On 09/09/2014 02:29 PM, freeradius-users-request(a)lists.freeradius.org
wrote:
>> Message: 1
>> Date: Tue, 09 Sep 2014 12:51:44 -0500
>> From: xxiao8 <xxiao8(a)fosiao.com>
>> To: freeradius-users(a)lists.freeradius.org
>> Subject: eapol_test works but not wpa_supplicant with wired interface
>> Message-ID: <540F3E30.50603(a)fosiao.com>
>> Content-Type: text/plain; charset=windows-1252; format=flowed
>>
>> Hello,
>>
>> I just set up freeradius 2.1.2(default) on debian and try to do
>> wpa_supplicant via wired interface to it. while eapol_test worked fine,
>> when wpa_supplicant is used on the freeradius server side I can never
>> see any incoming RADIUS packets(or any packets) at all.
>>
>> I'm running wpa_supplicant/eapol_test on a ubuntu 12.04 while the
>> freeradius is hosted on a VM/debian-wheezy in the same bridged network.
>>
>> Am I missing something basic? all logs are below.
>>
>> Thanks,
>> xxiao
>>
>> ==========config file used==================
>> $cat ttls-mschapv2.conf
>> ctrl_interface=/var/run/wpa_supplicant
>> ap_scan=0
>> fast_reauth=1
>> network={
>> key_mgmt=IEEE8021X
>> identity="bob"
>> password="hello"
>> eapol_flags=0
>> eap=TTLS
>> anonymous_identity="anonymous"
>> phase2="auth=MSCHAPV2"
>> }
>>
>> ===============eapol_test works====================
>> $sudo eapol_test -c ttls-mschapv2.conf -a192.168.1.132 -p1812
>> -stesting123 -r2
>> RADIUS packet matching with station
>> MS-MPPE-Send-Key (sign) - hexdump(len=32): 0e 41 0d 3b 24 75 5f 43 08 cc
>> 1c 63 c6 f8 21 d5 9c 2f f2 89 dd ab d9 d9 31 18 39 00 16 c3 92 86
>> MS-MPPE-Recv-Key (crypt) - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0
>> 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f
>> decapsulated EAP packet (code=3 id=6 len=4) from RADIUS server: EAP Success
>> EAPOL: Received EAP-Packet frame
>> EAPOL: SUPP_BE entering state REQUEST
>> EAPOL: getSuppRsp
>> EAP: EAP entering state RECEIVED
>> EAP: Received EAP-Success
>> EAP: Status notification: completion (param=success)
>> EAP: EAP entering state SUCCESS
>> CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
>> EAPOL: SUPP_PAE entering state AUTHENTICATED
>> EAPOL: SUPP_BE entering state RECEIVE
>> EAPOL: SUPP_BE entering state SUCCESS
>> EAPOL: SUPP_BE entering state IDLE
>> eapol_sm_cb: result=1
>> EAPOL: Successfully fetched key (len=32)
>> PMK from EAPOL - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58
>> 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f
>> No EAP-Key-Name received from server
>> EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit
>> ENGINE: engine deinit
>> MPPE keys OK: 3 mismatch: 0
>> SUCCESS
>>
>>
>> ======wpa_supplicant wired does not work===========
>> $ sudo wpa_supplicant -Dwired -ieth0 -cttls-mschapv2.conf -d
>> wpa_supplicant v2.2
>> random: Trying to read entropy from /dev/random
>> Successfully initialized wpa_supplicant
>> Initializing interface 'eth0' conf 'ttls-mschapv2.conf' driver 'wired'
>> ctrl_interface 'N/A' bridge 'N/A'
>> Configuration file 'ttls-mschapv2.conf' -> '/tmp/ttls-mschapv2.conf'
>> Reading configuration file '/tmp/ttls-mschapv2.conf'
>> ctrl_interface='/var/run/wpa_supplicant'
>> ap_scan=0
>> fast_reauth=1
>> Priority group 0
>> id=0 ssid=''
>> wpa_driver_wired_init: Added multicast membership with packet socket
>> Add interface eth0 to a new radio N/A
>> eth0: Own MAC address: 18:03:73:e0:ba:f1
>> eth0: RSN: flushing PMKID list in the driver
>> eth0: Setting scan request: 0.100000 sec
>> EAPOL: SUPP_PAE entering state DISCONNECTED
>> EAPOL: Supplicant port status: Unauthorized
>> EAPOL: KEY_RX entering state NO_KEY_RECEIVE
>> EAPOL: SUPP_BE entering state INITIALIZE
>> EAP: EAP entering state DISABLED
>> eth0: Added interface eth0
>> eth0: State: DISCONNECTED -> DISCONNECTED
>> random: Got 20/20 bytes from /dev/random
>> EAPOL: External notification - EAP success=0
>> EAPOL: External notification - EAP fail=0
>> EAPOL: External notification - portControl=Auto
>> eth0: Already associated with a configured network - generating
>> associated event
>> eth0: Event ASSOC (0) received
>> eth0: Association info event
>> eth0: State: DISCONNECTED -> ASSOCIATED
>> eth0: Associated to a new BSS: BSSID=01:80:c2:00:00:03
>> eth0: Select network based on association information
>> eth0: Network configuration found for the current AP
