Merge branch 'testing-stretch'

Use Debian stretch as base image for the testing environment.
2018-11-21 14:34:57 +01:00
parent cbe9e575ee 48afa6b783
commit 9820e3dd59
328 changed files with 1316 additions and 11693 deletions
@@ -574,6 +574,24 @@ INSERT INTO products (      /* 96 */
 'Ubuntu 18.04 x86_64'
 );

+INSERT INTO products (      /* 97 */
+  name
+) VALUES (
+ 'Debian 9.5 i686'
+);
+
+INSERT INTO products (      /* 98 */
+  name
+) VALUES (
+ 'Debian 9.5 x86_64'
+);
+
+INSERT INTO products (      /* 99 */
+  name
+) VALUES (
+ 'Debian 9.6 x86_64'
+);
+
 /* Directories */

 INSERT INTO directories (		/*  1 */
@@ -1144,6 +1162,12 @@ INSERT INTO groups_product_defaults (
  4, 94
 );

+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 97
+);
+
 INSERT INTO groups_product_defaults (
  group_id, product_id
 ) VALUES (
@@ -1264,6 +1288,18 @@ INSERT INTO groups_product_defaults (
  5, 95
 );

+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  5, 98
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  5, 99
+);
+
 INSERT INTO groups_product_defaults (
  group_id, product_id
 ) VALUES (
@@ -1,8 +1,8 @@
 <domain type='kvm'>
  <name>alice</name>
  <uuid>1f35c25d-6a7b-4ee1-2461-d7e530e7b2a9</uuid>
-  <memory unit='KiB'>131072</memory>
-  <currentMemory unit='KiB'>131072</currentMemory>
+  <memory unit='KiB'>163840</memory>
+  <currentMemory unit='KiB'>163840</currentMemory>
  <vcpu placement='static'>1</vcpu>
  <os>
    <type arch='x86_64' machine='pc'>hvm</type>
@@ -51,11 +51,15 @@ subdir_cnt="0"
 ##############################################################################
 # parse optional arguments
 #
-while getopts "v" opt
+while getopts "vt" opt
 do
 	case "$opt" in
 	v)
 		verbose=YES
+		timestamps=YES
+		;;
+	t)
+		timestamps=YES
 		;;
 	esac
 done
@@ -64,7 +68,7 @@ shift $((OPTIND-1))

 function print_time()
 {
-	[ "$verbose" == "YES" ] && echo "$(date +%T.%N) ~ "
+	[ "$timestamps" == "YES" ] && echo "$(date +%T.%N) ~ "
 }

 ##############################################################################
@@ -689,21 +693,25 @@ do
 	do
 	    eval HOSTLOGIN=root@\$ipv4_${host}

-	    for file in clients.conf eap.conf radiusd.conf proxy.conf users
-	    do
-		scp $SSHCONF $HOSTLOGIN:/etc/freeradius/$file \
-		    $TESTRESULTDIR/${host}.$file  > /dev/null 2>&1
-	    done
+		RADIUS_DIR=/etc/freeradius/3.0
+		RADIUS_EAP_FILE=mods-enabled/eap
+		RADIUS_EAP_NAME=eap
+		if [ "$BASEIMGSUITE" == "jessie" ]
+		then
+			RADIUS_DIR=/etc/freeradius
+			RADIUS_EAP_FILE=eap.conf
+			RADIUS_EAP_NAME=eap.conf
+		fi

-		scp $SSHCONF $HOSTLOGIN:/etc/strongswan.conf \
-		    $TESTRESULTDIR/${host}.strongswan.conf  > /dev/null 2>&1
+		for file in clients.conf radiusd.conf proxy.conf users sites-enabled/default sites-enabled/inner-tunnel $RADIUS_EAP_FILE
+	    do
+		scp $SSHCONF $HOSTLOGIN:$RADIUS_DIR/$file \
+		    $TESTRESULTDIR/${host}.$(basename $file) > /dev/null 2>&1
+	    done

 	    scp $SSHCONF $HOSTLOGIN:/var/log/freeradius/radius.log \
 		$TESTRESULTDIR/${host}.radius.log  > /dev/null 2>&1

