Handle type of first EAP-RADIUS response more sophisticated
authorTobias Brunner <tobias@strongswan.org>
Tue, 16 Oct 2012 14:39:49 +0000 (16:39 +0200)
committerTobias Brunner <tobias@strongswan.org>
Thu, 18 Oct 2012 12:48:11 +0000 (14:48 +0200)
src/libcharon/plugins/eap_radius/eap_radius.c

index 870ed1f..6009d3a 100644 (file)
@@ -181,9 +181,23 @@ METHOD(eap_method_t, initiate, status_t,
        if (response)
        {
                eap_radius_forward_to_ike(response);
-               if (radius2ike(this, response, out))
+               switch (response->get_code(response))
                {
-                       status = NEED_MORE;
+                       case RMC_ACCESS_CHALLENGE:
+                               if (radius2ike(this, response, out))
+                               {
+                                       status = NEED_MORE;
+                               }
+                               break;
+                       case RMC_ACCESS_ACCEPT:
+                               /* Microsoft RADIUS servers can run in a mode where they respond
+                                * like this on the first request (i.e. without authentication),
+                                * we treat this as Access-Reject */
+                       case RMC_ACCESS_REJECT:
+                       default:
+                               DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed",
+                                        this->peer);
+                               break;
                }
                response->destroy(response);
        }
@@ -365,7 +379,8 @@ METHOD(eap_method_t, process, status_t,
                                break;
                        case RMC_ACCESS_REJECT:
                        default:
-                               DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed", this->peer);
+                               DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed",
+                                        this->peer);
                                status = FAILED;
                                break;
                }