freeradius 错误： error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certifi

Posted 2020-10-08 rohens

在进行802.1x 测试时遇到如下问题：

Waking up in 4.6 seconds.
(156) Received Access-Request Id 82 from 192.168.1.126:44896 to 192.168.1.122:1812 length 524
(156)   User-Name = "dddddd"
(156)   Called-Station-Id = "70-CC-CC-E3-00-91:myssid"
(156)   NAS-Port-Type = Wireless-802.11
(156)   NAS-Port = 1
(156)   Calling-Station-Id = "70-CC-CC-E1-22-35"
(156)   Connect-Info = "CONNECT 54Mbps 802.11g"
(156)   Acct-Session-Id = "59BD3E8C-000000DB"
(156)   Framed-MTU = 1400
(156)   EAP-Message = 0x025101580d0016030100070b00000300000016030101061000010201005334a243b0db1f6b723285cb5c7e721c0c14fde8164460fdf99b40e26ef1e98c4388577b61732cf224c668bd961722be74963d055c18293b95d9ed937e331d4ad0f0afaba131a9a3d1c8d1b44d201a9a26ff9ddf6b26deb7ee58
(156)   State = 0xf8598809fd08850a5fc36ea7518e8167
(156)   Message-Authenticator = 0x33eb613f3409a98c69ee6ab0e649785b
(156) session-state: No cached attributes
(156) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(156)   authorize {
(156)     policy filter_username {
(156)       if (&User-Name) {
(156)       if (&User-Name)  -> TRUE
(156)       if (&User-Name)  {
(156)         if (&User-Name =~ / /) {
(156)         if (&User-Name =~ / /)  -> FALSE
(156)         if (&User-Name =~ /@[^@]*@/ ) {
(156)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(156)         if (&User-Name =~ /\.\./ ) {
(156)         if (&User-Name =~ /\.\./ )  -> FALSE
(156)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(156)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(156)         if (&User-Name =~ /\.$/)  {
(156)         if (&User-Name =~ /\.$/)   -> FALSE
(156)         if (&User-Name =~ /@\./)  {
(156)         if (&User-Name =~ /@\./)   -> FALSE
(156)       } # if (&User-Name)  = notfound
(156)     } # policy filter_username = notfound
(156)     [preprocess] = ok
(156)     [chap] = noop
(156)     [mschap] = noop
(156)     [digest] = noop
(156) suffix: Checking for suffix after "@"
(156) suffix: No ‘@‘ in User-Name = "dddddd", looking up realm NULL
(156) suffix: No such realm "NULL"
(156)     [suffix] = noop
(156) eap: Peer sent EAP Response (code 2) ID 81 length 344
(156) eap: No EAP Start, assuming it‘s an on-going EAP conversation
(156)     [eap] = updated
(156) files: users: Matched entry huwomo at line 221
(156)     [files] = ok
(156)     [expiration] = noop
(156)     [logintime] = noop
(156) pap: WARNING: Auth-Type already set.  Not setting to PAP
(156)     [pap] = noop
(156)   } # authorize = updated
(156) Found Auth-Type = eap
(156) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(156)   authenticate {
(156) eap: Expiring EAP session with state 0xf8598809fd08850a
(156) eap: Finished EAP session with state 0xf8598809fd08850a
(156) eap: Previous EAP request found for state 0xf8598809fd08850a, released from the list
(156) eap: Peer sent packet with method EAP TLS (13)
(156) eap: Calling submodule eap_tls to process data
(156) eap_tls: Continuing EAP-TLS
(156) eap_tls: [eaptls verify] = ok
(156) eap_tls: Done initial handshake
(156) eap_tls: <<< recv TLS 1.0 Handshake [length 0007], Certificate
(156) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal handshake_failure
(156) eap_tls: ERROR: TLS Alert write:fatal:handshake failure
tls: TLS_accept: Error in error
(156) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:140890C7:SSL routines:ssl3_get_client_certificate:peer did not return a certificate
(156) eap_tls: ERROR: System call (I/O) error (-1)
(156) eap_tls: ERROR: TLS receive handshake failed during operation
(156) eap_tls: ERROR: [eaptls process] = fail
(156) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module failed
(156) eap: Sending EAP Failure (code 4) ID 81 length 4
(156) eap: Failed in EAP select
(156)     [eap] = invalid
(156)   } # authenticate = invalid
(156) Failed to authenticate the user
(156) Using Post-Auth-Type Reject
(156) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(156)   Post-Auth-Type REJECT {
(156) attr_filter.access_reject: EXPAND %{User-Name}
(156) attr_filter.access_reject:    --> huwomo
(156) attr_filter.access_reject: Matched entry DEFAULT at line 11
(156)     [attr_filter.access_reject] = updated
(156)     [eap] = noop
(156)     policy remove_reply_message_if_eap {
(156)       if (&reply:EAP-Message && &reply:Reply-Message) {
(156)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(156)       else {
(156)         [noop] = noop
(156)       } # else = noop
(156)     } # policy remove_reply_message_if_eap = noop
(156)   } # Post-Auth-Type REJECT = updated
(156) Login incorrect (eap_tls: TLS Alert write:fatal:handshake failure): [huwomo] (from client hwm port 1 cli 78-C2-C0-E1-22-35)
(156) Delaying response for 1.000000 seconds

