From: Alan T. DeKok <aland@freeradius.org>
Date: Mon, 13 Jul 2020 17:30:12 +0000 (-0400)
Subject: switch to just using TLS1_3_VERSION
X-Git-Tag: release_3_0_22~537
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd3aec4dc9eb28398df2d7639ba682a9931ccb28;p=thirdparty%2Ffreeradius-server.git

switch to just using TLS1_3_VERSION

instead of checking for a particular revision of OpenSSL
---

diff --git a/src/modules/rlm_eap/libeap/eap_tls.c b/src/modules/rlm_eap/libeap/eap_tls.c
index 9b73c482f83..eacb4369577 100644
--- a/src/modules/rlm_eap/libeap/eap_tls.c
+++ b/src/modules/rlm_eap/libeap/eap_tls.c
@@ -163,12 +163,12 @@ int eaptls_success(eap_handler_t *handler, int peap_flag)
 	if (tls_session->label) {
 		uint8_t const *context = NULL;
 		size_t context_size = 0;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
 		uint8_t const context_tls13[] = { handler->type };
 #endif
 
 		switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
 		case TLS1_3_VERSION:
 			context = context_tls13;
 			context_size = sizeof(context_tls13);
@@ -750,9 +750,17 @@ static fr_tls_status_t eaptls_operation(fr_tls_status_t status, eap_handler_t *h
 		return FR_TLS_FAIL;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-	/* draft-ietf-emu-eap-tls13-10 section 2.5 */
-	if (tls_session->is_init_finished && tls_session->info.version == TLS1_3_VERSION && handler->type == PW_EAP_TLS) {
+#ifdef TLS1_3_VERSION
+	/*
+	 *	draft-ietf-emu-eap-tls13-10 section 2.5
+	 *
+	 *	We need to signal the other end that TLS negotiation
+	 *	is done.  We can't send a zero-length application data
+	 *	message, so we send application data which is one byte
+	 *	of zero.
+	 */
+	if (tls_session->is_init_finished && (tls_session->info.version == TLS1_3_VERSION) &&
+	    (handler->type == PW_EAP_TLS)) {
 		RDEBUG("TLS send Commitment Message");
 		tls_session->record_plus(&tls_session->clean_in, "\0", 1);
 		tls_handshake_send(request, tls_session);
diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
index d3be348ce3b..9ab2fcd71be 100644
--- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
+++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c
@@ -372,7 +372,7 @@ static int mod_process(void *arg, eap_handler_t *handler)
 		 *	Set the label based on the TLS version negotiated in the handshake.
 		 */
 		switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
 		case TLS1_3_VERSION:
 			tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
 			break;
diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index 305ba21cfcd..e7e6de7596f 100644
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -194,10 +194,12 @@ static int CC_HINT(nonnull) mod_process(void *type_arg, eap_handler_t *handler)
 		 * Set the label based on the TLS version negotiated in the handshake.
 		 */
 		switch (tls_session->info.version) {
+#ifdef TLS1_3_VERSION
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 		case TLS1_3_VERSION:
 			tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
 			break;
+#endif
 #endif
 		case TLS1_2_VERSION:
 		case TLS1_1_VERSION:
diff --git a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
index e9b96b1c810..fafc4a9d8a4 100644
--- a/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_ttls/rlm_eap_ttls.c
@@ -270,7 +270,7 @@ static int mod_process(void *arg, eap_handler_t *handler)
 			 *	Set the label based on the TLS version negotiated in the handshake.
 			 */
 			switch (tls_session->info.version) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+#ifdef TLS1_3_VERSION
 			case TLS1_3_VERSION:
 				tls_session->label = "EXPORTER_EAP_TLS_Key_Material";
 				break;