add internal "name" to tls_server_conf_t

so that when the TLS code prints out debugging information, it
can print out "RADIUS/TLS proxy" or "RADIUS/TLS listen" or even
the individual EAP type

diff --git a/src/include/tls-h b/src/include/tls-h
index 1edcd214b2dabc5ae53c8150a327fbc04deaed7c..506fb19778231add7c5ace250f2153a52e3e6945 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -357,6 +357,8 @@ struct fr_tls_server_conf_t {
        SSL_CTX         *ctx;
        CONF_SECTION    *cs;
 
+       char const      *name;                          //!< name of the thing doing TLS.
+
        char const      *private_key_password;
        char const      *private_key_file;
        char const      *certificate_file;

diff --git a/src/main/cb.c b/src/main/cb.c
index db764aa327e691e62ed45b674c16d567119cf689..ad66e0d759cfd083f933e20a5f2df5f768612831 100644 (file)
--- a/src/main/cb.c
+++ b/src/main/cb.c
@@ -31,6 +31,7 @@ void cbtls_info(SSL const *s, int where, int ret)
 {
        char const *role, *state;
        REQUEST *request = SSL_get_ex_data(s, FR_TLS_EX_INDEX_REQUEST);
+       fr_tls_server_conf_t *conf = (fr_tls_server_conf_t *) SSL_get_ex_data(s, FR_TLS_EX_INDEX_CONF);
 
        if ((where & ~SSL_ST_MASK) & SSL_ST_CONNECT) {
                role = "Client ";
@@ -58,7 +59,7 @@ void cbtls_info(SSL const *s, int where, int ret)
                        len = strlen(abbrv);
                        if ((len > 1) && (abbrv[len - 1] == ' ')) len--;
 
-                       RDEBUG3("(TLS) Handshake state [%.*s] - %s%s (%d)",
+                       RDEBUG3("(TLS) %s - Handshake state [%.*s] - %s%s (%d)", conf->name,
                                (int)len, abbrv, role, state, SSL_get_state(s));
 
                        /*
@@ -82,7 +83,7 @@ void cbtls_info(SSL const *s, int where, int ret)
        
                                client_ciphers = SSL_get_client_ciphers(s);
                                if (client_ciphers) {
-                                       RDEBUG3("Client preferred ciphers (by priority)");
+                                       RDEBUG3("(TLS) %s - Client preferred ciphers (by priority)", conf->name);
                                        num_ciphers = sk_SSL_CIPHER_num(client_ciphers);
                                        for (i = 0; i < num_ciphers; i++) {
                                                this_cipher = sk_SSL_CIPHER_value(client_ciphers, i);
@@ -92,7 +93,7 @@ void cbtls_info(SSL const *s, int where, int ret)
                        }
 #endif
                } else {
-                       RDEBUG2("(TLS) Handshake state - %s%s", role, state);
+                       RDEBUG2("(TLS) %s - Handshake state - %s%s", conf->name, role, state);
                }
                return;
        }
@@ -100,23 +101,23 @@ void cbtls_info(SSL const *s, int where, int ret)
        if (where & SSL_CB_ALERT) {
                if ((ret & 0xff) == SSL_AD_CLOSE_NOTIFY) return;
 
-               RERROR("(TLS) Alert %s:%s:%s", (where & SSL_CB_READ) ? "read": "write",
+               RERROR("(TLS) %s - Alert %s:%s:%s", conf->name, (where & SSL_CB_READ) ? "read": "write",
                       SSL_alert_type_string_long(ret), SSL_alert_desc_string_long(ret));
                return;
        }
 
        if (where & SSL_CB_EXIT) {
                if (ret == 0) {
-                       RERROR("(TLS) %s: Failed in %s", role, state);
+                       RERROR("(TLS) %s - %s: Failed in %s", conf->name, role, state);
                        return;
                }
 
                if (ret < 0) {
                        if (SSL_want_read(s)) {
-                               RDEBUG2("(TLS) %s: Need to read more data: %s", role, state);
+                               RDEBUG2("(TLS) %s - %s: Need to read more data: %s", conf->name, role, state);
                                return;
                        }
-                       RERROR("(TLS) %s: Error in %s", role, state);
+                       RERROR("(TLS) %s - %s: Error in %s", conf->name, role, state);
                }
        }
 }

diff --git a/src/main/listen.c b/src/main/listen.c
index d0bfbfdd9f483687c10a27b46c93c9287900b200..75045d244cea64b88b110255cc0c2dca1a901225 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -1467,6 +1467,8 @@ int common_socket_parse(CONF_SECTION *cs, rad_listen_t *this)
                                return -1;
                        }
 
