user/password auth with cert works, without cert not - why?

Fl0Wde

hi folks,

i'm sorry for asking but i'm very confused about. i have set up a server configuration at a OpenWRT Backfire 10.03.1 router and this is my problem:

i created certs, setup the configuration at server and client and also firewall is working fine.

situation 1:
i'm using client and server cert and the tunnel is working fine from internal/external connections.

situation2:
i want to use only username and passwort (client-cert-not-required) without a user cert. but in this case i always get a error and i'm not able to establish a connection 🙁

RFri May 31 10:31:11 2013 us=617986 89.204.xxx.xxx:38917 TLS: Initial packet from 89.204.xxx.xxx:38917, sid=2d389893 ddfa130a
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRFri May 31 10:31:15 2013 us=880603 89.204.138.181:38917 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:lib(20):func(137):reason(199)
Fri May 31 10:31:15 2013 us=880839 89.204.xxx.xxx:38917 TLS Error: TLS object -> incoming plaintext read error
Fri May 31 10:31:15 2013 us=880973 89.204.xxx.xxx:38917 TLS Error: TLS handshake failed
Fri May 31 10:31:15 2013 us=881726 89.204.xxx.xxx:38917 SIGUSR1[soft,tls-error] received, client-instance restarting

the only parameters i changed at my server config are:

option 'client-cert-not-required'
option 'username-as-common-name'

why my setup without user certs is not working and i get this error? 🙁

i hope anybody can help me to fix my small issue 😉 if needed i can also post configs, logs, etc.

thanks, greets Fl0W

janjust

without the full client and server configs it's not possible to tell what is happening here - even with 'client-cert-not-required' you still need a server side certificate AND a valid ca.crt file.

Fl0Wde

thanks for your reply and your help! sure i can post the complete configs 😉

situation 1, working:
client:

client
dev tun
proto udp
remote myhost.hopto.org
port 11194
nobind
pull
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass
auth-nocache
comp-lzo
cipher BF-CBC
verb 1
cert client1.crt
key client1.key

server:

option 'comp_lzo' '1'
option 'keepalive' '10 60'
option 'tls_server' '1'
option 'cipher' 'BF-CBC'
option 'ifconfig_nowarn' '1'
option 'persist_tun' '1'
option 'persist_key' '1'
option 'ping_timer_rem' '1'
#option 'management' '127.0.0.1 31195'
option 'ca' '/etc/openvpn/server_home/certificate/ca.crt'
option 'cert' '/etc/openvpn/server_home/certificate/server.crt'
option 'key' '/etc/openvpn/server_home/certificate/server.key'
option 'dh' '/etc/openvpn/server_home/certificate/dh1024.pem'
option 'ifconfig_pool_persist' '/tmp/ipp.txt'
option 'dev' 'tun1'
option 'port' '11194'
option 'verb' '5'
option 'log' '/tmp/openvpn.log'
option 'local' '10.20.50.254'
option 'server' '10.20.50.0 255.255.255.0'
option 'auth' 'SHA1'
option 'auth_user_pass_verify' '/etc/openvpn/server_home/config/openvpn-auth.sh via-file'
option 'script_security' '2'
option 'client_to_client' '1'
option 'route' 'route 10.20.1.0 255.255.255.0'
list 'push' 'route 10.20.1.0 255.255.255.0'
list 'push' 'dhcp-option DNS 10.20.50.254'
list 'push' 'dhcp-option DNS 10.20.1.250'
list 'push' 'dhcp-option DNS 8.8.8.8'
list 'push' 'dhcp-option DNS 8.8.4.4'

situation 2, NOT working:
client:

client
dev tun
proto udp
remote myhost.hopto.org
port 11194
nobind
pull
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass
auth-nocache
comp-lzo
cipher BF-CBC
verb 1

server:

