无法连接wpa2企业加密ESP-TLS (IDFGH-3779)

Environment

Development Kit:      ESP32-DevKitC
Module or chip used:  ESP32-WROOM-32D
IDF version (run git describe --tags to find it):
// v4.3-dev-771-gc77c4ccf6
Build System:         idf.py
Compiler version (run xtensa-esp32-elf-gcc --version to find it):
// xtensa-esp32-elf-gcc (crosstool-NG esp-2020r2) 8.2.0
Operating System:     wsl
Using an IDE?: No
Power Supply:         USB

Problem Description
ESP32使用wpa2_enterprise例程，无法连接wpa2企业加密EAP-TLS，电脑和手机连接无问题
路由器使用ASUSwrt merlin，安装本地FreeRADIUS Version 3.0.21
根据其他issue
ESP32设置了
config EXAMPLE_VALIDATE_SERVER_CERT=n
config WPA_MBEDTLS_CRYPTO=n
FreeRADIUS设置了
disable_tlsv1_2 = no
disable_tlsv1_1 = yes
disable_tlsv1 = yes
tls_min_version = "1.2"
tls_max_version = "1.2"
FreeRADIUS Debug信息如下
(0) Received Access-Request Id 106 from <IP_ADDRESS>:48424 to <IP_ADDRESS>:1812 length 233
(0)   User-Name =<EMAIL_ADDRESS>(0)   NAS-IP-Address = <IP_ADDRESS>
(0)   Called-Station-Id = "D4-5D-64-4D-7B-C8:ASUS"
(0)   NAS-Port-Type = Wireless-802.11
(0)   Service-Type = Framed-User
(0)   Calling-Station-Id = "C8-2B-96-B8-6A-DC"
(0)   Connect-Info = "CONNECT 0Mbps 802.11g"
(0)   Acct-Session-Id = "AA3CF7806C39EB64"
(0)   Acct-Multi-Session-Id = "0ABFDC1446AD11C1"
(0)   Attr-186 = 0x000fac04
(0)   Attr-187 = 0x000fac04
(0)   Attr-188 = 0x000fac01
(0)   Framed-MTU = 1400
(0)   EAP-Message = 0x02af001a016578616d706c65406573707265737369662e636f6d
(0)   Message-Authenticator = 0x032d3ecaee12ccb4bfe5826034ada2bc
(0) # Executing section authorize from file /opt/etc/freeradius3/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]@/ ) {
(0)         if (&User-Name =~ /@[^@]@/ )  -> FALSE
(0)         if (&User-Name =~ /../ ) {
(0)         if (&User-Name =~ /../ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /.$/)  {
(0)         if (&User-Name =~ /.$/)   -> FALSE
(0)         if (&User-Name =~<EMAIL_ADDRESS> {
(0)         if (&User-Name =~<EMAIL_ADDRESS>  -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "espressif.com" for User-Name =<EMAIL_ADDRESS>(0) suffix: No such realm "espressif.com"
(0)     [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 175 length 26
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_tls to process data
(0) eap_tls: Initiating new TLS session
(0) eap_tls: Setting verify mode to require certificate from client
(0) eap_tls: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 176 length 6
(0) eap: EAP session adding &reply:State = 0xc607166ac6b71b6d
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(0)   Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 106 from <IP_ADDRESS>:1812 to <IP_ADDRESS>:48424 length 0
(0)   EAP-Message = 0x01b000060d20
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0xc607166ac6b71b6dda08a4b72dd608fd
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 107 from <IP_ADDRESS>:48424 to <IP_ADDRESS>:1812 length 233
(1)   User-Name =<EMAIL_ADDRESS>(1)   NAS-IP-Address = <IP_ADDRESS>
(1)   Called-Station-Id = "D4-5D-64-4D-7B-C8:ASUS"
(1)   NAS-Port-Type = Wireless-802.11
(1)   Service-Type = Framed-User
(1)   Calling-Station-Id = "C8-2B-96-B8-6A-DC"
(1)   Connect-Info = "CONNECT 0Mbps 802.11g"
(1)   Acct-Session-Id = "AA3CF7806C39EB64"
(1)   Acct-Multi-Session-Id = "0ABFDC1446AD11C1"
(1)   Attr-186 = 0x000fac04
(1)   Attr-187 = 0x000fac04
(1)   Attr-188 = 0x000fac01
(1)   Framed-MTU = 1400
(1)   EAP-Message = 0x02b00008030d1915
(1)   State = 0xc607166ac6b71b6dda08a4b72dd608fd
(1)   Message-Authenticator = 0x3ec65b164aa3513125bb08ad57020896
(1) session-state: No cached attributes
(1) # Executing section authorize from file /opt/etc/freeradius3/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]@/ ) {
(1)         if (&User-Name =~ /@[^@]@/ )  -> FALSE
(1)         if (&User-Name =~ /../ ) {
(1)         if (&User-Name =~ /../ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /.$/)  {
(1)         if (&User-Name =~ /.$/)   -> FALSE
(1)         if (&User-Name =~<EMAIL_ADDRESS> {
(1)         if (&User-Name =~<EMAIL_ADDRESS>  -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "espressif.com" for User-Name =<EMAIL_ADDRESS>(1) suffix: No such realm "espressif.com"
(1)     [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 176 length 8
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1)     [eap] = updated
(1)     [files] = noop
(1)     [expiration] = noop
(1)     [logintime] = noop
Not doing PAP as Auth-Type is already set.
(1)     [pap] = noop
(1)   } # authorize = updated
(1) Found Auth-Type = eap
(1) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0xc607166ac6b71b6d
(1) eap: Finished EAP session with state 0xc607166ac6b71b6d
(1) eap: Previous EAP request found for state 0xc607166ac6b71b6d, released from the list
(1) eap: Peer sent packet with method EAP NAK (3)
(1) eap: Peer NAK'd our request for TLS (13) with a request for TLS (13), skipping...
(1) eap: WARNING: !!! We requested to use an EAP type as normal.
(1) eap: WARNING: !!! The supplicant rejected that, and requested to use the same EAP type.
(1) eap: WARNING: !!!     i.e. the supplicant said 'I don't like X, please use X instead.
(1) eap: WARNING: !!! The supplicant software is broken and does not work properly.
(1) eap: WARNING: !!! Please upgrade it to software that works.
(1) eap: Found mutually acceptable type PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Initiating new TLS session
(1) eap_peap: [eaptls start] = request
(1) eap: Sending EAP Request (code 1) ID 177 length 6
(1) eap: EAP session adding &reply:State = 0xc607166ac7b60f6d
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 107 from <IP_ADDRESS>:1812 to <IP_ADDRESS>:48424 length 0
(1)   EAP-Message = 0x01b100061920
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0xc607166ac7b60f6dda08a4b72dd608fd
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 108 from <IP_ADDRESS>:48424 to <IP_ADDRESS>:1812 length 233
(2)   User-Name =<EMAIL_ADDRESS>(2)   NAS-IP-Address = <IP_ADDRESS>
(2)   Called-Station-Id = "D4-5D-64-4D-7B-C8:ASUS"
(2)   NAS-Port-Type = Wireless-802.11
(2)   Service-Type = Framed-User
(2)   Calling-Station-Id = "C8-2B-96-B8-6A-DC"
(2)   Connect-Info = "CONNECT 0Mbps 802.11g"
(2)   Acct-Session-Id = "AA3CF7806C39EB64"
(2)   Acct-Multi-Session-Id = "0ABFDC1446AD11C1"
(2)   Attr-186 = 0x000fac04
(2)   Attr-187 = 0x000fac04
(2)   Attr-188 = 0x000fac01
(2)   Framed-MTU = 1400
(2)   EAP-Message = 0x02b10008030d1915
(2)   State = 0xc607166ac7b60f6dda08a4b72dd608fd
(2)   Message-Authenticator = 0x18d0d4bce15988cc7a95cbb1cc1d7693
(2) session-state: No cached attributes
(2) # Executing section authorize from file /opt/etc/freeradius3/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]@/ ) {
(2)         if (&User-Name =~ /@[^@]@/ )  -> FALSE
(2)         if (&User-Name =~ /../ ) {
(2)         if (&User-Name =~ /../ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /.$/)  {
(2)         if (&User-Name =~ /.$/)   -> FALSE
(2)         if (&User-Name =~<EMAIL_ADDRESS> {
(2)         if (&User-Name =~<EMAIL_ADDRESS>  -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "espressif.com" for User-Name =<EMAIL_ADDRESS>(2) suffix: No such realm "espressif.com"
(2)     [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 177 length 8
(2) eap: No EAP Start, assuming it's an on-going EAP conversation
(2)     [eap] = updated
(2)     [files] = noop
(2)     [expiration] = noop
(2)     [logintime] = noop
Not doing PAP as Auth-Type is already set.
(2)     [pap] = noop
(2)   } # authorize = updated
(2) Found Auth-Type = eap
(2) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0xc607166ac7b60f6d
(2) eap: Finished EAP session with state 0xc607166ac7b60f6d
(2) eap: Previous EAP request found for state 0xc607166ac7b60f6d, released from the list
(2) eap: Peer sent packet with method EAP NAK (3)
(2) eap: Found mutually acceptable type TLS (13)
(2) eap: Calling submodule eap_tls to process data
(2) eap_tls: Initiating new TLS session
(2) eap_tls: Setting verify mode to require certificate from client
(2) eap_tls: [eaptls start] = request
(2) eap: Sending EAP Request (code 1) ID 178 length 6
(2) eap: EAP session adding &reply:State = 0xc607166ac4b51b6d
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(2)   Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 108 from <IP_ADDRESS>:1812 to <IP_ADDRESS>:48424 length 0
(2)   EAP-Message = 0x01b200060d20
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0xc607166ac4b51b6dda08a4b72dd608fd
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 109 from <IP_ADDRESS>:48424 to <IP_ADDRESS>:1812 length 233
(3)   User-Name =<EMAIL_ADDRESS>(3)   NAS-IP-Address = <IP_ADDRESS>
(3)   Called-Station-Id = "D4-5D-64-4D-7B-C8:ASUS"
(3)   NAS-Port-Type = Wireless-802.11
(3)   Service-Type = Framed-User
(3)   Calling-Station-Id = "C8-2B-96-B8-6A-DC"
(3)   Connect-Info = "CONNECT 0Mbps 802.11g"
(3)   Acct-Session-Id = "AA3CF7806C39EB64"
(3)   Acct-Multi-Session-Id = "0ABFDC1446AD11C1"
(3)   Attr-186 = 0x000fac04
(3)   Attr-187 = 0x000fac04
(3)   Attr-188 = 0x000fac01
(3)   Framed-MTU = 1400
(3)   EAP-Message = 0x02b20008030d1915
(3)   State = 0xc607166ac4b51b6dda08a4b72dd608fd
(3)   Message-Authenticator = 0xa9f191297d509a6b9534d9868bb936e0
(3) session-state: No cached attributes
(3) # Executing section authorize from file /opt/etc/freeradius3/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]@/ ) {
(3)         if (&User-Name =~ /@[^@]@/ )  -> FALSE
(3)         if (&User-Name =~ /../ ) {
(3)         if (&User-Name =~ /../ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/))   -> FALSE
(3)         if (&User-Name =~ /.$/)  {
(3)         if (&User-Name =~ /.$/)   -> FALSE
(3)         if (&User-Name =~<EMAIL_ADDRESS> {
(3)         if (&User-Name =~<EMAIL_ADDRESS>  -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "espressif.com" for User-Name =<EMAIL_ADDRESS>(3) suffix: No such realm "espressif.com"
(3)     [suffix] = noop
(3) eap: Peer sent EAP Response (code 2) ID 178 length 8
(3) eap: No EAP Start, assuming it's an on-going EAP conversation
(3)     [eap] = updated
(3)     [files] = noop
(3)     [expiration] = noop
(3)     [logintime] = noop
Not doing PAP as Auth-Type is already set.
(3)     [pap] = noop
(3)   } # authorize = updated
(3) Found Auth-Type = eap
(3) # Executing group from file /opt/etc/freeradius3/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0xc607166ac4b51b6d
(3) eap: Finished EAP session with state 0xc607166ac4b51b6d
(3) eap: Previous EAP request found for state 0xc607166ac4b51b6d, released from the list
(3) eap: Peer sent packet with method EAP NAK (3)
(3) eap: Peer NAK'd our request for TLS (13) with a request for TLS (13), skipping...
(3) eap: WARNING: !!! We requested to use an EAP type as normal.
(3) eap: WARNING: !!! The supplicant rejected that, and requested to use the same EAP type.
(3) eap: WARNING: !!!     i.e. the supplicant said 'I don't like X, please use X instead.
(3) eap: WARNING: !!! The supplicant software is broken and does not work properly.
(3) eap: WARNING: !!! Please upgrade it to software that works.
(3) eap: Found mutually acceptable type PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Initiating new TLS session

@kaedewang - Can you help us with the default EAP method set on Freeradius side, typically available in mods_available/eap file? Also what is the value of  EAP_METHOD on esp32 in menuconfig?

