<div dir="ltr"><div>Hi Heikki,</div><div><br></div><div>We are using the "EAPTLS_Protocols TLSv1.3" currently in all of our AuthBy's for good measure. However, the TLS handshake appears to not use TLSv1.3 outbound for the establishment, and instead tries TLSv1.2 which fails. </div><div>See these two debug lines:</div><div>DEBUG: AuthSQL EAP-TTLS TLS handshake: Direction<b> IN, Version: TLS 1.3</b>, Record content: (22) Handshake, message type: (1) ClientHello<br style="font-size:12px">DEBUG: AuthSQL EAP-TTLS TLS handshake: Direction <b>OUT, Version: TLS 1.2</b>, Record content: (21) Alert, level: (2) fatal, description: (70) protocol version<br class="gmail-Apple-interchange-newline" style="color:rgb(0,0,0)"></div><div><br></div><div>Ideas?</div><div><br></div><div>Cassidy</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Oct 24, 2022 at 3:36 AM Heikki Vatiainen via radiator <<a href="mailto:radiator@lists.open.com.au">radiator@lists.open.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">On 22.10.2022 0.15, Dubravko Penezic via radiator wrote:<br>
<br>
> from my experience you have two options :<br>
> * set system SSL library to work only wit TLS v1.3<br>
> * set RADIATOR configuration to accept only TLS v1.3 by setting <br>
> TLS_Protocols to TLSv1.3<br>
<br>
I would the latter and put this to Radiator configuration under the <br>
AuthBy that terminates EAP-TTLS tunnel:<br>
<br>
<AuthBy ...><br>
# To support both TLSv1.2 and 1.3<br>
#EAPTLS_Protocols TLSv1.2, TLSv1.3<br>
<br>
# To support just TLSv1.3<br>
EAPTLS_Protocols TLSv1.3<br>
<br>
TLS_Protocols controls RadSec, Diameter and other non-EAP protocols. <br>
It's a config option, but not for EAP.<br>
<br>
> Also be aware that from many recent reports client which declare that <br>
> work only with TLS v1.3 doesnt do that on correct way or not work at all <br>
> with v1.3.<br>
<br>
EAP-TTLS is currently set in Radiator 4.26-24 and other 4.26-nn versions <br>
so that session resumption is disabled. The reasons is for this is that <br>
EAP-TTLS/PAP (and non-EAP CHAP variants) did not work with all EAP-TTLS <br>
implementations. The reason is how session resumption is done and is one <br>
example not fully all clients fully working.<br>
<br>
For more information see discussion related to document <br>
draft-ietf-emu-tls-eap-types that has been ongoing this year on the <br>
IETF's EAP Method Update (EMU) mailing list:<br>
<br>
<a href="https://www.ietf.org/mailman/listinfo/emu" rel="noreferrer" target="_blank">https://www.ietf.org/mailman/listinfo/emu</a><br>
<br>
The next Radiator release supports TLSv1.3 for RadSec and has been <br>
updated for EAP-TLS, EAP-TTLS and PEAP with TLSv1.3. There could still <br>
be some work-arounds enabled, such as disabled session resumption, but <br>
full authentication should work fine for the said EAP methods.<br>
<br>
Thanks,<br>
Heikki<br>
<br>
<br>
> Regards,<br>
> Dubravko Penezic<br>
> Srce<br>
> <br>
> On 10/21/22 22:54, Cassidy B. Larson via radiator wrote:<br>
>> More specifically, here's the debug output:<br>
>><br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL Handling EAP type 1 <br>
>> (Identity), code: 2 (Response), identifier: 191, length: 20<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Initialised SSL library: Net::SSLeay <br>
>> 1.92, OpenSSL 1.1.1o-freebsd 3 May 2022<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x9 (9) for Net::SSLeay <br>
>> constant ERROR_WANT_ASYNC<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0xa (10) for Net::SSLeay <br>
>> constant ERROR_WANT_ASYNC_JOB<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0xb (11) for Net::SSLeay <br>
>> constant ERROR_WANT_CLIENT_HELLO_CB<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0xc (12) for Net::SSLeay <br>
>> constant ERROR_WANT_RETRY_VERIFY<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x8 (8) for Net::SSLeay <br>
>> constant SSL2_MT_CLIENT_CERTIFICATE<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x3 (3) for Net::SSLeay <br>
>> constant SSL2_MT_CLIENT_FINISHED<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x2 (2) for Net::SSLeay <br>
>> constant SSL2_MT_CLIENT_MASTER_KEY<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x0 (0) for Net::SSLeay <br>
>> constant SSL2_MT_ERROR<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x6 (6) for Net::SSLeay <br>
>> constant SSL2_MT_REQUEST_CERTIFICATE<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x6 (6) for Net::SSLeay <br>
>> constant SSL2_MT_SERVER_FINISHED<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x4 (4) for Net::SSLeay <br>
>> constant SSL2_MT_SERVER_HELLO<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x5 (5) for Net::SSLeay <br>
>> constant SSL2_MT_SERVER_VERIFY<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x2 (2) for Net::SSLeay <br>
>> constant TLSEXT_ERR_ALERT_FATAL<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x1 (1) for Net::SSLeay <br>
>> constant TLSEXT_ERR_ALERT_WARNING<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x3 (3) for Net::SSLeay <br>
>> constant TLSEXT_ERR_NOACK<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: TLS: Using 0x0 (0) for Net::SSLeay <br>
