1.30 fails to connect to some APs

1.30 fails to connect to some APs

[Sebastien Bacher]

[-- Attachment #1: Type: text/plain, Size: 479 bytes --]

Using iwd 1.30 on Ubuntu Kinetic, I've some APs my laptop fails to 
connect to

I'm including a log from 'iwd -d' while trying to connect using

$ sudo iwctl station wlan0 connect <APNAME>

The log states

'wiphy_select_akm() Network is WPA3-Personal...'

But iwlist states 'IE: IEEE 802.11i/WPA2 Version 1' and using 
wpasupplicant works fine and network-manager also flags it as WPA2, 
could it be that iwd wrongly detect the authentification to use?

Cheers,
Sebastien Bacher

[-- Attachment #2: iwdlog --]
[-- Type: text/plain, Size: 4674 bytes --]

src/agent.c:agent_register() agent register called
src/agent.c:agent_register() agent :1.139 path /agent/11500
src/network.c:network_connect() 
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/network.c:network_connect_psk() ask_passphrase: true
src/agent.c:agent_request_passphrase() agent 0x55d601478db0 owner :1.139 path /agent/11500
src/agent.c:agent_send_next_request() send request to :1.139 /agent/11500
src/agent.c:agent_receive_reply() agent 0x55d601478db0 request id 38
src/network.c:passphrase_callback() result 0
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/network.c:network_generate_sae_pt() Generating PT for Group 19
src/network.c:network_generate_sae_pt() Generating PT for Group 20
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/sae.c:sae_sm_new() Using SAE Hunting and Pecking
src/netdev.c:netdev_cqm_rssi_update() 
src/wiphy.c:wiphy_radio_work_insert() Inserting work item 3
src/wiphy.c:wiphy_radio_work_next() Starting work item 3
src/station.c:__station_connect_network() connecting to BSS e0:63:da:52:98:08
src/station.c:station_enter_state() Old State: disconnected, new state: connecting
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event() 
src/sae.c:sae_verify_packet() rx trans=1, state=committed
src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event() 
src/sae.c:sae_verify_packet() rx trans=1, state=committed
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event() 
src/sae.c:sae_verify_packet() rx trans=2, state=confirmed
src/wiphy.c:wiphy_radio_work_done() Work item 3 done
src/station.c:station_connect_cb() 22, result: 1
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/station.c:station_reset_connection_state() 22
src/station.c:station_roam_state_clear() 22
src/station.c:station_enter_state() Old State: connecting, new state: disconnected
src/station.c:station_enter_state() Old State: disconnected, new state: autoconnect_quick
src/wiphy.c:wiphy_radio_work_insert() Inserting work item 4
src/wiphy.c:wiphy_radio_work_next() Starting work item 4
src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)
src/scan.c:scan_notify() Scan notification Trigger Scan(33)
src/scan.c:scan_request_triggered() Active scan triggered for wdev e
src/station.c:station_quick_scan_triggered() Quick scan triggered for wlan0
src/agent.c:agent_disconnect() agent :1.139 disconnected
src/agent.c:agent_free() agent free 0x55d601478db0
src/scan.c:scan_notify() Scan notification New Scan Results(34)
src/netdev.c:netdev_link_notify() event 16 on ifindex 22
...
src/station.c:station_add_seen_bss() Processing BSS '7a:83:c2:16:2c:0f' with SSID: <APSNAMES>, freq: 5600, rank: 2946, strength: -5500, data_rate: 360.0
...
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/station.c:station_autoconnect_next() autoconnect: Trying SSID: <PUBLICAP>
src/station.c:station_autoconnect_next() autoconnect: '7a:83:c2:16:2c:0f' freq: 5600, rank: 2946, strength: -5500
src/wiphy.c:wiphy_select_akm() Network is WPA3-Personal...
src/sae.c:sae_sm_new() Using SAE Hunting and Pecking
src/netdev.c:netdev_cqm_rssi_update() 
src/wiphy.c:wiphy_radio_work_insert() Inserting work item 5
src/station.c:__station_connect_network() connecting to BSS 7a:83:c2:16:2c:0f
src/station.c:station_enter_state() Old State: autoconnect_quick, new state: connecting (auto)
src/scan.c:scan_cancel() Trying to cancel scan id 4 for wdev e
src/wiphy.c:wiphy_radio_work_done() Work item 4 done
src/wiphy.c:wiphy_radio_work_next() Starting work item 5
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/station.c:station_dbus_disconnect() 
src/station.c:station_reset_connection_state() 22
src/station.c:station_roam_state_clear() 22
src/station.c:station_enter_state() Old State: connecting (auto), new state: disconnecting
src/wiphy.c:wiphy_radio_work_done() Work item 5 done
src/station.c:station_connect_cb() 22, result: 5
src/station.c:station_disconnect_cb() 22, success: 1
src/station.c:station_enter_state() Old State: disconnecting, new state: disconnected
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event() 
Unexpected connection related event -- is another supplicant running?
src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)

