Hi,<br />
I am working on EAP-FAST with Cisco Internal Radius server.<br />
EAP is not getting successful.<br />
After supplicant sends the Client Key Exchange, Server sends the alert message.<br />
<br />
<br />
I see the similar problem is already reported in the forum in Mar 2008.<br />
The link is mentioned below.<br />
http://lists.shmoo.com/pipermail/hostap/2008-March/017520.html<br />
<br />
I tried every thing suggested in the thread . But still it doesn't work.<br />
<br />
Using the same supplicant code , I am able to connect in EAP-FAST mode by using as External Radius Server.It works fine .<br />
<br />
But it doesn't, If I try to use the internal radius server of Cisco Aeronet 1200 AP.<br />
<br />
I tried connecting my LAPTOP to the same with exactly the same configuration ( EAP-FAST , Internal Radius Server ). I am able to connect .<br />
<br />
Does any one have any suggestion on this issue.<br />
<br />
Any further information on the problem already reported in the thread as " Problem is porting to PALM and Invalid Tunnel MIC".<br />
The issue is resolved or still persists ?<br />
<br />
<br />
Regards<br />
Santosh<br />
<br />
Find the thread content below.<br />
I see the same logs in AP also.<br />
<br />
Problem in porting to PALM<br />
Jack Yip Jack at pitech.com <br />
Mon Mar 24 17:28:38 EDT 2008 <br />
<br />
Previous message: Problem in porting to PALM <br />
Next message: Supplicant used different EAP type 13: (TLS) <br />
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] <br />
<br />
--------------------------------------------------------------------------------<br />
<br />
Hi,<br />
I turned on more debug msg out from the CISCO server.<br />
<br />
**************************************************************************<br />
*Mar 8 06:02:30.107: RADSRV EAP-FAST: Add teap client 0011.d605.2cdc<br />
*Mar 8 06:02:30.107: RADSRV EAP-FAST: Sending TEAP start<br />
*Mar 8 06:02:30.253: RADSRV EAP-FAST: verify client_hello<br />
*Mar 8 06:02:30.253: RADSRV EAP-FAST: PAC to be provisioned, parsed 49, length<br />
49<br />
*Mar 8 06:02:30.253: RADSRV EAP-FAST: Build (provision) Server Hello, 0011.d605<br />
.2cdc<br />
*Mar 8 06:02:30.254: RADSRV EAP-FAST: Calculting DH Server public.. 0011.d605.2<br />
cdc<br />
*Mar 8 06:02:30.466: RADSRV EAP-FAST: DH public number generation failed<br />
*Mar 8 06:02:30.466: RADSRV EAP-FAST: Sending Server Hello, 0011.d605.2cdc<br />
*Mar 8 06:02:41.137: RADSRV EAP-FAST: verify client_finished, 0011.d605.2cdc<br />
*Mar 8 06:02:41.137: RADSRV EAP-FAST: Calculting premaster secret..<br />
*Mar 8 06:02:41.405: RADSRV EAP-FAST: Calculating Master secret...<br />
*Mar 8 06:02:41.408: RADSRV EAP-FAST: tunnel Decrypt pak (size 48):<br />
*Mar 8 06:02:41.408: Data out<br />
00DAA450: 59C9D621 YIV!<br />
00DAA460: CCF5E055 050EB6CB B37CF708 D97A0DB5 Lu`U..6K3|w.Yz.5<br />
00DAA470: C6D7FF1C 65B2A7FB 6A8D2F7A CEC3BB13 FW..e2'{j./zNC;.<br />
00DAA480: 16D843E6 46E37722 E3B7C3EF .XCfFcw"c7Co<br />
*Mar 8 06:02:41.409: RADSRV EAP-FAST: invalid tunnel MIC<br />
*Mar 8 06:02:41.409: RADSRV EAP-FAST: sending alert level 2, desc 0<br />
*Mar 8 06:02:56.409: RADSRV EAP-FAST: Timer expired, teap client 0011.d605.2cd<br />
c<br />
*Mar 8 06:02:56.409: RADSRV EAP-FAST: Delete teap client 0011.d605.2cdc<br />
<br />
<br />
**************************************************************************<br />
<br />
<br />
I found that after the server finish calculating master secret, it found invalid tunnel MIC. And then it send alert signal back to client.<br />
Does anyone know what is this mean?<br />
<br />
<br />
Jack<br />
<br />
<br />
<br />
________________________________<br />
<br />
From: hostap-bounces at lists.shmoo.com on behalf of Jack Yip<br />
