mcnewton/freeradius-server — comment on commit f73496894694c8a100e625bb751363c773e4852a
File: raddb/mods-available/eap line 316
By alandekok:

Matthew Newton wrote:
> No, it still doesn't allow you to put the tls options directly in the peap config section - the only new one allowed in there is the tls= option. Maybe the comment "TLS negotiation parameters" should be something more like "The tls option points to a section holding the TLS negotiation parameters" instead.

Ah. I was looking at the code for the TLS module.

> So the logic is currently like you say above:
> * no "tls" item means use the EAP-TLS config
> * tls is CONF_PAIR, uses reference to a configuration elsewhere
> The only thing you can't do is have a tls CONF_SECTION inside PEAP.
>
> But as you suggest, that might be a good idea, and would definitely be more flexible for the user.

Nah. That's nice, but more complicated. Better to keep it simple.

> Because conf parsing for all of EAP-TLS, EAP-PEAP and EAP-TTLS are very similar, I'll look at a libeap (or other library) function to do this parsing, so they all do the same thing. That should share some more code, and reduce the size of the *_attach functions drastically.

Sounds good to me.