EAP-TLS patch for pppd

Home

Download

Documentation

Download

eap-tls patches for pppd 2.4.8

eaptls-mppe-1.301.patch
- Fix PKCS#11 support by providing method to pass password/PIN to the PKCS#11 backend.
- Fix bug to allow loading of password protected private keys again.
- Fix (minor) gcc9 compiler warnings.
eaptls-mppe-1.300.patch
- Add (experimental) TLSv1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and requires OpenSSL 1.1.1+ to be effective.
- Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use (defaults to TLSv1.2 for now - so to use TLSv1.3 you need to explicitly add 'max-tls-version 1.3')
- First version for ppp-2.4.8.
eaptls-mppe-1.202.patch
- Fix PKCS#11 support by providing method to pass password/PIN to the PKCS#11 backend.
- Fix bug to allow loading of password protected private keys again.
- Fix (minor) gcc9 compiler warnings.
eaptls-mppe-1.201.patch
- Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation.
- First version for ppp-2.4.8.

eap-tls patches for pppd 2.4.7

eaptls-mppe-1.301.patch
- Fix PKCS#11 support by providing method to pass password/PIN to the PKCS#11 backend.
- Fix bug to allow loading of password protected private keys again.
- Fix (minor) gcc9 compiler warnings.
eaptls-mppe-1.300.patch
- Add (experimental) TLSv1.3 support. This is based on draft-ietf-emu-eap-tls13-05 (expired) and requires OpenSSL 1.1.1+ to be effective.
- Add new option 'max-tls-version' to specify the highest version of the TLS protocol to use (defaults to TLSv1.2 for now - so to use TLSv1.3 you need to explicitly add 'max-tls-version 1.3')
eaptls-mppe-1.202.patch
- Fix PKCS#11 support by providing method to pass password/PIN to the PKCS#11 backend.
- Fix bug to allow loading of password protected private keys again.
- Fix (minor) gcc9 compiler warnings.
eaptls-mppe-1.201.patch
- Force use of TLSv1.2 even if TLSv1.3 is available (with OpenSSL 1.1.1+). This ensures that you can compile and link against OpenSSL 1.1.1+ without breaking the TLS negotiation.
eaptls-mppe-1.200.patch
- First version of patch that was used to create a github PR against the main ppp code base.
- Added client-side 'capath' option to allow a directory with trusted CA certificates.
- Added compile-time Makefile option to have pppd use either the internal MD5+SHA1 functions or use the ones supplied by OpenSSL.
- Code now also builds on Solaris (x86 tested) but has not been tested yet, as the Solaris ppp kernel driver does not support MPPE.
eaptls-mppe-1.102.patch
- Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. This works both when compiling against OpenSSL 1.0.1+ and 1.1+.
- Print warning when certificate is either not yet valid or has expired.
- Perform better peer certificate checks.
- Allow certificate chain files to be used.
- Legacy Windows XP clients are working again, even with OpenSSL 1.1+.
eaptls-mppe-1.101.patch
- Fixed security vulnerability CVE-2018-11574.
eaptls-mppe-0.999 patch
- Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x (thanks to Lubomir Rintel for supplying an initial patch).
  NOTE When linking against OpenSSL 1.1+, EAP-TLS will make use of TLS v1.2. This breaks compatibility with legacy clients, such as Windows XP.
eaptls-mppe-0.998 patch
- Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 (thanks to Michal Sekletar for informing me).
- First version for ppp-2.4.7 (patch is identical to 2.4.6 one)

eap-tls patches for pppd 2.4.6

eaptls-mppe-1.102.patch
- Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. This works both when compiling against OpenSSL 1.0.1+ and 1.1+.
- Print warning when certificate is either not yet valid or has expired.
- Perform better peer certificate checks.
- Allow certificate chain files to be used.
- Legacy Windows XP clients are working again, even with OpenSSL 1.1+.
eaptls-mppe-1.101.patch
- Fixed security vulnerability CVE-2018-11574.
- Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x (thanks to Lubomir Rintel for supplying an initial patch).
  NOTE When linking against OpenSSL 1.1+, EAP-TLS will make use of TLS v1.2. This breaks compatibility with legacy clients, such as Windows XP.
eaptls-mppe-0.998 patch
- Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 (thanks to Michal Sekletar for informing me).
eaptls-mppe-0.997 patch
- Change option name from SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET (thanks to René Fürst).
- Fix error with packet fragmentation during connection initialisation (thanks to René Fürst).
eaptls-mppe-0.996 patch
- Clean up SSL Session Ticket support (esp for debugging).
  NOTE Unfortunately this breaks building against OpenSSL 0.9.8. In that case, use patch 0.995. This will be fixed in the next version of the patch.
- Updated pppd.8 manual page with EAP-TLS specific options.
- README.eap-tls file now contains an example on how to use the patched pppd.
eaptls-mppe-0.995 patch
- First version for ppp-2.4.6
- Add support for a CRL file using the command-line option 'crl' (prior only 'crl-dir' was supported).
- Fix segfault when pkcs11 enginename was not specified correctly (thanks to Evgeny Khorkin).
- Fix segfault when client was misconfigured (thanks to Zoltan Padrah).
- Disable SSL Session Ticket support as Windows 8 does not support this (thanks to Charlie Brady).

