<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi all,<br>
<br>
as I am trying to implement EAP-TLS with GnuTLS, Jouni raised the idea
to have a look into his EAP implementation, so I tried eap_example to
see whether it works. By default, eap_example does not use GnuTLS, so I
added the following options to its Makefile:<br>
<br>
CONFIG_TLS=gnutls<br>
...<br>
ifeq ($(CONFIG_TLS),
gnutls)
<br>
CFLAGS +=
-DEAP_TLS_GNUTLS
<br>
OBJS_both +=
../src/crypto/tls_gnutls.o
<br>
OBJS_both +=
../src/crypto/crypto_gnutls.o
LIBS += -lgnutls
-lgnutls-extra
<br>
LIBS +=
-lgcrypt
<br>
endif <br>
<br>
...<br>
CLFAGS += -DEAP_SERVER_TLS<br>
<br>
The compiler does not give any errors using that modified Makefile. If
I execute eap_example as it is, it runs successfully and authenticates
the peer using PEAP/MSCHAPv2. But as I said, I wanted to test EAP-TLS
:) So I changed eap_example_server.c: EAP_TYPE_PEAP -> EAP_TYPE_TLS<br>
and eap_example_peer.c:<br>
<br>
eap_ctx.eap_config.client_cert = (u8 *)
os_strdup("client.pem");
<br>
eap_ctx.eap_config.private_key = (u8 *) os_strdup("client.key"); <br>
<br>
The compiler gives no errors, but when I run eap_example like that I
get:<br>
<br>
EAP: Server state machine created<br>
---[ server ]--------------------------------<br>
EAP: EAP entering state INITIALIZE<br>
EAP: EAP entering state SELECT_ACTION<br>
EAP: getDecision: no identity known yet -> CONTINUE<br>
EAP: EAP entering state PROPOSE_METHOD<br>
EAP: getNextMethod: vendor 0 type 1<br>
EAP: EAP entering state METHOD_REQUEST<br>
EAP: building EAP-Request: Identifier 103<br>
EAP: EAP entering state SEND_REQUEST<br>
EAP: EAP entering state IDLE<br>
EAP: retransmit timeout 3 seconds (from dynamic back off;
retransCount=0)<br>
==> Request<br>
---[ peer ]----------------------------------<br>
EAP: EAP entering state IDLE<br>
EAP: EAP entering state RECEIVED<br>
EAP: Received EAP-Request id=103 method=1 vendor=0 vendorMethod=0<br>
EAP: EAP entering state IDENTITY<br>
CTRL-EVENT-EAP-STARTED EAP authentication started<br>
EAP: EAP-Request Identity data - hexdump_ascii(len=0):<br>
EAP: using real identity - hexdump_ascii(len=4):<br>
75 73 65 72 user <br>
EAP: EAP entering state SEND_RESPONSE<br>
EAP: EAP entering state IDLE<br>
==> Response<br>
---[ server ]--------------------------------<br>
EAP: EAP entering state RECEIVED<br>
EAP: parseEapResp: rxResp=1 respId=103 respMethod=1 respVendor=0
respVendorMethod=0<br>
EAP: EAP entering state INTEGRITY_CHECK<br>
EAP: EAP entering state METHOD_RESPONSE<br>
EAP-Identity: Peer identity - hexdump_ascii(len=4):<br>
75 73 65 72 user <br>
EAP: EAP entering state SELECT_ACTION<br>
EAP: getDecision: another method available -> CONTINUE<br>
EAP: EAP entering state PROPOSE_METHOD<br>
EAP: getNextMethod: vendor 0 type 13<br>
EAP: EAP entering state METHOD_REQUEST<br>
EAP: building EAP-Request: Identifier 104<br>
EAP-TLS: START -> CONTINUE<br>
EAP: EAP entering state SEND_REQUEST<br>
EAP: EAP entering state IDLE<br>
EAP: retransmit timeout 3 seconds (from dynamic back off;
retransCount=0)<br>
==> Request<br>
---[ peer ]----------------------------------<br>
EAP: EAP entering state RECEIVED<br>
EAP: Received EAP-Request id=104 method=13 vendor=0 vendorMethod=0<br>
EAP: EAP entering state GET_METHOD<br>
EAP: Initialize selected EAP method: vendor 0 method 13 (TLS)<br>
TLS: using phase1 config options<br>
CTRL-EVENT-EAP-METHOD EAP vendor 0 method 13 (TLS) selected<br>
EAP: EAP entering state METHOD<br>
SSL: Received packet(len=6) - Flags 0x20<br>
EAP-TLS: Start<br>
SSL: 84 bytes left to be sent out (of total 84 bytes)<br>
EAP: method process -> ignore=FALSE methodState=MAY_CONT
decision=FAIL<br>
EAP: EAP entering state SEND_RESPONSE<br>
EAP: EAP entering state IDLE<br>
==> Response<br>
---[ server ]--------------------------------<br>
EAP: EAP entering state RECEIVED<br>
EAP: parseEapResp: rxResp=1 respId=104 respMethod=13 respVendor=0
respVendorMethod=0<br>
EAP: EAP entering state INTEGRITY_CHECK<br>
EAP: EAP entering state METHOD_RESPONSE<br>
SSL: Received packet(len=90) - Flags 0x00<br>
SSL: Received packet: Flags 0x0 Message Length 0<br>
tls_pull_func - 79 bytes remaining in pull_buf<br>
tls_pull_func - pull_buf consumed<br>
<b>tls_connection_handshake - gnutls_handshake failed -> Could not
negotiate a supported cipher suite.</b><br>
SSL: TLS processing failed<br>
EAP-TLS: CONTINUE -> FAILURE<br>
EAP: EAP entering state SELECT_ACTION<br>
EAP: getDecision: method failed -> FAILURE<br>
EAP: EAP entering state FAILURE<br>
EAP: Building EAP-Failure (id=104)<br>
==> Fail<br>
---[ peer ]----------------------------------<br>
EAP: EAP entering state RECEIVED<br>
EAP: Received EAP-Failure<br>
EAP: EAP entering state FAILURE<br>
CTRL-EVENT-EAP-FAILURE EAP authentication failed<br>
---[ server ]--------------------------------<br>
---[ peer ]----------------------------------<br>
EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit<br>
EAP: Server state machine removed<br>
<br>
<br>
I found old mails on several lists that say, that this error indicates
that client and server do not use the same ciphersuites, but as they
come the same source, it cannot be the case here. I could imagine, that
EAP-TLS requires ciphersuites that GnuTLS cannot provide (even if that
sounds strange), could that be? <br>
<br>
I wrote my own TLS (no EAP, only TLS) test server and client, which are
working perfectly and compared it to your code in tls_gnutls.c (the TLS
inside EAP should be the same as in TLS-only or am I wrong?), but I
cannot see much difference. So it should work... What did I miss? Did
anybody test it? Or maybe, there was a reason not to include gnutls
into eap_example/Makefile?<br>
<br>
Carolin<br>
</body>
</html>