[Pi 4] Other machines cannot connect to wireless AP when ieee80211w=1

[hvenev]

Is this the right place for my bug report?
It might be related to brcmfmac firmware. I am using the firmware from https://github.com/RPi-Distro/firmware-nonfree

Describe the bug
It looks like brcmfmac does not support ieee80211w/MFP in AP mode. Clients are unable to connect to the network because the RSN IE message during handshake is different from the one in the beacon frame.

Disabling ieee80211w fixes the issue.

If I run the same hostapd.conf on my laptop (iwlwifi/iwlmvm), my phone connects to it just fine.

To reproduce
hostapd.conf:

ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel

driver=nl80211

macaddr_acl=0
wmm_enabled=1
country_code=BG
ignore_broadcast_ssid=0
hw_mode=g
ieee80211n=1
ieee80211w=1
ieee80211d=1
channel=6

interface=wlan0

ssid=REDACTED
wpa=2
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
wpa_passphrase=REDACTED

Expected behaviour
Clients can connect to the network.

Actual behaviour
Clients cannot connect to the network.

System
Device: Raspberry Pi 4 Model B Rev 1.2
Kernel: rpi-5.6.y from 5377449
Firwmare version: May 11 2020 18:59:41, 21bfdeee3a6ea823e2113b983390acd1eec8edfb (clean) (release) (start)
OS: Fedora 32 aarch64
hostapd: hostapd-2.9-3.fc32.aarch64

Logs
No errors appear on the Pi.

Here is what happens on my laptop when it tries to connect:

wpa_supplicant: wlan: SME: Trying to authenticate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz)
kernel: wlan: authenticate with dc:a6:32:87:2a:8d
kernel: wlan: send auth to dc:a6:32:87:2a:8d (try 1/3)
wpa_supplicant: wlan: Trying to associate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz)
kernel: wlan: authenticated
kernel: wlan: associate with dc:a6:32:87:2a:8d (try 1/3)
kernel: wlan: RX AssocResp from dc:a6:32:87:2a:8d (capab=0x411 status=0 aid=1)
wpa_supplicant: wlan: Associated with dc:a6:32:87:2a:8d
wpa_supplicant: wlan: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
kernel: wlan: associated
wpa_supplicant: wlan: WPA: IE in 3/4 msg does not match with IE in Beacon/ProbeResp (src=dc:a6:32:87:2a:8d)
wpa_supplicant: WPA: RSN IE in Beacon/ProbeResp - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 0c 00
wpa_supplicant: WPA: RSN IE in 3/4 msg - hexdump(len=26): 30 18 01 00 00 0f ac 04 01 00 00 0f ac 04 02 00 00 0f ac 02 00 0f ac 08 0c 00
kernel: wlan: deauthenticating from dc:a6:32:87:2a:8d by local choice (Reason: 17=IE_DIFFERENT)
wpa_supplicant: wlan: CTRL-EVENT-DISCONNECTED bssid=dc:a6:32:87:2a:8d reason=17 locally_generated=1

[pelwell]

Do you have reason to think this should be supported?

[hvenev]

Do you have reason to think this should be supported?

Yes. It's a basic security measure that makes it more difficult for script kiddies to disconnect me from my network.

Furthermore, the behaviour of silently creating a broken network is quite confusing.

[hvenev]

If I set wpa_key_mgmt=SAE WPA-PSK, I also get a similarly broken network, even if ieee80211w=0.

Before you ask, SAE should be supported because it makes offline brute force attacks against the network password much more expensive.

Note that most often people who conduct offline brute force attacks start by capturing a handshake. The easiest way to capture a handshake is to cause an existing client to disconnect and reconnect. If ieee80211w=0, anyone can just disconnect any client and observe a handshake.

[burnbabyburn]

+1
802.11w is a basic and old standard (2009) to protect against deauth attacks.
If WIFI-AP is a valid usecase for any RPI it should be supported.

Specially at times where deauth runs on very cheap ESP chips.

Did u try this hint?
https://github.com/billz/raspap-webgui/issues/484

[hvenev]

Did u try this hint?
billz/raspap-webgui#484

What exactly? Configuring the network as WPA3 Enterprise?

Edit: I tried wpa_key_mgmt=WPA-EAP-SHA256 ieee80211w=2 as suggested, and I got the following error (52 = EBADE):

ieee80211 phy0: brcmf_cfg80211_add_key: set wsec error (-52)

[cybern0id]

This bug is not just related to RPi4 and/or AP mode.

