-
Notifications
You must be signed in to change notification settings - Fork 7.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
WPA Enterprise fails when server sends TLS message with multiple records (IDFGH-5702) #7422
Labels
Comments
I just confirmed that e8360fe solved the issue. |
@NorbertoNorbs Thanks for sharing the updates. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Problem Description
When connecting to a WPA Enterprise network that authenticates using NPS running in Windows server 2016 the association fails after the ESP receives and parses the ServerHello message, the windows NPS log shows error 262 'The supplied message is incomplete. The signature was not verified.'.
I'm using PEAP/MSCHAPv2 but as far as I can tell this problem can happen in other environments/authentication methods too, since this appears to be a issue in the TLS message exchange (I found a fix that I'll describe further below).
What I found is that when the server sends a single TLS message with multiple records the ESP only process the first one.
In my case the server is sending the ServerHello and the Certificate in the same message, the ESP parses the ServeHello but fails to read the certificate and reply with a ack (The message 'application data is null, adding one byte for ack' is shown in the console) but the server ends the connection since is already sent what it was supposed to.
I narrowed the problem to the function tls_connection_handshake in .\components\wpa_supplicant\src\crypto\tls_mbedtls.c:
I fixed the problem by adding the condition of 'is there more records to be read?' in the while loop:
I don't know if this is the best solution, but it may help others while the developers check this issue (I was in a tight spot with a costumer so I spent some long hours trying to debug this, I'm no wpa supplicant specialist so may be there's more to it, but at least it's working for now).
How to reproduce
I'm using the Windows NPS as the RADIUS in a fresh installed Windows 2016 server with a self-signed certificate, my route is a simple TP-Link TL-WR940N that supports WPA Enterprise (I have the same problem with a costumer that uses a Cisco router).
To validate the setup I connected to this network using Ubuntu in a notebook.
The wpa_enterprise idf example was used, I set the SSID, ID, Username and password fields, 'validate server' is disabled.
Debug Logs
I'm attaching 2 debug logs as a reference: The first is the error I get using the idf as is, and the other connecting with success after applying the fix.
esp32 wpa error.txt
esp32 wpa success.txt
The text was updated successfully, but these errors were encountered: