Subject: PEAP Authentication-EAPTLS_HANDLED : Help Please
From: <[email-masked]>
To: <[email-masked]>
Date: Wed, 15 Nov 2006 12:20:13 +0530

Hi  all ,
 
I am trying to use peap as authentication mechanism using `radiusd' and `radeapclient' programs .
 
I am not able to get the TLS session established successfuly .
 
I believe that the client has to send a `Cleint Hello' message to the server after the first packet, how to send that , can any one give me that file format which is to be redirected to the `radeapclient' program as input . 
 
I am getting a message from `radiusd' as EAPTLS_HANDLED , i think i must get EAPTLS_OK , i dont know if its  right or wrong , please guide me.
 
i am using a script to run the `radeapclient' twice with diffrent attributes including some attributes which got from the reply packet from `radiusd' server such as EAP-Message ,Message-Authenticator ,State.
 
-----------------------------------------------------------------------------------------------

# peap.09112006_1_Identity :- This is the input for first `radeapclient'

User-Name = "bob"

NAS-IP-Address = localhost

EAP-Code = Response

EAP-Id = 210

EAP-Type-Identity = bob

NAS-Port = 0

# EAP-MD5-Password = "bob"

# EAP-Type = PEAP

--------------------------------------------------------------------------------
# rad_Response.test_script :- The script i have written 

(

echo 'User-Name = "bob"'

echo 'NAS-IP-Address = localhost'

echo 'EAP-Code = Response'

echo 'EAP-Id = 212'

echo 'NAS-Port = 0'

echo 'EAP-Type = PEAP'

)>peap.Response.test

radeapclient  localhost  auth testing123 < peap.09112006_1_Identity | tail -6 |head -3|tr -s " " >> peap.Response.test

radeapclient localhost auth testing123 < peap.Response.test 

# Script Ends...

---------------------------------------------------------------------------------

The out put (log) given by `radiusd -X' is given below 
i am just omitting the initial configuration part logs 

---------------------------------------------------------------------       .

       .

Ready to process requests.

rad_recv: Access-Request packet from host 127.0.0.1:32784, id=96, length=65

User-Name = "bob"

NAS-IP-Address = 255.255.255.255 

NAS-Port = 0

EAP-Message = 0x02d2000801626f62

Message-Authenticator = 0xef15cf5bbfe704b556ec0f6a1dd2e34a

Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 0

modcall[authorize]: module "preprocess" returns ok for request 0

modcall[authorize]: module "chap" returns noop for request 0

modcall[authorize]: module "mschap" returns noop for request 0

rlm_realm: No '@' in User-Name = "bob", looking up realm NULL

rlm_realm: No such realm "NULL"

modcall[authorize]: module "suffix" returns noop for request 0

rlm_eap: EAP packet type response id 210 length 8

rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

modcall[authorize]: module "eap" returns updated for request 0

users: Matched entry DEFAULT at line 152

modcall[authorize]: module "files" returns ok for request 0

modcall: leaving group authorize (returns updated) for request 0

rad_check_password: Found Auth-Type EAP

auth: type "EAP"

Processing the authenticate section of radiusd.conf

modcall: entering group authenticate for request 0

rlm_eap: EAP Identity

rlm_eap: processing type tls

rlm_eap_tls: Initiate

rlm_eap_tls: Start returned 1

modcall[authenticate]: module "eap" returns handled for request 0

modcall: leaving group authenticate (returns handled) for request 0

Sending Access-Challenge of id 96 to 127.0.0.1 port 32784

EAP-Message = 0x01d300061920

Message-Authenticator = 0x00000000000000000000000000000000

State = 0x961ec0665d9ea5b0b52bd317fce0153f

Finished request 0

Going to the next request

--- Walking the entire request list ---

Waking up in 6 seconds...

rad_recv: Access-Request packet from host 127.0.0.1:32784, id=100, length=81

User-Name = "bob"

NAS-IP-Address = 255.255.255.255

NAS-Port = 0

EAP-Message = 0x01d300061920

Message-Authenticator = 0xe723b1d886f4f0d4832289a61a4422be

State = 0x961ec0665d9ea5b0b52bd317fce0153f

Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 1

modcall[authorize]: module "preprocess" returns ok for request 1

modcall[authorize]: module "chap" returns noop for request 1

modcall[authorize]: module "mschap" returns noop for request 1

rlm_realm: No '@' in User-Name = "bob", looking up realm NULL 

rlm_realm: No such realm "NULL"

modcall[authorize]: module "suffix" returns noop for request 1

rlm_eap: EAP packet type request id 211 length 6

rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

modcall[authorize]: module "eap" returns updated for request 1

users: Matched entry DEFAULT at line 152

modcall[authorize]: module "files" returns ok for request 1

modcall: leaving group authorize (returns updated) for request 1

rad_check_password: Found Auth-Type EAP

auth: type "EAP"

Processing the authenticate section of radiusd.conf

modcall: entering group authenticate for request 1

rlm_eap: Request found, released from the list

rlm_eap: EAP/peap

rlm_eap: processing type peap

rlm_eap_peap: Authenticate

rlm_eap_tls: processing TLS

rlm_eap_tls: Received EAP-TLS ACK message

rlm_eap_tls: No SSL info available. Waiting for more SSL data.

eaptls_verify returned 1

eaptls_process returned 13

rlm_eap_peap: EAPTLS_HANDLED

modcall[authenticate]: module "eap" returns handled for request 1

modcall: leaving group authenticate (returns handled) for request 1

Sending Access-Challenge of id 100 to 127.0.0.1 port 32784

EAP-Message = 0x01d400061900

Message-Authenticator = 0x00000000000000000000000000000000

State = 0x29288ff34589baf19093dcf736f3cd81

Finished request 1

Going to the next request

Waking up in 6 seconds...

--- Walking the entire request list ---

Cleaning up request 0 ID 96 with timestamp 455b3a86

Cleaning up request 1 ID 100 with timestamp 455b3a86

Nothing to do. Sleeping until we see a request.

rad_recv: Access-Request packet from host 127.0.0.1:32784, id=110, length=65

User-Name = "bob"

NAS-IP-Address = 255.255.255.255

NAS-Port = 0

EAP-Message = 0x02d2000801626f62

Message-Authenticator = 0xafa588d86de1c2528a7603689764c229

Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 2

modcall[authorize]: module "preprocess" returns ok for request 2

modcall[authorize]: module "chap" returns noop for request 2

modcall[authorize]: module "mschap" returns noop for request 2

rlm_realm: No '@' in User-Name = "bob", looking up realm NULL

rlm_realm: No such realm "NULL" 

modcall[authorize]: module "suffix" returns noop for request 2

rlm_eap: EAP packet type response id 210 length 8

rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

modcall[authorize]: module "eap" returns updated for request 2

users: Matched entry DEFAULT at line 152

modcall[authorize]: module "files" returns ok for request 2

modcall: leaving group authorize (returns updated) for request 2

rad_check_password: Found Auth-Type EAP

auth: type "EAP"

Processing the authenticate section of radiusd.conf

modcall: entering group authenticate for request 2

rlm_eap: EAP Identity

rlm_eap: processing type tls

rlm_eap_tls: Initiate

rlm_eap_tls: Start returned 1

modcall[authenticate]: module "eap" returns handled for request 2

modcall: leaving group authenticate (returns handled) for request 2

Sending Access-Challenge of id 110 to 127.0.0.1 port 32784

EAP-Message = 0x01d300061920

Message-Authenticator = 0x00000000000000000000000000000000

State = 0xba5e3090ffba6d17056026182249b652

Finished request 2

Going to the next request

--- Walking the entire request list ---

Waking up in 6 seconds...

rad_recv: Access-Request packet from host 127.0.0.1:32784, id=114, length=81

User-Name = "bob"

NAS-IP-Address = 255.255.255.255

NAS-Port = 0

EAP-Message = 0x01d300061920

Message-Authenticator = 0x459c9b86c384f4196374ecd7a2f1a00b

State = 0xba5e3090ffba6d17056026182249b652

Processing the authorize section of radiusd.conf

modcall: entering group authorize for request 3

modcall[authorize]: module "preprocess" returns ok for request 3

modcall[authorize]: module "chap" returns noop for request 3

modcall[authorize]: module "mschap" returns noop for request 3

rlm_realm: No '@' in User-Name = "bob", looking up realm NULL

rlm_realm: No such realm "NULL"

modcall[authorize]: module "suffix" returns noop for request 3

rlm_eap: EAP packet type request id 211 length 6

rlm_eap: No EAP Start, assuming it's an on-going EAP conversation

modcall[authorize]: module "eap" returns updated for request 3

users: Matched entry DEFAULT at line 152

modcall[authorize]: module "files" returns ok for request 3

modcall: leaving group authorize (returns updated) for request 3

rad_check_password: Found Auth-Type EAP

auth: type "EAP"

Processing the authenticate section of radiusd.conf

modcall: entering group authenticate for request 3

rlm_eap: Request found, released from the list

rlm_eap: EAP/peap

rlm_eap: processing type peap

rlm_eap_peap: Authenticate

rlm_eap_tls: processing TLS

rlm_eap_tls: Received EAP-TLS ACK message

rlm_eap_tls: No SSL info available. Waiting for more SSL data.

eaptls_verify returned 1

eaptls_process returned 13

rlm_eap_peap: EAPTLS_HANDLED

modcall[authenticate]: module "eap" returns handled for request 3

modcall: leaving group authenticate (returns handled) for request 3

Sending Access-Challenge of id 114 to 127.0.0.1 port 32784

EAP-Message = 0x01d400061900

Message-Authenticator = 0x00000000000000000000000000000000

State = 0x1d3d57567289ab355dead22c39e84732

Finished request 3

Going to the next request

Waking up in 6 seconds...

--- Walking the entire request list ---

-------------------------------------------------

Can any one tell me how to pass the Client Hello message to the server , or in any other method i can get the TLS session established properly ? I tried to physically add these Client Hello into the reply paclet TLVs form the `radeapclient' side , but i could not find what attribute is  this `Client Hello' message

If any body can give me a input file  to `radeapclient' sample which passes these  `Client Hello'  , it will be of great help for me .

ya , one more doubt i have is , whether these `radeapclient'  a stateful or stateless program , i.e. its just for the testing purpose  ? or can be used as a real life radius client itself without adding aditional code into it.

Thanks in advance .

Regards , 

Shibu.P