From d90c4bf807c662c1d4e7b75930d4b9598d7010ad Mon Sep 17 00:00:00 2001 From: Arran Cudbard-Bell Date: Sun, 20 Jan 2019 16:59:03 +0700 Subject: [PATCH] Use SSL_is_init_finished instead of checking the last handshake_type This fixes some compatibility issues with TLS 1.3. We still disagree on MPPE keys with eapol_test though... --- src/lib/eap/tls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/eap/tls.c b/src/lib/eap/tls.c index 2b10ececcbb..f3cc449174c 100644 --- a/src/lib/eap/tls.c +++ b/src/lib/eap/tls.c @@ -496,8 +496,8 @@ static eap_tls_status_t eap_tls_session_status(eap_session_t *eap_session) RDEBUG2("Peer ACKed our alert"); return EAP_TLS_FAIL; - if ((tls_session->info.handshake_type == handshake_finished) && (tls_session->dirty_out.used == 0)) { case SSL3_RT_HANDSHAKE: + if (SSL_is_init_finished(tls_session->ssl) && (tls_session->dirty_out.used == 0)) { RDEBUG2("Peer ACKed our handshake fragment. handshake is finished"); /* -- 2.47.3