<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1908881131;
mso-list-type:hybrid;
mso-list-template-ids:1994695054 -34178148 134807555 134807557 134807553 134807555 134807557 134807553 134807555 134807557;}
@list l0:level1
{mso-level-start-at:50;
mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoPlainText><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Hello
all,<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoPlainText><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> I
am having a wpa_supplicant (0.7.3) client that tries to authenticate to a FreeRadius
(2.1.10) over hostapd (0.7.2) using EAP-TTLS and having fast_reauth=1 and
session resumption enabled on the server side. <o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoPlainText style='text-indent:36.0pt'><span style='font-size:10.0pt;
font-family:"Calibri","sans-serif"'>In fact if I have just that enabled, fast
reauthentication never happens because I am told that FreeRadius does not store
proper data in its cache to reauthenticate the user, as openSSL stores what is
on the reply of the inner packet (phase 2 of eap-ttls) and that, does not have
the identity of the user to be cached (and the outer has an anonymous one). <o:p></o:p></span></p>
<p class=MsoPlainText style='text-indent:36.0pt'><span style='font-size:10.0pt;
font-family:"Calibri","sans-serif"'><o:p> </o:p></span></p>
<p class=MsoPlainText style='text-indent:36.0pt'><span style='font-size:10.0pt;
font-family:"Calibri","sans-serif"'>In order to fix this, I have enabled on
FreeRadus the “use_tunneled_reply = yes”, however what I see now is
that the client gets authenticated successfully but the 4-way handshake betweek
wpa_supplicant and hostapd fails with the following message in wpa_supplicant.<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>State: ASSOCIATED ->
4WAY_HANDSHAKE<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>WPA: RX message 1 of 4-Way
Handshake from 00:14:6c:2d:00:85 (ver=2)<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>RSN: msg 1/4 key data -
hexdump(len=22): dd 14 00 0f ac 04 bc cf 0e 3e 42 3c 4f c5 2c 18 fc 7d 5e 39 b2
8a<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>WPA: PMKID in EAPOL-Key -
hexdump(len=22): dd 14 00 0f ac 04 bc cf 0e 3e<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>42 3c 4f c5 2c 18 fc 7d 5e
39 b2 8a<o:p></o:p></span></p>
<p class=MsoPlainText><b><span style='font-size:9.0pt'>RSN: PMKID from
Authenticator - hexdump(len=16): bc cf 0e 3e 42 3c 4f c5 2c 18 fc 7d 5e 39 b2
8a<o:p></o:p></span></b></p>
<p class=MsoPlainText><b><span style='font-size:9.0pt'>RSN: no matching PMKID
found<o:p></o:p></span></b></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>EAPOL: Successfully fetched
key (len=32)<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>WPA: PMK from EAPOL state
machines - hexdump(len=32): [REMOVED]<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>RSN: added PMKSA cache
entry for 00:14:6c:2d:00:85<o:p></o:p></span></p>
<p class=MsoPlainText><b><span style='font-size:9.0pt'>RSN: no PMKSA entry
found - trigger full EAP authentication<o:p></o:p></span></b></p>
<p class=MsoPlainText><b><span style='font-size:9.0pt'>RSN: Do not reply to msg
1/4 - requesting full EAP authentication RX ctrl_iface - hexdump_ascii(len=4):<o:p></o:p></span></b></p>
<p class=MsoPlainText><span style='font-size:9.0pt'> 50
49 4e
47
PING<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>RX EAPOL from
00:14:6c:2d:00:85<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>RX EAPOL - hexdump(len=25):
02 00 00 15 01 f2 00 15 01 68 65 6c 6c 6f 2d 50 41 4e 4f 53 2d 41 50 2d 32<o:p></o:p></span></p>
<p class=MsoPlainText><span style='font-size:9.0pt'>EAPOL: Received EAP-Packet
frame<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'> After
that wpa_supplicant issues an EAPOL start frame and the authentication happens
from the start but again the same thing happen when they reach the 4 way
handshake. It seems to me that there is some sort of a bug on the
wpa_supplicant side.. Could anyone shed some light?<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'>
Thanks a lot,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'> Panos<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:9.0pt;font-family:Symbol'><span style='mso-list:Ignore'>·<span
style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:9.0pt'>Wpa supplicant
output : <a href="http://pastebin.com/4xSPt0k3">http://pastebin.com/4xSPt0k3</a>
<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:9.0pt;font-family:Symbol'><span style='mso-list:Ignore'>·<span
style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:9.0pt'>Hostapd output : <a
href="http://pastebin.com/Xnb0TF2q">http://pastebin.com/Xnb0TF2q</a> <o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-18.0pt;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:9.0pt;font-family:Symbol'><span style='mso-list:Ignore'>·<span
style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:9.0pt'>FreeRadius output:
<a href="http://pastebin.com/p1V1XEVm">http://pastebin.com/p1V1XEVm</a> <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:9.0pt'><o:p> </o:p></span></p>
</div>
</body>
</html>