<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We have a radius server which does not understand EAP and we are using Free Radius as EAP-PEAP-GTC proxy-inner-tunnel.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>As the present code does not set User-Password in EAP-PEAP-GTC mode so we made the following code changes:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoPlainText>1. File: src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c<o:p></o:p></p><p class=MsoPlainText> In function gtc_initiate(void *type_data, EAP_HANDLER *handler)<o:p></o:p></p><p class=MsoPlainText> Added following lines with reference to the src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c file<o:p></o:p></p><p class=MsoPlainText> #ifdef WITH_PROXY<o:p></o:p></p><p class=MsoPlainText> /*<o:p></o:p></p><p class=MsoPlainText> * The EAP session doesn't have enough information to<o:p></o:p></p><p class=MsoPlainText> * proxy the "inside EAP" protocol. Disable EAP proxying.<o:p></o:p></p><p class=MsoPlainText> */<o:p></o:p></p><p class=MsoPlainText> handler->request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;<o:p></o:p></p><p class=MsoPlainText> #endif<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>2. We also added the following functions in rlm_eap_gtc.c file <o:p></o:p></p><p class=MsoPlainText> static int gtc_postproxy(EAP_HANDLER *handler, void *tunnel_data)<o:p></o:p></p><p class=MsoPlainText> This functions doesn’t seem to be called.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>3. gtc_autheticate changes:<o:p></o:p></p><p class=MsoPlainText>#ifdef WITH_PROXY<o:p></o:p></p><p class=MsoPlainText> /*<o:p></o:p></p><p class=MsoPlainText> * If this options is set, then we do NOT authenticate the<o:p></o:p></p><p class=MsoPlainText> * user here. Instead, now that we've added the PAP<o:p></o:p></p><p class=MsoPlainText> * attributes to the request, we STOP, and let the outer<o:p></o:p></p><p class=MsoPlainText> * tunnel code handle it.<o:p></o:p></p><p class=MsoPlainText> *<o:p></o:p></p><p class=MsoPlainText> * This means that the outer tunnel code will DELETE the<o:p></o:p></p><p class=MsoPlainText> * EAP attributes, and proxy the PAP attributes to a<o:p></o:p></p><p class=MsoPlainText> * home server.<o:p></o:p></p><p class=MsoPlainText> */<o:p></o:p></p><p class=MsoPlainText> if (handler->request->options & RAD_REQUEST_OPTION_PROXY_EAP) {<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> /*<o:p></o:p></p><p class=MsoPlainText> * Set up the callbacks for the tunnel<o:p></o:p></p><p class=MsoPlainText> */<o:p></o:p></p><p class=MsoPlainText> eap_tunnel_data_t *tunnel;<o:p></o:p></p><p class=MsoPlainText> tunnel = rad_malloc(sizeof(*tunnel));<o:p></o:p></p><p class=MsoPlainText> memset(tunnel, 0, sizeof(*tunnel));<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> tunnel->tls_session = type_data;<o:p></o:p></p><p class=MsoPlainText> tunnel->callback = gtc_postproxy;<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> /*<o:p></o:p></p><p class=MsoPlainText> * Associate the callback with the request.<o:p></o:p></p><p class=MsoPlainText> */<o:p></o:p></p><p class=MsoPlainText> rcode = request_data_add(handler->request,<o:p></o:p></p><p class=MsoPlainText> handler->request->proxy,<o:p></o:p></p><p class=MsoPlainText> REQUEST_DATA_EAP_TUNNEL_CALLBACK,<o:p></o:p></p><p class=MsoPlainText> tunnel, free);<o:p></o:p></p><p class=MsoPlainText> rad_assert(rcode == 0);<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> pairdelete(&handler->request->packet->vps, PW_STATE);<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText> return 1;<o:p></o:p></p><p class=MsoPlainText> }<o:p></o:p></p><p class=MsoPlainText>#endif<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The modified rlm_eap_gtc.c is attached for reference.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>With these code changes we are able to set the User-Password in EAP-PEAP-GTC proxy mode. Also, debug message from gtc_postproxy is not visible in the log file.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>However, when the proxied-to RADIUS Server throws Access-Challenge the same is not forwarded by Free RADIUS to the client i.e. Reply-Message is stripped by Free RADIUS. <o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Please let us know how to convert the Reply-Message as challenge for the client.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Thanks n regards<o:p></o:p></p><p class=MsoPlainText>Sankalp Dubey<o:p></o:p></p></div></body></html>