-	    ssh $SSHCONF $HOSTLOGIN grep imcv /var/log/daemon.log \
-		>> $TESTRESULTDIR/${host}.daemon.log 2>/dev/null
-
 	    chmod a+r $TESTRESULTDIR/*
 	    cat >> $TESTRESULTDIR/index.html <<@EOF
    <h3>$host</h3>
@@ -713,14 +721,14 @@ do
 	  <ul>
 	    <li><a href="$host.clients.conf">clients.conf</a></li>
 	    <li><a href="$host.radiusd.conf">radiusd.conf</a></li>
-	    <li><a href="$host.strongswan.conf">strongswan.conf</a></li>
+	    <li><a href="$host.$RADIUS_EAP_NAME">$RADIUS_EAP_NAME</a></li>
 	  </ul>
 	</td>
 	<td valign="top">
 	  <ul>
-	    <li><a href="$host.eap.conf">eap.conf</a></li>
+	    <li><a href="$host.default">sites-enabled/default</a></li>
+	    <li><a href="$host.inner-tunnel">sites-enabled/inner-tunnel</a></li>
 	    <li><a href="$host.radius.log">radius.log</a></li>
-	    <li><a href="$host.daemon.log">daemon.log</a></li>
 	  </ul>
      </td>
 	<td valign="top">
@@ -0,0 +1,5 @@
+client moon {
+  ipaddr = 10.1.0.1
+  secret = gv6URkSs
+  require_message_authenticator = yes
+}
@@ -0,0 +1,99 @@
+# radiusd.conf	-- FreeRADIUS server configuration file.
+
+prefix = /usr
+exec_prefix = /usr
+sysconfdir = /etc
+localstatedir = /var
+sbindir = ${exec_prefix}/sbin
+logdir = /var/log/freeradius
+raddbdir = /etc/freeradius/3.0
+radacctdir = ${logdir}/radacct
+
+#  name of the running server.  See also the "-n" command-line option.
+name = freeradius
+
+#  Location of config and logfiles.
+confdir = ${raddbdir}
+modconfdir = ${confdir}/mods-config
+certdir = ${sysconfdir}/raddb/certs
+cadir   = ${sysconfdir}/raddb/certs
+run_dir = ${localstatedir}/run/${name}
+
+# Should likely be ${localstatedir}/lib/radiusd
+db_dir = ${raddbdir}
+
+# libdir: Where to find the rlm_* modules.
+libdir = ${exec_prefix}/lib
+
+#  pidfile: Where to place the PID of the RADIUS server.
+pidfile = ${run_dir}/${name}.pid
+
+#  correct_escapes: use correct backslash escaping
+correct_escapes = true
+
+#  max_request_time: The maximum time (in seconds) to handle a request.
+max_request_time = 30
+
+#  cleanup_delay: The time to wait (in seconds) before cleaning up
+cleanup_delay = 5
+
+#  max_requests: The maximum number of requests which the server keeps
+max_requests = 1024
+
+#  hostname_lookups: Log the names of clients or just their IP addresses
+hostname_lookups = no
+
+#  Logging section
+log {
+  destination = files
+  colourise = yes
+  file = ${logdir}/radius.log
+  syslog_facility = daemon
+  stripped_names = no
+  auth = yes
+  auth_badpass = yes
+  auth_goodpass = yes
+}
+
+#  The program to execute to do concurrency checks.
+checkrad = ${sbindir}/checkrad
+
+#  SECURITY CONFIGURATION
+security {
+  user = freerad
+  group = freerad
+  allow_core_dumps = no
+  max_attributes = 200
+  reject_delay = 1
+  status_server = yes
+}
+
+# PROXY CONFIGURATION
+proxy_requests = yes
+$INCLUDE proxy.conf
+
+# CLIENTS CONFIGURATION
+$INCLUDE clients.conf
+
+# THREAD POOL CONFIGURATION
+thread pool {
+  start_servers = 5
+  max_servers = 32
+  min_spare_servers = 3
+  max_spare_servers = 10
+  max_requests_per_server = 0
+  auto_limit_acct = no
+}
+
+# MODULE CONFIGURATION
+modules {
+  $INCLUDE ${confdir}/mods-enabled/
+}
+
+# Policies
+policy {
+  $INCLUDE policy.d/
+}
+
+# Include all enabled virtual hosts
+$INCLUDE sites-enabled/
@@ -11,7 +11,7 @@
 #
 #	The filename given here should be an absolute path.
 #
-$INCLUDE	/usr/local/share/freeradius/dictionary
+$INCLUDE	/usr/share/freeradius/dictionary

 #
 #	Place additional attributes or $INCLUDEs here.  They will
@@ -101,8 +101,6 @@ thread pool {
 modules {
  $INCLUDE ${confdir}/modules/
  $INCLUDE eap.conf
-  $INCLUDE sql.conf
-  $INCLUDE sql/mysql/counter.conf
 }

 # Instantiation
@@ -2,7 +2,6 @@ Port 22
 Protocol 2
 Ciphers [email protected]
 HostKey /etc/ssh/ssh_host_rsa_key
-HostKey /etc/ssh/ssh_host_dsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key
 UsePrivilegeSeparation no
 PermitRootLogin yes
@@ -1,4 +1,6 @@
 #! /bin/sh

 cat /usr/local/share/strongswan/templates/database/sw-collector/sw_collector_tables.sql | sqlite3 /etc/db.d/collector.db
+sed -i "s:DEBIAN_VERSION:`cat /etc/debian_version`:" /etc/pts/collector.sql
+cat /etc/pts/collector.sql | sqlite3 /etc/db.d/collector.db
 LEAK_DETECTIVE_DISABLE=1 /usr/local/sbin/sw-collector
@@ -0,0 +1,3 @@
+# explicitly set an interface to avoid having to configure and run DHCPv6
+INTERFACESv4="eth0"
+INTERFACESv6=""
@@ -2,3 +2,4 @@ AddType text/plain .conf .log .sql .users
 AddType text/plain .secrets .listall .statusall
 AddType text/plain .conns .certs .sas .pools .authorities .stats
 AddType text/plain .policy .state .route .iptables .iptables-save
+AddType text/plain .eap .default .inner-tunnel
@@ -1 +0,0 @@
-../conf-enabled/testresults-as-text.conf
@@ -12,13 +12,7 @@ AddHandler cgi-script .cgi
    DirectoryIndex ocsp.cgi
    <Directory "/etc/openssl/ocsp">
        Options  +ExecCGI
-        <IfModule mod_authz_core.c>
-            Require all granted
-        </IfModule>
-        <IfModule !mod_authz_core.c>
-            Order deny,allow
-            Allow from all
-        </IfModule>
+        Require all granted
   </Directory>
   ErrorLog     /var/log/apache2/ocsp/error_log
   CustomLog    /var/log/apache2/ocsp/access_log combined
@@ -34,13 +28,7 @@ Listen 8881
    DirectoryIndex ocsp.cgi
    <Directory "/etc/openssl/research/ocsp">
        Options +ExecCGI
-        <IfModule mod_authz_core.c>
-            Require all granted
-        </IfModule>
-        <IfModule !mod_authz_core.c>
-            Order deny,allow
-            Allow from all
-        </IfModule>
+        Require all granted
   </Directory>
   ErrorLog     /var/log/apache2/ocsp/error_log
   CustomLog    /var/log/apache2/ocsp/access_log combined
@@ -56,13 +44,7 @@ Listen 8882
    DirectoryIndex ocsp.cgi
    <Directory "/etc/openssl/sales/ocsp">
        Options +ExecCGI
-        <IfModule mod_authz_core.c>
-            Require all granted
-        </IfModule>
-        <IfModule !mod_authz_core.c>
-            Order deny,allow
-            Allow from all
-        </IfModule>
+        Require all granted
   </Directory>
   ErrorLog     /var/log/apache2/ocsp/error_log
   CustomLog    /var/log/apache2/ocsp/access_log combined
@@ -12,29 +12,34 @@ running_any $STRONGSWANHOSTS && die "Please stop test environment before running
 check_commands debootstrap mkfs.ext3 partprobe qemu-img qemu-nbd sfdisk