Sent: Tue 3/25/2008 4:15 AM<br />
To: hostap at shmoo.com<br />
Subject: RE: Problem in porting to PALM<br />
<br />
<br />
Hi<br />
<br />
<br />
This is the information of the AP:<br />
System Software Version: Cisco IOS Software <br />
Product/Model Number: AIR-AP1242AG-A-K9 <br />
Top Assembly Serial Number: FTX1136B1XA <br />
System Software Filename: c1240-k9w7-tar.124-3g.JA1 <br />
System Software Version: 12.4(3g)JA1 <br />
Bootloader Version: 12.3(7)JA1 <br />
<br />
<br />
I have changed the code in the function "tlsv1_client_set_cipher_list"<br />
**********************************************************************************<br />
int tlsv1_client_set_cipher_list(struct tlsv1_client *conn, u8 *ciphers)<br />
{<br />
#ifdef EAP_FAST<br />
size_t count;<br />
u16 *suites;<br />
/* TODO: implement proper configuration of cipher suites */<br />
if (ciphers[0] == TLS_CIPHER_ANON_DH_AES128_SHA) {<br />
count = 0;<br />
suites = conn->cipher_suites;<br />
/* suites[count++] = TLS_DH_anon_WITH_AES_256_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_RC4_128_MD5;<br />
suites[count++] = TLS_DH_anon_WITH_DES_CBC_SHA;<br />
*/<br />
//JACK<br />
suites[count++] = TLS_DH_anon_WITH_AES_256_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;<br />
suites[count++] = TLS_DH_anon_WITH_RC4_128_MD5;<br />
suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA;<br />
<br />
<br />
<br />
conn->num_cipher_suites = count;<br />
}<br />
return 0;<br />
#else /* EAP_FAST */<br />
return -1;<br />
#endif /* EAP_FAST */<br />
}<br />
**********************************************************************************<br />
<br />
<br />
<br />
<br />
<br />
<br />
And then the debug msg no longer have the line "Cipher RC4_128_SHA / TLS_DH_anon_WITH_AES_128_CBC_SHA1 not found, client may be open source".But Still I have the following msg which makes me have failed authentication.<br />
<br />
<br />
<br />
*Mar 8 04:47:12.990: RADSRV EAP-FAST: Add teap client 0011.d605.2cdc<br />
*Mar 8 04:47:12.990: RADSRV EAP-FAST: Sending TEAP start<br />
*Mar 8 04:47:13.134: RADSRV EAP-FAST: verify client_hello<br />
*Mar 8 04:47:13.134: RADSRV EAP-FAST: PAC to be provisioned, parsed 49, length<br />
49<br />
*Mar 8 04:47:13.134: RADSRV EAP-FAST: Build (provision) Server Hello, 0011.d605<br />
.2cdc<br />
*Mar 8 04:47:13.135: RADSRV EAP-FAST: Calculting DH Server public.. 0011.d605.2<br />
cdc<br />
*Mar 8 04:47:13.347: RADSRV EAP-FAST: DH public number generation failed<br />
*Mar 8 04:47:13.347: RADSRV EAP-FAST: Sending Server Hello, 0011.d605.2cdc<br />
*Mar 8 04:47:24.017: RADSRV EAP-FAST: verify client_finished, 0011.d605.2cdc<br />
*Mar 8 04:47:24.017: RADSRV EAP-FAST: Calculting premaster secret..<br />
*Mar 8 04:47:24.282: RADSRV EAP-FAST: Calculating Master secret...<br />
*Mar 8 04:47:24.285: RADSRV EAP-FAST: sending alert level 2, desc 0<br />
*Mar 8 04:47:24.395: RADSRV EAP-FAST:<br />
Alert from 0011.d605.2cdc: Fatal : code 10<br />
*Mar 8 04:47:24.395: RADSRV EAP-FAST: Delete teap client 0011.d605.2cdc<br />
*Mar 8 04:47:24.396: %DOT11-7-AUTH_FAILED: Station 0011.d605.2cdc Authenticatio<br />
n failed<br />
<br />
<br />
Do you have any idea of this?<br />
Why after calculating master secert, the server will send back alert level?<br />
<br />
Please advise!!!<br />
<br />
By the way,I am trying to see the difference of wpa_supplicant-0.5.9.tar.gz and wpa_supplicant-0.5.10.tar.gz <br />
<br />
JACK<br />
<br />
<br />
<br />
________________________________<br />
<br />
From: hostap-bounces at lists.shmoo.com on behalf of Jouni Malinen<br />
Sent: Tue 3/25/2008 1:32 AM<br />
To: hostap at shmoo.com<br />
Subject: Re: Problem in porting to PALM<br />
<br />
<br />