EAP-TLS  测试过程中， freeradius 服务器端报错如上，没有得到client端正确的证书。

而 client端 报出的错误是  密钥解析错误，跟踪 wpa_supplicant 代码，得到如下内容：

Thu Sep 21 17:35:18 2017 user.debug syslog: eap_peer_sm_step_received 697
Thu Sep 21 17:35:18 2017 user.debug syslog: EAP: Status notification: started (param=)
Thu Sep 21 17:35:19 2017 user.debug syslog: EAP: Status notification: refuse proposed method (param=PEAP)
Thu Sep 21 17:35:19 2017 user.debug syslog: EAP: Status notification: accept proposed method (param=TLS)
Thu Sep 21 17:35:19 2017 user.debug syslog: sm_EAP_GET_METHOD_Enter 290, selectedMethod : 0, reqMethod : 13
Thu Sep 21 17:35:19 2017 user.debug syslog: EAP: Initialize selected EAP method: vendor 0 method 13 (TLS)
Thu Sep 21 17:35:19 2017 user.debug syslog: asn1_parse_oid 95 
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_private_key_import 50
Thu Sep 21 17:35:19 2017 user.debug syslog: pkcs8_enc_key_import 156 class : 0, tag : d
Thu Sep 21 17:35:19 2017 user.debug syslog: Trying to parse PKCS #1 encoded RSA private key
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_rsa_import_private_key 199 class : 0, tag : d
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_private_key_import 44
Thu Sep 21 17:35:19 2017 user.debug syslog: pkcs8_key_import 27
Thu Sep 21 17:35:19 2017 user.debug syslog: pkcs8_key_import 45 class : 0, tag : 10
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_private_key_import 50
Thu Sep 21 17:35:19 2017 user.debug syslog: pkcs5_decrypt 187
Thu Sep 21 17:35:19 2017 user.debug syslog: pkcs5_get_params 54
Thu Sep 21 17:35:19 2017 user.debug syslog: asn1_parse_oid 95
Thu Sep 21 17:35:19 2017 user.debug syslog: PKCS #5: encryption algorithm 1.2.840.113549.1.5.13
Thu Sep 21 17:35:19 2017 user.debug syslog: PKCS #5: unsupported encryption algorithm 1.2.840.113549.1.5.13
Thu Sep 21 17:35:19 2017 user.debug syslog: Trying to parse PKCS #1 encoded RSA private key
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_rsa_parse_integer 41
Thu Sep 21 17:35:19 2017 user.debug syslog: crypto_rsa_import_private_key 213
Thu Sep 21 17:35:19 2017 user.debug syslog: TLSv1: Failed to parse private key
Thu Sep 21 17:35:19 2017 user.debug syslog: eap_tls_init_connection 194 res : -1
Thu Sep 21 17:35:19 2017 user.debug syslog: EAP-TLS: Start
Thu Sep 21 17:35:19 2017 user.debug syslog: SSL: Building ACK (type=13 id=217 ver=0)
Thu Sep 21 17:35:19 2017 user.debug syslog: SSL: Building ACK (type=13 id=218 ver=0)
Thu Sep 21 17:35:19 2017 user.debug syslog: SSL: Building ACK (type=13 id=219 ver=0)
Thu Sep 21 17:35:24 2017 user.debug syslog: EAP: Status notification: completion (param=failure)