>> eth0: WPA: clearing AP WPA IE
>> eth0: WPA: clearing AP RSN IE
>> eth0: WPA: clearing own WPA/RSN IE
>> eth0: Failed to get scan results
>> EAPOL: External notification - EAP success=0
>> EAPOL: External notification - EAP fail=0
>> EAPOL: External notification - portControl=Auto
>> eth0: Associated with 01:80:c2:00:00:03
>> eth0: WPA: Association event - clear replay counter
>> eth0: WPA: Clear old PTK
>> EAPOL: External notification - portEnabled=0
>> EAPOL: External notification - portValid=0
>> EAPOL: External notification - portEnabled=1
>> EAPOL: SUPP_PAE entering state CONNECTING
>> EAPOL: SUPP_BE entering state IDLE
>> EAP: EAP entering state INITIALIZE
>> EAP: EAP entering state IDLE
>> eth0: Cancelling scan request
>> EAPOL: startWhen --> 0
>> EAPOL: SUPP_PAE entering state CONNECTING
>> EAPOL: txStart
>> TX EAPOL: dst=01:80:c2:00:00:03
>> EAPOL: startWhen --> 0
>> EAPOL: SUPP_PAE entering state CONNECTING
>> EAPOL: txStart
>> TX EAPOL: dst=01:80:c2:00:00:03
>> EAPOL: idleWhile --> 0
>> EAP: EAP entering state FAILURE
>> eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed
>> EAPOL: SUPP_PAE entering state AUTHENTICATING
>> EAPOL: SUPP_BE entering state FAIL
>> EAPOL: SUPP_PAE entering state HELD
>> EAPOL: Supplicant port status: Unauthorized
>> EAPOL: SUPP_BE entering state IDLE
>> EAPOL authentication completed - result=FAILURE
>> ^Ceth0: Removing interface eth0
>> eth0: Request to deauthenticate - bssid=01:80:c2:00:00:03
>> pending_bssid=00:00:00:00:00:00 reason=3 state=ASSOCIATED
>> eth0: Event DEAUTH (12) received
>> eth0: Deauthentication notification
>> eth0: * reason 3 (locally generated)
>> Deauthentication frame IE(s) - hexdump(len=0): [NULL]
>> eth0: CTRL-EVENT-DISCONNECTED bssid=01:80:c2:00:00:03 reason=3
>> locally_generated=1
>> eth0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="" auth_failures=1
>> duration=10 reason=AUTH_FAILED
>> eth0: Auto connect disabled: do not try to re-connect
>> eth0: Ignore connection failure indication since interface has been put
>> into disconnected state
>> eth0: State: ASSOCIATED -> DISCONNECTED
>> EAPOL: External notification - portEnabled=0
>> EAPOL: SUPP_PAE entering state DISCONNECTED
>> EAPOL: Supplicant port status: Unauthorized
>> EAPOL: SUPP_BE entering state INITIALIZE
>> EAP: EAP entering state DISABLED
>> EAPOL: External notification - portValid=0
>> eth0: State: DISCONNECTED -> DISCONNECTED
>> EAPOL: External notification - portEnabled=0
>> EAPOL: External notification - portValid=0
>> eth0: Cancelling scan request
>> eth0: Cancelling authentication timeout
>> Remove interface eth0 from radio
>> Remove radio
>> eth0: CTRL-EVENT-TERMINATING
>>
>>
>>
>> Message: 3
>> Date: Tue, 9 Sep 2014 18:18:00 +0000
>> From: A.L.M.Buxey(a)lboro.ac.uk
>> To: FreeRadius users mailing list
>> <freeradius-users(a)lists.freeradius.org>
>> Subject: Re: eapol_test works but not wpa_supplicant with wired
>> interface
>> Message-ID: <20140909181800.GD12554(a)lboro.ac.uk>
>> Content-Type: text/plain; charset=us-ascii
>>
>> hi,
>>
>>
>> you need to look at your freeradius server in debug mode to see whats going on...and
>> verify that the packets are being received by the server (eg by using 'tcpdump' tool or such
>> looking for udp port 1812). you also need to eg check your freeradius server to ensure
>> that the firewall isnt blocking said UDP 1812 port (eapol_test locally bypasses this....)
>> and finally you need to verify your switch that you are doing 802.1X on to ensure that its
>> sending auths to the right box...you should be able to do debug on the switch too....
>>
>> alan
>>
>>
>> ------------------------------
>>
> Yes I did run freeradius -X -f and it receives lots of info from
> eapol_test successfully, when I ran wpa_supplicant as described above I
> received nothing at all either over 'freeradius -X -f' or from
> 'tcpdump', it's like somehow wpa_supplicant is not sending out anything
> to the multicast MAC? I made sure iptable is fully disabled, plus
> eapol_test is running from the same machine where I ran
> wpa_supplicant(non-localhost that is).
>
> Thanks!
> xxiao
>
>
I forgot to mention that I'm running against freeradius directly, from a
Linux PC on the local LAN, so there is no switch involved at all, could
this be a problem? can WPA_SUPPLICANT talk with freeradius _directly_?
Thanks,
xxiao