<br />
On Tue, Mar 25, 2008 at 12:13:21AM +0800, Jack Yip wrote:<br />
<br />
> I have captured the debug msg with binary packet printed out from the CISCO server.<br />
<br />
> *Mar 8 00:24:06.587: RADSRV EAP-FAST: Add teap client 0011.d605.2cdc<br />
> *Mar 8 00:24:06.587: RADSRV EAP-FAST: EAP-FAST pak rx:<br />
> 01814770: 02 02000E01 616E6F6E 796D6F75 .....anonymou<br />
> 01814780: 73 s <br />
> *Mar 8 00:24:06.587: RADSRV EAP-FAST: EAP-FAST pak tx:<br />
> 01851070: 0103 001A2B21 ....+!<br />
> 01851080: 00040010 4C4F4341 4C205241 44495553 ....LOCAL RADIUS<br />
> 01851090: 20534552 SER <br />
<br />
Oh.. This is not ACS, but an internal EAP-FAST server in a Cisco AP..<br />
Which version of the AP software (IOS) are you using?<br />
<br />
> *Mar 8 00:24:06.588: RADSRV EAP-FAST: Sending TEAP start<br />
> *Mar 8 00:24:06.731: RADSRV EAP-FAST: EAP-FAST pak rx:<br />
> 01819650: 02 0300402B ... at +<br />
> 01819660: 01160301 00350100 00310301 45986005 .....5...1..E.`.<br />
> 01819670: BDA2B8BA 4D2702EA 306B7F69 80119AE7 ="8:M'.j0k.i...g<br />
> 01819680: BD3B975E 41E59F87 E7830B97 00000A00 =;.^Ae..g.......<br />
> 01819690: 3A003400 1B001800 1A0100 :.4........ <br />
<br />
Which TLS library (and which version of it) are you using in the client?<br />
<br />
The ClientHello seems to advertise support for following ciphers:<br />
TLS_DH_anon_WITH_AES_256_CBC_SHA<br />
TLS_DH_anon_WITH_AES_128_CBC_SHA<br />
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA<br />
TLS_DH_anon_WITH_RC4_128_MD5<br />
TLS_DH_anon_WITH_DES_CBC_SHA<br />
<br />
<br />
> *Mar 8 00:24:06.732: RADSRV EAP-FAST: verify client_hello<br />
> *Mar 8 00:24:06.732: RADSRV EAP-FAST: Cipher RC4_128_SHA / TLS_DH_anon_WITH_AES<br />
> _128_CBC_SHA1 not found, client may be open source<br />
<br />
This looks bit odd.. RC4_128_SHA is not there (which is as expected,<br />
since this is likely for anonymous provisioning), but<br />
TLS_DH_anon_WITH_AES_128_CBC_SHA1 is in the list.. This looks like a bug<br />
in the authentication server. I've seen the issue before, but I've never<br />
seen this level of debug output from the server.. Which debug options<br />
did not enable to get this?<br />
<br />
If I remember correctly, the server gets confused because of one of the<br />
ciphers and refuses to do provisioning because of this. Workaround would<br />
be to remove most of those ciphers from ClientHello and just try to use<br />
TLS_DH_anon_WITH_AES_128_CBC_SHA which is known to not confuse the local<br />
authentication server..<br />
<br />
I don't know whether this has been fixed in a newer IOS version, but it<br />
might be worthwhile to test upgrading if a newer firmware version is<br />
available.<br />
<br />
> By the way, I should be using the wpa_supplicant-0.5.9.tar.gz for porting(not wpa_supplicant-0.5.10.tar.gz ), does it work with EAP-FAST?<br />
<br />
Why should you use 0.5.9 instead of 0.5.10? I do not remember whether<br />
there were any changes that could affect EAP-FAST behavior between those<br />
versions, but in general, I would recommend using the latest available<br />
stable version due to bug fixes included in it.<br />
<br />
--<br />
Jouni Malinen PGP id EFC895FA<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br><br><br><Table border=0 Width=644 Height=57 cellspacing=0 cellpadding=0 style='font-family:Verdana;font-size:11px;line-height:15px;'><TR><td><a href='http://adworks.rediff.com/cgi-bin/AdWorks/click.cgi/www.rediff.com/signature-home.htm/1050715198@Middle5/2705210_2676711/2680353/1?PARTNER=3&OAS_QUERY=null' target=new ><img src ='http://imadworks.rediff.com/cgi-bin/AdWorks/adimage.cgi/2705210_2676711/creative_2680353.gif' alt='Moneywiz' border=0></a></td></TR></Table>