+                       this->tls->name = "RADIUS/TLS";
+
 #ifdef HAVE_PTHREAD_H
                        if (pthread_mutex_init(&sock->mutex, NULL) < 0) {
                                rad_assert(0 == 1);
@@ -3473,6 +3475,7 @@ rad_listen_t *proxy_new_listener(TALLOC_CTX *ctx, home_server_t *home, uint16_t
                }
 #endif
 
+
                sock->connect_timeout = home->connect_timeout;
 
                this->recv = proxy_tls_recv;

diff --git a/src/main/realms.c b/src/main/realms.c
index ec886f1f2731c880b09ccd8548b625b2463bd2f6..83f7559bf01dda1ee9458e0f81aedf8c608376e2 100644 (file)
--- a/src/main/realms.c
+++ b/src/main/realms.c
@@ -1121,6 +1121,8 @@ home_server_t *home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SE
                                goto error;
                        }
 
+                       home->tls->name = "RADIUS/TLS";
+
                        /*
                         *      Connection timeouts for outgoing TLS connections.
                         */

diff --git a/src/main/tls.c b/src/main/tls.c
index c8cae3be46a94cfd1239d09eef77d79e51d9fdf4..1b1b894660ff4e83cc0ed43190e45627f7ef97ff 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -404,7 +404,7 @@ static unsigned int psk_server_callback(SSL *ssl, const char *identity,
                 *      The passed identity is weird.  Deny it.
                 */
                if (!identity_is_safe(identity)) {
-                       RWDEBUG("(TLS) Invalid characters in PSK identity %s", identity);
+                       RWDEBUG("(TLS) %s - Invalid characters in PSK identity %s", conf->name, identity);
                        return 0;
                }
 
@@ -421,7 +421,7 @@ static unsigned int psk_server_callback(SSL *ssl, const char *identity,
                hex_len = radius_xlat(buffer, sizeof(buffer), request, conf->psk_query,
                                      NULL, NULL);
                if (!hex_len) {
-                       RWDEBUG("(TLS) PSK expansion returned an empty string.");
+                       RWDEBUG("(TLS) %s - PSK expansion returned an empty string.", conf->name);
                        return 0;
                }
 
@@ -431,7 +431,7 @@ static unsigned int psk_server_callback(SSL *ssl, const char *identity,
                 *      the truncation, and complain about it.
                 */
                if (hex_len > (2 * max_psk_len)) {
-                       RWDEBUG("(TLS) Returned PSK is too long (%u > %u)",
+                       RWDEBUG("(TLS) %s - Returned PSK is too long (%u > %u)", conf->name,
                                (unsigned int) hex_len, 2 * max_psk_len);
                        return 0;
                }
@@ -681,7 +681,7 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
 
        rad_assert(request != NULL);
 
-       RDEBUG2("(TLS) Initiating new session");
+       RDEBUG2("(TLS) %s -Initiating new session", conf->name);
 
        /*
         *      Replace X509 store if it is time to update CRLs/certs in ca_path
@@ -690,10 +690,10 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
                pthread_mutex_lock(&conf->mutex);
                /* recheck conf->ca_path_last_reload because it may be inaccurate without mutex */
                if (conf->ca_path_last_reload + conf->ca_path_reload_interval <= request->timestamp) {
-                       RDEBUG2("Flushing X509 store to re-read data from ca_path dir");
+                       RDEBUG2("(TLS) Flushing X509 store to re-read data from ca_path dir");
 
                        if ((new_cert_store = fr_init_x509_store(conf)) == NULL) {
-                               RERROR("(TLS) Error replacing X509 store, out of memory (?)");
+                               RERROR("(TLS) Error replacing X509 store, out of memory (?)", conf->name);
                        } else {
                                if (conf->old_x509_store) X509_STORE_free(conf->old_x509_store);
                                /*
@@ -752,7 +752,7 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
        SSL_set_app_data(new_tls, NULL);
 
        if ((state = talloc_zero(ctx, tls_session_t)) == NULL) {
-               RERROR("(TLS) Error allocating memory for SSL state");
+               RERROR("(TLS) %s - Error allocating memory for SSL state", conf->name);
                return NULL;
        }
        session_init(state);
@@ -808,7 +808,7 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
                VALUE_PAIR *key = fr_pair_find_by_num(request->config, PW_TLS_SESSION_CERT_PRIVATE_KEY_FILE, 0, TAG_ANY);
                if (!key) key = vp;
 