@kaedewang Thanks for reporting, would you please help share if any updates per the questions by @sagb2015 ? Thanks.

@sagb2015 @Alvin1Zhang
ESP32 EAP method:TLS
EAP setting is almost default.
Only change
default_eap_type = tls
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.pem
disable_tlsv1_2 = no
disable_tlsv1_1 = yes
disable_tlsv1 = yes
tls_min_version = "1.2"
tls_max_version = "1.2"
And delete other unused EAP method
eap {
#  Invoke the default supported EAP type when
#  EAP-Identity response is received.
#
#  The incoming EAP messages DO NOT specify which EAP
#  type they will be using, so it MUST be set here.
#
#  For now, only one default EAP type may be used at a time.
#
#  If the EAP-Type attribute is set by another module,
#  then that EAP type takes precedence over the
#  default type configured here.
#
default_eap_type = tls
    #  A list is maintained to correlate EAP-Response
    #  packets with EAP-Request packets.  After a
    #  configurable length of time, entries in the list
    #  expire, and are deleted.
    #
    timer_expire = 60

    #  There are many EAP types, but the server has support
    #  for only a limited subset.  If the server receives
    #  a request for an EAP type it does not support, then
    #  it normally rejects the request.  By setting this
    #  configuration to "yes", you can tell the server to
    #  instead keep processing the request.  Another module
    #  MUST then be configured to proxy the request to
    #  another RADIUS server which supports that EAP type.
    #
    #  If another module is NOT configured to handle the
    #  request, then the request will still end up being
    #  rejected.
    #
    ignore_unknown_eap_types = no

    # Cisco AP1230B firmware 12.2(13)JA1 has a bug.  When given
    # a User-Name attribute in an Access-Accept, it copies one
    # more byte than it should.
    #
    # We can work around it by configurably adding an extra
    # zero byte.
    #
    cisco_accounting_username_bug = no

    #  Help prevent DoS attacks by limiting the number of
    #  sessions that the server is tracking.  For simplicity,
    #  this is taken from the "max_requests" directive in
    #  radiusd.conf.
    #
    max_sessions = ${max_requests}

    ############################################################
    #
    #  Supported EAP-types
    #

    #  Common TLS configuration for TLS-based EAP types
    #  ------------------------------------------------
    #
    #  See raddb/certs/README for additional comments
    #  on certificates.
    #
    #  If OpenSSL was not found at the time the server was
    #  built, the "tls", "ttls", and "peap" sections will
    #  be ignored.
    #
    #  If you do not currently have certificates signed by
    #  a trusted CA you may use the 'snakeoil' certificates.
    #  Included with the server in raddb/certs.
    #
    #  If these certificates have not been auto-generated:
    #    cd raddb/certs
    #    make
    #
    #  These test certificates SHOULD NOT be used in a normal
    #  deployment.  They are created only to make it easier
    #  to install the server, and to perform some simple
    #  tests with EAP-TLS, TTLS, or PEAP.
    #
    #  Note that you should NOT use a globally known CA here!
    #  e.g. using a Verisign cert as a "known CA" means that
    #  ANYONE who has a certificate signed by them can
    #  authenticate via EAP-TLS!  This is likely not what you want.
    #
    tls-config tls-common {
            private_key_password = whatever
            private_key_file = ${certdir}/server.key

            #  If Private key & Certificate are located in
            #  the same file, then private_key_file &
            #  certificate_file must contain the same file
            #  name.
            #
            #  If ca_file (below) is not used, then the
            #  certificate_file below SHOULD also include all of
            #  the intermediate CA certificates used to sign the
            #  server certificate, but NOT the root CA.
            #
            #  Including the ROOT CA certificate is not useful and
            #  merely inflates the exchanged data volume during
            #  the TLS negotiation.
            #
            #  This file should contain the server certificate,
            #  followed by intermediate certificates, in order.
            #  i.e. If we have a server certificate signed by CA1,
            #  which is signed by CA2, which is signed by a root
            #  CA, then the "certificate_file" should contain
            #  server.pem, followed by CA1.pem, followed by
            #  CA2.pem.
            #
            #  When using "ca_file" or "ca_dir", the
            #  "certificate_file" should contain only
            #  "server.pem".  And then you may (or may not) need
            #  to set "auto_chain", depending on your version of
            #  OpenSSL.
            #
            #  In short, SSL / TLS certificates are complex.
            #  There are many versions of software, each of which
            #  behave slightly differently.  It is impossible to
            #  give advice which will work everywhere.  Instead,
            #  we give general guidelines.
            #
            certificate_file = ${certdir}/server.pem

            #  Trusted Root CA list
            #
            #  This file can contain multiple CA certificates.
            #  ALL of the CA's in this list will be trusted to
            #  issue client certificates for authentication.
            #
            #  In general, you should use self-signed
            #  certificates for 802.1x (EAP) authentication.
            #  In that case, this CA file should contain
            #  *one* CA certificate.
            #
            ca_file = ${cadir}/ca.pem

            #  OpenSSL will automatically create certificate chains,
            #  unless we tell it to not do that.  The problem is that
            #  it sometimes gets the chains right from a certificate
            #  signature view, but wrong from the clients view.
            #
            #  When setting "auto_chain = no", the server certificate
            #  file MUST include the full certificate chain.
            #
    #       auto_chain = yes

            #  If OpenSSL supports TLS-PSK, then we can use a
            #  fixed PSK identity and (hex) password.  As of
            #  3.0.18, these can be used at the same time as the
            #  certificate configuration, but only for TLS 1.0
            #  through 1.2.
            #
            #  If PSK and certificates are configured at the same
            #  time for TLS 1.3, then the server will warn you,
            #  and will disable TLS 1.3, as it will not work.
            #
            #  The work around is to have two modules (or for
            #  RadSec, two listen sections).  One will have PSK
            #  configured, and the other will have certificates
            #  configured.
            #
    #       psk_identity = "test"
    #       psk_hexphrase = "036363823"

            #  Dynamic queries for the PSK.  If TLS-PSK is used,
            #  and psk_query is set, then you MUST NOT use
            #  psk_identity or psk_hexphrase.
            #
            #  Instead, use a dynamic expansion similar to the one
            #  below.  It keys off of TLS-PSK-Identity.  It should
            #  return a of string no more than 512 hex characters.
            #  That string will be converted to binary, and will
            #  be used as the dynamic PSK hexphrase.
            #
            #  Note that this query is just an example.  You will
            #  need to customize it for your installation.
            #
    #       psk_query = "%{sql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}"

            #  For DH cipher suites to work, you have to
            #  run OpenSSL to create the DH file first:
            #
            #    openssl dhparam -out certs/dh 2048
            #
            dh_file = ${certdir}/dh

            #  If your system doesn't have /dev/urandom,
            #  you will need to create this file, and
            #  periodically change its contents.
            #
            #  For security reasons, FreeRADIUS doesn't
            #  write to files in its configuration
            #  directory.
            #
    #       random_file = /dev/urandom

            #  This can never exceed the size of a RADIUS
            #  packet (4096 bytes), and is preferably half
            #  that, to accommodate other attributes in
            #  RADIUS packet.  On most APs the MAX packet
            #  length is configured between 1500 - 1600
            #  In these cases, fragment size should be
            #  1024 or less.
            #
    #       fragment_size = 1024

            #  include_length is a flag which is
            #  by default set to yes If set to
            #  yes, Total Length of the message is
            #  included in EVERY packet we send.
            #  If set to no, Total Length of the
            #  message is included ONLY in the
            #  First packet of a fragment series.
            #
    #       include_length = yes

            #  Check the Certificate Revocation List
            #
            #  1) Copy CA certificates and CRLs to same directory.
            #  2) Execute 'c_rehash <CA certs&CRLs Directory>'.
            #     'c_rehash' is OpenSSL's command.
            #  3) uncomment the lines below.
            #  5) Restart radiusd
    #       check_crl = yes

            # Check if intermediate CAs have been revoked.
    #       check_all_crl = yes

            ca_path = ${cadir}

            # Accept an expired Certificate Revocation List
            #
    #       allow_expired_crl = no

            #  If check_cert_issuer is set, the value will
            #  be checked against the DN of the issuer in
            #  the client certificate.  If the values do not
            #  match, the certificate verification will fail,
            #  rejecting the user.
            #
            #  This check can be done more generally by checking
            #  the value of the TLS-Client-Cert-Issuer attribute.
            #  This check can be done via any mechanism you
            #  choose.
            #
    #       check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"

            #  If check_cert_cn is set, the value will
            #  be xlat'ed and checked against the CN
            #  in the client certificate.  If the values
            #  do not match, the certificate verification
            #  will fail rejecting the user.
            #
            #  This check is done only if the previous
            #  "check_cert_issuer" is not set, or if
            #  the check succeeds.
            #
            #  In 2.1.10 and later, this check can be done
            #  more generally by checking the value of the
            #  TLS-Client-Cert-Common-Name attribute.  This check
            #  can be done via any mechanism you choose.
            #
    #       check_cert_cn = %{User-Name}

            #  Set this option to specify the allowed
            #  TLS cipher suites.  The format is listed
            #  in "man 1 ciphers".
            #
            #  For EAP-FAST, use "ALL:!EXPORT:!eNULL:!SSLv2"
            #
            cipher_list = "DEFAULT"

            #  If enabled, OpenSSL will use server cipher list
            #  (possibly defined by cipher_list option above)
            #  for choosing right cipher suite rather than
            #  using client-specified list which is OpenSSl default
            #  behavior.  Setting this to "yes" means that OpenSSL
            #  will choose the servers ciphers, even if they do not
            #  best match what the client sends.
            #
            #  TLS negotiation is usually good, but can be imperfect.
            #  This setting allows administrators to "fine tune" it
            #  if necessary.
            #
            cipher_server_preference = no

            #  You can selectively disable TLS versions for
            #  compatability with old client devices.
            #
            #  If your system has OpenSSL 1.1.0 or greater, do NOT
            #  use these.  Instead, set tls_min_version and
            #  tls_max_version.
            #
            disable_tlsv1_2 = no
            disable_tlsv1_1 = yes
            disable_tlsv1 = yes