>> constant TLSEXT_ERR_OK<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL setting TLS protocols to: <br>
>> TLSv1.3<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL setting EAPTLS_Ciphers to: <br>
>> DEFAULT:!EXPORT:!LOW@SECLEVEL=1<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: EAP result: 3, EAP-TTLS Challenge<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Radius::AuthGROUP: result: <br>
>> CHALLENGE, EAP-TTLS Challenge<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthBy GROUP result: CHALLENGE, <br>
>> EAP-TTLS Challenge<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Access challenged for <....>: <br>
>> EAP-TTLS Challenge<br>
>><br>
>><br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Handling with Radius::AuthGROUP:<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Handling with AuthSQL<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Handling with Radius::AuthSQL:<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL Handling EAP type 21 (TTLS), <br>
>> code: 2 (Response), identifier: 192, length: 196<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS state: before <br>
>> SSL initialization<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS state: before <br>
>> SSL initialization<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS state: before <br>
>> SSL initialization<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS handshake: <br>
>> Direction IN, Version: TLS 1.3, Record content: (22) Handshake, <br>
>> message type: (1) ClientHello<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS handshake: <br>
>> Direction OUT, Version: TLS 1.2, Record content: (21) Alert, level: <br>
>> (2) fatal, description: (70) protocol version<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS state: error<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS TLS state: error<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP-TTLS SSL_accept result: <br>
>> -1, reason/error: 'SSL_ERROR_SSL, state: 'error'<br>
>> Fri Oct 21 14:52:17 2022: ERR: AuthSQL EAP-TTLS TLS Handshake error: <br>
>> result: -1, reason/error: 'SSL_ERROR_SSL', state: 'error', <br>
>> error:14209102:SSL <br>
>> routines:tls_early_post_process_client_hello:unsupported protocol<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthSQL EAP Failure, elapsed time <br>
>> 0.050957<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: EAP result: 1, EAP-TTLS TLS Handshake <br>
>> error: unsupported protocol<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: Radius::AuthGROUP: result: REJECT, <br>
>> EAP-TTLS TLS Handshake error: unsupported protocol<br>
>> Fri Oct 21 14:52:17 2022: DEBUG: AuthBy GROUP result: REJECT, EAP-TTLS <br>
>> TLS Handshake error: unsupported protocol<br>
>> Fri Oct 21 14:52:17 2022: INFO: Access rejected for 888901007406545: <br>
>> EAP-TTLS TLS Handshake error: unsupported protocol<br>
>><br>
>> We're running OpenSSL 1.1.1o and Net:SSLeay 1.92 as detailed above.<br>
>><br>
>><br>
>> On Fri, Oct 21, 2022 at 1:39 PM Cassidy B. Larson <<a href="mailto:alandaluz@gmail.com" target="_blank">alandaluz@gmail.com</a> <br>
>> <mailto:<a href="mailto:alandaluz@gmail.com" target="_blank">alandaluz@gmail.com</a>>> wrote:<br>
>><br>
>> We're spinning up a new EAP-TTLS source. Installed latest dev of<br>
>> 4.26-24. When I force EAP_TLS_Protocols to TLSv1.3 alone, I see the<br>
>> TLSv1.3 handshake request come in, but outbound handshake is<br>
>> TLSv1.2. Apparently our vendor only allows TLSv1.3 right now.<br>
>><br>
>> Any ideas how to get outbound handshakes to use TLSv1.3?<br>
>><br>
>> Fri Oct 21 13:30:12 2022: DEBUG: AuthSQL EAP-TTLS TLS handshake:<br>
>> Direction IN, Version: TLS 1.3, Record content: (22) Handshake,<br>
>> message type: (1) ClientHello Fri Oct 21 13:30:12 2022: DEBUG:<br>
>> AuthSQL EAP-TTLS TLS handshake: Direction OUT, Version: TLS 1.2,<br>
>> Record content: (21) Alert, level: (2) fatal, description: (70)<br>
>> protocol version<br>
>><br>
>><br>
>> Thanks!<br>
>><br>
>> -c<br>
>><br>
>><br>
>> _______________________________________________<br>
>> radiator mailing list<br>
>> <a href="mailto:radiator@lists.open.com.au" target="_blank">radiator@lists.open.com.au</a><br>
>> <a href="https://lists.open.com.au/mailman/listinfo/radiator" rel="noreferrer" target="_blank">https://lists.open.com.au/mailman/listinfo/radiator</a><br>
> _______________________________________________<br>
> radiator mailing list<br>
> <a href="mailto:radiator@lists.open.com.au" target="_blank">radiator@lists.open.com.au</a><br>
> <a href="https://lists.open.com.au/mailman/listinfo/radiator" rel="noreferrer" target="_blank">https://lists.open.com.au/mailman/listinfo/radiator</a><br>
<br>
-- <br>
Heikki Vatiainen<br>
OSC, makers of Radiator<br>
Visit <a href="http://radiatorsoftware.com" rel="noreferrer" target="_blank">radiatorsoftware.com</a> for Radiator AAA server software<br>
_______________________________________________<br>
radiator mailing list<br>
<a href="mailto:radiator@lists.open.com.au" target="_blank">radiator@lists.open.com.au</a><br>
<a href="https://lists.open.com.au/mailman/listinfo/radiator" rel="noreferrer" target="_blank">https://lists.open.com.au/mailman/listinfo/radiator</a></blockquote></div></div>