 fake = request_alloc_fake(request);
 806                 rad_assert(!fake->packet->vps);
 807                 eapsoh_verify(fake, fake->packet, data, data_len);
 808                 setup_fake_request(request, fake, t);
 809
 810                 if (t->soh_virtual_server) {
 811                         fake->server = t->soh_virtual_server;
 812                 }
 813                 RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
 814                 rad_virtual_server(fake);
 815
 816                 if (fake->reply->code != PW_CODE_ACCESS_ACCEPT) {
 817                         RDEBUG2("SoH was rejected");
 818                         talloc_free(fake);
 819                         t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 820                         eappeap_failure(handler, tls_session);
 821                         return RLM_MODULE_HANDLED;
 822                 }
 823
 824                 /* save the SoH VPs */
 825                 rad_assert(!t->soh_reply_vps);
 826                 fr_pair_list_mcopy_by_num(t, &t->soh_reply_vps, &fake->reply->vps, 0, 0, TAG_ANY);
 827                 rad_assert(!fake->reply->vps);
 828                 talloc_free(fake);
 829
 830                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 831                         /* we're good, send success TLV */
 832                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 833                         eappeap_success(handler, tls_session);
 834                         return RLM_MODULE_HANDLED;
 835                 }
 836
 837                 t->status = PEAP_STATUS_PHASE2_INIT;
 838                 break;
 839
 840
 841         /*
 842          *      If we authenticated the user, then it's OK.
 843          */
 844         case PEAP_STATUS_SENT_TLV_SUCCESS:
 845                 if (eappeap_check_tlv(request, data, data_len)) {
 846                         RDEBUG2("Success");
 847                         return RLM_MODULE_OK;
 848                 }
 849
 850                 /*
 851                  *      Otherwise, the client rejected the session
 852                  *      resumption.  If the session is being re-used,
 853                  *      we need to do a full authentication.
 854                  *
 855                  *      We do this by sending an EAP-Identity request
 856                  *      inside of the PEAP tunnel.
 857                  */
 858                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 859                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 860
 861                         /*
 862                          *      Mark session resumption status.
 863                          */
 864                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 865                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 866
 867                         eappeap_identity(handler, tls_session);
 868                         return RLM_MODULE_HANDLED;
 869                 }
 870
 871                 REDEBUG("We sent a success, but the client did not agree");
 872                 return RLM_MODULE_REJECT;
 873
 874         /*
 875          *      Supplicant ACKs our failure.
 876          */
 877         case PEAP_STATUS_SENT_TLV_FAILURE:
 878                 RINDENT();
 879                 REDEBUG("The users session was previously rejected: returning reject (again.)");
 880                 RIDEBUG("This means you need to read the PREVIOUS messages in the debug output");
 881                 RIDEBUG("to find out the reason why the user was rejected");
 882                 RIDEBUG("Look for \"reject\" or \"fail\".  Those earlier messages will tell you");
 883                 RIDEBUG("what went wrong, and how to fix the problem");
 884                 REXDENT();
 885
 886                 return RLM_MODULE_REJECT;
 887
 888                 case PEAP_STATUS_PHASE2_INIT:
 889                         RDEBUG("In state machine in phase2 init?");
 890
 891                 case PEAP_STATUS_PHASE2:
 892                         break;
 893
 894                 default:
 895                         REDEBUG("Unhandled state in peap");
 896                         return RLM_MODULE_REJECT;
 897         }
 898
 899         fake = request_alloc_fake(request);
 900
 901         rad_assert(!fake->packet->vps);
 902
 903         switch (t->status) {
 904                 /*
 905                  *      If we're in PHASE2_INIT, the phase2 method hasn't been
 906                  *      sent an Identity packet yet; do so from the stored
 907                  *      username and this will kick off the phase2 eap method
 908                  */
 909
 910         case PEAP_STATUS_PHASE2_INIT: {
 911                 size_t len = t->username->vp_length + EAP_HEADER_LEN + 1;
 912                 uint8_t *q;
 913
 914                 t->status = PEAP_STATUS_PHASE2;
 915
 916                 vp = fr_pair_afrom_num(fake->packet, PW_EAP_MESSAGE, 0);
