Re: [PATCH] Log falling back from SAE to WPA2

[Denis Kenzior <denkenz@gmail.com>]

Hi Fiona,

On 1/9/24 03:59, Fiona Klute wrote:
> I've had connections to a WPA3-Personal only network fail with no log
> message from iwd, and eventually figured out to was because the driver
> would've required using CMD_EXTERNAL_AUTH. With the added log messages
> the reason becomes obvious.

Interesting.  Last time I checked only the quantenna driver used this feature 
and it wasn't very common.  If it isn't a secret, what card / driver do you have?

> 
> Additionally the fallback may happen even if the user explicitly
> configured WPA3 in NetworkManager, I believe a warning is appropriate
> there.

There's currently no way to force WPA3-only in iwd.  Either configure the AP to 
be WPA3 only, or have the AP enforce transition-disable bit.  But this typically 
requires iwd to connect at least once with WPA3.  See 'TransitionDisable' and 
'DisabledTransitionModes' in man 5 iwd.network

> ---
>   src/wiphy.c | 6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/src/wiphy.c b/src/wiphy.c
> index 766df348..5530e9c6 100644
> --- a/src/wiphy.c
> +++ b/src/wiphy.c
> @@ -248,6 +248,8 @@ static bool wiphy_can_connect_sae(struct wiphy *wiphy)
>   		 *
>   		 * TODO: No support for CMD_EXTERNAL_AUTH yet.
>   		 */
> +		l_debug("Unsupported: %s needs CMD_EXTERNAL_AUTH for SAE",
> +			wiphy->driver_str);

I flipped this around and made this statement an l_warn to make it clearer that 
this is an iwd limitation.

>   		return false;
>   	}
> 
> @@ -312,8 +314,10 @@ enum ie_rsn_akm_suite wiphy_select_akm(struct wiphy *wiphy,
>   		if (ie_rsne_is_wpa3_personal(info)) {
>   			l_debug("Network is WPA3-Personal...");
> 
> -			if (!wiphy_can_connect_sae(wiphy))
> +			if (!wiphy_can_connect_sae(wiphy)) {
> +				l_warn("Can't use SAE, trying WPA-2");

And made this into l_debug.

>   				goto wpa2_personal;
> +			}
> 
>   			if (info->akm_suites &
>   					IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256)
> --

Regards,
-Denis