-               RDEBUG2("(TLS) Loading session certificate file \"%s\"", vp->vp_strvalue);
+               RDEBUG2("(TLS) %s - Loading session certificate file \"%s\"", conf->name, vp->vp_strvalue);
 
                if (conf->realms) {
                        fr_realm_ctx_t my_r, *r;
@@ -887,7 +887,7 @@ after_chain:
         *      Verify the peer certificate, if asked.
         */
        if (client_cert) {
-               RDEBUG2("(TLS) Setting verify mode to require certificate from client");
+               RDEBUG2("(TLS) %s - Setting verify mode to require certificate from client", conf->name);
                verify_mode = SSL_VERIFY_PEER;
                verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
                verify_mode |= SSL_VERIFY_CLIENT_ONCE;
@@ -970,14 +970,14 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
        int err;
 
        if (ssn->invalid_hb_used) {
-               REDEBUG("(TLS) OpenSSL Heartbeat attack detected.  Closing connection");
+               REDEBUG("(TLS) %s - OpenSSL Heartbeat attack detected.  Closing connection", ssn->conf->name);
                return 0;
        }
 
        if (ssn->dirty_in.used > 0) {
                err = BIO_write(ssn->into_ssl, ssn->dirty_in.data, ssn->dirty_in.used);
                if (err != (int) ssn->dirty_in.used) {
-                       REDEBUG("(TLS) Failed writing %zd bytes to SSL BIO: %d", ssn->dirty_in.used, err);
+                       REDEBUG("(TLS) %s - Failed writing %zd bytes to SSL BIO: %d", ssn->conf->name, ssn->dirty_in.used, err);
                        record_init(&ssn->dirty_in);
                        return 0;
                }
@@ -998,7 +998,7 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
                VALUE_PAIR *vp;
                char const *str_version;
 
-               RDEBUG2("(TLS) Connection Established");
+               RDEBUG2("(TLS) %s - Connection Established", ssn->conf->name);
                ssn->is_init_finished = true;
 
                vp = fr_pair_afrom_num(request->state_ctx, PW_TLS_SESSION_CIPHER_SUITE, 0);
@@ -1049,10 +1049,10 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
                        REXDENT();
                }
        }
-       else if (SSL_in_init(ssn->ssl)) { RDEBUG2("(TLS) In Handshake Phase"); }
-       else if (SSL_in_before(ssn->ssl)) { RDEBUG2("(TLS) Before Handshake Phase"); }
-       else if (SSL_in_accept_init(ssn->ssl)) { RDEBUG2("(TLS) In Accept mode"); }
-       else if (SSL_in_connect_init(ssn->ssl)) { RDEBUG2("(TLS) In Connect mode"); }
+       else if (SSL_in_init(ssn->ssl)) { RDEBUG2("(TLS) %s - In Handshake Phase", ssn->conf->name); }
+       else if (SSL_in_before(ssn->ssl)) { RDEBUG2("(TLS) %s - Before Handshake Phase", ssn->conf->name); }
+       else if (SSL_in_accept_init(ssn->ssl)) { RDEBUG2("(TLS) %s- In Accept mode", ssn->conf->name); }
+       else if (SSL_in_connect_init(ssn->ssl)) { RDEBUG2("(TLS) %s - In Connect mode", ssn->conf->name); }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
        /*
@@ -1070,7 +1070,7 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
                 *      to get the session is a hard fail.
                 */
                if (!ssn->ssl_session && ssn->is_init_finished) {
-                       RDEBUG("(TLS) Failed getting session");
+                       RDEBUG("(TLS) %s - Failed getting session", ssn->conf->name);
                        return 0;
                }
        }
@@ -1084,12 +1084,12 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
                err = BIO_read(ssn->from_ssl, ssn->dirty_out.data,
                               sizeof(ssn->dirty_out.data));
                if (err > 0) {
-                       RDEBUG3("(TLS) got %d bytes of data", err);
+                       RDEBUG3("(TLS) %s- got %d bytes of data", ssn->conf->name, err);
                        ssn->dirty_out.used = err;
 
