EAP-TLS + WPA: no reply from AP

Nicolas Courtel courtel at cena.fr
Thu Apr 15 11:33:46 EDT 2010


Hello all,

I'm trying to connect to an EAP-TLS + WPA network, using wpasupplicant 
0.6.10 on Debian testing, and seem to get no reply from the access point.
As there is no SSL information in the output of wpasupplicant, I suppose 
that it's at least part of the problem, but I can't figure out what's 
going on from the informations I got so far (man, FAQ, list archives, 
...). So it would be nice if someone could give me a clue about what 
I've done wrong.

The config file is the following:


ctrl_interface=/var/run/wpa_supplicant

network={
    ssid="Wifi-DTI"
    scan_ssid=1
    key_mgmt=WPA-EAP
    pairwise=CCMP
    group=CCMP
    eap=TLS
    identity="tortu.tls.cena.fr"
    ca_cert="/etc/ssl/certs/DTI_RootCA.pem"
    client_cert="/etc/ssl/private/tortu.pem"
    private_key="/etc/ssl/private/tortu.pem"
    private_key_passwd="********"
}

The file tortu.pem contains both the certificate and the private key for 
the the host tortu.tls.cena.fr.
And the output with -dd is the following; after the last line, it waits 
for a while, then starts again, untils it quits.


