-
-
Notifications
You must be signed in to change notification settings - Fork 11k
Description
It looks like something in OpenSSL 1.1.1-pre1 broke EAP-FAST support. SSL_connect() is now failing on the client side when trying to prepare ClientHello (debug logs from wpa_supplicant):
EAP-FAST: No PAC found - starting provisioning
EAP-FAST: Enabling authenticated provisioning TLS cipher suites
OpenSSL: cipher suites: DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA:RC4-SHA
SSL: (where=0x10 ret=0x1)
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:before SSL initialization
OpenSSL: TX ver=0x0 content_type=256 (TLS header info/)
OpenSSL: Message - hexdump(len=5): 15 03 01 00 02
OpenSSL: TX ver=0x304 content_type=21 (alert/)
OpenSSL: Message - hexdump(len=2): 02 50
SSL: (where=0x4008 ret=0x250)
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:internal error
EAP: Status notification: local TLS alert (param=internal error)
SSL: (where=0x1002 ret=0xffffffff)
SSL: SSL_connect:error in error
OpenSSL: openssl_handshake - SSL_connect error:141A90B5:SSL routines:ssl_cipher_list_to_bytes:no ciphers available
This is what this looks like in a successful run (from a build with OpenSSL 1.1.0f):
EAP-FAST: No PAC found - starting provisioning
EAP-FAST: Enabling authenticated provisioning TLS cipher suites
OpenSSL: cipher suites: DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA:RC4-SHA
SSL: (where=0x10 ret=0x1)
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:before SSL initialization
OpenSSL: TX ver=0x0 content_type=256 (TLS header info/)
OpenSSL: Message - hexdump(len=5): 16 03 01 00 63
OpenSSL: TX ver=0x303 content_type=22 (handshake/client hello)
OpenSSL: Message - hexdump(len=99): 01 00 00 5f 03 03 0d 86 19 ca 1e 86 c9 9c ee 4e 8e ab 67 4c 13 0d 13 ec 0d 70 78 49 4e 8e c2 76 74 47 85 e1 40 4d 00 00 0a 00 39 00 33 00 35 00 2f 00 ff 01 00 00 2c 00 0d 00 20 00 1e 06 01 06 02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03 01 03 02 03 03 02 01 02 02 02 03 00 16 00 00 00 17 00 00
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3/TLS write client hello
SSL: (where=0x1002 ret=0xffffffff)
SSL: SSL_connect:error in SSLv3/TLS write client hello
SSL: SSL_connect - want more data