EAP server: Disable TLS session ticket with EAP-TLS/TTLS/PEAP

The EAP server is not yet capable of using TLS session ticket to resume
a session. Explicitly disable use of TLS session ticket with
EAP-TLS/TTLS/PEAP to avoid wasting resources on generating a session
ticket that cannot be used for anything.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_server/eap_server_fast.c b/src/eap_server/eap_server_fast.c
index 6745100d338c0543883c30ad2044d42c07f26a2c..bd9018e78b56b062ad6114f80da75d43f6984d01 100644 (file)
--- a/src/eap_server/eap_server_fast.c
+++ b/src/eap_server/eap_server_fast.c
@@ -428,7 +428,7 @@ static void * eap_fast_init(struct eap_sm *sm)
        }
        data->state = START;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 0, EAP_TYPE_FAST)) {
                wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
                eap_fast_reset(sm, data);
                return NULL;

diff --git a/src/eap_server/eap_server_peap.c b/src/eap_server/eap_server_peap.c
index 3848f308784ab1db467a74f9a71098a77cdb5268..ff3401b4689317ba909138fc1edbc196307040fc 100644 (file)
--- a/src/eap_server/eap_server_peap.c
+++ b/src/eap_server/eap_server_peap.c
@@ -151,7 +151,7 @@ static void * eap_peap_init(struct eap_sm *sm)
        data->state = START;
        data->crypto_binding = OPTIONAL_BINDING;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 0, EAP_TYPE_PEAP)) {
                wpa_printf(MSG_INFO, "EAP-PEAP: Failed to initialize SSL.");
                eap_peap_reset(sm, data);
                return NULL;

diff --git a/src/eap_server/eap_server_tls.c b/src/eap_server/eap_server_tls.c
index 58cfe8ac64a027d415df29d9ce0c0f00729f1d5d..7304d128b4e79a9d2ee0ec7f97fbe703a24d24f1 100644 (file)
--- a/src/eap_server/eap_server_tls.c
+++ b/src/eap_server/eap_server_tls.c
@@ -60,7 +60,7 @@ static void * eap_tls_init(struct eap_sm *sm)
                return NULL;
        data->state = START;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 1)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 1, EAP_TYPE_TLS)) {
                wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
                eap_tls_reset(sm, data);
                return NULL;
@@ -82,7 +82,7 @@ static void * eap_unauth_tls_init(struct eap_sm *sm)
                return NULL;
        data->state = START;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 0, EAP_UNAUTH_TLS_TYPE)) {
                wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
                eap_tls_reset(sm, data);
                return NULL;
@@ -104,7 +104,8 @@ static void * eap_wfa_unauth_tls_init(struct eap_sm *sm)
                return NULL;
        data->state = START;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 0,
+                                   EAP_WFA_UNAUTH_TLS_TYPE)) {
                wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
                eap_tls_reset(sm, data);
                return NULL;

diff --git a/src/eap_server/eap_server_tls_common.c b/src/eap_server/eap_server_tls_common.c
index ce3bda336637b619ab6b805e947a3c004aa775f7..ec1501672029b2dfedcf5517be77e5b1c53d5fb8 100644 (file)
--- a/src/eap_server/eap_server_tls_common.c
+++ b/src/eap_server/eap_server_tls_common.c
@@ -44,7 +44,7 @@ static void eap_server_tls_log_cb(void *ctx, const char *msg)
 
 
 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
-                           int verify_peer)
+                           int verify_peer, int eap_type)
 {
        unsigned int flags = 0;
 
@@ -70,6 +70,8 @@ int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
 #endif /* CONFIG_TESTING_OPTIONS */
 #endif /* CONFIG_TLS_INTERNAL */
 
+       if (eap_type != EAP_TYPE_FAST)
+               flags |= TLS_CONN_DISABLE_SESSION_TICKET;
        if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer,
                                      flags, NULL, 0)) {
                wpa_printf(MSG_INFO, "SSL: Failed to configure verification "

diff --git a/src/eap_server/eap_server_ttls.c b/src/eap_server/eap_server_ttls.c
index 31c67e8f76a5bbdeb99649d7b34ee3fe527ab2e8..6766dd2add5303449c5b537a4c97a64c06be5de5 100644 (file)
--- a/src/eap_server/eap_server_ttls.c
+++ b/src/eap_server/eap_server_ttls.c
@@ -317,7 +317,7 @@ static void * eap_ttls_init(struct eap_sm *sm)
        data->ttls_version = EAP_TTLS_VERSION;
        data->state = START;
 
-       if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
+       if (eap_server_tls_ssl_init(sm, &data->ssl, 0, EAP_TYPE_TTLS)) {
                wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
                eap_ttls_reset(sm, data);
                return NULL;

diff --git a/src/eap_server/eap_tls_common.h b/src/eap_server/eap_tls_common.h
index ddf90b859ee402319566f78d012e2f3f4e652d2a..dc943eb207d74ccd288983aa6745bc83f03498e9 100644 (file)
--- a/src/eap_server/eap_tls_common.h
+++ b/src/eap_server/eap_tls_common.h
@@ -70,7 +70,7 @@ struct eap_ssl_data {
 struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len,
                                  u8 code, u8 identifier);
 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
-                           int verify_peer);
+                           int verify_peer, int eap_type);
 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data);
 u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
                               char *label, size_t len);