option 'comp_lzo' '1'
option 'keepalive' '10 60'
option 'tls_server' '1'
option 'cipher' 'BF-CBC'
option 'ifconfig_nowarn' '1'
option 'persist_tun' '1'
option 'persist_key' '1'
option 'ping_timer_rem' '1'
#option 'management' '127.0.0.1 31195'
option 'ca' '/etc/openvpn/server_home/certificate/ca.crt'
option 'cert' '/etc/openvpn/server_home/certificate/server.crt'
option 'key' '/etc/openvpn/server_home/certificate/server.key'
option 'dh' '/etc/openvpn/server_home/certificate/dh1024.pem'
option 'ifconfig_pool_persist' '/tmp/ipp.txt'
option 'dev' 'tun1'
option 'port' '11194'
option 'verb' '5'
option 'log' '/tmp/openvpn.log'
option 'local' '10.20.50.254'
option 'server' '10.20.50.0 255.255.255.0'
option 'auth' 'SHA1'
option 'client-cert-not-required'
option 'username-as-common-name'
option 'auth_user_pass_verify' '/etc/openvpn/server_home/config/openvpn-auth.sh via-file'
option 'script_security' '2'
option 'client_to_client' '1'
option 'route' 'route 10.20.1.0 255.255.255.0'
list 'push' 'route 10.20.1.0 255.255.255.0'
list 'push' 'dhcp-option DNS 10.20.50.254'
list 'push' 'dhcp-option DNS 10.20.1.250'
list 'push' 'dhcp-option DNS 8.8.8.8'
list 'push' 'dhcp-option DNS 8.8.4.4'

error message:

RFri May 31 10:31:11 2013 us=617986 89.204.xxx.xxx:38917 TLS: Initial packet from 89.204.xxx.xxx:38917, sid=2d389893 ddfa130a
WRRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRFri May 31 10:31:15 2013 us=880603 89.204.xxx.xxx:38917 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:lib(20):func(137):reason(199)
Fri May 31 10:31:15 2013 us=880839 89.204.xxx.xxx:38917 TLS Error: TLS object -> incoming plaintext read error
Fri May 31 10:31:15 2013 us=880973 89.204.xxx.xxx:38917 TLS Error: TLS handshake failed
Fri May 31 10:31:15 2013 us=881726 89.204.xxx.xxx:38917 SIGUSR1[soft,tls-error] received, client-instance restarting

info: the option, list, etc. values at server config are needed by OpenWRT.

janjust

this looks like a bug in this version of openvpn for openwrt - which *exact* version is this?
the message

error:140890C7:lib(20):func(137):reason(199)

is the openssl library reporting that it WANTS a client-side certificate but did not get one, and hence aborts the connection; the problem is, the library should not have insisted on getting this.

Fl0Wde

hi janjust,

thanks for your reply and the tip about the bug in the version. i do have exactly the following versions:

openwrt:

BusyBox v1.15.3 (2011-11-24 00:44:20 CET) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 Backfire (10.03.1, r29592) ------------------------
  * 1/3 shot Kahlua    In a shot glass, layer Kahlua
  * 1/3 shot Bailey's  on the bottom, then Bailey's,
  * 1/3 shot Vodka     then Vodka.
 ---------------------------------------------------

kernel:

root@localhost:~# uname -r
2.6.32.27

openvpn:

root@localhost:~# openvpn --version
OpenVPN 2.1.4 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Nov 14 2011
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

openssl:

root@localhost:~# openssl version
OpenSSL 0.9.8r 8 Feb 2011

so which version i must use? do i have to compile openvpn by myself? 🙁

thanks and greets, Fl0W

Fl0Wde

hi again janjust,

i tried to upgrade OpenWRT version to latest, but openvpn still isn't working correct 🙁

these are the current versions after the upgrade:

openwrt:

BusyBox v1.19.4 (2013-03-14 11:28:31 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
ATTITUDE ADJUSTMENT (12.09, r36088)
-----------------------------------------------------
* 1/4 oz Vodka Pour all ingredients into mixing
* 1/4 oz Gin tin with ice, strain into glass.
* 1/4 oz Amaretto
* 1/4 oz Triple sec
* 1/4 oz Peach schnapps
* 1/4 oz Sour mix
* 1 splash Cranberry juice
-----------------------------------------------------

kernel:

root@localhost:~# uname -r
3.3.8

openvpn:

root@localhost:~# openvpn --version
OpenVPN 2.3_alpha3 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Mar 14 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

openssl:

root@localhost:~# openssl version
OpenSSL 1.0.1e 11 Feb 2013

current error with latest versions:

Jun  5 15:37:34 zn-gw-1 daemon.notice openvpn(server_home)[7076]: 82.113.98.32:43685 TLS: Initial packet from [AF_INET]82.113.xxx.xxx:43685, sid=050decff f2a383a9
Jun  5 15:37:35 zn-gw-1 daemon.err openvpn(server_home)[7076]: 82.113.xxx.xxx:43685 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:lib(20):func(137):reason(199)
Jun  5 15:37:35 zn-gw-1 daemon.err openvpn(server_home)[7076]: 82.113.xxx.xxx:43685 TLS Error: TLS object -> incoming plaintext read error
Jun  5 15:37:35 zn-gw-1 daemon.err openvpn(server_home)[7076]: 82.113.xxx.xxx:43685 TLS Error: TLS handshake failed
Jun  5 15:37:35 zn-gw-1 daemon.notice openvpn(server_home)[7076]: 82.113.xxx.xxx:43685 SIGUSR1[soft,tls-error] received, client-instance restarting

