From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 5 Apr 2019 22:00:15 +0000 (-0400)
Subject: Fix setting up EAP-TLS success after virtual server is called
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ec2dc4e42a9a538843665ff5fa9183e1639e7267;p=thirdparty%2Ffreeradius-server.git

Fix setting up EAP-TLS success after virtual server is called
---

diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index c2045bd07b0..3820bc0e0a0 100644
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -73,6 +73,51 @@ fr_dict_attr_autoload_t rlm_eap_tls_dict_attr[] = {
  */
 static rlm_rcode_t CC_HINT(nonnull) mod_process(void *instance, eap_session_t *eap_session);
 
+static rlm_rcode_t eap_tls_success_with_prf(eap_session_t *eap_session)
+{
+		tls_session_t		*tls_session = eap_tls_session->tls_session;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+	/*
+	 *	Set the PRF label based on the TLS version negotiated
+	 *	in the handshake.
+	 */
+	switch (SSL_SESSION_get_protocol_version(SSL_get_session(tls_session->ssl))) {
+	case SSL2_VERSION:			/* Should never happen */
+	case SSL3_VERSION:			/* Should never happen */
+		rad_assert(0);
+		return RLM_MODULE_INVALID;
+
+	case TLS1_VERSION:
+	case TLS1_1_VERSION:
+	case TLS1_2_VERSION:
+#endif
+	{
+		static char const keying_prf_label[] = "client EAP encryption";
+
+		if (eap_tls_success(eap_session,
+				    keying_prf_label, sizeof(keying_prf_label) - 1,
+				    NULL, 0) < 0) return RLM_MODULE_FAIL;
+	}
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+		break;
+
+	case TLS1_3_VERSION:
+	default:
+	{
+		static char const keying_prf_label[] = "EXPORTER_EAP_TLS_Key_Material";
+		static char const sessid_prf_label[] = "EXPORTER_EAP_TLS_Method-Id";
+
+		if (eap_tls_success(eap_session,
+				    keying_prf_label, sizeof(keying_prf_label) - 1,
+				    sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL;
+	}
+		break;
+	}
+#endif
+	return RLM_MODULE_OK;
+}
+
 static unlang_action_t eap_tls_virtual_server_result(REQUEST *request, rlm_rcode_t *presult,
 						     UNUSED int *priority, void *uctx)
 {
@@ -81,6 +126,7 @@ static unlang_action_t eap_tls_virtual_server_result(REQUEST *request, rlm_rcode
 	switch (*presult) {
 	case RLM_MODULE_OK:
 	case RLM_MODULE_UPDATED:
+		*presult = eap_tls_success_with_prf(eap_session);
 		break;
 
 	default:
@@ -167,51 +213,9 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session)
 	 *	it accepts the certificates, too.
 	 */
 	case EAP_TLS_ESTABLISHED:
-	{
 		if (inst->virtual_server) return eap_tls_virtual_server(inst, eap_session);
+		return eap_tls_success_with_prf(eap_session);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-		/*
-		 *	Set the PRF label based on the TLS version negotiated
-		 *	in the handshake.
-		 */
-		switch (SSL_SESSION_get_protocol_version(SSL_get_session(tls_session->ssl))) {
-		case SSL2_VERSION:			/* Should never happen */
-		case SSL3_VERSION:			/* Should never happen */
-			rad_assert(0);
-			return RLM_MODULE_INVALID;
-
-		case TLS1_VERSION:
-		case TLS1_1_VERSION:
-		case TLS1_2_VERSION:
-#endif
-		{
-			static char const keying_prf_label[] = "client EAP encryption";
-
-			if (eap_tls_success(eap_session,
-				    	    keying_prf_label, sizeof(keying_prf_label) - 1,
-				    	    NULL, 0) < 0) return RLM_MODULE_FAIL;
-		}
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-			break;
-
-		case TLS1_3_VERSION:
-		default:
-		{
-			static char const keying_prf_label[] = "EXPORTER_EAP_TLS_Key_Material";
-			static char const sessid_prf_label[] = "EXPORTER_EAP_TLS_Method-Id";
-
-			if (eap_tls_success(eap_session,
-				    	    keying_prf_label, sizeof(keying_prf_label) - 1,
-				    	    sessid_prf_label, sizeof(sessid_prf_label) - 1) < 0) return RLM_MODULE_FAIL;
-		}
-			break;
-		}
-#endif
-
-
-	}
-		return RLM_MODULE_OK;
 
 	/*
 	 *	The TLS code is still working on the TLS