 # package includes/excludes
-INC=automake,autoconf,libtool,bison,flex,gperf,pkg-config,gettext,less
+INC=automake,autoconf,libtool,bison,flex,gperf,pkg-config,gettext,less,locales
 INC=$INC,build-essential,libgmp-dev,libldap2-dev,libcurl4-openssl-dev,ethtool
 INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc
 INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,liblog4cxx10-dev
-INC=$INC,libboost-thread-dev,libboost-system-dev,git-core,iperf,htop,screen
+INC=$INC,libboost-thread-dev,libboost-system-dev,git-core,iperf,htop
 INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev
 INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip,libsystemd-dev
 INC=$INC,python,python-setuptools,python-dev,python-pip,apt-transport-https
-INC=$INC,libjson0-dev,libxslt1-dev,libapache2-mod-wsgi,iptables-dev
+INC=$INC,libjson-c-dev,libxslt1-dev,libapache2-mod-wsgi,iptables-dev
+INC=$INC,libxerces-c-dev,libgcrypt20-dev,traceroute
 case "$BASEIMGSUITE" in
-wheezy)
-	INC=$INC,libxerces-c2-dev,libahven3-dev,libxmlada4.1-dev,libgmpada3-dev
-	INC=$INC,libalog0.4.1-base-dev
-	;;
 jessie)
-	INC=$INC,libxerces-c-dev,libahven4-dev,libxmlada5-dev,libgmpada5-dev
-	INC=$INC,libalog1-dev,libgcrypt20-dev
+	INC=$INC,libahven4-dev,libxmlada5-dev,libgmpada5-dev
+	INC=$INC,libalog1-dev
+	;;
+stretch)
+	INC=$INC,libahven5-dev,libxmlada-schema6-dev,libgmpada6-dev
+	INC=$INC,libalog2-dev
 	;;
 *)
 	echo_warn "Package list for '$BASEIMGSUITE' might has to be updated"
 esac
-SERVICES="apache2 dbus isc-dhcp-server slapd bind9"
+SERVICES="apache2 dbus isc-dhcp-server slapd bind9 freeradius"
 INC=$INC,${SERVICES// /,}
+# packages to install via APT, for SWIMA tests
+APT="tmux"
+# additional services to disable
+SERVICES="$SERVICES systemd-timesyncd.service"

 CACHEDIR=$BUILDDIR/cache
 APTCACHE=$LOOPDIR/var/cache/apt/archives
@@ -86,6 +91,13 @@ execute "debootstrap --arch=$BASEIMGARCH --include=$INC $BASEIMGSUITE $LOOPDIR $
 execute "mount -t proc none $LOOPDIR/proc" 0
 do_on_exit graceful_umount $LOOPDIR/proc

+log_action "Generating locales"
+cat > $LOOPDIR/etc/locale.gen << EOF
+de_CH.UTF-8 UTF-8
+en_US.UTF-8 UTF-8
+EOF
+execute_chroot "locale-gen"
+
 log_action "Downloading signing key for custom apt repo"
 execute_chroot "wget -q $BASEIMGEXTKEY -O /tmp/key"
 log_action "Installing signing key for custom apt repo"
@@ -107,18 +119,15 @@ log_status $?

 log_action "Update package sources"
 execute_chroot "apt-get update"
+log_action "Install packages via APT"
+execute_chroot "apt-get -y install $APT"
 log_action "Install packages from custom repo"
 execute_chroot "apt-get -y upgrade"

 for service in $SERVICES
 do
 	log_action "Disabling service $service"
-	if [ "$BASEIMGSUITE" == "wheezy" ]
-	then
-		execute_chroot "update-rc.d -f $service remove"
-	else
-		execute_chroot "systemctl disable $service"
-	fi
+	execute_chroot "systemctl disable $service"
 done

 log_action "Disabling root password"
@@ -76,12 +76,7 @@ do

 		for service in "apache2 slapd bind9"
 		do
-			if [ "$BASEIMGSUITE" == "wheezy" ]
-			then
-				execute_chroot "update-rc.d $service defaults" 0
-			else
-				execute_chroot "systemctl enable $service" 0
-			fi
+			execute_chroot "systemctl enable $service" 0
 		done
 	fi
 	sync
@@ -55,8 +55,11 @@ do_on_exit umount $LOOPDIR/root/shared

