From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Sun, 20 Jan 2019 09:59:03 +0000 (+0700)
Subject: Use SSL_is_init_finished instead of checking the last handshake_type
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d90c4bf807;p=thirdparty%2Ffreeradius-server.git

Use SSL_is_init_finished instead of checking the last handshake_type

This fixes some compatibility issues with TLS 1.3.  We still disagree on MPPE keys with eapol_test though...
---

diff --git a/src/lib/eap/tls.c b/src/lib/eap/tls.c
index 2b10ececcbb..f3cc449174c 100644
--- a/src/lib/eap/tls.c
+++ b/src/lib/eap/tls.c
@@ -496,8 +496,8 @@ static eap_tls_status_t eap_tls_session_status(eap_session_t *eap_session)
 		RDEBUG2("Peer ACKed our alert");
 		return EAP_TLS_FAIL;
 
-		if ((tls_session->info.handshake_type == handshake_finished) && (tls_session->dirty_out.used == 0)) {
 	case SSL3_RT_HANDSHAKE:
+		if (SSL_is_init_finished(tls_session->ssl) && (tls_session->dirty_out.used == 0)) {
 			RDEBUG2("Peer ACKed our handshake fragment.  handshake is finished");
 
 			/*