            #  Set min / max TLS version.  Mainly for Debian
            #  "trusty", which disables older versions of TLS, and
            #  requires the application to manually enable them.
            #
            #  If you are running Debian trusty, you should set
            #  these options, otherwise older clients will not be
            #  able to connect.
            #
            #  Allowed values are "1.0", "1.1", "1.2", and "1.3".
            #
            #  Note that the server WILL NOT permit negotiation of
            #  TLS 1.3.  The EAP-TLS standards for TLS 1.3 are NOT
            #  finished.  It is therefore impossible for the server
            #  to negotiate EAP-TLS correctly with TLS 1.3.
            #
            #  The values must be in quotes.
            #
            tls_min_version = "1.2"
            tls_max_version = "1.2"

            #  Elliptical cryptography configuration
            #
            #  Only for OpenSSL >= 0.9.8.f
            #
            ecdh_curve = "prime256v1"

            #  Session resumption / fast reauthentication
            #  cache.
            #
            #  The cache contains the following information:
            #
            #   session Id - unique identifier, managed by SSL
            #   User-Name  - from the Access-Accept
            #   Stripped-User-Name - from the Access-Request
            #   Cached-Session-Policy - from the Access-Accept
            #
            #  See also the "store" subsection below for
            #  additional attributes which can be cached.
            #
            #  The "Cached-Session-Policy" is the name of a
            #  policy which should be applied to the cached
            #  session.  This policy can be used to assign
            #  VLANs, IP addresses, etc.  It serves as a useful
            #  way to re-apply the policy from the original
            #  Access-Accept to the subsequent Access-Accept
            #  for the cached session.
            #
            #  On session resumption, these attributes are
            #  copied from the cache, and placed into the
            #  reply list.
            #
            #  You probably also want "use_tunneled_reply = yes"
            #  when using fast session resumption.
            #
            #  You can check if a session has been resumed by
            #  looking for the existence of the EAP-Session-Resumed
            #  attribute.  Note that this attribute will *only*
            #  exist in the "post-auth" section.
            #
            #  CAVEATS: The cache is stored and reloaded BEFORE
            #  the "post-auth" section is run.  This limitation
            #  makes caching more difficult than it should be.  In
            #  practice, it means that the first authentication
            #  session must set the reply attributes before the
            #  post-auth section is run.
            #
            #  When the session is resumed, the attributes are
            #  restored and placed into the session-state list.
            #
            cache {
                    #  Enable it.  The default is "no". Deleting the entire "cache"
                    #  subsection also disables caching.
                    #
                    #  As of version 3.0.14, the session cache requires the use
                    #  of the "name" and "persist_dir" configuration items, below.
                    #
                    #  The internal OpenSSL session cache has been permanently
                    #  disabled.
                    #
                    #  You can disallow resumption for a particular user by adding the
                    #  following attribute to the control item list:
                    #
                    #    Allow-Session-Resumption = No
                    #
                    #  If "enable = no" below, you CANNOT enable resumption for just one
                    #  user by setting the above attribute to "yes".
                    #
                    enable = no

                    #  Lifetime of the cached entries, in hours. The sessions will be
                    #  deleted/invalidated after this time.
                    #
                    lifetime = 24 # hours

                    #  Internal "name" of the session cache. Used to
                    #  distinguish which TLS context sessions belong to.
                    #
                    #  The server will generate a random value if unset.
                    #  This will change across server restart so you MUST
                    #  set the "name" if you want to persist sessions (see
                    #  below).
                    #
            #       name = "EAP module"

                    #  Simple directory-based storage of sessions.
                    #  Two files per session will be written, the SSL
                    #  state and the cached VPs. This will persist session
                    #  across server restarts.
                    #
                    #  The default directory is ${logdir}, for historical
                    #  reasons.  You should ${db_dir} instead.  And check
                    #  the value of db_dir in the main radiusd.conf file.
                    #  It should not point to ${raddb}
                    #
                    #  The server will need write perms, and the directory
                    #  should be secured from anyone else. You might want
                    #  a script to remove old files from here periodically:
                    #
                    #    find ${logdir}/tlscache -mtime +2 -exec rm -f {} \;
                    #
                    #  This feature REQUIRES "name" option be set above.
                    #
            #       persist_dir = "${logdir}/tlscache"

                    #
                    #  As of 3.0.20, it is possible to partially
                    #  control which attributes exist in the
                    #  session cache.  This subsection lists
                    #  attributes which are taken from the reply,
                    #  and saved to the on-disk cache.  When the
                    #  session is resumed, these attributes are
                    #  added to the "session-state" list.  The
                    #  default configuration will then take care
                    #  of copying them to the reply.
                    #
                    store {
                            Tunnel-Private-Group-Id
                    }
            }

            #  As of version 2.1.10, client certificates can be
            #  validated via an external command.  This allows
            #  dynamic CRLs or OCSP to be used.
            #
            #  This configuration is commented out in the
            #  default configuration.  Uncomment it, and configure
            #  the correct paths below to enable it.
            #
            #  If OCSP checking is enabled, and the OCSP checks fail,
            #  the verify section is not run.
            #
            #  If OCSP checking is disabled, the verify section is
            #  run on successful certificate validation.
            #
            verify {
                    #  If the OCSP checks succeed, the verify section
                    #  is run to allow additional checks.
                    #
                    #  If you want to skip verify on OCSP success,
                    #  uncomment this configuration item, and set it
                    #  to "yes".
                    #
            #       skip_if_ocsp_ok = no

                    #  A temporary directory where the client
                    #  certificates are stored.  This directory
                    #  MUST be owned by the UID of the server,
                    #  and MUST not be accessible by any other
                    #  users.  When the server starts, it will do
                    #  "chmod go-rwx" on the directory, for
                    #  security reasons.  The directory MUST
                    #  exist when the server starts.
                    #
                    #  You should also delete all of the files
                    #  in the directory when the server starts.
                    #
            #       tmpdir = /tmp/radiusd

                    #  The command used to verify the client cert.
                    #  We recommend using the OpenSSL command-line
                    #  tool.
                    #
                    #  The ${..ca_path} text is a reference to
                    #  the ca_path variable defined above.
                    #
                    #  The %{TLS-Client-Cert-Filename} is the name
                    #  of the temporary file containing the cert
                    #  in PEM format.  This file is automatically
                    #  deleted by the server when the command
                    #  returns.
                    #
            #       client = "/path/to/openssl verify -CApath ${..ca_path} %{TLS-Client-Cert-Filename}"
            }

            #  OCSP Configuration
            #
            #  Certificates can be verified against an OCSP
            #  Responder. This makes it possible to immediately
            #  revoke certificates without the distribution of
            #  new Certificate Revocation Lists (CRLs).
            #
            ocsp {
                    #  Enable it.  The default is "no".
                    #  Deleting the entire "ocsp" subsection
                    #  also disables ocsp checking
                    #
                    enable = no

                    #  The OCSP Responder URL can be automatically
                    #  extracted from the certificate in question.
                    #  To override the OCSP Responder URL set
                    #  "override_cert_url = yes".
                    #
                    override_cert_url = yes

                    #  If the OCSP Responder address is not extracted from
                    #  the certificate, the URL can be defined here.
                    #
                    url = "http://<IP_ADDRESS>/ocsp/"

                    # If the OCSP Responder can not cope with nonce
                    # in the request, then it can be disabled here.
                    #
                    # For security reasons, disabling this option
                    # is not recommended as nonce protects against
                    # replay attacks.
                    #
                    # Note that Microsoft AD Certificate Services OCSP
                    # Responder does not enable nonce by default. It is
                    # more secure to enable nonce on the responder than
                    # to disable it in the query here.
                    # See http://technet.microsoft.com/en-us/library/cc770413%28WS.10%29.aspx
                    #
            #       use_nonce = yes

                    # Number of seconds before giving up waiting
                    # for OCSP response. 0 uses system default.
                    #
            #       timeout = 0

                    # Normally an error in querying the OCSP
                    # responder (no response from server, server did
                    # not understand the request, etc) will result in
                    # a validation failure.
                    #
                    # To treat these errors as 'soft' failures and
                    # still accept the certificate, enable this
                    # option.
                    #
                    # Warning: this may enable clients with revoked
                    # certificates to connect if the OCSP responder
                    # is not available. Use with caution.
                    #
            #       softfail = no
            }
    }

    #  EAP-TLS
    #
    #  As of Version 3.0, the TLS configuration for TLS-based
    #  EAP types is above in the "tls-config" section.
    #
    tls {
            #  Point to the common TLS configuration
            #
            tls = tls-common

            #  As part of checking a client certificate, the EAP-TLS
            #  sets some attributes such as TLS-Client-Cert-Common-Name. This
            #  virtual server has access to these attributes, and can
            #  be used to accept or reject the request.
            #
    #       virtual_server = check-eap-tls
    }

    #  EAP-PEAP
    #

    ##################################################
    #
    #  !!!!! WARNINGS for Windows compatibility  !!!!!
    #
    ##################################################
    #
    #  If you see the server send an Access-Challenge,
    #  and the client never sends another Access-Request,
    #  then
    #
    #               STOP!
    #
    #  The server certificate has to have special OID's
    #  in it, or else the Microsoft clients will silently
    #  fail.  See the "scripts/xpextensions" file for
    #  details, and the following page:
    #
    #       https://support.microsoft.com/en-us/help/814394/
    #
    #  If is still doesn't work, and you're using Samba,
    #  you may be encountering a Samba bug.  See:
    #
    #       https://bugzilla.samba.org/show_bug.cgi?id=6563
    #
    #  Note that we do not necessarily agree with their
    #  explanation... but the fix does appear to work.
    #
    ##################################################

    #  The tunneled EAP session needs a default EAP type
    #  which is separate from the one for the non-tunneled
    #  EAP module.  Inside of the TLS/PEAP tunnel, we
    #  recommend using EAP-MS-CHAPv2.
    #
    peap {
            #  Which tls-config section the TLS negotiation parameters
            #  are in - see EAP-TLS above for an explanation.
            #
            #  In the case that an old configuration from FreeRADIUS
            #  v2.x is being used, all the options of the tls-config
            #  section may also appear instead in the 'tls' section
            #  above. If that is done, the tls= option here (and in
            #  tls above) MUST be commented out.
            #
            tls = tls-common

            #  The tunneled EAP session needs a default
            #  EAP type which is separate from the one for
            #  the non-tunneled EAP module.  Inside of the
            #  PEAP tunnel, we recommend using MS-CHAPv2,
            #  as that is the default type supported by
            #  Windows clients.
            #
            default_eap_type = mschapv2

            #  The PEAP module also has these configuration
            #  items, which are the same as for TTLS.
            #
            copy_request_to_tunnel = no

            #  As of version 3.0.5, this configuration item
            #  is deprecated.  Instead, you should use
            #
            #    update outer.session-state {
            #      ...
            #    }
            #
            #  This will cache attributes for the final Access-Accept.
            #
            use_tunneled_reply = no

            #  When the tunneled session is proxied, the
            #  home server may not understand EAP-MSCHAP-V2.
            #  Set this entry to "no" to proxy the tunneled
            #  EAP-MSCHAP-V2 as normal MSCHAPv2.
            #
    #       proxy_tunneled_request_as_eap = yes

            #  The inner tunneled request can be sent
            #  through a virtual server constructed
            #  specifically for this purpose.
            #
            #  A virtual server MUST be specified.
            #
            virtual_server = "inner-tunnel"

            #  This option enables support for MS-SoH
            #  see doc/SoH.txt for more info.
            #  It is disabled by default.
            #
    #       soh = yes