 echo "Installing software from source"
 RECPDIR=$DIR/recipes
+if [ -d "$RECPDIR/patches" ]
+then
+	execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0
+fi
 RECIPES=`ls $RECPDIR/*.mk | xargs -n1 basename`
-execute "cp -r $RECPDIR/patches $LOOPDIR/root/shared/compile" 0
 for r in $RECIPES
 do
 	cp $RECPDIR/$r ${LOOPDIR}/root/shared/compile
@@ -1,31 +0,0 @@
-#!/usr/bin/make
-
-PV  = 1.25
-PKG = libtnc-$(PV)
-TAR = $(PKG).tar.gz
-SRC = http://downloads.sourceforge.net/project/libtnc/libtnc/$(PV)/$(TAR)
-
-NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
-
-CONFIG_OPTS = \
-	--sysconfdir=/etc
-
-all: install
-
-$(TAR):
-	wget $(SRC)
-
-.$(PKG)-unpacked: $(TAR)
-	tar xfz $(TAR)
-	@touch $@
-
-.$(PKG)-configured: .$(PKG)-unpacked
-	cd $(PKG) && ./configure $(CONFIG_OPTS)
-	@touch $@
-
-.$(PKG)-built: .$(PKG)-configured
-	cd $(PKG) && make -j $(NUM_CPUS)
-	@touch $@
-
-install: .$(PKG)-built
-	cd $(PKG) && make install
@@ -1,35 +0,0 @@
-#!/usr/bin/make
-
-PKG = fhhtnc
-SRC = git://github.com/trustatfhh/tnc-fhh.git
-
-NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
-
-CONFIG_OPTS = \
-	-DCOMPONENT=all \
-	-DNAL=8021x
-
-PATCHES = \
-	tnc-fhh-tncsim
-
-all: install
-
-.$(PKG)-cloned:
-	git clone $(SRC) $(PKG)
-	mkdir $(PKG)/build
-	@touch $@
-
-.$(PKG)-patches-applied: .$(PKG)-cloned
-	cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
-	@touch $@
-
-.$(PKG)-configured: .$(PKG)-patches-applied
-	cd $(PKG)/build && cmake $(CONFIG_OPTS) ../
-	@touch $@
-
-.$(PKG)-built: .$(PKG)-configured
-	cd $(PKG)/build && make -j $(NUM_CPUS)
-	@touch $@
-
-install: .$(PKG)-built
-	cd $(PKG)/build && make install
@@ -1,43 +0,0 @@
-#!/usr/bin/make
-
-PV  = 2.2.8
-PKG = freeradius-server-$(PV)
-TAR = $(PKG).tar.bz2
-SRC = ftp://ftp.freeradius.org/pub/freeradius/old/$(TAR)
-
-NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
-
-CONFIG_OPTS = \
-	--with-raddbdir=/etc/freeradius \
-	--sysconfdir=/etc \
-	--with-logdir=/var/log/freeradius \
-	--enable-developer \
-	--with-experimental-modules
-
-PATCHES = \
-	freeradius-eap-sim-identity \
-	freeradius-tnc-fhh
-
-all: install
-
-$(TAR):
-	wget $(SRC)
-
-.$(PKG)-unpacked: $(TAR)
-	tar xfj $(TAR)
-	@touch $@
-
-.$(PKG)-patches-applied: .$(PKG)-unpacked
-	cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
-	@touch $@
-
-.$(PKG)-configured: .$(PKG)-patches-applied
-	cd $(PKG) && ./configure $(CONFIG_OPTS)
-	@touch $@
-
-.$(PKG)-built: .$(PKG)-configured
-	cd $(PKG) && make -j $(NUM_CPUS)
-	@touch $@
-
-install: .$(PKG)-built
-	cd $(PKG) && make install
@@ -1,39 +0,0 @@
-#!/usr/bin/make
-
-PV  = 2.0
-PKG = hostapd-$(PV)
-TAR = $(PKG).tar.gz
-SRC = http://w1.fi/releases/$(TAR)
-
-NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
-
-CONFIG_OPTS =
-
-PATCHES = \
-	hostapd-config
-
-SUBDIR = hostapd
-
-all: install
-
-$(TAR):
-	wget $(SRC)
-
-.$(PKG)-unpacked: $(TAR)
-	tar xfz $(TAR)
-	@touch $@
-
-.$(PKG)-patches-applied: .$(PKG)-unpacked
-	cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
-	@touch $@
-
-.$(PKG)-configured: .$(PKG)-patches-applied
-	cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
-	@touch $@
-
-.$(PKG)-built: .$(PKG)-configured
-	cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
-	@touch $@
-
-install: .$(PKG)-built
-	cd $(PKG)/$(SUBDIR) && make install
@@ -1,39 +0,0 @@
-#!/usr/bin/make
-
-PV  = 2.0
-PKG = wpa_supplicant-$(PV)
-TAR = $(PKG).tar.gz
-SRC = http://w1.fi/releases/$(TAR)
-
-NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)
-
-CONFIG_OPTS =
-
-PATCHES = \
-	wpa_supplicant-eap-tnc
-
-SUBDIR = wpa_supplicant
-
-all: install
-
-$(TAR):
-	wget $(SRC)
-
-.$(PKG)-unpacked: $(TAR)
-	tar xfz $(TAR)
-	@touch $@
-
-.$(PKG)-patches-applied: .$(PKG)-unpacked
-	cd $(PKG) && cat $(addprefix ../patches/, $(PATCHES)) | patch -p1
-	@touch $@
-
-.$(PKG)-configured: .$(PKG)-patches-applied
-	cp $(PKG)/$(SUBDIR)/defconfig $(PKG)/$(SUBDIR)/.config
-	@touch $@
-
-.$(PKG)-built: .$(PKG)-configured
-	cd $(PKG)/$(SUBDIR) && make -j $(NUM_CPUS)
-	@touch $@
-
-install: .$(PKG)-built
-	cd $(PKG)/$(SUBDIR) && make install
@@ -1,30 +0,0 @@
--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c	2012-11-28 11:03:05.081225276 +0100
-+++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c	2012-11-28 11:46:59.746289881 +0100
-@@ -246,14 +246,21 @@
-	newvp->vp_integer = ess->sim_id++;
-	pairreplace(outvps, newvp);
-
-+	ess->keys.identitylen = strlen(handler->identity);
-+	memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
-+
-	/* make a copy of the identity */
-	newvp = pairfind(*invps, ATTRIBUTE_EAP_SIM_BASE + PW_EAP_SIM_IDENTITY);
