append tunneled reply, rather than moving it

This means that the operators are ignored, and any proxied
packet (with operators '=' for multiple VSAs of the same name) will
get handled properly.

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index 4f2c42c..007f5b0 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -309,7 +309,7 @@ static int eappeap_authenticate(void *arg, EAP_HANDLER *handler)
                peap = tls_session->opaque;
                if (peap->accept_vps) {
                        RDEBUG2("Using saved attributes from the original Access-Accept");
-                       pairmove(&handler->request->reply->vps, &peap->accept_vps);
+                       pairadd(&handler->request->reply->vps, &peap->accept_vps);
                        pairfree(&peap->accept_vps);
                }