Re: 1.30 fails to connect to some APs

[Denis Kenzior <denkenz@gmail.com>]

Hi Sebastien,

On 9/16/22 06:32, Sebastien Bacher wrote:
> Using iwd 1.30 on Ubuntu Kinetic, I've some APs my laptop fails to connect to
> 
> I'm including a log from 'iwd -d' while trying to connect using
> 
> $ sudo iwctl station wlan0 connect <APNAME>
> 
> The log states
> 
> 'wiphy_select_akm() Network is WPA3-Personal...'
> 

So if we select WPA-Personal, the AP most likely is configured like this. 
Perhaps it is in WPA3 Transition mode where both WPA2 and WPA3 AKMs are enabled. 
  Hard to say without seeing the detailed iwmon (preferably) or iw scan result 
output.

> But iwlist states 'IE: IEEE 802.11i/WPA2 Version 1' and using wpasupplicant 

Note that iwlist isn't WPA3 aware [1].

> works fine and network-manager also flags it as WPA2, could it be that iwd 
> wrongly detect the authentification to use?

Dunno about NM/wpa_s.  But your AP is certainly acting like a WPA3 AP.  From 
your log:

src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=1, state=committed

<--- We receive an SAE (WPA3) reply packet from the AP

src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=1, state=committed

<---- And again here

src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=2, state=confirmed

<---- And looks like we do not consider the confirm reply valid (?)

Can you tell us more about the AP? Do you have any way of obtaining logs from it 
by any chance?  Does 'iw dev <foo> scan' results for your AP list any Vendor 
IEs?  Note that iwd uses P384 curves for SAE by default (for higher security). 
Some older WPA3 implementations implement the spec poorly when curves other than 
P256 are used.

Also, it might be useful for us to look at the iwmon output.  See [2].  Start 
iwmon just prior to iwctl 'station <device> scan' and 'station <device> 
connect...'  Feel free to send the output to me directly if there are any 
privacy concerns.

[1] 
https://github.com/HewlettPackard/wireless-tools/blob/master/wireless_tools/iwlist.c#L301
[2] https://iwd.wiki.kernel.org/debugging#iwmon

Regards,
-Denis