I have a RPi 3B+ running stock Raspberry Pi OS (Raspbian) Lite installed today, with kernel 4.19.118-v7+; using its on-board wifi chip, it is unable to connect as a client to my Openwrt router.

The access point is set up with "WPA2-PSK/WPA3-SAE Mixed Mode" and with 802.11w Management Frame Protection set to "Optional".

It is dual band with Qualcomm Atheros QCA9880 802.11acn 5 GHz and Atheros AR9287 802.11bgn 2 GHz.

All my other devices can connect to the access point without issue (3 different Android phones, Sony PS4, Nintendo Switch, Lenovo X230 running Devuan or Windows 10, Lenovo X230T running either Windows 10 or Android x86, even a little ESP8266 ESP-01 module in my Sinclair Spectrum Next).

To troubleshoot, I used a process of elimination to determine that the RPi 3 will only connect when the access point is in WPA2-PSK only mode, with 802.11w Management Frame Protection disabled.

Setting the AP to either WPA2-PSK/WPA3-SAE Mixed Mode with 802.11w Management Frame Protection disabled OR to WPA2-PSK only mode with 802.11w Management Frame Protection set to either "Optional" or "Required" results in no connection.

Adding combinations of pmf=1, proto=RSN key_mgmt=SAE and sae_password=####### to the wpa_supplicant.conf config file did not have the desired effect.

The router logs show the following repeatedly when the RPi 3B tries unsuccessfully to connect:

Tue Jun 9 04:15:02 2020 daemon.info hostapd: wlan1-1: STA b8:27:eb:xx:xx:xx IEEE 802.11: authenticated
Tue Jun 9 04:15:02 2020 daemon.info hostapd: wlan1-1: STA b8:27:eb:xx:xx:xx IEEE 802.11: associated (aid 1)
Tue Jun 9 04:15:02 2020 daemon.notice hostapd: wlan1-1: AP-STA-POSSIBLE-PSK-MISMATCH b8:27:eb:xx:xx:xx
Tue Jun 9 04:15:03 2020 daemon.notice hostapd: wlan1-1: AP-STA-POSSIBLE-PSK-MISMATCH b8:27:eb:xx:xx:xx
Tue Jun 9 04:15:04 2020 daemon.notice hostapd: wlan1-1: AP-STA-POSSIBLE-PSK-MISMATCH b8:27:eb:xx:xx:xx
Tue Jun 9 04:15:05 2020 daemon.notice hostapd: wlan1-1: AP-STA-POSSIBLE-PSK-MISMATCH b8:27:eb:xx:xx:xx
Tue Jun 9 04:15:11 2020 daemon.info hostapd: wlan1-1: STA b8:27:eb:xx:xx:xx IEEE 802.11: deauthenticated due to local deauth request

This article suggests that both the kernel and wpa_supplicant must be patched to support WPA3-Personal (SAE/PMF), though I'm unsure as to whether this is still necessary as it is dated June 2019.

https://github.com/billz/raspap-webgui/issues/484 describes some related background info.

I agree with all the other comments in saying this is quite an important bug to resolve due to the security implications. It is trivial and cheap to make a device that can prevent any clients joining a WPA2 wireless network that doesn't have 802.11w Management Frame Protection enabled.

[pelwell]

There is a ticket open with Cypress asking about support for 802.11w and WPA3-SAE.

[pelwell]

I can confirm that the current firmware release doesn't include MFP or WPA3/SAE support (unlike recent general public releases), but that we've requested an update.

[burnbabyburn]

Did u try this hint?
billz/raspap-webgui#484

What exactly? Configuring the network as WPA3 Enterprise?

Edit: I tried wpa_key_mgmt=WPA-EAP-SHA256 ieee80211w=2 as suggested, and I got the following error (52 = EBADE):

ieee80211 phy0: brcmf_cfg80211_add_key: set wsec error (-52)

exactly => It was just a blind guess as billz reported it worked in earlier kernel versions.