 

在 tlsv1_set_key 中使用 PKCS#1 /  PKCS#5  / PKCS#8 方式解析密钥文件，均解析错误。

static int tlsv1_set_key(struct tlsv1_credentials *cred,
    const u8 *key, size_t len, const char *passwd)
{
 syslog(LOG_DEBUG, "%s %d", __func__, __LINE__);
 cred->key = crypto_private_key_import(key, len, passwd);
 if (cred->key == NULL)
  cred->key = tlsv1_set_key_pem(key, len);

 if (cred->key == NULL)
  cred->key = tlsv1_set_key_enc_pem(key, len, passwd);
 
 if (cred->key == NULL) {
  syslog(LOG_DEBUG, "TLSv1: Failed to parse private key");
  wpa_printf(MSG_INFO, "TLSv1: Failed to parse private key");
  return -1;
 }
 return 0;
}

其中 使用PKCS#5 解析时，报错如下：

Thu Sep 21 17:35:19 2017 user.debug syslog: PKCS #5: encryption algorithm 1.2.840.113549.1.5.13
Thu Sep 21 17:35:19 2017 user.debug syslog: PKCS #5: unsupported encryption algorithm 1.2.840.113549.1.5.13

查找代码，在函数 pkcs5_get_params 中，解析params->alg = pkcs5_get_alg(&oid); 时，值应该为

static enum pkcs5_alg pkcs5_get_alg(struct asn1_oid *oid)
{
 if (oid->len == 7 &&
     oid->oid[0] == 1 /* iso */ &&
     oid->oid[1] == 2 /* member-body */ &&
     oid->oid[2] == 840 /* us */ &&
     oid->oid[3] == 113549 /* rsadsi */ &&
     oid->oid[4] == 1 /* pkcs */ &&
     oid->oid[5] == 5 /* pkcs-5 */ &&
     oid->oid[6] == 3 /* pbeWithMD5AndDES-CBC */)    
  return PKCS5_ALG_MD5_DES_CBC;

 return PKCS5_ALG_UNKNOWN;
}

错在最后一位不相符。

通过查看  OID 节点 网页 http://oidref.com/   上相关内容得知：

 1.2.840.113549.1.5.13    pkcs5 pebs2

1.2.840.113549.1.5.3        pbeWithMD5AndDES-CBC

两者加密的方式不同，  前者为 pebs2,  后者为 md5 des-cbc.

查看wpa-supplicant 修改日志， 得知  2016-10-2，V2.6  的修改日志中记录

	* TLS client
	  - do not verify CA certificates when ca_cert is not specified
	  - support validating server certificate hash
	  - support SHA384 and SHA512 hashes
	  - add signature_algorithms extension into ClientHello
	  - support TLS v1.2 signature algorithm with SHA384 and SHA512
	  - support server certificate probing
	  - allow specific TLS versions to be disabled with phase2 parameter
	  - support extKeyUsage
	  - support PKCS #5 v2.0 PBES2
	  - support PKCS #5 with PKCS #12 style key decryption
	  - minimal support for PKCS #12
	  - support OCSP stapling (including ocsp_multi)

 了加入了对PEBS2的解析。

因此将代码升级到相应版本，问题解决。

 

此处留有疑问的是: 由于使用git使用的较少， 也懒的移植最新的wpa-supplicant的代码到openwrt  bb版本，从trunk版本上更新了hostapd代码为 2016-01-15  的版本也支持，不知道git跟 官网是怎样对应的。