WPA2 Enterprise PEAP-MSCHAPv2 not working

[averri]

Hardware:

Board: esp32dev
Core Installation/update date: 04/05/2018
IDE name: Platform.io
Flash Frequency: 80Mhz
Upload Speed: 115200

Description:

The ESP32 cannot connect to WiFi using WPA2 Enterprise PEAP/MSCHAPv2. There is an error message reported, please see below.

Error messages when executing the sketch:

.E (3449) wpa: Method private structure allocated failure

..E (7006) wpa: Method private structure allocated failure

..E (10559) wpa: Method private structure allocated failure

Sketch:

#include "esp_wpa2.h"
#include <WiFi.h>

const char *ssid = "mySSID";
#define EAP_ID "myID"
#define EAP_USERNAME ""
#define EAP_PASSWORD "myPassword"

void setup() {

    Serial.begin(9600);
    delay(10);

    Serial.println();
    Serial.print("Connecting to ");
    Serial.println(ssid);

    WiFi.disconnect(true);
    
    esp_wifi_sta_wpa2_ent_set_identity((uint8_t *)EAP_ID, strlen(EAP_ID));
    //esp_wifi_sta_wpa2_ent_set_username((uint8_t *)EAP_USERNAME, strlen(EAP_USERNAME));
    esp_wifi_sta_wpa2_ent_set_password((uint8_t *)EAP_PASSWORD, strlen(EAP_PASSWORD));

    esp_wpa2_config_t config = WPA2_CONFIG_INIT_DEFAULT(); 
    esp_err_t code = esp_wifi_sta_wpa2_ent_enable(&config);

    Serial.print("Code: ");
    Serial.println(code);
    
    WiFi.begin(ssid);

    while (WiFi.status() != WL_CONNECTED) {
        delay(2000);
        Serial.print(".");        
    }

    Serial.println("");
    Serial.println("WiFi connected");
    Serial.println("IP address: ");
    Serial.println(WiFi.localIP());
}

void loop() {
    // Your code here.
}

Debug Messages:

Connecting to mySSID
[D][WiFiGeneric.cpp:293] _eventCallback(): Event: 2 - STA_START
Code: 0
.E (3569) wpa: Method private structure allocated failure

.[D][WiFiGeneric.cpp:293] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:298] _eventCallback(): Reason: 2 - AUTH_EXPIRE
.E (7118) wpa: Method private structure allocated failure

[D][WiFiGeneric.cpp:293] _eventCallback(): Event: 5 - STA_DISCONNECTED
[W][WiFiGeneric.cpp:298] _eventCallback(): Reason: 2 - AUTH_EXPIRE
..E (10691) wpa: Method private structure allocated failure

[XinDeng11]

hi @averri PEAP method need certificate to build TLS tunnel, password and username to do MSCHAPv2 verify, I saw you mark down the username set, I think it may the reason why you fail, can you set a legal name and password and try again？ Besides, please make sure your server need do certificate verify so that you can build TLS tunnel needn't certificate

[averri]

Hi @XinDeng11, thank you very much for your attention.

I have set the username together with identity and valid password and it's not working. I have tested the same configuration using my Android phone, and it's working fine. The administrator of the network recommend to use just the identity, without username, and there is no need to set any certificate in the client. This configuration is working fine in the Android phone.

So, in summary, this code snippet is not working (using the same username as identity):

esp_wifi_sta_wpa2_ent_set_identity((uint8_t *)EAP_ID, strlen(EAP_ID));
esp_wifi_sta_wpa2_ent_set_username((uint8_t *)EAP_USERNAME, strlen(EAP_USERNAME));
esp_wifi_sta_wpa2_ent_set_password((uint8_t *)EAP_PASSWORD, strlen(EAP_PASSWORD));

Do you think I still need to get the server certificate and set it in the code?

[XinDeng11]

@averri, yeah, there is unnecessary to use user name in TLS method. But it should have a username and password in PEAP method because our ID can not instead of username now. Many phones has installed some common certificates so that it can pass. But PEAP can jump certificate check if it unnessary. Can you offer us your sniffer log(air packets) so that we can check when it failed.

[averri]

Hi @XinDeng11, I'll test again with a certificate (presuming a server certificate, because I don't have the client one) and let you know. Thanks for this information. In relation to the sniffer, I don't have access to the router, so the other place we could capture is inside the ESP32, but I'm unaware of any solution like this. I did a test trying to capture the packets in promiscuous mode in the WiFi interface of my notebook, but then I noticed that there are no relevant packets of the authentication process. I have filtered the packets by the MAC address of ESP32. Another option I have is to buy a router with WPA2 Enterprise and create my development environment, where I can easily capture the relevant logs.

Please let me know if there is any other option for capturing the sniffer logs.

[viniciusov]

I'm having this exactly same issue. I tried to connect to my university's network (eduroam) with the code above but I couldn't succeed.

By the way @averri , how can you get this Debug Messages?
I only get:

"Connecting to eduroam
Code: 0
....................................................................................... (and so on...)"