            #  The SoH reply will be turned into a request which
            #  can be sent to a specific virtual server:
            #
    #       soh_virtual_server = "soh-server"

            #  Unlike EAP-TLS, PEAP does not require a client certificate.
            #  However, you can require one by setting the following
            #  option. You can also override this option by setting
            #
            #    EAP-TLS-Require-Client-Cert = Yes
            #
            #  in the control items for a request.
            #
            #  Note that the majority of supplicants do not support using a
            #  client certificate with PEAP, so this option is unlikely to
            #  be usable for most people.
            #
    #       require_client_cert = yes
    }

    #  EAP-MSCHAPv2
    #
    #  Note that it is the EAP MS-CHAPv2 sub-module, not
    #  the main 'mschap' module.
    #
    #  Note also that in order for this sub-module to work,
    #  the main 'mschap' module MUST ALSO be configured.
    #
    #  This module is the *Microsoft* implementation of MS-CHAPv2
    #  in EAP.  There is another (incompatible) implementation
    #  of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not
    #  currently support.
    #
    mschapv2 {
            #  Prior to version 2.1.11, the module never
            #  sent the MS-CHAP-Error message to the
            #  client.  This worked, but it had issues
            #  when the cached password was wrong.  The
            #  server *should* send "E=691 R=0" to the
            #  client, which tells it to prompt the user
            #  for a new password.
            #
            #  The default is to behave as in 2.1.10 and
            #  earlier, which is known to work.  If you
            #  set "send_error = yes", then the error
            #  message will be sent back to the client.
            #  This *may* help some clients work better,
            #  but *may* also cause other clients to stop
            #  working.
            #
    #       send_error = no

            #  Server identifier to send back in the challenge.
            #  This should generally be the host name of the
            #  RADIUS server.  Or, some information to uniquely
            #  identify it.
            #
    #       identity = "FreeRADIUS"
    }

}

I successed to connect wpa2-enterprise by EAP-TLS.
The problem is client key. I used client key with password. After clearing password it is OK.

@kaedewang
The password protected client key should also work.
ESP_ERROR_CHECK( esp_wifi_sta_wpa2_ent_set_cert_key(client_crt_start, client_crt_bytes,\
            client_key_start, client_key_bytes, NULL, 0) );

The latest 2 parameters is private_key_passwd and private_key_passwd_len.
You can check again by set correct password and password length.

The password protected client key should also work.
ESP_ERROR_CHECK( esp_wifi_sta_wpa2_ent_set_cert_key(client_crt_start, client_crt_bytes,\
            client_key_start, client_key_bytes, NULL, 0) );

The latest 2 parameters is private_key_passwd and private_key_passwd_len.
You can check again by set correct password and password length.

@AxelLin, sorry for this noob question, but i'm struggling with the understanding of that function.
From my understanding, the following is a common use-case:

Considering a network configured as WPA2-EAP TLS
Then, the IT administrator will give to me a ca-certificate for server certification and a client certificate that is used by my client to authenticate towards the server
The ca-certificate has to be set with esp_wifi_sta_wpa2_ent_set_ca_cert()
The client certificate has to be set with esp_wifi_sta_wpa2_ent_set_cert_key()

But what to pass to client_key_start, if i only have gotten the client certificate (.crt) file but no "client key" (that is also called private_key in the header file)?

@dabbinavo In PKI, both parties (client and server in this case) generate <private, public> key pair and get certificates from trusted CA (which ties public key to the identity). Each side is supposed to know and keep their private keys private. The arg client_key_start refers to private key of the ESP32 device. Please refer to this article for more information on PKI and also contact your IT admin about generating the key pair and getting client-certificate signed by CA trusted by your organisation.

@sagb2015 Thanks for the information! It wasn't clear to me, that the user certificate (client certificate) in .p12 format (PKCS#12) distributed by the IT admin contains both, the certificate and the private key. So to use the ESP-IDF API esp_wifi_sta_wpa2_ent_set_cert_key(...);, the certificate and the private key first have to be extracted from the .p12 file and then passed to the arguments client_cert and private_key (and private_key_passwd if a password had to be specified during the extraction process for private key), right?
If so, does some ESP-IDF library running on the ESP32 already provide any functions to extract the certificate and private key from a .p12 file or do I have to include/use a separate library for this (e.g. openssl which can do that)?

@kaedewang
The password protected client key should also work.
ESP_ERROR_CHECK( esp_wifi_sta_wpa2_ent_set_cert_key(client_crt_start, client_crt_bytes,\
            client_key_start, client_key_bytes, NULL, 0) );

The latest 2 parameters is private_key_passwd and private_key_passwd_len.
You can check again by set correct password and password length.

I take it back.
While testing with v4.3-356-g48ae2309fd9c, I found the same issue as reported by https://github.com/espressif/esp-idf/issues/5698#issuecomment-682328164
(It does not work if the client key needs password, but it works if the key does not need password).
I test again with v4.4-dev-2825-gb63ec47238fd, the same symptom: It does not work if the client key needs password.
@sagb2015 @kapilkedawat  (I think this issue should be re-open)

@sagb2015 Thanks for the information! It wasn't clear to me, that the user certificate (client certificate) in .p12 format (PKCS#12) distributed by the IT admin contains both, the certificate and the private key. So to use the ESP-IDF API esp_wifi_sta_wpa2_ent_set_cert_key(...);, the certificate and the private key first have to be extracted from the .p12 file and then passed to the arguments client_cert and private_key (and private_key_passwd if a password had to be specified during the extraction process for private key), right?
If so, does some ESP-IDF library running on the ESP32 already provide any functions to extract the certificate and private key from a .p12 file or do I have to include/use a separate library for this (e.g. openssl which can do that)?

Hi @dabbinavo , you can use openssl commands to extract certificate and key.

While testing with v4.3-356-g48ae2309fd9c, I found the same issue as reported by #5698 (comment)
(It does not work if the client key needs password, but it works if the key does not need password).

I test again with v4.4-dev-2825-gb63ec47238fd, the same symptom: It does not work if the client key needs password.

Hi @AxelLin , can you please share the certificates that you have used? If not possible, can you please share the cert type?

@kapilkedawat
My testing ca, client certificate, key as below.
(For password protected key, the password: whatever)
ca.pem + client.crt + client_without_pwd.key works.
ca.pem + client.crt + client_with_pwd.key + passord(whatever) fails.
ca.pem.txt
client.crt.txt
client_without_pwd.key.txt
client_with_pwd.key.txt

@kapilkedawat
I test again, this time it works. (No idea why if fails in my previous test).
With CONFIG_WPA_DEBUG_PRINT=y, it works but it shows some error messages as below (FYI).
(The same error messages on both v4.3 and master)
I (3941) wifi:new:<11,2>, old:<1,0>, ap:<255,255>, sta:<11,2>, prof:1
I (4958) wifi:state: init -> auth (b0)
I (4999) wifi:state: auth -> assoc (0)
I (5047) wifi:state: assoc -> run (10)
I (5048) wpa: wpa2_task prio:2, stack:6656
I (17123) wpa: SSL: Need 1914 bytes more input data
I (20117) wpa: SSL: Need 920 bytes more input data
E (22611) net_utils: wifi_sta_up timeout 20000 ms, bits=0x0
I (24224) wpa: application data is null, adding one byte for ack
I (24233) wpa: >>>>>wpa2 FINISH
E (25240) wpa: RSN: PMKSA cache entry found - PMKID - hexdump(len=16):
E (25241) wpa: 92 98 05 cd 6c 63 ed cf 7b fb e2 44 7d d3 51 ae
I (26259) wifi:connected with IGS-MESH, aid = 2, channel 11, 40D, bssid = 18:a6:f7:ab:ca:66
I (26260) wifi:security: WPA2-ENT, phy: bgn, rssi: -49
I (26262) wifi:pm start, type: 1
W (26265) wifi:Next TBTT incorrect! last beacon:1318892, offset:383, next beacon:11763692, beacon interval:102400, dtim period:0, dtim count:0, listen interval:3, now:23657636

@kapilkedawat
(I'm not sure how it works in my previous test. I guess it was mistakely tested with non password protected key)
Test again with v4.4-dev-2928-gd5f58ab13551 and v4.3.1 debug build, I got below error message on the device:
E (407759) wpa: mbedtls_pk_parse_keyfile returned -0x2e80
E (407759) wpa: Failed to set client pki context
E (407760) wpa: Failed to set client configurations
E (407765) wpa: failed to create ssl handle
I (407770) wpa: TLS: Failed to set TLS connection parameters
I (407776) wpa: EAP-TLS: Failed to initialize SSL.

@kapilkedawat
(I'm not sure how it works in my previous test. I guess it was mistakely tested with non password protected key)
Test again with v4.4-dev-2928-gd5f58ab13551 and v4.3.1 debug build, I got below error message on the device:
E (407759) wpa: mbedtls_pk_parse_keyfile returned -0x2e80
E (407759) wpa: Failed to set client pki context
E (407760) wpa: Failed to set client configurations
E (407765) wpa: failed to create ssl handle
I (407770) wpa: TLS: Failed to set TLS connection parameters
I (407776) wpa: EAP-TLS: Failed to initialize SSL.

Hi @kapilkedawat
Above error is because mbedtls_cipher_info_from_type() failed which is because the
cipher_alg is MBEDTLS_CIPHER_DES_EDE3_CBC and it is not supported.
Setting CONFIG_MBEDTLS_DES_C=y avoid the error.
Then I can connect to the AP.
Note, even though it works in the end, it fails so may times before successfully join the AP. (I got many disconnect with reason 204, 205).

@kapilkedawat
I tried diffent -keypbe setting to generate the key via openssl, e.g. PBE-SHA1-RC2-128
# openssl pkcs12 -info -in client.p12 -noout
Enter Import Password:
MAC: sha1, Iteration 2048
MAC length: 20, salt length: 8
PKCS7 Encrypted data: pbeWithSHA1And128BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And128BitRC2-CBC, Iteration 2048

But I still got below error if CONFIG_MBEDTLS_DES_C=n
E (111835) wpa: mbedtls_pk_parse_keyfile returned -0x2e80
Is it necessary to set CONFIG_MBEDTLS_DES_C=y for password protected key?
I'm wondering if I missed something? ( How to test password protected key with CONFIG_MBEDTLS_DES_C=n?)

Hi @AxelLin ,
You can try with AES encryptions(128-192-256 bits). I would advise against enabling DES since it is vulnerable to sweet32 attacks.

Hi @AxelLin ,
You can try with AES encryptions(128-192-256 bits). I would advise against enabling DES since it is vulnerable to sweet32 attacks.

Could you show me the example to generate AES encryption key? Thanks.

Hi @AxelLin ,
Following are the steps to generate the encrypted Crts.
1.openssl genrsa -aes256 -out server.key 4096 {AES encryption of the 	private key}
2. openssl req -new -key server.key -out server.csr -config <required_config>
3. openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key 'whatever' -out server.crt -config <required_config>
For more detailed steps,Pls refer this Doc. Link

@AxelLin
Hello, I cannot connect to the RADIUS server while debugging EAP-TLS. I am using IDF4.4, the routine is WPA2_Enterprise and the chip is ESP32-D0WDQ6-V3.
I replaced wpa2_ca.pem, wpa2_client.crt, wpa2_client.ket, and wpa2_client.pem in my routine with files in the RADIUS server.
I don't use CA authentication, so I disabled it in the ConfigurAction Editor and selected TLS for the EAP Method.
When I use a Huawei mobile phone to connect to RADIUS, a user certificate is selected. The user certificate is a client. p12 file provided by my colleagues who set up RADIUS.
But I don't understand how ESP32 uses the client.p12 file.

