mcnewton/freeradius-server — comment on commit f73496894694c8a100e625bb751363c773e4852a
File: raddb/mods-available/eap line 316
By mcnewton:

No, it still doesn't allow you to put the tls options directly in the peap config section - the only new one allowed in there is the tls= option. Maybe the comment "TLS negotiation parameters" should be something more like "The tls option points to a section holding the TLS negotiation parameters" instead.

So the logic is currently like you say above:
* no "tls" item means use the EAP-TLS config
* tls is CONF_PAIR, uses reference to a configuration elsewhere
The only thing you can't do is have a tls CONF_SECTION inside PEAP.

But as you suggest, that might be a good idea, and would definitely be more flexible for the user.

Because conf parsing for all of EAP-TLS, EAP-PEAP and EAP-TTLS are very similar, I'll look at a libeap (or other library) function to do this parsing, so they all do the same thing. That should share some more code, and reduce the size of the *_attach functions drastically.