eap-tls patches for pppd 2.4.5

eaptls-mppe-1.102.patch
- Add TLS 1.2 support. Windows 7/8 will connect using TLS 1.0, Windows 10 clients using TLS 1.2. This works both when compiling against OpenSSL 1.0.1+ and 1.1+.
- Print warning when certificate is either not yet valid or has expired.
- Perform better peer certificate checks.
- Allow certificate chain files to be used.
- Legacy Windows XP clients are working again, even with OpenSSL 1.1+.
eaptls-mppe-1.101.patch
- Fixed security vulnerability CVE-2018-11574.
- Added support for OpenSSL 1.1: the code will now compile against OpenSSL 1.0.x or 1.1.x (thanks to Lubomir Rintel for supplying an initial patch).
  NOTE When linking against OpenSSL 1.1+, EAP-TLS will make use of TLS v1.2. This breaks compatibility with legacy clients, such as Windows XP.
eaptls-mppe-0.998 patch
- Added fix for https://bugzilla.redhat.com/show_bug.cgi?id=1023620 (thanks to Michal Sekletar for informing me).
eaptls-mppe-0.997 patch
- Change option name from SSL_OP_NO_TICKETS to SSL_OP_NO_TICKET (thanks to René Fürst).
- Fix error with packet fragmentation during connection initialisation (thanks to René Fürst).
eaptls-mppe-0.996 patch
- Clean up SSL Session Ticket support (esp for debugging).
  NOTE Unfortunately this breaks building against OpenSSL 0.9.8. In that case, use patch 0.995. This will be fixed in the next version of the patch.
- Updated pppd.8 manual page with EAP-TLS specific options.
- README.eap-tls file now contains an example on how to use the patched pppd.
eaptls-mppe-0.995 patch
- Add support for a CRL file using the command-line option 'crl' (prior only 'crl-dir' was supported).
- Fix segfault when pkcs11 enginename was not specified correctly (thanks to Evgeny Khorkin).
- Fix segfault when client was misconfigured (thanks to Zoltan Padrah).
- Disable SSL Session Ticket support as Windows 8 does not support this (thanks to Charlie Brady).
eaptls-mppe-0.994 patch
- Fix compilation issue on Ubuntu 11.10 (thanks to Steffen Lange).
eaptls-mppe-0.993 patch
- Fix compilation issue when EAP_TLS=n in pppd/Makefile (thanks to Peter Meiser).
eaptls-mppe-0.992 patch
- Fix compilation issue with eaptls_check_hook and passwordfd plugin (thanks to Alin Năstac).
eaptls-mppe-0.991 patch
- Fix compilation issue with openssl 1.0 (thanks to Walter Rasmann).
eaptls-mppe-0.99 patch
- Fix coredump when using multilink option (thanks to Jiri Skala for pointing this bug out).
eaptls-mppe-0.98 patch
- Fix initialisation bug when using ca/cert/key command-line options (thanks to Brian Scholz).
eaptls-mppe-0.97 patch
- Some bug fixes for v0.96
- Added support for entering the password via a plugin. The sample plugin .../pppd/plugins/passprompt.c has been extended with EAP-TLS support.
  The "old" methods using the password option or the /etc/ppp/openssl.cnf file still work.
  
