• PEM
• ASN1

• TLSv1
• TLSv1.1
• TLSv1.2
• TLSv1.3

  CAUTION

  TLSv1.3 is not enabled by default with Radiator yet. Testing reports are welcome. Net::SSLeay 1.83 or later is required if you use Radiator with SSL/TLS library that has TLSv1.3 enabled. Net::SSLeay 1.92 or later is recommended.

# Do not allow TLSv1
EAPTLS_Protocols TLSv1.1, TLSv1.2

# Exclude cipher suites using RC4 too
EAPTLS_Ciphers DEFAULT:!EXPORT:!LOW:!RC4

# System default level 2 is too strict for this module
EAPTLS_Ciphers DEFAULT:!EXPORT:!LOW@SECLEVEL=1

# The default on this system, 2, is too strict for our clients,
# lower it for this Radiator module
EAPTLS_SecurityLevel 1

# Curves often have multiple aliases. Need OpenSSL name here.
# openssl ecparam -list_curves
EAPTLS_ECDH_Curve prime256v1

• EAPTLS_CRLCheck must be enabled in Radiator configuration
• Both base and delta CRLs must use CRL v2 format
• Do not use delta CRL files without enabling EAPTLS_CRLCheckUseDeltas
• OpenSSL indicates only one delta CRL file can be used
• Review OpenSSL notes about delta CRLs on OpenSSL manual page for X509_VERIFY_PARAM_set_flags.
• Test that your base and delta CRL work when CRL files are updated or refreshed

# Disable session resumption
EAPTLS_SessionResumption 0

# Allow resumption when using the same Client and Handler
EAPTLS_SessionContextId %0%1

EAPTLSRewriteCertificateCommonName s/testUser/mikem/

# Require just one policy
EAPTLS_PolicyOID 1.3.6.1.4.1.9048.33.2

• $_[0]: $matchedcn, the CN that matched the user name or identity with or without the domain name. $matchedcn is the CN in the certificate that was matched against either the user name or EAP identity. It is normally used as the user name to do the user database lookup, but you can return a new name from this function.
• $_[1]: $x509_store_ctx, the EAP SSLEAY store context (you can pass this to Net::SSLeay::X509_STORE_CTX_get_current_cert)
• $_[2]: $cert, the current certificate, result of Net::SSLeay::X509_STORE_CTX- _get_current_cert($x509_store_ctx)
• $_[3]: $subject_name, the certificates subject name, result of &Net::SSLeay::X509_get_subject_name($cert)
• $_[4]: $subject, the certificate subject, result of &Net::SSLeay::X509_NAME_oneline($subject_name)
• $_[5]: $p, the current Radius::Radius request

• $_[0]: $verify_error
  This is the EAP SSLEAY store context verification code.
• $_[1]: $x509_store_ctx
  This is the EAP SSLEAY store context.
• $_[2]: $cert
  This is the current certificate. May be undefined.
• $_[3]: $subject_name
  This is the certificate's subject name. Undefined when $cert is undefined.
• $_[4]: $subject
  This is the certificate subject. Undefined when $cert is undefined.
• $_[5]: $p
  This is the current Radius::Radius request.

• > 0: Non-zero error code
  This is a new verification result code.
• 0
  This changes verification failure to verification success.
• < 0
  The verification process is immediately stopped with "verification failed" state.
• Undefined
  This is handled as an OpenSSL error X509_V_ERR_APPLICATION_VERIFICATION.

EAPTLS_CertificateVerifyFailedHook sub { return 0; }

EAPTLS_CertificateVerifyFailedHook sub { \
                if ($_[0] == 10) { return 0; } else { return $_[0]; } }

• $_[0]: the CN
• $_[1]: the User-Name from the incoming request
• $_[2]: the EAP Identity of the TLS handshake

# Turn on TLS state tracing for this AuthBy
EAPTLS_TraceState

EAPTLS_CopyToInnerRequest Calling-Station-Id, Called-Station-Id

• OpenSSL 1.0.0 or later
• Net::SSLeay 1.59 or later. Net::SSLeay 1.82 or later is recommended.
  If you use EAPTLS_OCSPStapling, Net::SSLeay 1.82 or later is required.

• EAPTLS_OCSPURI is not set and the certificate does not have OCSP URI.
• OCSP responder is not responding.
• OCSP responder cannot be reached.

• User-Name
• User-Password
• CHAP-Password
• CHAP-Challenge
• EAP-Message
• MS-CHAP-Response
• MS-CHAP-Challenge
• MS-CHAP2-Response

# Also allow our vendor specific attribute in EAP-TTLS requests
EAP_TTLS_AllowInRequest OSC-AVPAIR, User-Name, User-Password, \
         CHAP-Password, CHAP-Challenge, EAP-Message, \
         MS-CHAP-Response, MS-CHAP-Challenge, MS-CHAP2-Response

• EAP-Message
• MS-CHAP2-Success

# Also allow our vendor specific attribute in EAP-TTLS replies
EAP_TTLS_AllowInReply OSC-AVPAIR, EAP-Message, MS-CHAP2-Success

# Our passwords are stored in {nthash} prefixed format
EAP_PWD_PrepMethod NtHash

UsernameCharset a-zA-Z0-9._@-

AuthByPolicy ContinueWhileAccept
# Check the MAC address is valid..
<AuthBy FILE>
      NoEAP
      AuthenticateAttribute Calling-Station-Id
      Filename ...
      ...
</AuthBy>
# then check the username and password, perhaps by EAP
<AuthBy LDAP2>
      EAPType ....
      ....
</AuthBy>

• Client clause
  PreHandlerHook is called for each request after per-Client user name rewriting and duplicate rejection, and before the request is passed to a Realm or Handler clause.
• AuthBy clause
  The functionality depends on the used EAP authentication type:
  • PEAP, EAP-TTLS, EAP-FAST
    PreHandlerHook specifies a Perl hook to be called before the inner request is re-dispatched to a matching Realm or Handler.
  • LEAP
    If EAP_LEAP_MSCHAP_Convert flag is set, PreHandlerHook specifies a Perl hook to be called before the converted request is re-dispatched to a matching Realm or Handler.
  • EAP-MSCHAPv2
    If EAP_PEAP_MSCHAP_Convert flag is set, PreHandlerHook specifies a Perl hook to be called before the converted request is re-dispatched to a matching Realm or Handler.
  • EAP-GTC
    If EAP_GTC_PAP_Convert flag is set, PreHandlerHook specifies a Perl hook to be called before the converted request is re-dispatched to a matching Realm or Handler.
• AuthBy DYNAUTH clause
  PreHandlerHook is called for each request created by the clause before the request is passed to a Realm or Handler clause.
• ServerRADSEC clause
  PreHandlerHook is called for each request after global and per-ServerRADSEC user name rewriting and before the request is passed to a Realm or Handler clause.
• ServerDIAMETER clause
  PreHandlerHook is called for each request received by ServerDIAMETER before the request is passed to a Realm or Handler clause.
• ServerTACACSPLUS clause
  PreHandlerHook is called for each request before it is passed to a Realm or Handler clause. If a Client is found for the request, Client's PrehandlerHook is run before ServerTACASPLUS's PreHandlerHook. Global and per-Client user name rewriting and other processing is done before the hooks are run.

# Fake a new attribute into the request
PreHandlerHook sub { ${$_[0]}->add_attr('test-attr', \
      'test-value');}

# Enable when debugging, remove when in production
EAPTLS_KeylogFilename %L/eap-keylog