Thx for requesting firmware @pelwell
Would you be so kind to open another ticket for 40Mhz/80MHz channel width?
#3415 (comment)
I'll now stop hijacking this issue :)

[pelwell]

There is a trial firmware to download here: https://drive.google.com/file/d/1sOsgqaTK1OiGyyhYNNeEo02XqCQPCPcx/view?usp=sharing

(This firmware may look familiar, @hvenev - Cypress have suggested it)

Make a backup of your old firmware and install the new one using:

$ sudo cp /lib/firmware/brcm/brcmfmac43455-sdio.bin{,.orig}
$ sudo cp brcmfmac43455-sdio-2.bin /lib/firmware/brcm/brcmfmac43455-sdio.bin

In case you encounter any problems you can enable firmware logging by adding brcmfmac.debug=0x100000 to cmdline.txt. Diagnostic output from the firmware will appear in the output of dmesg.

Reverting to the original firmware is accomplished with:

$ sudo mv /lib/firmware/brcm/brcmfmac43455-sdio.bin{.orig,}

[hvenev]

There is a trial firmware to download here: https://drive.google.com/file/d/1sOsgqaTK1OiGyyhYNNeEo02XqCQPCPcx/view?usp=sharing

Yes, I tried this firmware quite a while ago. It is also broken.

I am still unable to create a network with MFP optional (broken network created) or required (hostapd fails to start) or SAE (error in the kernel log, broken network created). I tried to create a network with wpa_key_mgmt=WPA-PSK-SHA256. My phone thinks that the network is using WPA(2?) Enterprise.

I cannot connect to a network with ieee80211w=1 and wpa_key_mgmt=WPA-PSK WPA-PSK-SHA256 SAE.

Edit: Do I need to build the kernel with CONFIG_BRCM_TRACING=y?

Edit 2: Actually it looks like firmware logging is handled by brcmfmac/sdio.c brcmf_sdio_bus_watchdog and is only built when the magic macro DEBUG is defined. Do I need to do that?

Edit 3: That macro is apparently enabled by CONFIG_BRCMDBG=y.

[pelwell]

Yes, I tried this firmware quite a while ago. It is also broken.

In which case I'll presumably be reporting that fact back to them fairly soon.

Re: custom kernel builds, bcm2711_defconfig (always a good place to check) has:

CONFIG_BRCMDBG=y

[hvenev]

Log with wpa_key_mgmt=WPA-PSK ieee80211w=1:

