Fix setting up EAP-TLS success after virtual server is called

diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index c2045bd07b0694f49c71a3db21a69f9ebf658aa6..3820bc0e0a0dabd4a1556d180dfdfa911f447291 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -73,6 +73,51 @@ fr_dict_attr_autoload_t rlm_eap_tls_dict_attr[] = {
  */
 static rlm_rcode_t CC_HINT(nonnull) mod_process(void *instance, eap_session_t *eap_session);
 
+static rlm_rcode_t eap_tls_success_with_prf(eap_session_t *eap_session)
+{
+               tls_session_t           *tls_session = eap_tls_session->tls_session;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+       /*
+        *      Set the PRF label based on the TLS version negotiated
+        *      in the handshake.
+        */
+       switch (SSL_SESSION_get_protocol_version(SSL_get_session(tls_session->ssl))) {
+       case SSL2_VERSION:                      /* Should never happen */
+       case SSL3_VERSION:                      /* Should never happen */
+               rad_assert(0);
+               return RLM_MODULE_INVALID;
+
+       case TLS1_VERSION:
+       case TLS1_1_VERSION:
+       case TLS1_2_VERSION:
+#endif
+       {
+               static char const keying_prf_label[] = "client EAP encryption";
+
+               if (eap_tls_success(eap_session,
+                                   keying_prf_label, sizeof(keying_prf_label) - 1,
+                                   NULL, 0) < 0) return RLM_MODULE_FAIL;
+       }
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+               break;
+
+       case TLS1_3_VERSION:
+       default:
+       {
+               static char const keying_prf_label[] = "EXPORTER_EAP_TLS_Key_Material";
+               static char const sessid_prf_label[] = "EXPORTER_EAP_TLS_Method-Id";
+
+               if (eap_tls_success(eap_session,
+                                   keying_prf_label, sizeof(keying_prf_label) - 1,
+                                   sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL;
+       }
+               break;
+       }
+#endif
+       return RLM_MODULE_OK;
+}
+
 static unlang_action_t eap_tls_virtual_server_result(REQUEST *request, rlm_rcode_t *presult,
                                                     UNUSED int *priority, void *uctx)
 {
@@ -81,6 +126,7 @@ static unlang_action_t eap_tls_virtual_server_result(REQUEST *request, rlm_rcode
        switch (*presult) {
        case RLM_MODULE_OK:
        case RLM_MODULE_UPDATED:
+               *presult = eap_tls_success_with_prf(eap_session);
                break;
 
        default:
@@ -167,51 +213,9 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
         *      it accepts the certificates, too.
         */
        case EAP_TLS_ESTABLISHED:
-       {
                if (inst->virtual_server) return eap_tls_virtual_server(inst, eap_session);
+               return eap_tls_success_with_prf(eap_session);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-               /*
-                *      Set the PRF label based on the TLS version negotiated
-                *      in the handshake.
-                */
-               switch (SSL_SESSION_get_protocol_version(SSL_get_session(tls_session->ssl))) {
-               case SSL2_VERSION:                      /* Should never happen */
-               case SSL3_VERSION:                      /* Should never happen */
-                       rad_assert(0);
-                       return RLM_MODULE_INVALID;
-
-               case TLS1_VERSION:
-               case TLS1_1_VERSION:
-               case TLS1_2_VERSION:
-#endif
-               {
-                       static char const keying_prf_label[] = "client EAP encryption";
-
-                       if (eap_tls_success(eap_session,
-                                           keying_prf_label, sizeof(keying_prf_label) - 1,
-                                           NULL, 0) < 0) return RLM_MODULE_FAIL;
-               }
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-                       break;
-
-               case TLS1_3_VERSION:
-               default:
-               {
-                       static char const keying_prf_label[] = "EXPORTER_EAP_TLS_Key_Material";
-                       static char const sessid_prf_label[] = "EXPORTER_EAP_TLS_Method-Id";
-
-                       if (eap_tls_success(eap_session,
-                                           keying_prf_label, sizeof(keying_prf_label) - 1,
-                                           sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL;
-               }
-                       break;
-               }
-#endif
-
-
-       }
-               return RLM_MODULE_OK;
 
        /*
         *      The TLS code is still working on the TLS