When I use a Huawei mobile phone to connect to RADIUS, a user certificate is selected. The user certificate is a client. p12 file provided by my colleagues who set up RADIUS.
But I don't understand how ESP32 uses the client.p12 file.

If you want to use the .p12 file on ESP32, you have to extract the information from it. You can do this for example with openSSL:
https://github.com/openssl/openssl/blob/master/demos/pkcs12/pkread.c

Hi @AxelLin , Following are the steps to generate the encrypted Crts. 1.openssl genrsa -aes256 -out server.key 4096 {AES encryption of the private key}

Hi @nishanth-radja
Above command does not work, I need to add additional "-traditional" to make it generate PKCS#1 format instead of default PKCS#8 format.
Without "-traditional" , I got E (6105) wpa: mbedtls_pk_parse_keyfile returned -0x2e80.
pk_parse_key_pkcs8_encrypted_der()
    mbedtls_pkcs5_pbes2()
        mbedtls_oid_get_cipher_alg() returns MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA

Just wondering Is it possible to support PKCS#8 format?

@dabbinavo
Thank you for your answer. Let me look at the routine first。


Menlo font not applied to all code files [Android]

Although the Menlo font comes with default in iOS devices, it doesn't for Android hence why I recently linked it to the app. Noticing something very weird where some files (yarn.lock for example - it seems applied but not for others 🤔 )

The same applies for repository code files as well as pull request diff screens

I'll take a look during the afternoon, maybe it's caused by #60

Cheers it might be but I wasn't sure - thanks matey 🙌

Are we sure every custom fonts are rendered in Android ?
From https://github.com/gitpoint/git-point/blob/master/src/config/fonts.js#L11-L17 :
const androidFonts = {
  fontPrimaryLight: { fontFamily: 'OpensSans-Light', fontWeight: '300' },
  fontPrimary: { fontFamily: 'OpensSans-Regular' },
  fontPrimarySemiBold: { fontFamily: 'OpensSans-SemiBold', fontWeight: '600' },
  fontPrimaryBold: { fontFamily: 'OpensSans-Bold', fontWeight: '700' },
  fontCode: { fontFamily: 'Menlo' },
};

All OpenSans fonts have a weird s in the javascript declaration that doesn't exist in fonts name (https://github.com/gitpoint/git-point/tree/master/android/app/src/main/assets/fonts).

I removed these extra s, results are here :

Before
After

g of gitpoint (Owner section) is different!
(Menlo is still buggy...)

:disappointed: :disappointed: :disappointed: :disappointed: How did I not catch that extra S :disappointed: :disappointed: :disappointed: :disappointed:
Thanks so much for noticing mate - let me know if you notice anything fishy about the Menlo font as well

I created a test view for the fonts:

Menlo seems to be applied, but in a ugly way... Corrupted or incompatiblettf?

It does look ugly :thinking:
I can try switching it up for another .ttf (but feel free to try and find one if you like). I found this one here so I guess that probably wasn't a good idea :joy: https://github.com/hbin/top-programming-fonts


I have searched in existing issues.

Oh, it seems that I mistakenly clicked on "convert to issue" from a list item in #4292 without noticing. :scream:
It is very confusing (I didn't even had any confirmation).


Update DI questions

Hi @fredericbarthelet ,
sorry for the time needed to reach you : would you mind to rebase your contribution ?
I'll merge it 👍

@mickaelandrieu , I just rebased :)

Thanks !


WideningTransformer misdirects IntersectionOperations

transformIntersectionOperation() should forward to transformSetOperation(), not transformBinaryOperation() as it currently does on line 147:
    shared actual default Result transformIntersectionOperation(IntersectionOperation that) => transformBinaryOperation(that);

Thanks, should be fixed now.

Thanks!


curl: (60) SSL certificate problem when trying to install vcpkg on Ubuntu 20,4

Operating system
ubuntu 20.4
Compiler
No response
Steps to reproduce the behavior
I followed the tutorial here to install vcpkg
https://vcpkg.io/en/getting-started.html

git clone https://github.com/Microsoft/vcpkg.git

When I excute second step
./vcpkg/bootstrap-vcpkg.sh

I get the error about curl(60) ssl.

Failure logs
Downloading vcpkg-glibc...
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Additional context
I tried to look it in Stack Overflow and the website suggested in terminal, could not solve it.

Have you tried this: https://stackoverflow.com/a/54403068/10162645 ?

Have you tried this: https://stackoverflow.com/a/54403068/10162645 ?

thank you for your help.
Yes I have tried. The thing is curl works for me for most url. So I think I am not in the same case.
I just tried a few times, I think maybe it's due to the connection to github.
>curl https://github.com/
curl: (7) Failed to connect to github.com port 443 after 27 ms: Bad access

but the weird part is I can do git clone (like in the first step).

update:
I managed to update ca-certificate again. It works for all links except github.
curl -k https://github.com w can work
So I think it might be proxy and firewall probelm.
When I look into bootstrap-vcpkg.sh.
I found there is indeed a  github link in it.
https://github.com/microsoft/vcpkg-tool/releases/download/$vcpkgToolReleaseTag/$vcpkgToolName

#!/bin/sh

Find .vcpkg-root.
vcpkgRootDir=$(X= cd -- "$(dirname -- "$0")" && pwd -P)
while [ "$vcpkgRootDir" != "/" ] && ! [ -e "$vcpkgRootDir/.vcpkg-root" ]; do
vcpkgRootDir="$(dirname "$vcpkgRootDir")"
done
Parse arguments.
vcpkgDisableMetrics="OFF"
vcpkgUseSystem=false
vcpkgUseMuslC="OFF"
for var in "$@"
do
if [ "$var" = "-disableMetrics" -o "$var" = "--disableMetrics" ]; then
vcpkgDisableMetrics="ON"
elif [ "$var" = "-useSystemBinaries" -o "$var" = "--useSystemBinaries" ]; then
echo "Warning: -useSystemBinaries no longer has any effect; ignored. Note that the VCPKG_USE_SYSTEM_BINARIES environment variable behavior is not changed."
elif [ "$var" = "-allowAppleClang" -o "$var" = "--allowAppleClang" ]; then
echo "Warning: -allowAppleClang no longer has any effect; ignored."
elif [ "$var" = "-buildTests" ]; then
echo "Warning: -buildTests no longer has any effect; ignored."
elif [ "$var" = "-musl" ]; then
vcpkgUseMuslC="ON"
elif [ "$var" = "-help" -o "$var" = "--help" ]; then
echo "Usage: ./bootstrap-vcpkg.sh [options]"
echo
echo "Options:"
echo "    -help                Display usage help"
echo "    -disableMetrics      Mark this vcpkg root to disable metrics."
echo "    -musl                Use the musl binary rather than the glibc binary on Linux."
exit 1
else
echo "Unknown argument $var. Use '-help' for help."
exit 1
fi
done
Enable using this entry point on windows from git bash by redirecting to the .bat file.
unixName=$(uname -s | sed 's/MINGW._NT./MINGW_NT/')
if [ "$unixName" = "MINGW_NT" ]; then
if [ "$vcpkgDisableMetrics" = "ON" ]; then
args="-disableMetrics"
else
args=""
fi
vcpkgRootDir=$(cygpath -aw "$vcpkgRootDir")
cmd "/C $vcpkgRootDir\\bootstrap-vcpkg.bat $args" || exit 1
exit 0

fi
Determine the downloads directory.
if [ -z ${VCPKG_DOWNLOADS+x} ]; then
downloadsDir="$vcpkgRootDir/downloads"
else
downloadsDir="$VCPKG_DOWNLOADS"
if [ ! -d "$VCPKG_DOWNLOADS" ]; then
echo "VCPKG_DOWNLOADS was set to '$VCPKG_DOWNLOADS', but that was not a directory."
exit 1
fi
fi
Check for minimal prerequisites.
vcpkgCheckRepoTool()
{
__tool=$1
if ! command -v "$__tool" >/dev/null 2>&1 ; then
echo "Could not find $__tool. Please install it (and other dependencies) with:"
echo "On Debian and Ubuntu derivatives:"
echo "  sudo apt-get install curl zip unzip tar"
echo "On recent Red Hat and Fedora derivatives:"
echo "  sudo dnf install curl zip unzip tar"
echo "On older Red Hat and Fedora derivatives:"
echo "  sudo yum install curl zip unzip tar"
echo "On SUSE Linux and derivatives:"
echo "  sudo zypper install curl zip unzip tar"
echo "On Arch Linux and derivatives:"
echo "  sudo pacman -S curl zip unzip tar cmake ninja"
echo "On Alpine:"
echo "  apk add build-base cmake ninja zip unzip curl git"
echo "  (and export VCPKG_FORCE_SYSTEM_BINARIES=1)"
exit 1
fi
}
vcpkgCheckRepoTool curl
vcpkgCheckRepoTool zip
vcpkgCheckRepoTool unzip
vcpkgCheckRepoTool tar
UNAME="$(uname)"
ARCH="$(uname -m)"
if [ -e /etc/alpine-release ]; then
vcpkgUseSystem="ON"
if [ "$ARCH" = "x86_64" ]; then
vcpkgUseMuslC="ON"
fi
fi
if [ "$UNAME" = "OpenBSD" ]; then
vcpkgUseSystem="ON"
if [ -z "$CXX" ]; then
    CXX=/usr/bin/clang++
fi
if [ -z "$CC" ]; then
    CC=/usr/bin/clang
fi

fi
if [ "$vcpkgUseSystem" = "ON" ]; then
vcpkgCheckRepoTool cmake
vcpkgCheckRepoTool ninja
vcpkgCheckRepoTool git
vcpkgCheckRepoTool gcc
fi
Determine what we are going to do to bootstrap:
MacOS -> Download vcpkg-macos
Linux
useMuslC -> download vcpkg-muslc
amd64 -> download vcpkg-glibc
Otherwise
Download and build from source
Choose the vcpkg binary to download
vcpkgDownloadTool="ON"
vcpkgToolReleaseTag="2023-04-07"
if [ "$UNAME" = "Darwin" ]; then
echo "Downloading vcpkg-macos..."
vcpkgToolReleaseSha="2a2805aa251a9523311c813e9e68896f18805fed4ace301c603f4afac3940b27d4ef1d3b4572c8f93ce4d13ac613720275b9e21e39cc5d19115d2fc849bfe2bb"
vcpkgToolName="vcpkg-macos"
elif [ "$vcpkgUseMuslC" = "ON" ]; then
echo "Downloading vcpkg-muslc..."
vcpkgToolReleaseSha="d8dc48e6dc866f4ebe3919c0bf1377769d6c6f1ad2dab7fc09da9b26f7dac3ab3b06affb585ece7ba72e2fdeacdc77b8df31ad08cff49e4c060b7647fc1cc22a"
vcpkgToolName="vcpkg-muslc"
elif [ "$ARCH" = "x86_64" ]; then
echo "Downloading vcpkg-glibc..."
vcpkgToolReleaseSha="f26aaf5f503b9fd0a8b206230df19af966390d7087a9f3342f24c2d5e73f1f1bd81cba2695a89c87015ec822bd41bf836c2a9ef9f0e11acc61d6d9593aa8fae9"
vcpkgToolName="vcpkg-glibc"
else
echo "Unable to determine a binary release of vcpkg; attempting to build from source."
vcpkgDownloadTool="OFF"
vcpkgToolReleaseSha="89dc32154e22f6a51fa18a8ea22c16263533546469f73cdb4ee168ab7c68ebc2b2a93177284dc03ecf2d2ca438f9fd583def48844788942e98ea45027e8ec2fa"
fi
Do the download or build.
vcpkgCheckEqualFileHash()
{
url=$1; filePath=$2; expectedHash=$3
if command -v "sha512sum" >/dev/null 2>&1 ; then
    actualHash=$(sha512sum "$filePath")
else
    # sha512sum is not available by default on osx
    # shasum is not available by default on Fedora
    actualHash=$(shasum -a 512 "$filePath")
fi

actualHash="${actualHash%% *}" # shasum returns [hash filename], so get the first word

if ! [ "$expectedHash" = "$actualHash" ]; then
    echo ""
    echo "File does not have expected hash:"
    echo "              url: [ $url ]"
    echo "        File path: [ $downloadPath ]"
    echo "    Expected hash: [ $sha512 ]"
    echo "      Actual hash: [ $actualHash ]"
    exit 1
fi

