switch to just using TLS1_3_VERSION

instead of checking for a particular revision of OpenSSL

diff --git a/src/modules/rlm_eap/libeap/eap_tls.c b/src/modules/rlm_eap/libeap/eap_tls.c
index 9b73c482f8363d4a7d5dbdbb0bdee736c36baa4b..eacb4369577d9f53d773d16a1db949b74734bcf1 100644 (file)
--- a/src/modules/rlm_eap/libeap/eap_tls.c
+++ b/src/modules/rlm_eap/libeap/eap_tls.c
@@ -163,12 +163,12 @@ int eaptls_success(eap_handler_t *handler, int peap_flag)
        if (tls_session->label) {
                uint8_t const *context = NULL;
                size_t context_size = 0;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
                uint8_t const context_tls13[] = { handler->type };
 #endif
 
                switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
                case TLS1_3_VERSION:
                        context = context_tls13;
                        context_size = sizeof(context_tls13);
@@ -750,9 +750,17 @@ static fr_tls_status_t eaptls_operation(fr_tls_status_t status, eap_handler_t *h
                return FR_TLS_FAIL;
        }
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-       /* draft-ietf-emu-eap-tls13-10 section 2.5 */
-       if (tls_session->is_init_finished && tls_session->info.version == TLS1_3_VERSION && handler->type == PW_EAP_TLS) {
+#ifdef TLS1_3_VERSION
+       /*
+        *      draft-ietf-emu-eap-tls13-10 section 2.5
+        *
+        *      We need to signal the other end that TLS negotiation
+        *      is done.  We can't send a zero-length application data
+        *      message, so we send application data which is one byte
+        *      of zero.
+        */
+       if (tls_session->is_init_finished && (tls_session->info.version == TLS1_3_VERSION) &&
+           (handler->type == PW_EAP_TLS)) {
                RDEBUG("TLS send Commitment Message");
                tls_session->record_plus(&tls_session->clean_in, "\0", 1);
                tls_handshake_send(request, tls_session);

diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index d3be348ce3baa3b60ef64ef637258c94977a8855..9ab2fcd71be0ccf28367d70f741c50e844f5858c 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -372,7 +372,7 @@ static int mod_process(void *arg, eap_handler_t *handler)
                 *      Set the label based on the TLS version negotiated in the handshake.
                 */
                switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
                case TLS1_3_VERSION:
                        tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
                        break;

diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index 305ba21cfcd3dae3720d0edc92c7e26e8b68a681..e7e6de7596ff8f6a4cdfa6b6b6bd0036033720b6 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -194,10 +194,12 @@ static int CC_HINT(nonnull) mod_process(void *type_arg, eap_handler_t *handler)
                 * Set the label based on the TLS version negotiated in the handshake.
                 */
                switch (tls_session->info.version) {
+#ifdef TLS1_3_VERSION
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
                case TLS1_3_VERSION:
                        tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
                        break;
+#endif
 #endif
                case TLS1_2_VERSION:
                case TLS1_1_VERSION:

diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
index e9b96b1c8104de35cc8b58091c951c194ae3d9c9..fafc4a9d8a4fab2fce3659081aa3c768f7d27289 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
@@ -270,7 +270,7 @@ static int mod_process(void *arg, eap_handler_t *handler)
                         *      Set the label based on the TLS version negotiated in the handshake.
                         */
                        switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
                        case TLS1_3_VERSION:
                                tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
                                break;