{"action":"created","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/5359","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/5359/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/5359/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/5359/events","html_url":"https://github.com/openssl/openssl/issues/5359","id":296893398,"number":5359,"title":"EAP-FAST failing in generation of ClientHello with 1.1.1-pre1","user":{"login":"jmalinen","id":5983923,"avatar_url":"https://avatars0.githubusercontent.com/u/5983923?v=4","gravatar_id":"","url":"https://api.github.com/users/jmalinen","html_url":"https://github.com/jmalinen","followers_url":"https://api.github.com/users/jmalinen/followers","following_url":"https://api.github.com/users/jmalinen/following{/other_user}","gists_url":"https://api.github.com/users/jmalinen/gists{/gist_id}","starred_url":"https://api.github.com/users/jmalinen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmalinen/subscriptions","organizations_url":"https://api.github.com/users/jmalinen/orgs","repos_url":"https://api.github.com/users/jmalinen/repos","events_url":"https://api.github.com/users/jmalinen/events{/privacy}","received_events_url":"https://api.github.com/users/jmalinen/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2018-02-13T21:34:47Z","updated_at":"2018-02-14T18:14:21Z","closed_at":null,"author_association":"NONE","body":"It looks like something in OpenSSL 1.1.1-pre1 broke EAP-FAST support. SSL_connect() is now failing on the client side when trying to prepare ClientHello (debug logs from wpa_supplicant):\r\n\r\nEAP-FAST: No PAC found - starting provisioning\r\nEAP-FAST: Enabling authenticated provisioning TLS cipher suites\r\nOpenSSL: cipher suites: DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA:RC4-SHA\r\nSSL: (where=0x10 ret=0x1)\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:before SSL initialization\r\nOpenSSL: TX ver=0x0 content_type=256 (TLS header info/)\r\nOpenSSL: Message - hexdump(len=5): 15 03 01 00 02\r\nOpenSSL: TX ver=0x304 content_type=21 (alert/)\r\nOpenSSL: Message - hexdump(len=2): 02 50\r\nSSL: (where=0x4008 ret=0x250)\r\nSSL: SSL3 alert: write (local SSL3 detected an error):fatal:internal error\r\nEAP: Status notification: local TLS alert (param=internal error)\r\nSSL: (where=0x1002 ret=0xffffffff)\r\nSSL: SSL_connect:error in error\r\nOpenSSL: openssl_handshake - SSL_connect error:141A90B5:SSL routines:ssl_cipher_list_to_bytes:no ciphers available\r\n\r\n\r\nThis is what this looks like in a successful run (from a build with OpenSSL 1.1.0f):\r\n\r\nEAP-FAST: No PAC found - starting provisioning\r\nEAP-FAST: Enabling authenticated provisioning TLS cipher suites\r\nOpenSSL: cipher suites: DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:AES256-SHA:AES128-SHA:RC4-SHA\r\nSSL: (where=0x10 ret=0x1)\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:before SSL initialization\r\nOpenSSL: TX ver=0x0 content_type=256 (TLS header info/)\r\nOpenSSL: Message - hexdump(len=5): 16 03 01 00 63\r\nOpenSSL: TX ver=0x303 content_type=22 (handshake/client hello)\r\nOpenSSL: Message - hexdump(len=99): 01 00 00 5f 03 03 0d 86 19 ca 1e 86 c9 9c ee 4e 8e ab 67 4c 13 0d 13 ec 0d 70 78 49 4e 8e c2 76 74 47 85 e1 40 4d 00 00 0a 00 39 00 33 00 35 00 2f 00 ff 01 00 00 2c 00 0d 00 20 00 1e 06 01 06 02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03 01 03 02 03 03 02 01 02 02 02 03 00 16 00 00 00 17 00 00\r\nSSL: (where=0x1001 ret=0x1)\r\nSSL: SSL_connect:SSLv3/TLS write client hello\r\nSSL: (where=0x1002 ret=0xffffffff)\r\nSSL: SSL_connect:error in SSLv3/TLS write client hello\r\nSSL: SSL_connect - want more data\r\n"},"comment":{"url":"https://api.github.com/repos/openssl/openssl/issues/comments/365696262","html_url":"https://github.com/openssl/openssl/issues/5359#issuecomment-365696262","issue_url":"https://api.github.com/repos/openssl/openssl/issues/5359","id":365696262,"user":{"login":"davidben","id":109690,"avatar_url":"https://avatars0.githubusercontent.com/u/109690?v=4","gravatar_id":"","url":"https://api.github.com/users/davidben","html_url":"https://github.com/davidben","followers_url":"https://api.github.com/users/davidben/followers","following_url":"https://api.github.com/users/davidben/following{/other_user}","gists_url":"https://api.github.com/users/davidben/gists{/gist_id}","starred_url":"https://api.github.com/users/davidben/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidben/subscriptions","organizations_url":"https://api.github.com/users/davidben/orgs","repos_url":"https://api.github.com/users/davidben/repos","events_url":"https://api.github.com/users/davidben/events{/privacy}","received_events_url":"https://api.github.com/users/davidben/received_events","type":"User","site_admin":false},"created_at":"2018-02-14T18:14:21Z","updated_at":"2018-02-14T18:14:21Z","author_association":"CONTRIBUTOR","body":"Why is option 4 not feasible for a dot-dot release? It seems the most compatible option. Compatibility dictates that adding new capabilities (TLS 1.3 ciphers) is generally okay, but changing the semantics of existing ones (cipher configs that, to date, never precluded a higher TLS version) is questionable. Our deployment experience suggested this was the most compatible approach.\r\n\r\nThe root cause is that TLS 1.3 is the first time that ciphers have been removed in a version of TLS, and so by whitelisting TLS versions, you implicitly whitelist future newer TLS versions that your library may add. If you recall way back when the cipher suite negotiation was being revised from weirdly repurposing TLS 1.2 ciphers (PSK in particular) to new bespoke ones, this was a big part of the motivation. By separating them completely, it becomes much easier to consider them orthogonal, which was the cleanest way to deal with this issue.\r\n\r\n(Re TLS 1.2: TLS 1.2 will likely be around for some time, for practical purposes, just as other legacy TLS settings are still around. That's how deployments work. The old things take a long time to fall off the conveyor belt. The immediate corollary here is downgrade protection is absolutely critical, which is why we've been so pushy about not adding another client fallback.)"}}
{"actor":{"display_login":"davidben"}}