-	if (newvp) {
-		ess->keys.identitylen = newvp->length;
-		memcpy(ess->keys.identity, newvp->vp_octets, newvp->length);
-	} else {
-		ess->keys.identitylen = strlen(handler->identity);
-		memcpy(ess->keys.identity, handler->identity, ess->keys.identitylen);
-+	if (newvp && newvp->length > 2) {
-+		uint16_t len;
-+
-+		memcpy(&len, newvp->vp_octets, sizeof(uint16_t));
-+		len = ntohs(len);
-+		if (len <= newvp->length - 2 && len <= MAX_STRING_LEN) {
-+			ess->keys.identitylen = len;
-+			memcpy(ess->keys.identity, newvp->vp_octets + 2,
-+			       ess->keys.identitylen);
-+		}
-	}
-
-	/* all set, calculate keys! */
@@ -1,38 +0,0 @@
-diff -u -ur hostapd-2.0.orig/hostapd/defconfig hostapd-2.0/hostapd/defconfig
--- hostapd-2.0.orig/hostapd/defconfig	2013-01-12 16:42:53.000000000 +0100
-+++ hostapd-2.0/hostapd/defconfig	2016-06-15 17:32:57.000000000 +0200
-@@ -13,14 +13,14 @@
- CONFIG_DRIVER_HOSTAP=y
- 
- # Driver interface for wired authenticator
-#CONFIG_DRIVER_WIRED=y
-+CONFIG_DRIVER_WIRED=y
- 
- # Driver interface for madwifi driver
- #CONFIG_DRIVER_MADWIFI=y
- #CFLAGS += -I../../madwifi # change to the madwifi source directory
- 
- # Driver interface for drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-+#CONFIG_DRIVER_NL80211=y
- 
- # Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
- #CONFIG_DRIVER_BSD=y
-@@ -30,7 +30,7 @@
- #LIBS_c += -L/usr/local/lib
- 
- # Driver interface for no driver (e.g., RADIUS server only)
-#CONFIG_DRIVER_NONE=y
-+CONFIG_DRIVER_NONE=y
- 
- # IEEE 802.11F/IAPP
- CONFIG_IAPP=y
-@@ -152,7 +152,7 @@
- 
- # Add support for writing debug log to a file: -f /tmp/hostapd.log
- # Disabled by default.
-#CONFIG_DEBUG_FILE=y
-+CONFIG_DEBUG_FILE=y
- 
- # Remove support for RADIUS accounting
- #CONFIG_NO_ACCOUNTING=y
@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index fe65134512ea..3c5255f21ea6 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -101,7 +101,6 @@ IF(${COMPONENT} STREQUAL "ALL")
- 	add_subdirectory(tncxacml)
- 	add_subdirectory(imcv)
- 	add_subdirectory(tncs)
-	add_subdirectory(tncsim)
- 			
- 	IF(${NAL} STREQUAL "8021X" OR ${NAL} STREQUAL "ALL")
- 		add_subdirectory(naaeap)
@@ -1,47 +0,0 @@
-diff -urN wpa_supplicant-2.0.ori/src/eap_peer/tncc.c wpa_supplicant-2.0/src/eap_peer/tncc.c
--- wpa_supplicant-2.0.ori/src/eap_peer/tncc.c	2013-01-12 16:42:53.000000000 +0100
-+++ wpa_supplicant-2.0/src/eap_peer/tncc.c	2013-03-23 13:10:22.151059154 +0100
-@@ -465,7 +465,7 @@
- 		return -1;
- 	}
- #else /* CONFIG_NATIVE_WINDOWS */
-	imc->dlhandle = dlopen(imc->path, RTLD_LAZY);
-+	imc->dlhandle = dlopen(imc->path, RTLD_LAZY | RTLD_GLOBAL);
- 	if (imc->dlhandle == NULL) {
- 		wpa_printf(MSG_ERROR, "TNC: Failed to open IMC '%s' (%s): %s",
- 			   imc->name, imc->path, dlerror());
-diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/defconfig wpa_supplicant-2.0/wpa_supplicant/defconfig
--- wpa_supplicant-2.0.ori/wpa_supplicant/defconfig	2013-01-12 16:42:53.000000000 +0100
-+++ wpa_supplicant-2.0/wpa_supplicant/defconfig	2013-03-23 13:06:08.759052370 +0100
-@@ -86,7 +86,7 @@
- CONFIG_DRIVER_WEXT=y
- 
- # Driver interface for Linux drivers using the nl80211 kernel interface
-CONFIG_DRIVER_NL80211=y
-+#CONFIG_DRIVER_NL80211=y
- 
- # Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
- #CONFIG_DRIVER_BSD=y
-@@ -193,7 +193,7 @@
- #CONFIG_EAP_GPSK_SHA256=y
- 
- # EAP-TNC and related Trusted Network Connect support (experimental)
-#CONFIG_EAP_TNC=y
-+CONFIG_EAP_TNC=y
- 
- # Wi-Fi Protected Setup (WPS)
- #CONFIG_WPS=y
-diff -urN wpa_supplicant-2.0.ori/wpa_supplicant/Makefile wpa_supplicant-2.0/wpa_supplicant/Makefile
--- wpa_supplicant-2.0.ori/wpa_supplicant/Makefile	2013-01-12 16:42:53.000000000 +0100
-+++ wpa_supplicant-2.0/wpa_supplicant/Makefile	2013-03-23 13:06:08.759052370 +0100
-@@ -6,8 +6,8 @@
- CFLAGS = -MMD -O2 -Wall -g
- endif
- 
-export LIBDIR ?= /usr/local/lib/
-export BINDIR ?= /usr/local/sbin/
-+export LIBDIR ?= /usr/lib/
-+export BINDIR ?= /usr/sbin/
- PKG_CONFIG ?= pkg-config
- 
- CFLAGS += -I../src
@@ -49,7 +49,7 @@ fi
 # Base image settings
 # The base image is a pristine OS installation created using debootstrap.
 : ${BASEIMGSIZE=1600}
-: ${BASEIMGSUITE=jessie}
+: ${BASEIMGSUITE=stretch}
 : ${BASEIMGARCH=amd64}
 : ${BASEIMG=$IMGDIR/debian-$BASEIMGSUITE-$BASEIMGARCH.$IMGEXT}
 : ${BASEIMGMIRROR=http://http.debian.net/debian}
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = md5
+  md5 {
+  }
+}
@@ -1,9 +1,17 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
 authorize {
  suffix
+  files
  eap {
    ok = return
  }
-  files
 }