Initializing interface 'wlan0' conf '/etc/wpa_supplicant/wpa.conf' 
driver 'default' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant/wpa.conf' -> 
'/etc/wpa_supplicant/wpa.conf'
Reading configuration file '/etc/wpa_supplicant/wpa.conf'
ctrl_interface='/var/run/wpa_supplicant'
Line: 14 - start of a new network block
ssid - hexdump_ascii(len=8):
     57 69 66 69 2d 44 54 49                           Wifi-DTI       
scan_ssid=1 (0x1)
key_mgmt: 0x1
pairwise: 0x10
group: 0x10
eap methods - hexdump(len=16): 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 
00 00
identity - hexdump_ascii(len=17):
     74 6f 72 74 75 2e 74 6c 73 2e 63 65 6e 61 2e 66   tortu.tls.cena.f
     72                                                r              
ca_cert - hexdump_ascii(len=29):
     2f 65 74 63 2f 73 73 6c 2f 63 65 72 74 73 2f 44   /etc/ssl/certs/D
     54 49 5f 52 6f 6f 74 43 41 2e 70 65 6d            TI_RootCA.pem  
client_cert - hexdump_ascii(len=26):
     2f 65 74 63 2f 73 73 6c 2f 70 72 69 76 61 74 65   /etc/ssl/private
     2f 74 6f 72 74 75 2e 70 65 6d                     /tortu.pem     
private_key - hexdump_ascii(len=26):
     2f 65 74 63 2f 73 73 6c 2f 70 72 69 76 61 74 65   /etc/ssl/private
     2f 74 6f 72 74 75 2e 70 65 6d                     /tortu.pem     
private_key_passwd - hexdump_ascii(len=8): [REMOVED]
Priority group 0
   id=0 ssid='Wifi-DTI'
Initializing interface (2) 'wlan0'
Interface wlan0 set UP - waiting a second for the driver to complete 
initialization
SIOCGIWRANGE: WE(compiled)=22 WE(source)=14 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf flags 0x0
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:22:43:26:4b:2b
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
RSN: flushing PMKID list in the driver
Setting scan request: 0 sec 100000 usec
WPS: UUID based on MAC address - hexdump(len=16): 59 9e 03 ef 80 8d 53 
fb ad ca 9d d7 d5 f0 58 99
WPS: Build Beacon and Probe Response IEs
WPS:  * Version
WPS:  * Wi-Fi Protected Setup State (0)
WPS:  * Version
WPS:  * Wi-Fi Protected Setup State (0)
WPS:  * Response Type (2)
WPS:  * UUID-E
WPS:  * Manufacturer
WPS:  * Model Name
WPS:  * Model Number
WPS:  * Serial Number
WPS:  * Primary Device Type
WPS:  * Device Name
WPS:  * Config Methods (0)
WPS:  * RF Bands (3)
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
Added interface wlan0
RTM_NEWLINK: operstate=0 ifi_flags=0x1002 ()
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
State: DISCONNECTED -> SCANNING
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=8):
     57 69 66 69 2d 44 54 49                           Wifi-DTI       
Trying to get current scan results first without requesting a new scan 
to speed up initial association
Failed to get scan results
Failed to get scan results - try scanning again
Setting scan request: 0 sec 0 usec
Starting AP scan (broadcast SSID)
Scan requested (ret=0) - scan timeout 5 seconds
EAPOL: disable timer tick
Scan timeout - try to get results
Received 1260 bytes of scan results (11 BSSes)
New scan results available
Selecting BSS from priority group 0
Try to find WPA-enabled AP
0: 00:1d:7e:a0:65:6a ssid='Wifi-DTI' wpa_ie_len=24 rsn_ie_len=0 caps=0x11
   selected based on WPA IE
   selected WPA AP 00:1d:7e:a0:65:6a ssid='Wifi-DTI'
Trying to associate with 00:1d:7e:a0:65:6a (SSID='Wifi-DTI' freq=2457 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: using IEEE 802.11i/D3.0
WPA: Selected cipher suites: group 16 pairwise 16 key_mgmt 1 proto 1
WPA: set AP WPA IE - hexdump(len=26): dd 18 00 50 f2 01 01 00 00 50 f2 
04 01 00 00 50 f2 04 01 00 00 50 f2 01 00 00
WPA: clearing AP RSN IE
WPA: using GTK CCMP
WPA: using PTK CCMP
WPA: using KEY_MGMT 802.1X
WPA: Set own WPA IE default - hexdump(len=24): dd 16 00 50 f2 01 01 00 
00 50 f2 04 01 00 00 50 f2 04 01 00 00 50 f2 01
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
wpa_driver_wext_set_psk
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - EAP success=0
EAPOL: External notification - EAP fail=0
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
Wireless event: cmd=0x8b04 len=12
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
Wireless event: cmd=0x8c07 len=52
AssocReq IE wireless event - hexdump(len=44): 00 08 57 69 66 69 2d 44 54 
49 01 08 82 84 8b 96 a4 b0 c8 ec dd 16 00 50 f2 01 01 00 00 50 f2 04 01 
00 00 50 f2 04 01 00 00 50 f2 01
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:1d:7e:a0:65:6a
Association info event
req_ies - hexdump(len=44): 00 08 57 69 66 69 2d 44 54 49 01 08 82 84 8b 
96 a4 b0 c8 ec dd 16 00 50 f2 01 01 00 00 50 f2 04 01 00 00 50 f2 04 01 
00 00 50 f2 01
WPA: set own WPA/RSN IE - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 
f2 04 01 00 00 50 f2 04 01 00 00 50 f2 01
State: ASSOCIATING -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:1d:7e:a0:65:6a
No keys have been configured - skip key clearing
Associated with 00:1d:7e:a0:65:6a
WPA: Association event - clear replay counter
WPA: Clear old PTK
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: enable timer tick
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL: dst=00:1d:7e:a0:65:6a
TX EAPOL - hexdump(len=4): 01 01 00 00
RX EAPOL from 00:1d:7e:a0:65:6a
RX EAPOL - hexdump(len=9): 01 00 00 05 01 00 00 05 01
Setting authentication timeout: 70 sec 0 usec
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_PAE entering state RESTART
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=0 method=1 vendor=0 vendorMethod=0
EAP: EAP entering state IDENTITY
CTRL-EVENT-EAP-STARTED EAP authentication started
EAP: EAP-Request Identity data - hexdump_ascii(len=0):
EAP: using real identity - hexdump_ascii(len=17):
     74 6f 72 74 75 2e 74 6c 73 2e 63 65 6e 61 2e 66   tortu.tls.cena.f
     72                                                r              
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=00:1d:7e:a0:65:6a
TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 74 6f 72 74 75 2e 
74 6c 73 2e 63 65 6e 61 2e 66 72
EAPOL: SUPP_BE entering state RECEIVE
[...]
Authentication with 00:1d:7e:a0:65:6a timed out.
Added BSSID 00:1d:7e:a0:65:6a into blacklist

Thanks for your help,

-- 
Nicolas


More information about the HostAP mailing list