Move cbtls_verify to rlm_eap_tls, where it won't pollute

	radeapclient, which doesn't use or need it.

diff --git a/src/modules/rlm_eap/libeap/tls.c b/src/modules/rlm_eap/libeap/tls.c
index 46b17a6..53a0556 100644 (file)
--- a/src/modules/rlm_eap/libeap/tls.c
+++ b/src/modules/rlm_eap/libeap/tls.c
@@ -34,7 +34,8 @@ tls_session_t *eaptls_new_session(SSL_CTX *ssl_ctx, int client_cert)
 {
        tls_session_t *state = NULL;
        SSL *new_tls = NULL;
-       int verify_mode = SSL_VERIFY_NONE;
+
+       client_cert = client_cert; /* -Wunused.  See bug #350 */
 
        if ((new_tls = SSL_new(ssl_ctx)) == NULL) {
                radlog(L_ERR, "rlm_eap_tls: Error creating new SSL");
@@ -81,17 +82,6 @@ tls_session_t *eaptls_new_session(SSL_CTX *ssl_ctx, int client_cert)
        SSL_set_info_callback(new_tls, cbtls_info);
 
        /*
-        *      Verify the peer certificate, if asked.
-        */
-       if (client_cert) {
-               DEBUG2(" rlm_eap_tls: Requiring client certificate");
-               verify_mode = SSL_VERIFY_PEER;
-               verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
-               verify_mode |= SSL_VERIFY_CLIENT_ONCE;
-       }
-       SSL_set_verify(state->ssl, verify_mode, cbtls_verify);
-
-       /*
         *      In Server mode we only accept.
         */
        SSL_set_accept_state(state->ssl);

diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index 9bafa1a..09f7ac0 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -255,7 +255,7 @@ static SSL_CTX *init_tls_ctx(EAP_TLS_CONF *conf)
        SSL_METHOD *meth;
        SSL_CTX *ctx;
        X509_STORE *certstore;
-       int verify_mode = 0;
+       int verify_mode = SSL_VERIFY_NONE;
        int ctx_options = 0;
        int type;
 
@@ -525,6 +525,7 @@ static int eaptls_initiate(void *type_arg, EAP_HANDLER *handler)
        eap_tls_t       *inst;
        VALUE_PAIR      *vp;
        int             client_cert = TRUE;
+       int             verify_mode = SSL_VERIFY_NONE;
 
        inst = (eap_tls_t *)type_arg;
 
@@ -557,6 +558,17 @@ static int eaptls_initiate(void *type_arg, EAP_HANDLER *handler)
        }
 
        /*
+        *      Verify the peer certificate, if asked.
+        */
+       if (client_cert) {
+               DEBUG2(" rlm_eap_tls: Requiring client certificate");
+               verify_mode = SSL_VERIFY_PEER;
+               verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
+               verify_mode |= SSL_VERIFY_CLIENT_ONCE;
+       }
+       SSL_set_verify(ssn->ssl, verify_mode, cbtls_verify);
+
+       /*
         *      Create a structure for all the items required to be
         *      verified for each client and set that as opaque data
         *      structure.