}
vcpkgDownloadFile()
{
url=$1; downloadPath=$2 sha512=$3
rm -rf "$downloadPath.part"
curl -L $url --tlsv1.2 --create-dirs --retry 3 --output "$downloadPath.part" --silent --show-error --fail || exit 1
vcpkgCheckEqualFileHash $url "$downloadPath.part" $sha512
chmod +x "$downloadPath.part"
mv "$downloadPath.part" "$downloadPath"

}
vcpkgExtractTar()
{
archive=$1; toPath=$2
rm -rf "$toPath" "$toPath.partial"
mkdir -p "$toPath.partial"
$(cd "$toPath.partial" && tar xzf "$archive")
mv "$toPath.partial" "$toPath"
}
if [ "$vcpkgDownloadTool" = "ON" ]; then
vcpkgDownloadFile "https://github.com/microsoft/vcpkg-tool/releases/download/$vcpkgToolReleaseTag/$vcpkgToolName" "$vcpkgRootDir/vcpkg" $vcpkgToolReleaseSha
else
if [ "x$CXX" = "x" ]; then
if which g++-12 >/dev/null 2>&1; then
CXX=g++-12
elif which g++-11 >/dev/null 2>&1; then
CXX=g++-11
elif which g++-10 >/dev/null 2>&1; then
CXX=g++-10
elif which g++-9 >/dev/null 2>&1; then
CXX=g++-9
elif which g++-8 >/dev/null 2>&1; then
CXX=g++-8
elif which g++-7 >/dev/null 2>&1; then
CXX=g++-7
elif which g++-6 >/dev/null 2>&1; then
CXX=g++-6
elif which g++ >/dev/null 2>&1; then
CXX=g++
fi
# If we can't find g++, allow CMake to do the look-up
fi
vcpkgToolReleaseTarball="$vcpkgToolReleaseTag.tar.gz"
vcpkgToolUrl="https://github.com/microsoft/vcpkg-tool/archive/$vcpkgToolReleaseTarball"
baseBuildDir="$vcpkgRootDir/buildtrees/_vcpkg"
buildDir="$baseBuildDir/build"
tarballPath="$downloadsDir/$vcpkgToolReleaseTarball"
srcBaseDir="$baseBuildDir/src"
srcDir="$srcBaseDir/vcpkg-tool-$vcpkgToolReleaseTag"

if [ -e "$tarballPath" ]; then
    vcpkgCheckEqualFileHash "$vcpkgToolUrl" "$tarballPath" "$vcpkgToolReleaseSha"
else
    echo "Downloading vcpkg tool sources"
    vcpkgDownloadFile "$vcpkgToolUrl" "$tarballPath" "$vcpkgToolReleaseSha"
fi

echo "Building vcpkg-tool..."
rm -rf "$baseBuildDir"
mkdir -p "$buildDir"
vcpkgExtractTar "$tarballPath" "$srcBaseDir"
cmakeConfigOptions="-DCMAKE_BUILD_TYPE=Release -G 'Ninja' -DVCPKG_DEVELOPMENT_WARNINGS=OFF"

if [ "${VCPKG_MAX_CONCURRENCY}" != "" ] ; then
    cmakeConfigOptions=" $cmakeConfigOptions '-DCMAKE_JOB_POOL_COMPILE:STRING=compile' '-DCMAKE_JOB_POOL_LINK:STRING=link' '-DCMAKE_JOB_POOLS:STRING=compile=$VCPKG_MAX_CONCURRENCY;link=$VCPKG_MAX_CONCURRENCY' "
fi

(cd "$buildDir" && CXX="$CXX" eval cmake "$srcDir" $cmakeConfigOptions) || exit 1
(cd "$buildDir" && cmake --build .) || exit 1

rm -rf "$vcpkgRootDir/vcpkg"
cp "$buildDir/vcpkg" "$vcpkgRootDir/"

fi
Apply the disable-metrics marker file.
if [ "$vcpkgDisableMetrics" = "ON" ]; then
touch "$vcpkgRootDir/vcpkg.disable-metrics"
elif ! [ -f "$vcpkgRootDir/vcpkg.disable-metrics" ]; then
# Note that we intentionally leave any existing vcpkg.disable-metrics; once a user has
# opted out they should stay opted out.
cat <<EOF
Telemetry
vcpkg collects usage data in order to help us improve your experience.
The data collected by Microsoft is anonymous.
You can opt-out of telemetry by re-running the bootstrap-vcpkg script with -disableMetrics,
passing --disable-metrics to vcpkg on the command line,
or by setting the VCPKG_DISABLE_METRICS environment variable.
Read more about vcpkg telemetry at docs/about/privacy.md
EOF
fi

Hi I managed to solve the certificates issue today.
Now I am in the last step on installing vcpkg.
When I run

@~$ ./vcpkg/bootstrap-vcpkg.sh
Downloading vcpkg-glibc...
:~$ vcpkg
vcpkg: command not found

seems there is no warning but installation failed.
@Cheney-W could you please open a new issue? Sorry for the bothering but I think my issue is no longer same as yesterday.

@bghjmn32  There is no installation here.
./vcpkg/bootstrap-vcpkg.sh

runs the bootstrap-vcpkg.sh script in the vcpkg directory. That script will simply put the vcpkg tool into that directory.
vcpkg

searchs for a program called vcpkg via environment variable PATH. Normally this wont include the vcpkg dir, so it will fail.
cd vcpkg

makes the dir with the vcpkg repo your current working dir. Now you can run vcpkg with a shot path relative to the current dir:
./vcpkg install zlib

@dg0yt
Thanks very much for your knid help!
I just cd vcpkg and tried your command ./vcpkg install zlib.
My Ubuntu:~/vcpkg$ ./vcpkg install zlib
Computing installation plan...
A suitable version of cmake was not found (required v3.25.1) Downloading portable cmake 3.25.1...
Downloading cmake...
https://github.com/Kitware/CMake/releases/download/v3.25.1/cmake-3.25.1-linux-x86_64.tar.gz->/home/My Ubuntu/vcpkg/downloads/cmake-3.25.1-linux-x86_64.tar.gz
Extracting cmake...
The following packages will be built and installed:
  * vcpkg-cmake[core]:x64-linux -> 2022-12-22
    zlib[core]:x64-linux -> 1.2.13
Additional packages (*) will be modified to complete this operation.
Detecting compiler hash for triplet x64-linux...
Restored 0 package(s) from /home/My ubuntu/.cache/vcpkg/archives in 7.93 us. Use --debug to see more details.
Installing 1/2 vcpkg-cmake:x64-linux...
Building vcpkg-cmake[core]:x64-linux...
-- Installing: /home//vcpkg/packages/vcpkg-cmake_x64-linux/share/vcpkg-cmake/vcpkg_cmake_configure.cmake
-- Installing: /homey/vcpkg/packages/vcpkg-cmake_x64-linux/share/vcpkg-cmake/vcpkg_cmake_build.cmake
-- Installing: /home/i/vcpkg/packages/vcpkg-cmake_x64-linux/share/vcpkg-cmake/vcpkg_cmake_install.cmake
-- Installing: /home/i/vcpkg/packages/vcpkg-cmake_x64-linux/share/vcpkg-cmake/vcpkg-port-config.cmake
-- Installing: /home/i/vcpkg/packages/vcpkg-cmake_x64-linux/share/vcpkg-cmake/copyright
-- Performing post-build validation
Stored binaries in 1 destinations.
Elapsed time to handle vcpkg-cmake:x64-linux: 16.5 ms
Installing 2/2 zlib:x64-linux...
Building zlib[core]:x64-linux...
-- Downloading https://github.com/madler/zlib/archive/v1.2.13.tar.gz -> madler-zlib-v1.2.13.tar.gz...
-- Extracting source /home/hongyi/vcpkg/downloads/madler-zlib-v1.2.13.tar.gz
-- Applying patch 0001-Prevent-invalid-inclusions-when-HAVE_-is-set-to-0.patch
-- Applying patch 0002-skip-building-examples.patch
-- Applying patch 0003-build-static-or-shared-not-both.patch
-- Applying patch 0004-android-and-mingw-fixes.patch
-- Using source at /home/hongyi/vcpkg/buildtrees/zlib/src/v1.2.13-f30d2a168d.clean
-- Configuring x64-linux
-- Building x64-linux-dbg
-- Building x64-linux-rel
-- Installing: /home//vcpkg/packages/zlib_x64-linux/share/zlib/vcpkg-cmake-wrapper.cmake
-- Fixing pkgconfig file: /home//vcpkg/packages/zlib_x64-linux/lib/pkgconfig/zlib.pc
-- Fixing pkgconfig file: /home//vcpkg/packages/zlib_x64-linux/debug/lib/pkgconfig/zlib.pc
-- Installing: /home/hongyi/vcpkg/packages/zlib_x64-linux/share/zlib/copyright
-- Performing post-build validation
Stored binaries in 1 destinations.
Elapsed time to handle zlib:x64-linux: 1.7 s
Total install time: 2.8 s
The package zlib is compatible with built-in CMake targets:

    find_package(ZLIB REQUIRED)
    target_link_libraries(main PRIVATE ZLIB::ZLIB)

Does this means vcpkg already works in my ubuntu?? So everytime I need to cd vcpkg and use ./vcpkg install xxx right?

Yes, vcpkg is already working on your Ubuntu.
No, you can execute the installation command in a different folder without vcpkg by using the full path to vcpkg.exe. For example, if my vcpkg is installed in /home/vxincwa/cheney/vcpkg and I create a new empty folder called test, I can use the following command to execute the installation command in the test folder:
vxincwa@vxincwa-linux:~/test$ "/home/vxincwa/cheney/vcpkg" install zlib

However, please note that the installed ports will still be stored in the vcpkg folder, and test will remain an empty folder unless you use additional parameters to change the default path to a specific location.
https://learn.microsoft.com/en-us/vcpkg/commands/common-options

@Cheney-W
Thank you for answering my newbie question！

I hope all your questions have been resolved. If so, please close this issue. Thank you!


ms test v2 cannot be discovered by vstest.console.exe of vs 2015

Description

Please follow the link click here

Steps to reproduce

"C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\ID
E\CommonExtensions\Microsoft\TestWindow\vstest.console.exe" test.dll --> no tests found
"C:\Program Files (x86)\Microsoft Visual Studio\2017\Enterprise
\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe" test.dll --> tests found and executed

runsettings are included and used see here, almost the same

Expected behavior

Visual Studio 2015 vstest.console should find all tests
Visual Studio 2017 vstest.console should create code coverage

Actual behavior

No test found on VS 2015 version of vstest.console
Test found and executed but no code coverage on VS 2017

Environment

Build Agent is Window 10, with VS 2015. Or my Computer with Win 7, VS 2015 and 2017
mstest v2 is 1.1.14 v
Project build runtime .net 4.5.2

@RomanKernSW : For VS 2015 when running locally, you need to provide a /testadapterpath pointing to bin\debug to get tests discovered. This logic is automatically built into the VS 2017 runner. I'm assuming this is a XAML build definition and not Build vnext. Since MSTest V2 is a nuget package based adapter please follow the steps [here](https://msdn.microsoft.com/en-us/library/ms253138(v=vs.120).aspx#Enable a third-party unit framework) to get this working in the CI.

