TTLS-PAP accounting bug

[Alan DeKok]

Sam Schultz wrote:
> I was just wondering if the bug from this post has been fixed since 1.1.6:

  No.  It looks like the fix to make tunneled & proxied MS-CHAP work
broke this.  i.e. a "pairmove" was turned into a "pairadd".

  See src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c:

...
		/*
		 *	If we've been told to use the attributes from
		 *	the reply, then do so.
		 *
		 *	WARNING: This may leak information about the
		 *	tunneled user!
		 */
		if (t->use_tunneled_reply) {
			pairdelete(&reply->vps, PW_PROXY_STATE);
			pairadd(&request->reply->vps, reply->vps);
			reply->vps = NULL;
		}
...

  change the "pairadd" to a "pairmove", and also in rlm_eap_ttls.c:

	case EAPTLS_SUCCESS:
		if (t->authenticated) {
			if (t->reply) {
				pairadd(&handler->request->reply->vps, t->reply);
				t->reply = NULL;
			}
...

  Change this one, too.  If it works, I'll commit a patch.

  Alan DeKok.