  NOTE the plugin is responsible for dealing with the number of login attempts. The EAP-TLS code will try to retrieve the passphrase for the private key or PKCS11 hardware device 19 times.
- Added support for specifying the client CA, certificate and private key on the command-line or via the ppp config file, e.g.
```
  ca   <path-to-CA-file>
  cert <path-to-cert-file-or-PKCS11-id>
  key  <path-to-key-file-or-PKCS11-id>
```
  This works only for the client, not the server, as a server setup normally requires a more elaborate eaptls-server file.
- TODO
  - Write NetworkManager-pptp patch to support eap-tls, using the above mentioned password hook and command-line support
eaptls-mppe-0.96 patch
- First version for ppp-2.4.5
- Added support for OpenSSL engines. This has been tested using 'engine_pkcs11' (see http://www.opensc-project.org/engine_pkcs11/) only, in combination with an Aladdin eToken PRO.
  To use it a few changes with respect to previous versions of this patch are required:
  - use a special private keyfile in the /etc/ppp/eaptls-client file:
```
  <engine>:<identifier>
```
    e.g.
```
  pkcs11:39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30
```
  - (Optional:) use a special client certificate filename in the /etc/ppp/eaptls-client file:
```
  <engine>:<identifier>
```
    e.g.
```
  pkcs11:39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30
```
  - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior to starting 'pppd'. v0.95 of the patch also allowed you to store the file in $OPENSSL_CONF but this has been removed for security reasons.
    Click to download a sample openssl.cnf file.
- There are two ways to specify a password/PIN for the PKCS11 engine:
  - inside the openssl.cnf file using
```
  PIN = your-secret-pin
```
    Note The keyword 'PIN' is case sensitive!
  - Using the 'password' in the ppp options file.
- You can download a pppd log of a successful connection here
- TODO
  - Come up with a better way to enter the password.
  - Add a method to specify cert+ca+key on the command-line instead of via the eaptls-client file
  - Write NetworkManager-pptp patch to support eap-tls, using the above mentioned password hook and command-line support

eap-tls patches for pppd 2.4.4

eaptls-mppe-0.98 patch
- Fix initialisation bug when using ca/cert/key command-line options (thanks to Brian Scholz).
eaptls-mppe-0.97 patch
- Some bug fixes for v0.96
- Added support for entering the password via a plugin. The sample plugin .../pppd/plugins/passprompt.c has been extended with EAP-TLS support.
  The "old" methods using the password option or the /etc/ppp/openssl.cnf file still work.
  
  NOTE the plugin is responsible for dealing with the number of login attempts. The EAP-TLS code will try to retrieve the passphrase for the private key or PKCS11 hardware device 19 times.
- Added support for specifying the client CA, certificate and private key on the command-line or via the ppp config file, e.g.
```
  ca   <path-to-CA-file>
  cert <path-to-cert-file-or-PKCS11-id>
  key  <path-to-key-file-or-PKCS11-id>
```
  This works only for the client, not the server, as a server setup normally requires a more elaborate eaptls-server file.
- TODO
  - Write NetworkManager-pptp patch to support eap-tls, using the above mentioned password hook and command-line support
eaptls-mppe-0.96 patch
- Added support for OpenSSL engines. This has been tested using 'engine_pkcs11' (see http://www.opensc-project.org/engine_pkcs11/) only, in combination with an Aladdin eToken PRO.
  To use it two changes with respect to previous versions of this patch are required:
  - use a special private keyfile in the /etc/ppp/eaptls-client file:
```
  <engine>:<identifier>
```
    e.g.
```
  pkcs11:39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30
```
  - (Optional:) use a special client certificate filename in the /etc/ppp/eaptls-client file:
```
  <engine>:<identifier>
```
    e.g.
```
  pkcs11:39453945373335312d333545442d343031612d384637302d3238463636393036363042303a30
```
  - Create an /etc/ppp/openssl.cnf file to load the right OpenSSL engine prior to starting 'pppd'. v0.95 of the patch also allowed you to store the file in $OPENSSL_CONF but this has been removed for security reasons.
    Click to download a sample openssl.cnf file.
- There are two ways to specify a password/PIN for the PKCS11 engine:
  - inside the openssl.cnf file using
```
  PIN = your-secret-pin
```
    Note The keyword 'PIN' is case sensitive!
  - Using the 'password' in the ppp options file.
- You can download a pppd log of a successful connection here
- TODO
  - Come up with a better way to enter the password.
Older versions of this patch:
- eaptls-mppe-0.95 patch : first version with OpenSSL engine support
- eaptls-mppe-0.94 patch : Added support for password-protected private keys by (ab)using the 'password' field.
- eaptls-mppe-0.93 patch : Make sure 'noauth' option can be used to bypass server certificate verification (thanks to Dmitry Kostenko).
- eaptls-mppe-0.92 patch : Fix for openssl 0.9.8 issue with md5 function overload
- eaptls-mppe-0.91 patch : Added missing #include <openssl/md5.h>
- eaptls-mppe-0.9 patch :

eap-tls patches for pppd 2.4.3

eaptls-mppe-0.91 patch
- Added missing #include <openssl/md5.h>
- Last version for ppp-2.4.3