 917                 vp->vp_length = len;
 918                 vp->vp_octets = q = talloc_array(vp, uint8_t, vp->vp_length);
 919
 920                 q[0] = PW_EAP_RESPONSE;
 921                 q[1] = eap_ds->response->id;
 922                 q[2] = (len >> 8) & 0xff;
 923                 q[3] = len & 0xff;
 924                 q[4] = PW_EAP_IDENTITY;
 925
 926                 memcpy(q + EAP_HEADER_LEN + 1,
 927                        t->username->vp_strvalue, t->username->vp_length);
 928
 929                 fr_pair_add(&fake->packet->vps, vp);
 930
 931                 if (t->default_method != 0) {
 932                         RDEBUG2("Setting default EAP type for tunneled EAP session");
 933                         vp = fr_pair_make(fake, &fake->config, "EAP-Type", "0", T_OP_EQ);
 934                         vp->vp_integer = t->default_method;
 935                 }
 936                 break; }
 937
 938         case PEAP_STATUS_PHASE2:
 939                 fake->packet->vps = eap2vp(request, fake->packet,
 940                                            eap_ds, data, data_len);
 941                 if (!fake->packet->vps) {
 942                         talloc_free(fake);
 943                         RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 944                         return RLM_MODULE_REJECT;
 945                 }
 946                 break;
 947
 948         default:
 949                 REDEBUG("Invalid state change in PEAP");
 950                 return RLM_MODULE_REJECT;
 951         }
 952
 953         RDEBUG2("Got tunneled request");
 954         rdebug_pair_list(L_DBG_LVL_2, request, fake->packet->vps, NULL);
 955
 956         /*
 957          *      Update other items in the REQUEST data structure.
 958          */
 959         if (!t->username) {
 960                 /*
 961                  *      There's no User-Name in the tunneled session,
 962                  *      so we add one here, by pulling it out of the
 963                  *      EAP-Identity packet.
 964                  */
 965                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 966                         t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 967                         rad_assert(t->username != NULL);
 968
 969                         fr_pair_value_bstrncpy(t->username, data + 1, data_len - 1);
 970
 971                         RDEBUG2("Got tunneled identity of %s", t->username->vp_strvalue);
 972
 973                         /*
 974                          *      If there's a default EAP type,
 975                          *      set it here.
 976                          */
 977                         if (t->default_method != 0) {
 978                                 RDEBUG2("Setting default EAP type for tunneled EAP session");
 979                                 vp = fr_pair_make(fake, &fake->config, "EAP-Type", "0", T_OP_EQ);
 980                                 vp->vp_integer = t->default_method;
 981                         }
 982                 }
 983         } /* else there WAS a t->username */
 984
 985         setup_fake_request(request, fake, t);
 986
 987         if ((vp = fr_pair_find_by_num(request->config, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
 988                 fake->server = vp->vp_strvalue;
 989
 990         } else if (t->virtual_server) {
 991                 fake->server = t->virtual_server;
 992
 993         } /* else fake->server == request->server */
 994
 995         if (fake->server) {
 996                 RDEBUG2("Sending tunneled request to %s", fake->server);
 997         } else {
 998                 RDEBUG2("Sending tunnelled request");
 999         }
1000         rdebug_pair_list(L_DBG_LVL_2, request, fake->packet->vps, NULL);
1001
1002         /*
1003          *      Call authentication recursively, which will
1004          *      do PAP, CHAP, MS-CHAP, etc.
1005          */
1006         rad_virtual_server(fake);
1007
1008         /*
1009          *      Note that we don't do *anything* with the reply
1010          *      attributes.
1011          */
1012         RDEBUG2("Got tunneled reply code %d", fake->reply->code);
1013         rdebug_pair_list(L_DBG_LVL_2, request, fake->reply->vps, NULL);
1014
1015         /*
1016          *      Decide what to do with the reply.
1017          */
1018         switch (fake->reply->code) {
1019         case 0:                 /* No reply code, must be proxied... */
1020 #ifdef WITH_PROXY
1021                 vp = fr_pair_find_by_num(fake->config, PW_PROXY_TO_REALM, 0, TAG_ANY);
1022
1023                 if (vp) {
1024                         eap_tunnel_data_t *tunnel;
1025
1026                         /*
1027                          *      The tunneled request was NOT handled,
1028                          *      it has to be proxied.  This means that
1029                          *      the "authenticate" stage was never
1030                          *      performed.
