VintageNet with Wired 802.1x under Nerves

BOOM!

Quick note. It works:

{:ok, engine} = NervesKey.PKCS11.load_engine()
{:ok, i2c} = ATECC508A.Transport.I2C.init([])

signer_cert = X509.Certificate.to_der(NervesKey.signer_cert(i2c))
cert = X509.Certificate.to_der(NervesKey.device_cert(i2c))
%{key_id: uri} = NervesKey.PKCS11.private_key(engine, {:i2c, 1})
File.write("/tmp/client_cert.der", cert)
File.write("/tmp/ca_cert.der", signer_cert)

path = Path.join(Application.app_dir(:nerves_key_pkcs11), "priv/nerves_key_pkcs11.so")
VintageNet.configure("eth0", %{
       type: VintageNetEthernet,
       ipv4: %{method: :dhcp},
       vintage_net_ethernet: %{
        wpa_supplicant_conf: """
        pkcs11_engine_path=/usr/lib/engines/libpkcs11.so
        pkcs11_module_path=#{path}
        network={
          key_mgmt=WPA-EAP
          identity="User"
          eap=TLS
          eapol_flags=3
          client_cert="/tmp/client_cert.der"
          private_key="#{uri}"
        }
        """
       }
     })

Skip ca_cert to avoid CA verification unless you are doing more CA-related stuff and it matters to you. If it matters, add your signer cert to your CA list. Should not be hard.

On the freeradius side (what I tested against). I only really had to replace the ca cert in freeradius with the signer cert and then also add the signer cert to my system CA list so that it was in the root of trust or whatever that’s called.

Will post updates require on the system as well as the forked vintage_net stuff that will later need to be integrated. I did this on nerves_system_rpi3 but it should work on any.

Using those forks of VintageNet I’ve had no real issue doing PEAP-MSCHAPv2 over ethernet.

Not my goal.

I want EAP-TLS using NervesKey.

Last run gave some promising results:

{:ok, engine} = NervesKey.PKCS11.load_engine()
{:ok, i2c} = ATECC508A.Transport.I2C.init([])

signer_cert = X509.Certificate.to_der(NervesKey.signer_cert(i2c))
cert = X509.Certificate.to_der(NervesKey.device_cert(i2c))
%{key_id: uri} = NervesKey.PKCS11.private_key(engine, {:i2c, 1})
File.write("/tmp/client_cert.der", cert)
File.write("/tmp/ca_cert.der", signer_cert)

path = Path.join(Application.app_dir(:nerves_key_pkcs11), "priv/nerves_key_pkcs11.so")
VintageNet.configure("eth0", %{
       type: VintageNetEthernet,
       ipv4: %{method: :dhcp},
       vintage_net_ethernet: %{
        wpa_supplicant_conf: """
        pkcs11_module_path="#{path}"
        network={
          key_mgmt=WPA-EAP
          identity="User"
          eap=TLS
          eapol_flags=3
          ca_cert="/tmp/ca_cert.der"
          client_cert="/tmp/client_cert.der"
          private_key="#{uri}"
        }
        """
       }
     })

The wrinkle is that OpenSSL doesn’t seem to have engine support compiled in (curious how Erlang does that differently) so I need to add something to Buildroot:

BR2_PACKAGE_OPENSSL_ENGINES=y

in nerves_defconfig is my theory.

The log was wildly misleading. The big read error seems irrelevant and is probably due to negotiations breaking down somehow. The real stuff is about failing to load and missing engine support by SSL and TLS higher up.

14:14:44.705 [debug] wpa_supplicant: eth0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13

14:14:44.706 [debug] WPASupplicant ignoring {:event, "CTRL-EVENT-EAP-PROPOSED-METHOD", %{"method" => "13", "vendor" => "0"}}

14:14:44.707 [debug] wpa_supplicant: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:05800088:x509 certificate routines::no certificate or crl found

14:14:44.712 [debug] wpa_supplicant: SSL: Configuration uses engine, but engine support was not compiled in

14:14:44.712 [debug] wpa_supplicant: TLS: Failed to load private key

14:14:44.712 [debug] wpa_supplicant: TLS: Failed to set TLS connection parameters

14:14:44.712 [debug] wpa_supplicant: EAP-TLS: Failed to initialize SSL.

14:14:44.713 [debug] wpa_supplicant: eth0: CTRL-REQ-PASSPHRASE-0:Private key passphrase needed for SSID 

14:14:44.713 [debug] wpa_supplicant: eth0: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)

14:14:44.715 [debug] WPASupplicant ignoring {:event, "CTRL-EVENT-EAP-STATUS", %{"parameter" => "PASSPHRASE", "status" => "eap parameter needed"}}

14:14:44.715 [error] GenServer {VintageNet.Interface.Registry, {VintageNetSupplicant.WPASupplicant, "eth0"}} terminating
** (MatchError) no match of right hand side value: ["PASSPHRASE", "0:Private key passphrase needed for SSID "]
    (vintage_net_supplicant 0.1.0) lib/vintage_net_supplicant/wpa_supplicant_decoder.ex:18: VintageNetSupplicant.WPASupplicantDecoder.decode_notification/1
    (vintage_net_supplicant 0.1.0) lib/vintage_net_supplicant/wpa_supplicant.ex:247: VintageNetSupplicant.WPASupplicant.handle_info/2
    (stdlib 5.2.3) gen_server.erl:1095: :gen_server.try_handle_info/3
    (stdlib 5.2.3) gen_server.erl:1183: :gen_server.handle_msg/6
    (stdlib 5.2.3) proc_lib.erl:241: :proc_lib.init_p_do_apply/3
Last message: {VintageNetSupplicant.WPASupplicantLL, 3, "CTRL-REQ-PASSPHRASE-0:Private key passphrase needed for SSID "}
State: %{driver: "wired", verbose: false, ll: #PID<0.12619.0>, ifname: "eth0", clients: [], access_points: %{}, peers: [], control_dir: "/tmp/vintage_net/wpa_supplicant", ap_mode: false, keep_alive_interval: 60000, wpa_supplicant: "wpa_supplicant", wpa_supplicant_conf_path: "/tmp/vintage_net/wpa_supplicant.conf.eth0", bssid_requester: #PID<0.12620.0>, current_ap: nil, eap_status: %VintageNet.Interface.EAPStatus{status: :started, method: "TLS", timestamp: ~U[2024-08-28 14:14:44.706670Z], remote_certificate_verified?: false}}

@fhunleth the separate supplicant library we discussed is taking shape here: GitHub - underjord/vintage_net_supplicant: Vintage Net Supplicant · GitHub

We are not 100% certain about the dividing line between Supplicant and WiFi libraries. Currently we brought a lot of WiFi-stuff over to the Supplicant library, because that worked and it all seemed relevant to the supplicant’s work. But much of it is pointless for the Supplicant under Ethernet. I think that’s fine but let us know what you think.

Plenty of tidying up before you get PRs for WiFi, Ethernet and we consider the Supplicant library ready to move over into the nerves-networking org but it is on it’s way.

It worked!