 authenticate {
@@ -21,6 +29,7 @@ accounting {
  detail
  unix
  radutmp
+  exec
  attr_filter.accounting_response
 }

@@ -32,6 +41,8 @@ post-auth {
  exec
  Post-Auth-Type REJECT {
    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
  }
 }

@@ -41,3 +52,5 @@ pre-proxy {
 post-proxy {
  eap
 }
+
+}
@@ -0,0 +1 @@
+carol	Cleartext-Password := "4iChxLT3"
@@ -1,5 +1,5 @@
 moon::ipsec stop
 carol::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
@@ -1,6 +1,6 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 moon::expect-connection rw
@@ -1,13 +1,21 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
 authorize {
  suffix
-  eap {
-    ok = return
-  }
  files
+  pap
 }

 authenticate {
-  eap
+  Auth-Type PAP {
+    pap
+  }
 }

 preacct {
@@ -21,6 +29,7 @@ accounting {
  detail
  unix
  radutmp
+  exec
  attr_filter.accounting_response
 }

@@ -39,5 +48,6 @@ pre-proxy {
 }

 post-proxy {
-  eap
+}
+
 }
@@ -0,0 +1 @@
+carol	Cleartext-Password := "4iChxLT3"
@@ -1,5 +1,5 @@
 moon::ipsec stop
 carol::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
@@ -1,6 +1,6 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 moon::expect-connection rw
@@ -1,9 +0,0 @@
-subnet 10.1.0.0 netmask 255.255.0.0 {
-  option routers 10.1.0.1;
-  option broadcast-address 10.1.255.255;
-  option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
-  option netbios-name-servers PH_IP_VENUS;
-
-  # dynamic address pool for visitors
-  range 10.1.0.30 10.1.0.50;
-}
@@ -1,9 +0,0 @@
-subnet 10.1.0.0 netmask 255.255.0.0 {
-  option routers 10.1.0.1;
-  option broadcast-address 10.1.255.255;
-  option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
-  option netbios-name-servers PH_IP_VENUS;
-
-  # dynamic address pool for visitors
-  range 10.1.0.30 10.1.0.50;
-}
@@ -1,9 +0,0 @@
-subnet 10.1.0.0 netmask 255.255.0.0 {
-  option routers 10.1.0.1;
-  option broadcast-address 10.1.255.255;
-  option domain-name servers PH_IP_WINNETOU PH_IP_VENUS
-  option netbios-name-servers PH_IP_VENUS;
-
-  # dynamic address pool for visitors
-  range 10.1.0.30 10.1.0.50;
-}
@@ -6,4 +6,4 @@ carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
 carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES
 carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES
 carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
-carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
+carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org.*: icmp_seq=1::YES
@@ -6,4 +6,4 @@ carol::cat /var/log/daemon.log::installing new virtual IP 10.3.0.1::YES
 carol::cat /var/log/daemon.log::installing new virtual IP fec3:\:1::YES
 carol::cat /var/log/daemon.log::TS 10.3.0.1/32 fec3:\:1/128 === 10.1.0.0/16 fec1:\:/16::YES
 carol::ping -c 1 PH_IP_MOON::64 bytes from PH_IP_MOON: icmp_.eq=1::YES
-carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org: icmp_seq=1::YES
+carol::ping6 -c 1 ip6-alice.strongswan.org::64 bytes from ip6-alice.strongswan.org.*: icmp_seq=1::YES
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = sim
+  sim {
+  }
+}
@@ -0,0 +1,58 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
+authorize {
+  preprocess
+  files
+  eap {
+    ok = return
+  }
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+preacct {
+  preprocess
+  acct_unique
+  suffix
+  files
+}
+
+accounting {
+  detail
+  unix
+  radutmp
+  exec
+  attr_filter.accounting_response
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  exec
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+}
@@ -0,0 +1,2 @@
+228060123456001	EAP-Type := SIM, EAP-Sim-RAND1 := 0x30000000000000000000000000000000, EAP-Sim-SRES1 := 0x30112233, EAP-Sim-KC1 := 0x305566778899AABB, EAP-Sim-RAND2 := 0x31000000000000000000000000000000, EAP-Sim-SRES2 := 0x31112233, EAP-Sim-KC2 := 0x315566778899AABB, EAP-Sim-RAND3 := 0x32000000000000000000000000000000, EAP-Sim-SRES3 := 0x32112233, EAP-Sim-KC3 := 0x325566778899AABB
+228060123456002	EAP-Type := SIM, EAP-Sim-RAND1 := 0x33000000000000000000000000000000, EAP-Sim-SRES1 := 0x33112233, EAP-Sim-KC1 := 0x335566778899AABB, EAP-Sim-RAND2 := 0x34000000000000000000000000000000, EAP-Sim-SRES2 := 0x34112233, EAP-Sim-KC2 := 0x345566778899AABB, EAP-Sim-RAND3 := 0x35000000000000000000000000000000, EAP-Sim-SRES3 := 0x35112233, EAP-Sim-KC3 := 0x355566778899AABB
@@ -1,3 +0,0 @@
-sim_files {
-	simtriplets = "/etc/freeradius/triplets.dat"
-}
@@ -2,13 +2,23 @@ authorize {
  preprocess
  chap
  mschap
-  sim_files
  suffix
+  files
+  update reply {
+    EAP-Sim-Rand1 := "%{control:EAP-Sim-Rand1}"
+    EAP-Sim-Rand2 := "%{control:EAP-Sim-Rand2}"
+    EAP-Sim-Rand3 := "%{control:EAP-Sim-Rand3}"
+    EAP-Sim-SRES1 := "%{control:EAP-Sim-SRES1}"
+    EAP-Sim-SRES2 := "%{control:EAP-Sim-SRES2}"
+    EAP-Sim-SRES3 := "%{control:EAP-Sim-SRES3}"
+    EAP-Sim-KC1   := "%{control:EAP-Sim-KC1}"
+    EAP-Sim-KC2   := "%{control:EAP-Sim-KC2}"
+    EAP-Sim-KC3   := "%{control:EAP-Sim-KC3}"