1031                          *
1032                          *      If we are told to NOT proxy the
1033                          *      tunneled request as EAP, then this
1034                          *      means that we've got to decode it,
1035                          *      which means that we MUST run the
1036                          *      "authenticate" portion by hand, here.
1037                          *
1038                          *      Once the tunneled EAP session is ALMOST
1039                          *      done, THEN we proxy it...
1040                          */
1041                         if (!t->proxy_tunneled_request_as_eap) {
1042                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
1043
1044                                 /*
1045                                  *      Hmm... should we check for
1046                                  *      Auth-Type & EAP-Message here?
1047                                  */
1048
1049                                 if (!auth_type_eap) {
1050                                         RERROR("You must set 'inner_eap_module' in the 'peap' configuration");
1051                                         RERROR("This is required in order to proxy the inner EAP session.");
1052                                         rcode = RLM_MODULE_REJECT;
1053                                         goto done;
1054                                 }
1055
1056                                 /*
1057                                  *      Run the EAP authentication.
1058                                  */
1059                                 RDEBUG2("Calling authenticate in order to initiate tunneled EAP session");
1060                                 rcode = process_authenticate(auth_type_eap, fake);
1061                                 if (rcode == RLM_MODULE_OK) {
1062                                         /*
1063                                          *      Authentication succeeded! Rah!
1064                                          */
1065                                         fake->reply->code = PW_CODE_ACCESS_ACCEPT;
1066                                         goto do_process;
1067                                 }
1068
1069                                 if (rcode != RLM_MODULE_HANDLED) {
1070                                         RDEBUG("Can't handle the return code %d", rcode);
1071                                         rcode = RLM_MODULE_REJECT;
1072                                         goto done;
1073                                 }
1074
1075                                 /*
1076                                  *      The module decided it wasn't
1077                                  *      done.  Handle it like normal.
1078                                  */
1079                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
1080                                         RDEBUG2("Cancelling proxy to realm %s until the tunneled EAP session "
1081                                                 "has been established", vp->vp_strvalue);
1082                                         goto do_process;
1083                                 }
1084
1085                                 /*
1086                                  *      The module has decoded the
1087                                  *      EAP-Message into another set
1088                                  *      of attributes.
1089                                  */
1090                                 fr_pair_delete_by_num(&fake->packet->vps,
1091                                            PW_EAP_MESSAGE, 0, TAG_ANY);
1092                         }
1093
1094                         RDEBUG2("Tunnelled authentication will be proxied to %s", vp->vp_strvalue);
1095
1096                         /*
1097                          *      Tell the original request that it's going
1098                          *      to be proxied.
1099                          */
1100                         fr_pair_list_mcopy_by_num(request, &request->config,
1101                                    &fake->config,
1102                                    PW_PROXY_TO_REALM, 0, TAG_ANY);
1103
1104                         /*
1105                          *      Seed the proxy packet with the
1106                          *      tunneled request.
1107                          */
1108                         rad_assert(!request->proxy);
1109                         request->proxy = talloc_steal(request, fake->packet);
1110                         memset(&request->proxy->src_ipaddr, 0,
1111                                sizeof(request->proxy->src_ipaddr));
1112                         memset(&request->proxy->dst_ipaddr, 0,
1113                                sizeof(request->proxy->dst_ipaddr));
1114                         request->proxy->src_port = 0;
1115                         request->proxy->dst_port = 0;
1116                         fake->packet = NULL;
1117                         rad_free(&fake->reply);
1118                         fake->reply = NULL;
1119
1120                         /*
1121                          *      Set up the callbacks for the tunnel
1122                          */
1123                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1124                         tunnel->tls_session = tls_session;
1125                         tunnel->callback = eappeap_postproxy;
1126
1127                         /*
1128                          *      Associate the callback with the request.
1129                          */
1130                         rcode = request_data_add(request,
1131                                                  request->proxy,
1132                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1133                                                  tunnel, false);
1134                         rad_assert(rcode == 0);
1135
1136                         /*
1137                          *      We're not proxying it as EAP, so we've got
1138                          *      to do the callback later.
1139                          */
1140                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
1141                                 RDEBUG2("Remembering to do EAP-MS-CHAP-V2 post-proxy");
1142
1143                                 /*
1144                                  *      rlm_eap.c has taken care of associating
1145                                  *      the handler with the fake request.
1146                                  *
1147                                  *      So we associate the fake request with
1148                                  *      this request.