Thanks alot... I've been looking for this problem since last week, but couldnt find anything. Path to the custom testadapter solve the discovery problem!

I do have last question: is my runsettings config obsolete or why there is no code coverage shown if I run all in Visual Studio 2017. The 2015 version shows the code coverage

@RomanKernSW : Can you share your runsettings please?

        <!-- Match assembly file paths: -->
        <ModulePaths>
          <Exclude>
            <ModulePath>.*Test.dll</ModulePath>
            <ModulePath>.*Definition.dll</ModulePath>
            <ModulePath>.*FakeItEasy.dll</ModulePath>
            <ModulePath>.*FluentAssertions.dll</ModulePath>
            <ModulePath>.*FluentAssertions.core.dll</ModulePath>
            <ModulePath>.*Infrastructure.dll</ModulePath>
          </Exclude>
        </ModulePaths>

        <!-- Match attributes on any code element: -->
        <Attributes>
          <Exclude>

            <Attribute>^System\.Diagnostics\.DebuggerHiddenAttribute$</Attribute>
            <Attribute>^System\.Diagnostics\.DebuggerNonUserCodeAttribute$</Attribute>
            <Attribute>^System\.Runtime\.CompilerServices.CompilerGeneratedAttribute$</Attribute>
            <Attribute>^System\.CodeDom\.Compiler.GeneratedCodeAttribute$</Attribute>
            <Attribute>^System\.Diagnostics\.CodeAnalysis.ExcludeFromCodeCoverageAttribute$</Attribute>
          </Exclude>
        </Attributes>

        <!-- Match the company name property in the assembly: -->
        <CompanyNames>
          <Exclude>
            <CompanyName>.*microsoft.*</CompanyName>
          </Exclude>
        </CompanyNames>

        <!-- Match the public key token of a signed assembly: -->
        <PublicKeyTokens>
          <!-- Exclude Visual Studio extensions: -->
          <Exclude>
            <PublicKeyToken>^B77A5C561934E089$</PublicKeyToken>
            <PublicKeyToken>^B03F5F7F11D50A3A$</PublicKeyToken>
            <PublicKeyToken>^31BF3856AD364E35$</PublicKeyToken>
            <PublicKeyToken>^89845DCD8080CC91$</PublicKeyToken>
            <PublicKeyToken>^71E9BCE111E9429C$</PublicKeyToken>
            <PublicKeyToken>^8F50407C4E9E73B6$</PublicKeyToken>
            <PublicKeyToken>^E361AF139669C375$</PublicKeyToken>
          </Exclude>
        </PublicKeyTokens>

        <!-- We recommend you do not change the following values: -->
        <UseVerifiableInstrumentation>True</UseVerifiableInstrumentation>
        <AllowLowIntegrityProcesses>True</AllowLowIntegrityProcesses>
        <CollectFromChildProcesses>True</CollectFromChildProcesses>
        <CollectAspDotNet>False</CollectAspDotNet>

      </CodeCoverage>
    </Configuration>
  </DataCollector>
</DataCollectors>

I do see the coverage file generated in TestResults folder at my end. One thing I had to fix however was an invalid character at line 56('<!—Don't forget "Attribute" at the end of the name -->  ') when I copied the content over. Removing that worked. It however does not show up the code coverage results window though. I'm not sure if you meant that.

OK, now it should be correct... couldnt put the xml here
<?xml version="1.0" encoding="utf-8"?>
<RunSettings>
<DataCollectionRunSettings>
<DataCollectors>
<DataCollector friendlyName="Code Coverage" uri="datacollector://Microsoft/CodeCoverage/2.0" assemblyQualifiedName="Microsoft.VisualStudio.Coverage.DynamicCoverageDataCollector, Microsoft.VisualStudio.TraceCollector, Version=<IP_ADDRESS>, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
<Configuration>
<CodeCoverage>
<ModulePaths>
<Exclude>
<ModulePath>.*Test.dll</ModulePath>
<ModulePath>.*Definition.dll</ModulePath>
<ModulePath>.*FakeItEasy.dll</ModulePath>
<ModulePath>.*FluentAssertions.dll</ModulePath>
<ModulePath>.*FluentAssertions.core.dll</ModulePath>
<ModulePath>.*Infrastructure.dll</ModulePath>
</Exclude>
</ModulePaths>
<Attributes>
<Exclude>
<Attribute>^System.Diagnostics.DebuggerHiddenAttribute$</Attribute>
<Attribute>^System.Diagnostics.DebuggerNonUserCodeAttribute$</Attribute>
<Attribute>^System.Runtime.CompilerServices.CompilerGeneratedAttribute$</Attribute>
<Attribute>^System.CodeDom.Compiler.GeneratedCodeAttribute$</Attribute>
<Attribute>^System.Diagnostics.CodeAnalysis.ExcludeFromCodeCoverageAttribute$</Attribute>
</Exclude>
</Attributes>
<CompanyNames>
<Exclude>
<CompanyName>.microsoft.</CompanyName>
</Exclude>
</CompanyNames>
<PublicKeyTokens>
<Exclude>
<PublicKeyToken>^B77A5C561934E089$</PublicKeyToken>
<PublicKeyToken>^B03F5F7F11D50A3A$</PublicKeyToken>
<PublicKeyToken>^31BF3856AD364E35$</PublicKeyToken>
<PublicKeyToken>^89845DCD8080CC91$</PublicKeyToken>
<PublicKeyToken>^71E9BCE111E9429C$</PublicKeyToken>
<PublicKeyToken>^8F50407C4E9E73B6$</PublicKeyToken>
<PublicKeyToken>^E361AF139669C375$</PublicKeyToken>
</Exclude>
</PublicKeyTokens>
<UseVerifiableInstrumentation>True</UseVerifiableInstrumentation>
<AllowLowIntegrityProcesses>True</AllowLowIntegrityProcesses>
<CollectFromChildProcesses>True</CollectFromChildProcesses>
<CollectAspDotNet>False</CollectAspDotNet>
</CodeCoverage>
</Configuration>
</DataCollector>
</DataCollectors>
</DataCollectionRunSettings>
</RunSettings>

@RomanKernSW : This works as well at my end. Are you performing an Analyze Code Coverage? Do you see a coverage file generated in the TestResults folder(Beside the solution file)?

Sorry, yes: TestResults is always generated. Code Coverage File is generated too, but it is empty except the first x bytes

ah I see. It looks like there is an issue in collecting coverage data then. Was this working earlier? Can you share the coverage file that got generated please?
Tagging @mayankbansal018 here as well.

I've tested already the vs 2015 and 2017 calls. vstest.console in 2017 do generate ".coverage" file without any information in it. It just filled with some bytes. give the testadapter path not solving the problem (sure, it just for tests not for coverage). the vs 2015 version creates ".coverage" file with code coverage results for all tests.
Microsoft.CodeCoverage nuget is not helping too. thought, maybe the asp.netv5 instrumentations would help, but they dont.
codecoverage.zip is currrent runsetting config the other file is the code coverage output
CodeCoverage.zip
2017-04-26 08_14_28.zip

@RomanKernSW : Spoke with @mayankbansal018 offline. Can you flip UseVerifiableInstrumentation to false in the runsettings above. Also can you verify if you can get Code Coverage on a blank unit test project?
Is this an ASP.NET based project? The issue filed seems to be pointing to a .Net 4.5.2 runtime. A sample project where this repro's(if possible) would help as well.

@AbhitejJohn to the settings: Yes both are correct. MS Test V2 Code Coverage works with VS 2015 and 2017 not. Test are executed. There is no changes with VS 2017 if testadapterpath variable is set or not. Same output.
Setting UseVerifiableInstrumentation to false emit no changes on output. I do still have the same scenario. No code coverage.
dotnet-test-mstest nuget do not create positive outcome. still have no code coverage

@RomanKernSW : Thanks for that info. How about the below:

Also can you verify if you can get Code Coverage on a blank unit test project?
Is this an ASP.NET based project? The issue filed seems to be pointing to a .Net 4.5.2 runtime. A sample project where this repro's(if possible) would help as well.

VS 2017 workflows do not need dotnet-test-mstest nor do they need Microsoft.CodeCoverage nuget package. A smaller sized repro (if possible) would greatly help get to the bottom of this.

dotnet-test-mstest was not installed as default. I just thought, it can be usefull to try with this packages too. So I've tested with this packages once and uninstall them afterward.
creating new project do not resolve the problem. the framework itself seems to be irrelevant (tried .Net 4.6.1 too).
Besides that, I do have another problem(s). the variable testadapterpath do not accept quoted string. my new project contains spaces in the path.
Error: The path 'C:\Users\xyz\Documents\visual studio 2017\Projects\MsTestV2
Testapp\MsTestV2Testapp.Test\bin\Debug" /UseVsixExtensions:true' specified in th
e 'TestAdapterPath' is invalid. Error: Illegales Zeichen im Pfad.

means => illegal character in path

My VS 2015 is english and VS 2017 is german. this was english version. Window is german
if the testadapter is not in same folder as test assembly:
Error: An exception occurred while invoking executor 'executor://mstestadapter/v
2': Der Konstruktor für den Typ "Microsoft.VisualStudio.TestPlatform.MSTest.Test
Adapter.Execution.UnitTestRunner" wurde nicht gefunden.

mean => no constructor found ...

maybe its a correct behave in such situation.

@RomanKernSW : Thanks again.

My VS 2015 is english and VS 2017 is german. this was english version. Window is german

That's interesting. So VS 2017 is German. There might be an issue in Code Coverage here. Can you also confirm if this is a 32 bit machine or a 64 bit machine?

Currently on Windows 7 64 Bit. I do have an windows 10 64 Bit with VS 2017.
There is asp.net Core project, that i maintain, on visual studio online where CI run on hosted VS 2017 machine. There is no code coverage too. I dont know, if the hosted machine is 32 or 64 bit. MS Build achritecture x86 on this ci.
The .net core is not running with x64 build, but the small unit test project with .net 4.5.2 can be started with x64. Code coverage is not available anyway.

Just gave it a shot on both a 32 bit and a 64 bit German box with Vs 2017 German installed and this worked for me. Can you try it out on this project please: ReproCodeCoverage.zip

haha... OK, your project still not working well for me. cant see the code coverage on 2017th.
hm.. but I still have same issue, because my other machine is Windows 10. Maybe I need to reinstall VS 2017. You have installed your VS 2017 on new Windows Image today or the other day without any updates?
very nice bug.  VS 2017 info:
Microsoft Visual Studio Enterprise 2017
Version 15.1 (26403.7) Release
VisualStudio.15.Release/15.1.0+26403.7
Microsoft .NET Framework
Version 4.6.01590

Yes this is a fresh install and on the very same build you have. Very interesting issue indeed. Is there a possibility you can give VS 2017 enu a try?
@mayankbansal018 anything else we can do to figure out what's happening here?

Hi, enu is acronym for what exactly?