                } else if (BIO_should_retry(ssn->from_ssl)) {
                        record_init(&ssn->dirty_in);
-                       RDEBUG2("(TLS) Asking for more data in tunnel.");
+                       RDEBUG2("(TLS) %s - Asking for more data in tunnel.", ssn->conf->name);
                        return 1;
 
                } else {
@@ -1098,7 +1098,7 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
                        return 0;
                }
        } else {
-               RDEBUG2("(TLS) Application data.");
+               RDEBUG2("(TLS) %s - Application data.", ssn->conf->name);
                /* Its clean application data, leave whatever is in the buffer */
 #if 0
                record_init(&ssn->clean_out);
@@ -1245,6 +1245,7 @@ void tls_session_information(tls_session_t *tls_session)
        REQUEST *request;
        VALUE_PAIR *vp;
        char content_type[16], alert_buf[16];
+       char name_buf[128];
        char buffer[32];
 
        /*
@@ -1262,7 +1263,12 @@ void tls_session_information(tls_session_t *tls_session)
        request = SSL_get_ex_data(tls_session->ssl, FR_TLS_EX_INDEX_REQUEST);
        if (!request) return;
 
-       str_write_p = tls_session->info.origin ? "(TLS) send" : "(TLS) recv";
+       if (tls_session->info.origin) {
+               snprintf(name_buf, sizeof(name_buf), "(TLS) %s - send", tls_session->conf->name);
+       } else {
+               snprintf(name_buf, sizeof(name_buf), "(TLS) %s - recv", tls_session->conf->name);
+       }
+       str_write_p = name_buf;
 
 #define FROM_CLIENT (tls_session->info.origin == 0)
 
@@ -1605,7 +1611,7 @@ void tls_session_information(tls_session_t *tls_session)
 
        RDEBUG2("%s", tls_session->info.info_description);
 
-       if (FROM_CLIENT && details) RDEBUG2("(TLS) The client is informing us that %s.", details);
+       if (FROM_CLIENT && details) RDEBUG2("(TLS) %s - The client is informing us that %s.", tls_session->conf->name, details);
 }
 
 static CONF_PARSER cache_config[] = {
@@ -1924,7 +1930,7 @@ static int cbtls_new_session(SSL *ssl, SSL_SESSION *sess)
                blob_len = i2d_SSL_SESSION(sess, NULL);
                if (blob_len < 1) {
                        /* something went wrong */
-                       if (request) RWDEBUG("(TLS) Session serialisation failed, could not determine required buffer length");
+                       if (request) RWDEBUG("(TLS) %s - Session serialisation failed, could not determine required buffer length", conf->name);
                        return 0;
                }
 
@@ -1932,14 +1938,14 @@ static int cbtls_new_session(SSL *ssl, SSL_SESSION *sess)
                /* alloc and convert to ASN.1 */
                sess_blob = malloc(blob_len);
                if (!sess_blob) {
-                       RWDEBUG("(TLS) Session serialisation failed, couldn't allocate buffer (%d bytes)", blob_len);
+                       RWDEBUG("(TLS) %s - Session serialisation failed, couldn't allocate buffer (%d bytes)", conf->name, blob_len);
                        return 0;
                }
                /* openssl mutates &p */
                p = sess_blob;
                rv = i2d_SSL_SESSION(sess, &p);
                if (rv != blob_len) {
-                       if (request) RWDEBUG("(TLS) Session serialisation failed");
+                       if (request) RWDEBUG("(TLS) %s - Session serialisation failed", conf->name);
                        goto error;
                }
 
@@ -1948,8 +1954,8 @@ static int cbtls_new_session(SSL *ssl, SSL_SESSION *sess)
                         conf->session_cache_path, FR_DIR_SEP, buffer);
                fd = open(filename, O_RDWR|O_CREAT|O_EXCL, S_IWUSR);
                if (fd < 0) {
-                       if (request) RERROR("(TLS) Session serialisation failed, failed opening session file %s: %s",
-                                           filename, fr_syserror(errno));
+                       if (request) RERROR("(TLS) %s - Session serialisation failed, failed opening session file %s: %s",
+                                           conf->name, filename, fr_syserror(errno));
                        goto error;
                }
 