1149                                  */
1150                                 rcode = request_data_add(request, request->proxy,
1151                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1152                                                          fake, true);
1153                                 rad_assert(rcode == 0);
1154
1155                                 /*
1156                                  *      Do NOT free the fake request!
1157                                  */
1158                                 return RLM_MODULE_UPDATED;
1159                         }
1160
1161                         /*
1162                          *      Didn't authenticate the packet, but
1163                          *      we're proxying it.
1164                          */
1165                         rcode = RLM_MODULE_UPDATED;
1166
1167                 } else
1168 #endif  /* WITH_PROXY */
1169                   {
1170                         REDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
1171                         rcode = RLM_MODULE_REJECT;
1172                   }
1173                 break;
1174
1175         default:
1176 #ifdef WITH_PROXY
1177         do_process:
1178 #endif
1179                 rcode = process_reply(handler, tls_session, request,
1180                                       fake->reply);
1181                 break;
1182         }
1183
1184 #ifdef WITH_PROXY
1185  done:
1186 #endif
1187         talloc_free(fake);
1188
1189         return rcode;
1190 }
1191
1192 static int CC_HINT(nonnull) setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
1193
1194         VALUE_PAIR *vp;
1195
1196         /*
1197          *      Tell the request that it's a fake one.
1198          */
1199         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
1200
1201         if (t->username) {
1202                 vp = fr_pair_list_copy(fake->packet, t->username);
1203                 fr_pair_add(&fake->packet->vps, vp);
1204                 fake->username = vp;
1205                 RDEBUG2("Setting User-Name to %s", fake->username->vp_strvalue);
1206         } else {
1207                 RDEBUG2("No tunnel username (SSL resumption?)");
1208         }
1209
1210
1211         /*
1212          *      Add the State attribute, too, if it exists.
1213          */
1214         if (t->state) {
1215                 vp = fr_pair_list_copy(fake->packet, t->state);
1216                 if (vp) fr_pair_add(&fake->packet->vps, vp);
1217         }
1218
1219         /*
1220          *      If this is set, we copy SOME of the request attributes
1221          *      from outside of the tunnel to inside of the tunnel.
1222          *
1223          *      We copy ONLY those attributes which do NOT already
1224          *      exist in the tunneled request.
1225          *
1226          *      This code is copied from ../rlm_eap_ttls/ttls.c
1227          */
1228         if (t->copy_request_to_tunnel) {
1229                 VALUE_PAIR *copy;
1230                 vp_cursor_t cursor;
1231
1232                 for (vp = fr_cursor_init(&cursor, &request->packet->vps);
1233                      vp;
1234                      vp = fr_cursor_next(&cursor)) {
1235                         /*
1236                          *      The attribute is a server-side thingy,
1237                          *      don't copy it.
1238                          */
1239                         if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
1240                                 continue;
1241                         }
1242
1243                         /*
1244                          *      The outside attribute is already in the
1245                          *      tunnel, don't copy it.
1246                          *
1247                          *      This works for BOTH attributes which
1248                          *      are originally in the tunneled request,
1249                          *      AND attributes which are copied there
1250                          *      from below.
1251                          */
1252                         if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue;
1253
1254                         /*
1255                          *      Some attributes are handled specially.
1256                          */
1257                         if (!vp->da->vendor) switch (vp->da->attr) {
1258                                 /*
1259                                  *      NEVER copy Message-Authenticator,
1260                                  *      EAP-Message, or State.  They're
1261                                  *      only for outside of the tunnel.
1262                                  */
1263                         case PW_USER_NAME:
1264                         case PW_USER_PASSWORD:
1265                         case PW_CHAP_PASSWORD:
1266                         case PW_CHAP_CHALLENGE:
1267                         case PW_PROXY_STATE:
1268                         case PW_MESSAGE_AUTHENTICATOR:
1269                         case PW_EAP_MESSAGE:
1270                         case PW_STATE:
1271                                 continue;
1272
1273                                 /*
1274                                  *      By default, copy it over.
1275                                  */
1276                         default:
1277                                 break;
1278                         }
1279
1280                         /*
1281                          *      Don't copy from the head, we've already
1282                          *      checked it.
1283                          */
1284                         copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
1285                         fr_pair_add(&fake->packet->vps, copy);
1286                 }
1287         }
1288
1289         return 0;
1290 }