From f55f9c4e1ed1b0cfdd9e0ae75b4b76ec22ff80b4 Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Tue, 24 Aug 2010 08:41:12 +0200
Subject: [PATCH] Client sends empty EAP-TTLS packet on fatal alerts to
 properly shut down TLS

---
 src/libcharon/plugins/eap_ttls/eap_ttls.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c
index d7372fe760..35a529091c 100644
--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c
+++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c
@@ -338,6 +338,12 @@ METHOD(eap_method_t, process, status_t,
 	{
 		*out = read_buf(this, pkt->identifier);
 	}
+	else if (status == FAILED && !this->is_server)
+	{	/* client sends an empty TLS message, waits for a EAP-Failure */
+		chunk_free(&this->output);
+		*out = read_buf(this, pkt->identifier);
+		return NEED_MORE;
+	}
 	return status;
 }
 
-- 
2.47.3