Unable to connect to eduroam

From: Michael Yartys <mail@yartys.no>
To: "iwd@lists.linux.dev" <iwd@lists.linux.dev>
Subject: Unable to connect to eduroam
Date: Fri, 23 Feb 2024 14:25:32 +0000	[thread overview]
Message-ID: <njvxKaPo_CBxsQGaNSRHj8xOSxzk1_j_K-minIe4GCKUMB1qxJT8nPk9SGmfqg7Aepm_5dO7FEofYIYP1g15R9V5dJ0F8bN6O4VthSjzu1g=@yartys.no> (raw)

Hi

I'm running iwd 2.14 on Fedora 39 Silverblue with kernel version 6.7.5-200.fc39.x86_64, and I've been having issues for the last two weeks or so connecting to my university eduroam network. What happens is that I get an internal error that causes the connection attempt to fail with eapFail. Here's the log output with TLS debugging enabled:

Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_tx_handshake:1244 Sending a TLS_CLIENT_HELLO of 140 bytes
Feb 23 14:35:55 localhost iwd[1233]: TTLS: l_tls_start:3610 New state TLS_HANDSHAKE_WAIT_HELLO
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_handshake:3074 Handling a TLS_SERVER_HELLO of 45 bytes
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_server_hello:2419 Negotiated TLS 1.2
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_server_hello:2455 Negotiated TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_server_hello:2466 Negotiated CompressionMethod.null
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_server_hello:2492 New state TLS_HANDSHAKE_WAIT_CERTIFICATE
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_handshake:3074 Handling a TLS_CERTIFICATE of 2126 bytes
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_certificate:2562 Peer certchain written to /tmp/iwd-tls-debug-server-cert.pem
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_handle_certificate:2673 Disconnect desc=internal_error local-desc=close_notify reason=Can't l_key_get_info for peer public key
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_send_alert:1175 Sending a Fatal Alert: internal_error
Feb 23 14:35:55 localhost iwd[1233]: TTLS: tls_reset_handshake:195 New state TLS_HANDSHAKE_WAIT_START
Feb 23 14:35:55 localhost iwd[1233]: TTLS: Tunnel has disconnected with alert: internal_error
Feb 23 14:35:56 localhost iwd[1233]: EAP completed with eapFail
Feb 23 14:35:56 localhost iwd[1233]: TTLS: tls_reset_handshake:195 New state TLS_HANDSHAKE_WAIT_START
Feb 23 14:35:56 localhost iwd[1233]: TTLS: tls_reset_handshake:195 New state TLS_HANDSHAKE_WAIT_START
Feb 23 14:35:56 localhost iwd[1233]: 4-Way handshake failed for ifindex: 4, reason: 23

Here is the associated dumped peer certchain:

I'm sure these certificates are correct because I was able to roll back to a working build on Fedora Silverblue to keep connecting to the network. Unfortunately, I was dumb enough to forget to pin/freeze that working build to prevent it from being replaced by new versions as I continually updated the system.

I searched a bit around and found that some other folks had experienced the same issue on Arch: https://bbs.archlinux.org/viewtopic.php?id=291921

That thread links to another thread about the deprecation of SHA-1 in the kernel: https://bbs.archlinux.org/viewtopic.php?id=292208

rochus from the first thread was able to connect to their eduroam network when they tried a kernel with the offending commit reverted. Now, I know very little about certificates, but no certificates in my cert chain are SHA-1 signed, are they? Could this still be related to the issue I'm experiencing?

Michael