+  }
  eap {
    ok = return
  }
  unix
-  files
  expiration
  logintime
  pap
@@ -1,6 +0,0 @@
-228060123456001,30000000000000000000000000000000,30112233,305566778899AABB
-228060123456001,31000000000000000000000000000000,31112233,315566778899AABB
-228060123456001,32000000000000000000000000000000,32112233,325566778899AABB
-228060123456002,33000000000000000000000000000000,33112233,335566778899AABB
-228060123456002,34000000000000000000000000000000,34112233,345566778899AABB
-228060123456002,35000000000000000000000000000000,35112233,355566778899AABB
@@ -0,0 +1,2 @@
+228060123456001	EAP-Type := SIM, EAP-Sim-RAND1 := 0x30000000000000000000000000000000, EAP-Sim-SRES1 := 0x30112233, EAP-Sim-KC1 := 0x305566778899AABB, EAP-Sim-RAND2 := 0x31000000000000000000000000000000, EAP-Sim-SRES2 := 0x31112233, EAP-Sim-KC2 := 0x315566778899AABB, EAP-Sim-RAND3 := 0x32000000000000000000000000000000, EAP-Sim-SRES3 := 0x32112233, EAP-Sim-KC3 := 0x325566778899AABB
+228060123456002	EAP-Type := SIM, EAP-Sim-RAND1 := 0x33000000000000000000000000000000, EAP-Sim-SRES1 := 0x33112233, EAP-Sim-KC1 := 0x335566778899AABB, EAP-Sim-RAND2 := 0x34000000000000000000000000000000, EAP-Sim-SRES2 := 0x34112233, EAP-Sim-KC2 := 0x345566778899AABB, EAP-Sim-RAND3 := 0x35000000000000000000000000000000, EAP-Sim-SRES3 := 0x35112233, EAP-Sim-KC3 := 0x355566778899AABB
@@ -1,4 +1,4 @@
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
@@ -1,10 +1,6 @@
-alice::cat /etc/freeradius/clients.conf
-alice::cat /etc/freeradius/eap.conf
-alice::cat /etc/freeradius/proxy.conf
-alice::cat /etc/freeradius/triplets.dat
 carol::cat /etc/ipsec.d/triplets.dat
 dave::cat /etc/ipsec.d/triplets.dat
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 dave::ipsec start
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = md5
+  md5 {
+  }
+}
@@ -0,0 +1,58 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
+authorize {
+  preprocess
+  eap {
+    ok = return
+  }
+  files
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+preacct {
+  preprocess
+  acct_unique
+  suffix
+  files
+}
+
+accounting {
+  detail
+  unix
+  radutmp
+  exec
+  attr_filter.accounting_response
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  exec
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+}
@@ -1,2 +1,4 @@
 carol	Cleartext-Password := "Ar3etTnp"
+		Framed-IP-Address = 10.3.0.1
 dave	Cleartext-Password := "W7R0g3do"
+		Framed-IP-Address = 10.3.0.2
@@ -1,7 +1,7 @@
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 dave::iptables-restore < /etc/iptables.flush
@@ -1,7 +1,7 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
 dave::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 dave::ipsec start
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = md5
+  md5 {
+  }
+}
@@ -0,0 +1,58 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
+authorize {
+  preprocess
+  eap {
+    ok = return
+  }
+  files
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+preacct {
+  preprocess
+  acct_unique
+  suffix
+  files
+}
+
+accounting {
+  detail
+  unix
+  radutmp
+  exec
+  attr_filter.accounting_response
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  exec
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+}
@@ -1,2 +1,4 @@
 carol	Cleartext-Password := "Ar3etTnp"
+		Class = "Research"
 dave	Cleartext-Password := "W7R0g3do"
+		Class = "Accounting"
@@ -1,7 +1,7 @@
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 dave::iptables-restore < /etc/iptables.flush
@@ -1,7 +1,7 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
 dave::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 dave::ipsec start
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = md5
+  md5 {
+  }
+}
@@ -0,0 +1,58 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
+authorize {
+  preprocess
+  eap {
+    ok = return
+  }
+  files
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+preacct {
+  preprocess
+  acct_unique
+  suffix
+  files
+}
+
+accounting {
+  detail
+  unix
+  radutmp
+  exec
+  attr_filter.accounting_response
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  exec
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+}
@@ -0,0 +1 @@
+carol	Cleartext-Password := "Ar3etTnp"
@@ -1,5 +1,5 @@
 moon::ipsec stop
 carol::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
@@ -1,6 +1,6 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 moon::expect-connection rw-eap
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = md5
+  md5 {
+  }
+}
@@ -1,9 +1,20 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
 authorize {
+  preprocess
  suffix
  eap {
    ok = return
  }
  files
+  expiration
+  logintime
 }

 authenticate {
@@ -21,6 +32,7 @@ accounting {
  detail
  unix
  radutmp
+  exec
  attr_filter.accounting_response
 }

@@ -32,6 +44,8 @@ post-auth {
  exec
  Post-Auth-Type REJECT {
    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
  }
 }