@@ -1971,7 +1977,7 @@ static int cbtls_new_session(SSL *ssl, SSL_SESSION *sess)
                while (todo > 0) {
                        rv = write(fd, p, todo);
                        if (rv < 1) {
-                               if (request) RWDEBUG("(TLS) Failed writing session: %s", fr_syserror(errno));
+                               if (request) RWDEBUG("(TLS) %s - Failed writing session: %s", conf->name, fr_syserror(errno));
                                close(fd);
                                goto error;
                        }
@@ -1979,7 +1985,7 @@ static int cbtls_new_session(SSL *ssl, SSL_SESSION *sess)
                        todo -= rv;
                }
                close(fd);
-               if (request) RWDEBUG("(TLS) Wrote session %s to %s (%d bytes)", buffer, filename, blob_len);
+               if (request) RWDEBUG("(TLS) %s - Wrote session %s to %s (%d bytes)", conf->name, buffer, filename, blob_len);
        }
 
 error:
@@ -2102,20 +2108,20 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                snprintf(filename, sizeof(filename), "%s%c%s.asn1", conf->session_cache_path, FR_DIR_SEP, buffer);
                fd = open(filename, O_RDONLY);
                if (fd < 0) {
-                       RWDEBUG("(TLS) No persisted session file %s: %s", filename, fr_syserror(errno));
+                       RWDEBUG("(TLS) %s - No persisted session file %s: %s", conf->name, filename, fr_syserror(errno));
                        goto error;
                }
 
                rv = fstat(fd, &st);
                if (rv < 0) {
-                       RWDEBUG("(TLS) Failed stating persisted session file %s: %s", filename, fr_syserror(errno));
+                       RWDEBUG("(TLS) %s - Failed stating persisted session file %s: %s", conf->name, filename, fr_syserror(errno));
                        close(fd);
                        goto error;
                }
 
                sess_data = talloc_array(NULL, unsigned char, st.st_size);
                if (!sess_data) {
-                       RWDEBUG("(TLS) Failed allocating buffer for persisted session (%d bytes)", (int) st.st_size);
+                       RWDEBUG("(TLS) %s- Failed allocating buffer for persisted session (%d bytes)", conf->name, (int) st.st_size);
                        close(fd);
                        goto error;
                }
@@ -2125,7 +2131,7 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                while (todo > 0) {
                        rv = read(fd, q, todo);
                        if (rv < 1) {
-                               RWDEBUG("(TLS) Failed reading persisted session: %s", fr_syserror(errno));
+                               RWDEBUG("(TLS) %s - Failed reading persisted session: %s", conf->name, fr_syserror(errno));
                                close(fd);
                                goto error;
                        }
@@ -2149,7 +2155,7 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                memcpy(&o, &p, sizeof(o));
                sess = d2i_SSL_SESSION(NULL, o, st.st_size);
                if (!sess) {
-                       RWDEBUG("(TLS) Failed loading persisted session: %s", ERR_error_string(ERR_get_error(), NULL));
+                       RWDEBUG("(TLS) %s - Failed loading persisted session: %s", conf->name, ERR_error_string(ERR_get_error(), NULL));
                        goto error;
                }
 
@@ -2159,7 +2165,7 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                rv = pairlist_read(talloc_ctx, filename, &pairlist, 1);
                if (rv < 0) {
                        /* not safe to un-persist a session w/o VPs */
-                       RWDEBUG("(TLS) Failed loading persisted VPs for session %s", buffer);
+                       RWDEBUG("(TLS) %s - Failed loading persisted VPs for session %s", conf->name, buffer);
                        SSL_SESSION_free(sess);
                        sess = NULL;
                        goto error;
@@ -2173,7 +2179,7 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                        time_t expires;
 
