[ath9k-devel] WPA and Apple devices

[ath9k-devel] WPA and Apple devices

[Marek Lindner]

Hi,

I recently have been hit by a strange issue and hoped some of you might have 
an idea how to proceed: When I configure 2 VAPs on my AR9285 based router 
Apple devices (i${whatever}) start to have connection issues. The following 
combinations of VAPs / WPA works:
 * 2x VAP, no WPA
 * 2x VAP, WPA on VAP#2 only

These combinations don't work:
 * 2x VAP, WPA on VAP#1 only
 * 2x VAP, WPA on both

The Apple devices would complete the WPA handshake (according to the hostapd 
logs) and then issue a "disassociate". On the device itself the user is 
presented a timeout error message.

It looks like the mac80211/ath9k driver gets confused when WPA is activated on 
VAP#1. Furthermore, other all non-Apple device seem to work fine.
Any idea how to debug it further ?

Regards,
Marek

[ath9k-devel] WPA and Apple devices

[Jouni Malinen]

On Wed, Oct 26, 2011 at 04:00:03AM +0200, Marek Lindner wrote:
> These combinations don't work:
>  * 2x VAP, WPA on VAP#1 only
>  * 2x VAP, WPA on both

Is that WPA or WPA2? Does the connection failure happen with both VAPs
or only one of them?

> The Apple devices would complete the WPA handshake (according to the hostapd 
> logs) and then issue a "disassociate". On the device itself the user is 
> presented a timeout error message.

That sounds like some message at the end of the EAPOL key exchange or
data after that did not go through properly.

> It looks like the mac80211/ath9k driver gets confused when WPA is activated on 
> VAP#1. Furthermore, other all non-Apple device seem to work fine.
> Any idea how to debug it further ?

Would you be able to capture all the frames exchanged between the AP
and the station with a wireless sniffer? It would be interesting to see
sniffer capture both for a successful and failed connection attempts.

-- 
Jouni Malinen                                            PGP id EFC895FA

[ath9k-devel] WPA and Apple devices

[Marek Lindner]

On Wednesday, October 26, 2011 09:47:08 Jouni Malinen wrote:
> On Wed, Oct 26, 2011 at 04:00:03AM +0200, Marek Lindner wrote:
> > These combinations don't work:
> >  * 2x VAP, WPA on VAP#1 only
> >  * 2x VAP, WPA on both
> 
> Is that WPA or WPA2?

WPA or WPA2 does not make any difference.


> Does the connection failure happen with both VAPs or only one of them?

IIRC both VAPs failed but I am going to retest to be certain.


> > It looks like the mac80211/ath9k driver gets confused when WPA is
> > activated on VAP#1. Furthermore, other all non-Apple device seem to work
> > fine. Any idea how to debug it further ?
> 
> Would you be able to capture all the frames exchanged between the AP
> and the station with a wireless sniffer? It would be interesting to see
> sniffer capture both for a successful and failed connection attempts.

Yes, no problem. I will get the dumps and upload them somewhere.

Regards,
Marek

[ath9k-devel] WPA and Apple devices

[Marek Lindner]

On Thursday, October 27, 2011 04:19:30 Marek Lindner wrote:
> > Does the connection failure happen with both VAPs or only one of them?
> 
> IIRC both VAPs failed but I am going to retest to be certain.

The second VAP shows different behavior:
* Without encryption one get's a simple "unable to connect" error.
* With WPA enabled the iOS client connects and disconnects shortly thereafter. 
It keeps doing that forever.

All that only happens if VPA#1 is configured with WPA enabled.


> > > It looks like the mac80211/ath9k driver gets confused when WPA is
> > > activated on VAP#1. Furthermore, other all non-Apple device seem to
> > > work fine. Any idea how to debug it further ?
> > 
> > Would you be able to capture all the frames exchanged between the AP
> > and the station with a wireless sniffer? It would be interesting to see
> > sniffer capture both for a successful and failed connection attempts.
> 
> Yes, no problem. I will get the dumps and upload them somewhere.

The pcap files can be found here:
http://dev.cloudtrax.com/downloads/pcap/

These pcap files were captured while VAP#1 was WPA encrypted and VPA#2 was 
unencrypted. An Apple notebook tried to connect to the router on VAP#1:
apple-vap1.pcap -> captured packets on the notebook itself
vap1_vpa2_nowpa.pcap -> captured packets from the router (wifi interface)
mon_vpa2_nowpa.pcap -> captured packets from the router (hostapd monitor 
interface)

As you can see the Apple device even sends a few DHCP/DNS/etc packets until it 
suddenly sends a disconnect request. This made me think it is not related to 
hostapd but I could be wrong here.

Regards,
Marek

[ath9k-devel] WPA and Apple devices

[Marek Lindner]

Hi,

> These pcap files were captured while VAP#1 was WPA encrypted and VPA#2 was 
> unencrypted. An Apple notebook tried to connect to the router on VAP#1:
> apple-vap1.pcap -> captured packets on the notebook itself
> vap1_vpa2_nowpa.pcap -> captured packets from the router (wifi interface)
> mon_vpa2_nowpa.pcap -> captured packets from the router (hostapd monitor 
> interface)
> 
> As you can see the Apple device even sends a few DHCP/DNS/etc packets until
> it  suddenly sends a disconnect request. This made me think it is not
> related to hostapd but I could be wrong here.

I managed to narrow down the whole issue: First of all, the connection issues 
are not limited to Apple devices. I found a few Linux boxes showing exactly 
the same behavior. Furthermore, I noticed that whenever a device has a 
connection issue the AR9285 would not send any beacons. Some devices / wifi 
drivers seem to manange connecting to an AP without any beacons and others 
don't. At this point I am pretty convinced that the missing AP beacons are 
causing the connection problems.

But there is more: I was able to test the prorietary Atheros driver on the 
AR9285 which works fine. In addition, I tested the same software stack 
(mac80211 / atk9k / hostapd / etc) on the bullet m running an AR9280 and it 
also is working fine. This leads me to the conclusion that the Atheros driver 
handles the beaconing for the AR9285 (at least slightly) different. Is there 
anyone capable of taking a peak into the code ? Any suggestion how to debug 
the missing beacons ?

Regards,
Marek

[ath9k-devel] WPA and Apple devices

[Adrian Chadd]

I wonder if it thinks the air is busy and thus can't really TX
anything, including beacons.
What kind of interference is this?



Adrian

[ath9k-devel] WPA and Apple devices

[Marek Lindner]

On Friday, November 04, 2011 04:05:49 Adrian Chadd wrote:
> I wonder if it thinks the air is busy and thus can't really TX
> anything, including beacons.
> What kind of interference is this?

Please keep in mind that all I need to do is to disable WPA on the first VAP 
to make the driver send beacons. Same environment, same software stack - just 
the setting is different. Therefore I have a hard time believe it is 
interference we are dealing with.

It also is possible that the beacons are sent but garbled on the way out. The 
ways and means to capture the beacon packets are rather simple: running 
wireshark on a monitor interface. There is enough room for other reasons why 
the beacons do not show up.

Regards,
Marek