Minor cleanups

diff --git a/src/lib/eap/crypto.c b/src/lib/eap/crypto.c
index ffa7eb7bf7506ea76154a1e9672fc2e3325a799d..3b810bed6e000ae22f8bb205d65fd3dd090c3ef8 100644 (file)
--- a/src/lib/eap/crypto.c
+++ b/src/lib/eap/crypto.c
@@ -163,29 +163,30 @@ void eap_crypto_mppe_keys(REQUEST *request, SSL *ssl, char const *prf_label, siz
  *     It's in the TLS module simply because it's only a few lines
  *     of code, and it needs access to the TLS PRF functions.
  */
-void eap_crypto_challenge(SSL *s, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label)
+void eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size,
+                         char const *prf_label, size_t prf_label_len)
 {
        uint8_t         *p;
        size_t          len, master_key_len;
        uint8_t         master_key[SSL_MAX_MASTER_KEY_LENGTH];
        uint8_t         seed[128 + (2 * SSL3_RANDOM_SIZE)];
 
-       if (SSL_export_keying_material(s, buffer, size, prf_label,
-                                      strlen(prf_label), NULL, 0, 0) == 1) return;
+       if (SSL_export_keying_material(ssl, buffer, size, prf_label,
+                                      prf_label_len, NULL, 0, 0) == 1) return;
 
-       len = strlen(prf_label);
+       len = prf_label_len;
        if (len > 128) len = 128;
 
        p = seed;
        memcpy(p, prf_label, len);
        p += len;
 
-       (void) SSL_get_client_random(s, p, SSL3_RANDOM_SIZE);
+       (void) SSL_get_client_random(ssl, p, SSL3_RANDOM_SIZE);
        p += SSL3_RANDOM_SIZE;
-       (void) SSL_get_server_random(s, p, SSL3_RANDOM_SIZE);
+       (void) SSL_get_server_random(ssl, p, SSL3_RANDOM_SIZE);
        p += SSL3_RANDOM_SIZE;
 
-       master_key_len = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, sizeof(master_key));
+       master_key_len = SSL_SESSION_get_master_key(SSL_get_session(ssl), master_key, sizeof(master_key));
        eap_crypto_rfc4346_prf(buffer, size, scratch, master_key, master_key_len, seed, p - seed);
 }
 
@@ -198,7 +199,7 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out,
 #if OPENSSL_VERSION_NUMBER < 0x10100000L
                              UNUSED
 #endif
-                             size_t prf_len)
+                             size_t prf_label_len)
 {
        uint8_t         *buff = NULL, *p;
 
@@ -235,7 +236,7 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out,
        {
                MEM(buff = p = talloc_array(ctx, uint8_t, sizeof(eap_type) + 64));
                *p++ = eap_type;
-               SSL_export_keying_material(ssl, p, 64, prf_label, prf_len, NULL, 0, 0);
+               SSL_export_keying_material(ssl, p, 64, prf_label, prf_label_len, NULL, 0, 0);
        }
                break;
        }

diff --git a/src/lib/eap/tls.c b/src/lib/eap/tls.c
index 30a785f02a17e3aded02cb4ae731e6f8b7b3aa9a..0ce8ea6d525e3277617f07e824609de3aa797a21 100644 (file)
--- a/src/lib/eap/tls.c
+++ b/src/lib/eap/tls.c
@@ -310,8 +310,8 @@ int eap_tls_success(eap_session_t *eap_session,
                VALUE_PAIR      *vp;
 
                if (eap_crypto_tls_session_id(eap_session->request->reply, &session_id,
-                                          tls_session->ssl, eap_session->type,
-                                          sessid_prf_label, sessid_prf_label_len) < 0) return -1;
+                                             tls_session->ssl, eap_session->type,
+                                             sessid_prf_label, sessid_prf_label_len) < 0) return -1;
 
                MEM(pair_add_reply(&vp, attr_eap_session_id) >= 0);
                fr_pair_value_memsteal(vp, session_id);

diff --git a/src/lib/eap/tls.h b/src/lib/eap/tls.h
index 74f73672c9274babfb5ac27f470b5b4ac8a13452..bec50cb5fc5781b8a844ece31833a485e420fb9c 100644 (file)
--- a/src/lib/eap/tls.h
+++ b/src/lib/eap/tls.h
@@ -177,11 +177,12 @@ void                      eap_crypto_rfc4346_prf(uint8_t *out, size_t out_len, uint8_t *scratch,
 void                   eap_crypto_mppe_keys(REQUEST *request, SSL *ssl,
                                             char const *prf_label, size_t prf_label_len) CC_HINT(nonnull);
 
-void                   eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) CC_HINT(nonnull);
+void                   eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size,
+                                            char const *prf_label, size_t prf_label_len) CC_HINT(nonnull);
 
 int                    eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out,
-                                              SSL *ssl, uint8_t eap_type,
-                                              char const *prf_label, size_t prf_len);
+                                                 SSL *ssl, uint8_t eap_type,
+                                                 char const *prf_label, size_t prf_label_len);
 
 /* EAP-TLS framework */
 eap_tls_session_t      *eap_tls_session_init(eap_session_t *eap_session, fr_tls_conf_t *tls_conf, bool client_cert) CC_HINT(nonnull);

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
index e7ab359b8df03bdf8198458aaf463b24edc70213..2be2527dd7ca8ca7147465314b31f92db83a5b9f 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c
@@ -261,6 +261,7 @@ do_value:
                if ((vp->da == attr_chap_challenge) || (vp->da == attr_ms_chap_challenge)) {
                        uint8_t challenge[16];
                        uint8_t scratch[16];
+                       char    label[] = "ttls challenge";
 
                        if ((vp->vp_length < 8) || (vp->vp_length > 16)) {
                                fr_strerror_printf("Tunneled challenge has invalid length");
@@ -268,7 +269,7 @@ do_value:
                        }
 
                        eap_crypto_challenge(ssl, challenge, scratch,
-                                             sizeof(challenge), "ttls challenge");
+                                            sizeof(challenge), label, sizeof(label) - 1);
 
                        if (memcmp(challenge, vp->vp_octets, vp->vp_length) != 0) {
                                fr_strerror_printf("Tunneled challenge is incorrect");