@@ -41,3 +55,5 @@ pre-proxy {
 post-proxy {
  eap
 }
+
+}
@@ -0,0 +1 @@
+carol	Cleartext-Password := "Ar3etTnp"
@@ -1,5 +1,5 @@
 moon::ipsec stop
 carol::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
@@ -1,6 +1,6 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 moon::expect-connection rw-eap
@@ -0,0 +1,21 @@
+eap {
+  md5 {
+  }
+  default_eap_type = peap
+
+  tls-config tls-common {
+    private_key_file = ${certdir}/aaaKey.pem
+    certificate_file = ${certdir}/aaaCert.pem
+    ca_file = ${cadir}/strongswanCert.pem
+    cipher_list = "DEFAULT"
+    dh_file = ${certdir}/dh
+    random_file = ${certdir}/random
+  }
+
+  peap {
+    tls = tls-common
+    default_eap_type = md5
+    use_tunneled_reply = yes
+    virtual_server = "inner-tunnel"
+  }
+}
@@ -1,9 +1,20 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
 authorize {
+  preprocess
  suffix
  eap {
    ok = return
  }
  files
+  expiration
+  logintime
 }

 authenticate {
@@ -21,6 +32,7 @@ accounting {
  detail
  unix
  radutmp
+  exec
  attr_filter.accounting_response
 }

@@ -32,6 +44,8 @@ post-auth {
  exec
  Post-Auth-Type REJECT {
    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
  }
 }

@@ -41,3 +55,5 @@ pre-proxy {
 post-proxy {
  eap
 }
+
+}
@@ -0,0 +1,38 @@
+server inner-tunnel {
+
+authorize {
+  filter_username
+  suffix
+  eap {
+    ok = return
+  }
+  files
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    update outer.session-state {
+      &Module-Failure-Message := &request:Module-Failure-Message
+    }
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+} # inner-tunnel server block
@@ -1,7 +1,7 @@
 moon::ipsec stop
 carol::ipsec stop
 dave::ipsec stop
-alice::killall radiusd
+alice::killall freeradius
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 dave::iptables-restore < /etc/iptables.flush
@@ -1,7 +1,7 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
 dave::iptables-restore < /etc/iptables.rules
-alice::radiusd
+alice::freeradius
 moon::ipsec start
 carol::ipsec start
 dave::ipsec start
@@ -0,0 +1,5 @@
+eap {
+  default_eap_type = sim
+  sim {
+  }
+}
@@ -0,0 +1,58 @@
+server default {
+
+listen {
+  type = auth
+  ipaddr = 10.1.0.10
+  port = 0
+}
+
+authorize {
+  preprocess
+  files
+  eap {
+    ok = return
+  }
+  expiration
+  logintime
+}
+
+authenticate {
+  eap
+}
+
+preacct {
+  preprocess
+  acct_unique
+  suffix
+  files
+}
+
+accounting {
+  detail
+  unix
+  radutmp
+  exec
+  attr_filter.accounting_response
+}
+
+session {
+  radutmp
+}
+
+post-auth {
+  exec
+  Post-Auth-Type REJECT {
+    attr_filter.access_reject
+    eap
+    remove_reply_message_if_eap
+  }
+}
+
+pre-proxy {
+}
+
+post-proxy {
+  eap
+}
+
+}
@@ -0,0 +1 @@
+228060123456001	EAP-Type := SIM, EAP-Sim-RAND1 := 0x30000000000000000000000000000000, EAP-Sim-SRES1 := 0x30112233, EAP-Sim-KC1 := 0x305566778899AABB, EAP-Sim-RAND2 := 0x31000000000000000000000000000000, EAP-Sim-SRES2 := 0x31112233, EAP-Sim-KC2 := 0x315566778899AABB, EAP-Sim-RAND3 := 0x32000000000000000000000000000000, EAP-Sim-SRES3 := 0x32112233, EAP-Sim-KC3 := 0x325566778899AABB
@@ -1,3 +0,0 @@
-sim_files {
-	simtriplets = "/etc/freeradius/triplets.dat"
-}
@@ -1,5 +1,16 @@
 authorize {
-  sim_files
+  files
+  update reply {
+    EAP-Sim-Rand1 := "%{control:EAP-Sim-Rand1}"
+    EAP-Sim-Rand2 := "%{control:EAP-Sim-Rand2}"
+    EAP-Sim-Rand3 := "%{control:EAP-Sim-Rand3}"
+    EAP-Sim-SRES1 := "%{control:EAP-Sim-SRES1}"
+    EAP-Sim-SRES2 := "%{control:EAP-Sim-SRES2}"
+    EAP-Sim-SRES3 := "%{control:EAP-Sim-SRES3}"
+    EAP-Sim-KC1   := "%{control:EAP-Sim-KC1}"
+    EAP-Sim-KC2   := "%{control:EAP-Sim-KC2}"
+    EAP-Sim-KC3   := "%{control:EAP-Sim-KC3}"
+  }
  eap {
    ok = return
  }
@@ -1,3 +0,0 @@
-228060123456001,30000000000000000000000000000000,30112233,305566778899AABB
-228060123456001,31000000000000000000000000000000,31112233,315566778899AABB
-228060123456001,32000000000000000000000000000000,32112233,325566778899AABB
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`228060123456001 EAP-Type := SIM, EAP-Sim-RAND1 := 0x30000000000000000000000000000000, EAP-Sim-SRES1 := 0x30112233, EAP-Sim-KC1 := 0x305566778899AABB, EAP-Sim-RAND2 := 0x31000000000000000000000000000000, EAP-Sim-SRES2 := 0x31112233, EAP-Sim-KC2 := 0x315566778899AABB, EAP-Sim-RAND3 := 0x32000000000000000000000000000000, EAP-Sim-SRES3 := 0x32112233, EAP-Sim-KC3 := 0x325566778899AABB`