Fl0Wde

and again me.. i tested also with the nightly build version of openvpn for openwrt:

openwrt:
see above

kernel:
see above

openssl:
see above

openvpn:

root@localhost:~# openvpn --version
OpenVPN 2.3.0 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jun  3 2013
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

current error:

Jun  5 16:15:05 zn-gw-1 daemon.err openvpn(server_home)[2713]: 82.113.xxx.xxx:46993 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:lib(20):func(137):reason(199)
Jun  5 16:15:05 zn-gw-1 daemon.err openvpn(server_home)[2713]: 82.113.xxx.xxx:46993 TLS Error: TLS object -> incoming plaintext read error
Jun  5 16:15:05 zn-gw-1 daemon.err openvpn(server_home)[2713]: 82.113.xxx.xxx:46993 TLS Error: TLS handshake failed
Jun  5 16:15:05 zn-gw-1 daemon.notice openvpn(server_home)[2713]: 82.113.xxx.xxx:46993 SIGUSR1[soft,tls-error] received, client-instance restarting

still not working.. 🙁 i hope you have a new tip for me? 😉

Fl0Wde

hey folks, no one can help me? maybe this is a general bug in OpenVPN? :?:

Fl0Wde

i'm still having the same issue 🙁 no one can help me..??? i guess you are the official forum :roll:

if this is a general bug you should also be interessted in solving this issue or not!?

Fl0Wde

still having same issue. no one can help me??? i guess this is the official support forum of openvpn?

as i can see this is a bug of openvpn. so no one wants to solve it or just analyse the fault? :oops:

bs27975-1

Thank you for making your OP so I could find it during a google search.

For me, the problem was solved because the current date in OpenWRT was 10 days old.

rdate -s time.chu.nrc.ca

made everything work.

Using LUA I went to Services / Scheduled Tasks and put in

0 */4 * * * rdate -s time.chu.nrc.ca

Hopefully this will keep things working for me.

HTH

MaxT

Hi, I have updated my router to LEDE 17.04.1 and now same problem.

Thu Apr  5 15:50:09 2018 daemon.notice openvpn(lan)[32652]: 151.19.104.122:23229 TLS: Initial packet from [AF_INET]151.19.104.122:23229, sid=fd67913c 84ea578c
Thu Apr  5 15:50:10 2018 daemon.err openvpn(lan)[32652]: 151.19.104.122:23229 OpenSSL: error:140890C7:lib(20):func(137):reason(199)
Thu Apr  5 15:50:10 2018 daemon.err openvpn(lan)[32652]: 151.19.104.122:23229 TLS_ERROR: BIO read tls_read_plaintext error
Thu Apr  5 15:50:10 2018 daemon.err openvpn(lan)[32652]: 151.19.104.122:23229 TLS Error: TLS object -> incoming plaintext read error
Thu Apr  5 15:50:10 2018 daemon.err openvpn(lan)[32652]: 151.19.104.122:23229 TLS Error: TLS handshake failed
Thu Apr  5 15:50:10 2018 daemon.notice openvpn(lan)[32652]: 151.19.104.122:23229 SIGUSR1[soft,tls-error] received, client-instance restarting
Thu Apr  5 15:50:11 2018 daemon.err openvpn(lan)[32652]: 192.168.11.149:57208 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr  5 15:50:11 2018 daemon.err openvpn(lan)[32652]: 192.168.11.149:57208 TLS Error: TLS handshake failed
Thu Apr  5 15:50:11 2018 daemon.notice openvpn(lan)[32652]: 192.168.11.149:57208 SIGUSR1[soft,tls-error] received, client-instance restarting

OpenVPN 2.4.5 mipsel-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD]
Library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.10

Where I'm doing wrong?

Thanks

MaxT

I read here that reason 199 is PEER_DID_NOT_RETURN_A_CERTIFICATE :o

MaxT

And here I can't find client cert not required option :shock:
https://community.openvpn.net/openvpn/wiki/DeprecatedOptions#a--client-cert-not-required

EDIT: OK solved replacing

option client_cert_not_required 1

with

option 'verify_client_cert' 'none'

Note that is _ and not -

Thanks 😉