"use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf

[Phil Mayers]

> In 3.x code, We are returning a RLM_MODULE_NOOP from eap_post_proxy() :
> 582 /*
> 583 * Just in case the admin lists EAP in post-proxy-type Fail.
> 584 */
> 585 if (!request->proxy_reply) return RLM_MODULE_NOOP;
>
> But we are not doing so in 2.1.11 code. We call the MSCHAPv2 callback,
> i.e. mschap_postproxy(),
> which might be wiping off the attributes.
>
> So, my question is: will adding this code patch to 2.x code prudent to
> make it work ? Or we need to fix the
> mschapv2 handler itself : mschap_postproxy() in rlm_eap_mschapv2.c,so
> that it retains the extra attributes
> sent by the RADIUS home server ?

This code is complex and needs to be treated with care. There were 
changes recently related to failures when proxying PEAP inner as eap 
versus non-eap, and this code was implicated.

Basically, be careful fiddling with it.