Hi @RomanKernSW,
enu- is acronym for English.
On German VS can you please do AnalyzeCodeCoverage again, & check in Event Viewer for .net runtime message. I'm expecting something of this sort ".NET Runtime version 4.0.30319.0 - The profiler was loaded successfully.  Profiler CLSID: '{9317ae81-bcd8-47b7-aaa1-a28062e41c71}'.  Process ID (decimal): 20040.  Message ID: [0x2507]."
Please share the coverage file that gets generated for you in this process. So far this most likely seems to be installation/upgrade gone wrong.
Please also check if there is any Environment variable with name "VS150COMNTOOLS", if it is there please note it's value, & remove it. Make sure you restart VS after this.

echo %VS150COMNTOOLS%
C:\Program Files (x86)\Microsoft Visual Studio 15.0\Common7\Tools\

.NET Runtime version 4.0.30319.0 - Der Profiler wurde erfolgreich geladen. Profiler-CLSID: "{9317ae81-bcd8-47b7-aaa1-a28062e41c71}".  Prozess-ID (dezimal): 17012. Meldungs-ID: [0x2507].

PCName 2017-05-03 11_44_42.zip
sometimes i have to repaire installation after update...

@mayankbansal018 : Looked at the coverage file @RomanKernSW shared above and this one is empty too.
<?xml version="1.0" encoding="UTF-8" ?>
<results>
</results>

and it looks like the TraceLog profiler seems to have been initialized without any problems.

I will try to install new VM with VS 2017 includes newest updates and try mstest v2 again.

@RomanKernSW : Just checking if this gave you similar results.

But what exactly cause this problem? VS installation/update problem or the defect is on nuget package (ms test vs2 assemblies)?

This actually isn't related to the mstest v2 package since this works with the same package in VS 2015 and at our end with VS 2017 as well. Code coverage isn't also related to what framework is chosen. This as of now looks like an installation issue but I wouldn't jump to that conclusion just yet. I'l let @mayankbansal018 suggest what we can do next.

OK. So I have to forward this bug to VS Installation routine team?

Can you send a mail to<EMAIL_ADDRESS>please? We can set up a call to figure this out.

Should I close this issue?

Sure @RomanKernSW . Go ahead.

So its confirmed. my VS 2017 installation is broken. Other colleagues can see the code coverage without problem, one with fresh installed VS and another that installed all updates one after another.

Ran into this issue today. I had installed 2017 professional first, then enterprise second, then uninstalled professional. Today i uninstalled enterprise (no remaining 2017 products installed), rebooted, and reinstalled enterprise to fix the issue.

We were also able to fix the problem by uninstalling VS Pro 2017, rebooting and then installing VS Enterprise 2016.

I have been having the same issue with the latest of VS Enterprise 2017 15.6.2. I tried uninstalling reinstalling it on my my build machine. The issue persists. The trx files created always show 0 coverage.

I have the same results as @RoseTharailJohn.  I found that the coverage comes out as 0 when the vstest.console.exe is run under the Local System account via a stock install of Jenkins.  Running under another account like my own or Network Service made the coverage show up again.  It still shows some odd logging behavior with that Coverage Collection Tool message printing at the beginning and in the middle of the test execution for some reason.
I was able to reproduce this with both 15.5.7 and 15.6.4.  2015's vstest seems to work perfectly fine under the Local System account.


Enable clipboard access.

Pull Request Description
Allows the clipboard permissions to be enabled for the web browser process.
Checklist
Please ensure that the following checklist has been satisfied before submitting the PR:

[x] The documentation has been updated, if necessary.
[x] Screenshots/screencasts have been attached, if there are any visual changes. For interactive or animated visual changes, a screencast is preferred.
[x] All code follows the
Scala,
Java,
and
Rust
style guides. In case you are using a language not listed above, follow the Rust style guide.
All code has been tested:

[x] Unit tests have been written where possible.
[ ] If GUI codebase was changed, the GUI was tested when built using ./run ide build.

Merging as it can't break CI and we have many PRs opened!


Upgrade FactoryGirl -> FactoryBot

We had deferred this upgrade, but @tjchambers knows a good bit about this migration so it may be worth while to tackle it while he's on the project.

My approach would be to fix the Factory singleton usage to use FactoryGirl correctly and remove that deprecation, and PR that. Then a second step to FactoryBot.

Makes sense to me!

merged in #623


Classical logic gate compilation

Classical logic gates (where each column contains one (and only one) one) when compiled by quilc do not produce a healthy-looking circuit. This is a result of LAPACK (which we use for matrix-related stuff) not dealing with these gates as a special-case, instead using a general-case algorithm which produces lacklustre results. Tweedledum is a C++ library to handle exactly this situtation. It produces shorter circuits with fewer 2Q gates, particularly as the gate size increases, when compared with quilc on the same gate.
This PR consists of the following items (please add more if you see fit):

[x] CFFI to Tweedledum, cl-tweedledum.
[x] Extension to the Quil language to support something like DEFGATE AS (MATRIX|PERM) where quilc will automatically invoke tweedledum for the PERM type.
[x] Tests
[ ] Analysis comparing tweedledum to quilc on range of inputs, pretty plots with labeleled axes.

Closes #120.

@notmgsk can you ruhbase your branch?


Add Support for Notices

It would be nice for admins to be able to create notices that would scroll along the bottom of the dashboard page (or some other place).
This could be used to notify users of incoming downtime, rule changes or other useful information.
I might give this a shot myself if it's of interest to people and I have time over the next week or so.

any update?

Please don't let it scroll along with the page. That can be pretty intrusive and annoying.
We can use our current alert UI. Maybe a timeout can also be added so it stops coming up as a notice.
I will add this to my backlog and if one sends a PR in ~2 weeks, will get to it

@lunny tbh mate, I'd totally forgotten about this and work is now far too hectic for me to look at it I'm afraid. If nobody has gotten to it once things get back to normal I'll take another look.


Fix import path on lib/flake.nix

Motivation for this change
Trying to create a simple flake with input:
{
     inputs.nixpkgs-lib.url = "github:NixOS/nixpkgs?dir=lib";
     outputs = {nixpkgs-lib, ...}: { };
}

Fails when trying to evaluate the nixpkgs-lib flake with an error like:
error: getting status of '/nix/store/xxxx-source/lib/lib': No such file or directory
(use '--show-trace' to show detailed location information)

Things done
Updated the import path to be ./. since it's relative to the flake root that is specified via ?dir=lib.

[ ] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
Built on platform(s)

[ ] NixOS
[ ] macOS
[ ] other Linux distributions

[ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
[ ] Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
[ ] Tested execution of all binary files (usually in ./result/bin/)
21.11 Release Notes (or backporting 21.05 Release notes)

[ ] (Package updates) Added a release notes entry if the change is major or breaking
[ ] (Module updates) Added a release notes entry if the change is significant
[ ] (Module addition) Added a release notes entry if adding a new NixOS module

[ ] Fits CONTRIBUTING.md.

cc @blaggacao victim of mv?

Oh, yeah this is probably an actual issue in flakes, and might be fixed via the follows patch

Oh, yep. Damn. Thank you!


direct yaml importing breaks importstr

In #106 we introduced direct importing of yaml documents (as they are similar enough to json) by wrapping the jsonnet.FileImporter and extending it by detecting all .yaml documents. In case it is indeed yaml, we return the contents as json, instead of the literal contents.
This however is problematic in combination with importstr, which should result in literal imports. But as the same importer is used, we also get the JSON contents here. Even worse, the jsonnet.Importer interface does not allow us to detect which import mode we operate on.
Any ideas how that could be solved @sbarzowski?

Even worse, the jsonnet.Importer interface does not allow us to detect which import mode we operate on.

This is very much by design. Importer is supposed to provide a "data layer". It should be possible to move the data to another storage system and use a different importer easily.

Any ideas how that could be solved @sbarzowski?

Considering that people seem quite enthusiastic about this feature here and people commonly use import "sth.json" instead of more proper std.parseJson(importstr "str.json") we can consider adding an upstream support for YAML/JSON parsing based on the imported path. It would need to happen outside of the importer. We would need to expose another interface to handle it in a way independent from the path format (for example it should work with the following notation for some imaginary importer: my.jsonnet.package.file:yaml). Another approach (slightly incompatible for Tanka users) would be to introduce new keywords importjson, importyaml. Of course that will require a discussion and if we decide to do it, it may still take a while. Other incompatible changes are coming to the Importer (due to #329) so it may be a good time to consider this.
@sparkprime, @lihaoyi What do you think about path-based detection of JSON and YAML?
Short of adding this sort of upstream support, I don't see a very good way out. The way we recommended so far upstream is std.parseYAML(importstr "sth.yaml"), but I see how going back to it would suck for your users. One way out of it, which can be implemented within the importer, is to introduce a "virtual" path. That is, if the user imports something like "blah/blah/file.yaml#raw" you can resolve it like "blah/blah/file.yaml", but without the magic conversion. This is pretty hacky of course.

Upstream support is the most proper solution and I am happy to wait for it. Until then we can just document this issue and are good to go.
Regarding the syntax, I feel like a generic import is the nicest approach. Using import for all JSON-like things (Jsonnet, JSON, YAML, maybe TOML) and importstr for everything else.
This is also non-breaking to the current workflow. I am happy to help implementing this!

I see a lot of import foo.json in our codebase. It might be a bit
finnicky to have it guess based on file extensions, but probably not a huge
deal. In the end Sjsonnet’s importer is swappable, so if we did this the
special-file-extension handler would just become swappable as well
On Tue, 7 Jan 2020 at 2:18 AM, sh0rez<EMAIL_ADDRESS>wrote:

Upstream support is the most proper solution and I am happy to wait for
it. Until then we can just document this issue and are good to go.
Regarding the syntax, I feel like a generic import is the nicest
approach. Using import for all JSON-like things (Jsonnet, JSON, YAML,
maybe TOML) and importstr for everything else.
This is also non-breaking to the current workflow. I am happy to help
implementing this!
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/grafana/tanka/issues/135?email_source=notifications&email_token=AAHEB7HX5YJY6MRCSA4RXCTQ4NYWPA5CNFSM4KDGU72KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIGJH7Q#issuecomment-571249662,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AAHEB7EOALEANMWNLDT63G3Q4NYWPANCNFSM4KDGU72A
.


Flying Bird Animation

I added a new project flying bird animation . I made this project using CSS Animation , Keyframes and CSS Transitions.

Thanks for you contribution 🚀 @Anjali-Git-Hub


Question: Why not including the rest of the model properties in the query tags?

Hello,
I  noticed that in the previous version of the plugin, the query tags had more information available. However,  it seems that all the items related to query tags have been removed.
https://github.com/get-select/dbt-snowflake-query-tags/pull/8/files
I'm curious to understand the rationale behind this decision. Specifically, I would like to know why the plugin no longer includes the remaining properties from the dbt model in the query tags. Is it because of limitations such as the size limit of the query tags?
    {# We have to bring is_incremental through here because its not available in the comment context #}
    {% if model.resource_type == 'model' %}
        {%- do tag_dict.update(
            is_incremental=is_incremental()
        ) -%}

>>>
        {%- do tag_dict.update(
            model_name=model.name
        ) -%}
        {%- do tag_dict.update(
            model_alias=model.alias
        ) -%}
        {%- do tag_dict.update(
            model_schema=model.schema
        ) -%}
.............
<<<
    {% endif %}

hey @ibardarov-fms,

Is it because of limitations such as the size limit of the query tags?

this is why we moved everything into the query comment - we were running into the 2000 character limit.
however, we couldn't move everything. the  is_incremental indicator has to live in the query tag because it is available at runtime when the query comment is being generated by dbt.


Can't combine annotations @Aux @This

subj

Added possibility to switch lower bound and F-bound off.