[   48.621861] brcmfmac: F1 signature read @0x18000000=0x15264345
[   48.627404] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
[   48.791199] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43455-sdio for chip BCM4345/6
[   48.803183] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Mar 23 2020 02:20:01 version 7.45.206 (r725000 CY) FWID 01-febaba43
[   48.890434] brcmfmac mmc1:0001:1 wlan: renamed from wlan0
[   48.898820] brcmfmac: CONSOLE: d 0
[   48.898824] brcmfmac: CONSOLE: 000000.063 wl0: Broadcom BCM4345 802.11 Wireless Controller 7.45.206 (r725000 CY)
[   48.898826] brcmfmac: CONSOLE: 000000.063 TCAM: 256 used: 251 exceed:0
[   48.898828] brcmfmac: CONSOLE: 000000.064 reclaim section 1: Returned 118440 bytes to the heap
[   48.898830] brcmfmac: CONSOLE: 000000.064 reclaim section 4: Returned 44 bytes to the heap
[   48.898831] brcmfmac: CONSOLE: 000000.064 sdpcmd_dpc: Enable
[   48.898833] brcmfmac: CONSOLE: 000000.084 wl0: wlc_iovar_op: txbf BCME -23 (Unsupported)
[   48.898835] brcmfmac: CONSOLE: 000000.086 wl0: unable to find iovar "rsdb_mode"
[   48.898837] brcmfmac: CONSOLE: 000000.086 wl0: wlc_iovar_op: rsdb_mode BCME -23 (Unsupported)
[   48.898839] brcmfmac: CONSOLE: 000000.086 wl0: unable to find iovar "tdls_enable"
[   48.898841] brcmfmac: CONSOLE: 000000.086 wl0: wlc_iovar_op: tdls_enable BCME -23 (Unsupported)
[   48.898842] brcmfmac: CONSOLE: 000000.102 wl0: wlc_phy_set_regtbl_on_femctrl: FIXME bt_coex
[   48.898844] brcmfmac: CONSOLE: 000000.162 wl0: wlc_iovar_op: bw_cap BCME -5 (Not down)
[   48.938789] brcmfmac: brcmf_cfg80211_set_power_mgmt: power save enabled
[   48.958838] brcmfmac: CONSOLE: 000000.209 wl0: unable to find iovar "toe_ol"
[   48.958841] brcmfmac: CONSOLE: 000000.209 wl0: wlc_iovar_op: toe_ol BCME -23 (Unsupported)
[   48.958844] brcmfmac: CONSOLE: 000000.210 wl0: wl_open
[   61.099371] local: port 1(wlan) entered blocking state
[   61.100463] local: port 1(wlan) entered disabled state
[   61.101672] device wlan entered promiscuous mode
[   61.128837] brcmfmac: CONSOLE: 000012.363 wl0: bc/mc deauth_reason on STA BSS?
[   61.128841] brcmfmac: CONSOLE: 000012.386 wl0: wlc_phy_set_regtbl_on_femctrl: FIXME bt_coex
[   61.148802] brcmfmac: CONSOLE: 000012.397 wl0: wl_open
[   61.162133] brcmfmac: CONSOLE: 000012.408 wl0: wlc_phy_set_regtbl_on_femctrl: FIXME bt_coex
[   61.226539] IPv6: ADDRCONF(NETDEV_CHANGE): wlan: link becomes ready
[   61.229436] local: port 1(wlan) entered blocking state
[   61.231735] local: port 1(wlan) entered forwarding state
[   61.234052] IPv6: ADDRCONF(NETDEV_CHANGE): local: link becomes ready
[   61.265566] brcmfmac: CONSOLE: 000012.481 wl0: link up (wl0)
[   61.265571] brcmfmac: CONSOLE: 000012.481 wl0: link up (wl0)
[  102.375324] brcmfmac: CONSOLE: 000053.432 
[  102.375332] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  102.755319] brcmfmac: CONSOLE: 000053.812 
[  102.755325] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  104.265314] brcmfmac: CONSOLE: 000055.301 
[  104.265319] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  105.265314] brcmfmac: CONSOLE: 000056.294 
[  105.265321] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  106.221971] brcmfmac: CONSOLE: 000057.245 
[  106.221977] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  108.011961] brcmfmac: CONSOLE: 000059.026 
[  108.011969] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  108.741971] brcmfmac: CONSOLE: 000059.774 
[  108.741976] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  109.955311] brcmfmac: CONSOLE: 000060.963 
[  109.955317] brcmfmac: CONSOLE: No PMKID found in RSNIE
[  113.418622] brcmfmac: CONSOLE: 000064.427 
[  113.418628] brcmfmac: CONSOLE: No PMKID found in RSNIE

[hvenev]

Log with wpa_key_mgmt=WPA-PSK-SHA256 ieee80211w=2:

[  344.179729] local: port 1(wlan) entered blocking state
[  344.180656] local: port 1(wlan) entered disabled state
[  344.181840] device wlan entered promiscuous mode
[  344.208485] brcmfmac: CONSOLE: 000294.428 wl0: bc/mc deauth_reason on STA BSS?
[  344.208489] brcmfmac: CONSOLE: 000294.452 wl0: wlc_phy_set_regtbl_on_femctrl: FIXME bt_coex
[  344.231870] brcmfmac: CONSOLE: 000294.463 wl0: wl_open
[  344.231874] brcmfmac: CONSOLE: 000294.474 wl0: wlc_phy_set_regtbl_on_femctrl: FIXME bt_coex
[  344.307723] local: port 1(wlan) entered blocking state
[  344.310055] local: port 1(wlan) entered forwarding state
[  344.314770] ieee80211 phy1: brcmf_cfg80211_add_key: set wsec error (-52)
[  344.331892] device wlan left promiscuous mode
[  344.334353] local: port 1(wlan) entered disabled state
[  344.365250] brcmfmac: CONSOLE: 000294.547 wl0: link up (wl0)
[  344.365259] brcmfmac: CONSOLE: 000294.547 wl0: link up (wl0)
[  344.365264] brcmfmac: CONSOLE: 000294.557 wl0: wlc_iovar_op: wsec BCME -2 (Bad Argument)
[  344.835324] brcmfmac: CONSOLE: 000295.023 wl0: wl_open

(hostapd fails to start)

Are there any other configurations you want me to test?

[pelwell]

Thanks - I've passed both of those on. You could try the worldwide-safe, Pi4-only clm_blob (https://drive.google.com/file/d/1Qoc90FCTO17d69PbBqUhkJKgqDMmdOui/view?usp=sharing - you'll have to rename it to brcmfmac43455-sdio.clm_blob, but I think you know that), but I don't expect it to make a difference to this issue.