[Phill93]

Also having this problem with "eduroam"

[martinius96]

If I am right, ID to Eduroam is for instance (in my university): xxx48
username is: xxx48@tuke.sk
password: password
Try it with that!

[averri]

@martinius96 , that does not work. The issue here is not about wrong credentials.

[martinius96]

Understand.
How about this sketch? Is it usable?
https://gist.github.com/me-no-dev/2d2b51b17226f5e9c5a4d9a78bdc0720
It got example with certificate

[martinius96]

Today I have tried Eduroam network. Working all ok, connecting about 4 seconds and then connected.
Sketch I have used:
`#include "esp_wpa2.h"
#include <WiFi.h>
String line;
const char* ssid = "eduroam"; // your ssid
#define EAP_ID "username@university.sk"
#define EAP_USERNAME "username@university.sk"
#define EAP_PASSWORD "password"
#ifdef __cplusplus
extern "C" {
#endif
uint8_t temprature_sens_read();
#ifdef __cplusplus
}
#endif
uint8_t temprature_sens_read();
void setup() {
Serial.begin(115200);
delay(10);

Serial.println();
Serial.print("Connecting to ");
Serial.println(ssid);

// WPA2 enterprise magic starts here
WiFi.disconnect(true);  

esp_wifi_sta_wpa2_ent_set_identity((uint8_t *)EAP_ID, strlen(EAP_ID));
esp_wifi_sta_wpa2_ent_set_username((uint8_t *)EAP_USERNAME, strlen(EAP_USERNAME));
esp_wifi_sta_wpa2_ent_set_password((uint8_t *)EAP_PASSWORD, strlen(EAP_PASSWORD));
esp_wpa2_config_t config = WPA2_CONFIG_INIT_DEFAULT();
esp_wifi_sta_wpa2_ent_enable(&config);

Serial.println("MAC address: ");
Serial.println(WiFi.macAddress());
// WPA2 enterprise magic ends here
WiFi.begin(ssid);
WiFi.setHostname("PINGER");
while (WiFi.status() != WL_CONNECTED) {
delay(500);
Serial.print(".");
}

Serial.println("");
Serial.println("WiFi connected");
Serial.println("IP address: ");
Serial.println(WiFi.localIP());

}

/*

• everyhting below this, in loop(), is just a standard request to a webserver and nothing else than an example to show that is works.

*/

const char* host = "arduino.php5.sk";

void loop() {
delay(5000);
while (WiFi.status() != WL_CONNECTED) {
delay(500);
Serial.print(".");
WiFi.begin(ssid);
WiFi.setHostname("PINGER");
}
Serial.print("connecting to ");
Serial.println(host);

WiFiClient client;
if (!client.connect(host, 80)) {
    Serial.println("connection failed");
    return;
}

String url = "/rele/rele1.txt";

Serial.print("Requesting URL: ");
Serial.println(url);

// This will send the request to the server
client.print(String("GET ") + url + " HTTP/1.1\r\n" +
             "Host: " + host + "\r\n" +
             "Connection: close\r\n\r\n");
unsigned long timeout = millis();
while (client.available() == 0) {
    if (millis() - timeout > 5000) {
        Serial.println(">>> Client Timeout !");
        client.stop();
        return;
    }
}

// Read all the lines of the reply from server and print them to Serial
while(client.available()) {
     line = client.readStringUntil('\n');
    Serial.println(line);

}

if (line=="VYP"){
  Serial.println("Vypnuty spotrebic");
  }else if (line=="ZAP"){
  Serial.println("Zapnuty spotrebic");
  }
  Serial.println(line.length());
//Serial.println(velkost);
Serial.println();
Serial.println("closing connection");
int measurement = 0;

measurement = hallRead();

Serial.print("Hall sensor measurement: ");
Serial.println(measurement); 
 Serial.print("Temperature: ");

// Convert raw temperature in F to Celsius degrees
Serial.print((temprature_sens_read() - 32) / 1.8);
Serial.println(" C");
}`

[martinius96]

@averri Don't answer now.

[mickel1138]

@martinius96 I can't get this code to work either. Our network is PEAP and MSCHAP V2. I even tried it setting a certificate, but that results in the "wpa: Method private structure..." error.
BTW, your example code is not well formatted, making it hard to copy. The code in your repo was fine, but didn't work either.

[martinius96]

@mickel1138 Hello there, I have tried it on Eduroam network in my university in Slovakia and also on school hostel network, that is under WPA2 Enterprise too (but it isn't Eduroam). Same sketch worked for me on both networks. Both these networks were under PEAP and MsCHAPv2 methods. That's weird. It was first sketch i have used on ESP32 board and it worked. I was using ESP32 DevKit v1 board. Maybe isn't there problem with ID and identity? I got for instance login@university.domain for ID and for identity too.. Maybe it isn't same at you, because in my sketch i set ID and IDENTITY same in my sketch in repo.

[mickel1138]

@martinius96 I have tried various combinations of ID, and user name. None of those worked. This issues seems to happen to others too, and may have to do with the ESP library build. There is quite a thread on it here: espressif/esp-idf#1297