                        if (ocsp_asn1time_to_epoch(&expires, vp->vp_strvalue) < 0) {
-                               RDEBUG2("Failed getting certificate expiration, removing cache entry for session %s - %s", buffer, fr_strerror());
+                               RDEBUG2("(TLS) - Failed getting certificate expiration, removing cache entry for session %s - %s", conf->name, buffer, fr_strerror());
                                SSL_SESSION_free(sess);
                                sess = NULL;
                                goto error;
@@ -2193,8 +2199,8 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                        if (vp) {
                                if ((request->timestamp + vp->vp_integer) > expires) {
                                        vp->vp_integer = expires - request->timestamp;
-                                       RWDEBUG2("(TLS) Updating Session-Timeout to %u, due to impending certificate expiration",
-                                                vp->vp_integer);
+                                       RWDEBUG2("(TLS) %s - Updating Session-Timeout to %u, due to impending certificate expiration",
+                                                conf->name, vp->vp_integer);
                                }
                        }
                }
@@ -2208,8 +2214,8 @@ static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int l
                        VALUE_PAIR *type = fr_pair_find_by_num(request->packet->vps, PW_EAP_TYPE, 0, TAG_ANY);
 
                        if (type && (type->vp_integer != vp->vp_integer)) {
-                               REDEBUG("Resumption has changed EAP types for session %s", buffer);
-                               REDEBUG("Rejecting session due to protocol violations");
+                               REDEBUG("(TLS) %s - Resumption has changed EAP types for session %s", conf->name, buffer);
+                               REDEBUG("(TLS) %s - Rejecting session due to protocol violations", conf->name);
                                goto error;
                        }
                }
@@ -2524,8 +2530,8 @@ static SSL_SESSION *cbtls_cache_load(SSL *ssl, const unsigned char *data, int le
                if (vp) {
                        if ((request->timestamp + vp->vp_integer) > expires) {
                                vp->vp_integer = expires - request->timestamp;
-                               RWDEBUG2("(TLS) Updating Session-Timeout to %u, due to impending certificate expiration",
-                                        vp->vp_integer);
+                               RWDEBUG2("(TLS) %s - Updating Session-Timeout to %u, due to impending certificate expiration",
+                                        conf->name, vp->vp_integer);
                        }
                }
        }
@@ -2535,7 +2541,7 @@ static SSL_SESSION *cbtls_cache_load(SSL *ssl, const unsigned char *data, int le
         */
        vp = fr_pair_find_by_num(fake->state, PW_TLS_SESSION_DATA, 0, TAG_ANY);
        if (!vp) {
-               RWDEBUG("(TLS) Failed to find TLS-Session-Data in 'session-state' list for session %s", buffer);
+               RWDEBUG("(TLS) %s - Failed to find TLS-Session-Data in 'session-state' list for session %s", conf->name, buffer);
                goto error;
        }
 
@@ -2552,7 +2558,7 @@ static SSL_SESSION *cbtls_cache_load(SSL *ssl, const unsigned char *data, int le
        p = vp->vp_octets;
        sess = d2i_SSL_SESSION(NULL, &p, vp->vp_length);
        if (!sess) {
-               RWDEBUG("(TLS) Failed loading persisted session: %s", ERR_error_string(ERR_get_error(), NULL));
+               RWDEBUG("(TLS) %s - Failed loading persisted session: %s", conf->name, ERR_error_string(ERR_get_error(), NULL));
                goto error;
        }
 
@@ -3048,7 +3054,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
        buf[0] = '\0';
        sn = X509_get_serialNumber(client_cert);
 
-       RDEBUG2("(TLS) Creating attributes from %s certificate", cert_names[lookup ]);
+       RDEBUG2("(TLS) %s - Creating attributes from %s certificate", conf->name, cert_names[lookup ]);
        RINDENT();
 
        /*

diff --git a/src/modules/rlm_eap/libeap/eap_tls.c b/src/modules/rlm_eap/libeap/eap_tls.c
index 77b84a9a4e767cde1412d2f0dcee76147433575d..9d5257abae61298cf7157fb8bf6db57af98ea748 100644 (file)
--- a/src/modules/rlm_eap/libeap/eap_tls.c
+++ b/src/modules/rlm_eap/libeap/eap_tls.c
@@ -69,6 +69,9 @@ tls_session_t *eaptls_session(eap_handler_t *handler, fr_tls_server_conf_t *tls_
 
        handler->tls = true;
 
+       tls_conf->name = dict_valnamebyattr(PW_EAP_TYPE, 0, handler->type);
+       if (!tls_conf->name) tls_conf->name = "???";
+
        /*
         *      Every new session is started only from EAP-TLS-START.
         *      Before Sending EAP-TLS-START, open a new SSL session.