From: Arran Cudbard-Bell Date: Sun, 27 Jan 2019 14:39:46 +0000 (+0700) Subject: Minor cleanups X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=79647acef2bb767f5f59a63c8b6fa0fca5c50359;p=thirdparty%2Ffreeradius-server.git Minor cleanups --- diff --git a/src/lib/eap/crypto.c b/src/lib/eap/crypto.c index ffa7eb7bf75..3b810bed6e0 100644 --- a/src/lib/eap/crypto.c +++ b/src/lib/eap/crypto.c @@ -163,29 +163,30 @@ void eap_crypto_mppe_keys(REQUEST *request, SSL *ssl, char const *prf_label, siz * It's in the TLS module simply because it's only a few lines * of code, and it needs access to the TLS PRF functions. */ -void eap_crypto_challenge(SSL *s, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) +void eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, + char const *prf_label, size_t prf_label_len) { uint8_t *p; size_t len, master_key_len; uint8_t master_key[SSL_MAX_MASTER_KEY_LENGTH]; uint8_t seed[128 + (2 * SSL3_RANDOM_SIZE)]; - if (SSL_export_keying_material(s, buffer, size, prf_label, - strlen(prf_label), NULL, 0, 0) == 1) return; + if (SSL_export_keying_material(ssl, buffer, size, prf_label, + prf_label_len, NULL, 0, 0) == 1) return; - len = strlen(prf_label); + len = prf_label_len; if (len > 128) len = 128; p = seed; memcpy(p, prf_label, len); p += len; - (void) SSL_get_client_random(s, p, SSL3_RANDOM_SIZE); + (void) SSL_get_client_random(ssl, p, SSL3_RANDOM_SIZE); p += SSL3_RANDOM_SIZE; - (void) SSL_get_server_random(s, p, SSL3_RANDOM_SIZE); + (void) SSL_get_server_random(ssl, p, SSL3_RANDOM_SIZE); p += SSL3_RANDOM_SIZE; - master_key_len = SSL_SESSION_get_master_key(SSL_get_session(s), master_key, sizeof(master_key)); + master_key_len = SSL_SESSION_get_master_key(SSL_get_session(ssl), master_key, sizeof(master_key)); eap_crypto_rfc4346_prf(buffer, size, scratch, master_key, master_key_len, seed, p - seed); } @@ -198,7 +199,7 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out, #if OPENSSL_VERSION_NUMBER < 0x10100000L UNUSED #endif - size_t prf_len) + size_t prf_label_len) { uint8_t *buff = NULL, *p; @@ -235,7 +236,7 @@ int eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out, { MEM(buff = p = talloc_array(ctx, uint8_t, sizeof(eap_type) + 64)); *p++ = eap_type; - SSL_export_keying_material(ssl, p, 64, prf_label, prf_len, NULL, 0, 0); + SSL_export_keying_material(ssl, p, 64, prf_label, prf_label_len, NULL, 0, 0); } break; } diff --git a/src/lib/eap/tls.c b/src/lib/eap/tls.c index 30a785f02a1..0ce8ea6d525 100644 --- a/src/lib/eap/tls.c +++ b/src/lib/eap/tls.c @@ -310,8 +310,8 @@ int eap_tls_success(eap_session_t *eap_session, VALUE_PAIR *vp; if (eap_crypto_tls_session_id(eap_session->request->reply, &session_id, - tls_session->ssl, eap_session->type, - sessid_prf_label, sessid_prf_label_len) < 0) return -1; + tls_session->ssl, eap_session->type, + sessid_prf_label, sessid_prf_label_len) < 0) return -1; MEM(pair_add_reply(&vp, attr_eap_session_id) >= 0); fr_pair_value_memsteal(vp, session_id); diff --git a/src/lib/eap/tls.h b/src/lib/eap/tls.h index 74f73672c92..bec50cb5fc5 100644 --- a/src/lib/eap/tls.h +++ b/src/lib/eap/tls.h @@ -177,11 +177,12 @@ void eap_crypto_rfc4346_prf(uint8_t *out, size_t out_len, uint8_t *scratch, void eap_crypto_mppe_keys(REQUEST *request, SSL *ssl, char const *prf_label, size_t prf_label_len) CC_HINT(nonnull); -void eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, char const *prf_label) CC_HINT(nonnull); +void eap_crypto_challenge(SSL *ssl, uint8_t *buffer, uint8_t *scratch, size_t size, + char const *prf_label, size_t prf_label_len) CC_HINT(nonnull); int eap_crypto_tls_session_id(TALLOC_CTX *ctx, uint8_t **out, - SSL *ssl, uint8_t eap_type, - char const *prf_label, size_t prf_len); + SSL *ssl, uint8_t eap_type, + char const *prf_label, size_t prf_label_len); /* EAP-TLS framework */ eap_tls_session_t *eap_tls_session_init(eap_session_t *eap_session, fr_tls_conf_t *tls_conf, bool client_cert) CC_HINT(nonnull); diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c index e7ab359b8df..2be2527dd7c 100644 --- a/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c +++ b/src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c @@ -261,6 +261,7 @@ do_value: if ((vp->da == attr_chap_challenge) || (vp->da == attr_ms_chap_challenge)) { uint8_t challenge[16]; uint8_t scratch[16]; + char label[] = "ttls challenge"; if ((vp->vp_length < 8) || (vp->vp_length > 16)) { fr_strerror_printf("Tunneled challenge has invalid length"); @@ -268,7 +269,7 @@ do_value: } eap_crypto_challenge(ssl, challenge, scratch, - sizeof(challenge), "ttls challenge"); + sizeof(challenge), label, sizeof(label) - 1); if (memcmp(challenge, vp->vp_octets, vp->vp_length) != 0) { fr_strerror_printf("Tunneled challenge is incorrect");