Re: 1.30 fails to connect to some APs

[Denis Kenzior]

Hi Sebastien,

On 9/16/22 06:32, Sebastien Bacher wrote:
> Using iwd 1.30 on Ubuntu Kinetic, I've some APs my laptop fails to connect to
> 
> I'm including a log from 'iwd -d' while trying to connect using
> 
> $ sudo iwctl station wlan0 connect <APNAME>
> 
> The log states
> 
> 'wiphy_select_akm() Network is WPA3-Personal...'
> 

So if we select WPA-Personal, the AP most likely is configured like this. 
Perhaps it is in WPA3 Transition mode where both WPA2 and WPA3 AKMs are enabled. 
  Hard to say without seeing the detailed iwmon (preferably) or iw scan result 
output.

> But iwlist states 'IE: IEEE 802.11i/WPA2 Version 1' and using wpasupplicant 

Note that iwlist isn't WPA3 aware [1].

> works fine and network-manager also flags it as WPA2, could it be that iwd 
> wrongly detect the authentification to use?

Dunno about NM/wpa_s.  But your AP is certainly acting like a WPA3 AP.  From 
your log:

src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=1, state=committed

<--- We receive an SAE (WPA3) reply packet from the AP

src/netdev.c:netdev_mlme_notify() MLME notification Del Station(20)
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=1, state=committed

<---- And again here

src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/sae.c:sae_verify_packet() rx trans=2, state=confirmed

<---- And looks like we do not consider the confirm reply valid (?)

Can you tell us more about the AP? Do you have any way of obtaining logs from it 
by any chance?  Does 'iw dev <foo> scan' results for your AP list any Vendor 
IEs?  Note that iwd uses P384 curves for SAE by default (for higher security). 
Some older WPA3 implementations implement the spec poorly when curves other than 
P256 are used.

Also, it might be useful for us to look at the iwmon output.  See [2].  Start 
iwmon just prior to iwctl 'station <device> scan' and 'station <device> 
connect...'  Feel free to send the output to me directly if there are any 
privacy concerns.

[1] 
https://github.com/HewlettPackard/wireless-tools/blob/master/wireless_tools/iwlist.c#L301
[2] https://iwd.wiki.kernel.org/debugging#iwmon

Regards,
-Denis

Re: 1.30 fails to connect to some APs

[Sebastien Bacher]

Hey Denis,

Thanks for the reply. That's the access point from a coworking space and 
I'm not there anymore for today but I will get the debugging log and 
extra information next week.

Cheers,
Sebastien Bacher

Le 16/09/2022 à 16:28, Denis Kenzior a écrit :
>
> Can you tell us more about the AP? Do you have any way of obtaining 
> logs from it by any chance?  Does 'iw dev <foo> scan' results for your 
> AP list any Vendor IEs?  Note that iwd uses P384 curves for SAE by 
> default (for higher security). Some older WPA3 implementations 
> implement the spec poorly when curves other than P256 are used.
>
> Also, it might be useful for us to look at the iwmon output.  See 
> [2].  Start iwmon just prior to iwctl 'station <device> scan' and 
> 'station <device> connect...'  Feel free to send the output to me 
> directly if there are any privacy concerns.
>
> [1] 
> https://github.com/HewlettPackard/wireless-tools/blob/master/wireless_tools/iwlist.c#L301 
>
> [2] https://iwd.wiki.kernel.org/debugging#iwmon