☰

国际妇女节

tag-icon • tag-icon wifi key-authentication iwd
国际妇女节

我想使用 连接到 EAP-TLS 接入点iwd，但是这失败了，因为它显然无法打开我的客户端密钥：

# iwctl
[iwd]# station wlan0 connect foo
Not configured

iwd说：

src/network.c:network_connect() 
src/network.c:network_connect_8021x() 
Failed to load /var/lib/wireless/skybert.pem

我的内核是最新的稳定内核，并且我已启用CONFIG_PKCS8_PRIVATE_KEY_PARSER：

# uname -r
5.2.1
# lsmod | grep pkcs8_key_parser
pkcs8_key_parser       16384  0

国际妇女节

# /usr/libexec/iwd --version
0.18
# export IWD_TLS_DEBUG=1
# /usr/libexec/iwd -d
[..]
src/network.c:network_connect() 
src/network.c:network_connect_8021x() 
Failed to load /var/lib/wireless/skybert.pem

/var/lib/iwd/foo.8021x

[Security]
EAP-Method=TLS
EAP-TLS-ClientCert=/var/lib/wirelss/skybert.pem
EAP-TLS-ClientKey=/var/lib/wireless/skybert.des3.key 
EAP-TLS-ClientKeyPassphrase=youwish
EAP-Identity=skybert

相应的工作wpa_supplicant块是：

network={
   ssid="foo"
   key_mgmt=WPA-EAP
   proto=WPA2
   eap=TLS
   identity="skybert"
   client_cert="/var/lib/wireless/skybert.pem"
   private_key="/var/lib/wireless/skybert.des3.key"
   private_key_passwd="youwish"
}

操作系统

❯ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 10 (buster)
Release:        10
Codename:       buster

（尝试）阅读源代码

据我所知，它ell/ell/pem.c（称为 from iwd/src/eap-tls-common.c）无法加载证书，但据我所知。无论路径存在还是不存在，错误消息都是相同的。

任何帮助将非常感激。

答案1

从文件中pem.c，第 321 行

以我对C语言的有限理解，只能从评论中推断：

/**
 * l_pem_load_private_key
 * @filename: path string to the PEM file to load
 * @passphrase: private key encryption passphrase or NULL for unencrypted
 * @encrypted: receives indication whether the file was encrypted if non-NULL
 *
 * Load the PEM encoded RSA Private Key file at @filename.  If it is an
 * encrypted private key and @passphrase was non-NULL, the file is
 * decrypted.  If it's unencrypted @passphrase is ignored.  @encrypted
 * stores information of whether the file was encrypted, both in a
 * success case and on error when NULL is returned.  This can be used to
 * check if a passphrase is required without prior information.
 *
 * Returns: An l_key object to be freed with an l_key_free* function,
 * or NULL.
 **/

RSA 摘录

加载 PEM 编码的 RSA 私钥文件。

所以，不再有 3DES（？）

从 NIST 2017 来看：三重 DES 已于 2017 年被 NIST 弃用，这很可能是原因。

相关内容