Port "use_tunneled_reply" fix for MS-CHAP from branch_1_1

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h b/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h
index a771c43..30ebf85 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/eap_ttls.h
@@ -31,6 +31,7 @@ RCSIDH(eap_ttls_h, "$Id$")
 typedef struct ttls_tunnel_t {
        VALUE_PAIR      *username;
        VALUE_PAIR      *state;
+       VALUE_PAIR      *reply;
        int             authenticated;
        int             default_eap_type;
        int             copy_request_to_tunnel;

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
index b320937..8b08930 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
@@ -145,12 +145,13 @@ static void ttls_free(void *p)
 
        pairfree(&t->username);
        pairfree(&t->state);
+       pairfree(&t->reply);
        free(t);
 }
 
 
 /*
- *     Free the TTLS per-session data
+ *     Allocate the TTLS per-session data
  */
 static ttls_tunnel_t *ttls_alloc(rlm_eap_ttls_t *inst)
 {
@@ -194,12 +195,16 @@ static int eapttls_authenticate(void *arg, EAP_HANDLER *handler)
                 */
        case EAPTLS_SUCCESS:
                if (t->authenticated) {
+                       if (t->reply) {
+                               pairadd(&handler->request->reply->vps, t->reply);
+                               t->reply = NULL;
+                       }
                        eaptls_success(handler->eap_ds, 0);
                        eaptls_gen_mppe_keys(&handler->request->reply->vps,
                                             tls_session->ssl,
                                             "ttls keying material");
                } else {
-               eaptls_request(handler->eap_ds, tls_session);
+                       eaptls_request(handler->eap_ds, tls_session);
                }
                return 1;
 

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
index 8320d61..bd5d270 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
@@ -616,6 +616,24 @@ static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
                        DEBUG2("  TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge.");
                        rcode = RLM_MODULE_HANDLED;
                        t->authenticated = TRUE;
+                       
+                       /*
+                        *      Delete MPPE keys & encryption policy.  We don't
+                        *      want these here.
+                        */
+                       pairdelete(&reply->vps, ((311 << 16) | 7));
+                       pairdelete(&reply->vps, ((311 << 16) | 8));
+                       pairdelete(&reply->vps, ((311 << 16) | 16));
+                       pairdelete(&reply->vps, ((311 << 16) | 17));
+                       
+                       /*
+                        *      Use the tunneled reply, but not now.
+                        */
+                       if (t->use_tunneled_reply) {
+                               t->reply = reply->vps;
+                               reply->vps = NULL;
+                       }
+
                } else { /* no MS-CHAP2-Success */
                        /*
                         *      Can only have EAP-Message if there's