Re: [Request] iwd to support brcmfmac 'SAE with AUTHENTICATE'

[James Prestwood <prestwoj@gmail.com>]

Hi Keith,

On 8/11/24 6:19 PM, KeithG wrote:
> On Sun, Aug 11, 2024 at 2:38 PM Denis Kenzior <denkenz@gmail.com> wrote:
>> Hi Keith,
>>
>>>       Supported extended features:
>>>           * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
>>>           * [ DFS_OFFLOAD ]: DFS offload
>>>
>> <snip>
>>
>>> The pcap is uploaded to my gdrive:
>>> https://drive.google.com/file/d/1vIuje60MGFPklcXtSNMi9-IOlV_6sBJ8/view?usp=drivesdk
>> What is the PCAP supposed to show?  There's no Connection attempt in there.
>>
>>> Hopefully, this helps to get started.
>>>
>> Anyway, I was curious and snooped on wpa_s from git trying to connect to an
>> iPhone 12 Personal Hotspot (Maximum Compatibility option off, so it uses SAE).
>> Not a pretty sight.  Firmware fails with errno=-52, Invalid exchange.  Has
>> anyone from RPI team actually tested this firmware before pushing it out?
>>
>> I also tried the old firmware with SAE_OFFLOAD bits, and that doesn't work with
>> wpa_s or iwd either.
>>
>> Until someone sends me a iwmon trace showing CMD_EXTERNAL_AUTH exchange working
>> on an WPA3-Personal Only network, I remain skeptical that any of the Cypress
>> firmwares actually work.
>>
>> Regards,
>> -Denis
> Denis,
>
> I did not attempt a connect with that first log. I misunderstood what
> James was asking for.

You didn't misunderstand :) I was confused by what I thought brcmfmac 
supported but Denis pointed out that the "Device supports SAE with 
AUTHENTICATE command" only mean NL80211_FEATURE_SAE was set, not that 
CMD_AUTHENTICATE is actually supported (really dumb and confusing, I know).

What is interesting though is even in your pcap CMD_EXTERNAL_AUTH isn't 
showing up as a supported command.

     Supported Commands:
         New Interface [7]
         Set Interface [6]
         New Key [11]
         Start AP [15]
         Join IBSS [43]
         Set PMKSA [52]
         Del PMKSA [53]
         Flush PMKSA [54]
         Remain on Channel [55]
         Frame [59]
         Set Wiphy Netns [49]
         Set Channel [65]
         Start Sched Scan [75]
         Start P2P Device [89]
         Connect [46]
         Disconnect [48]
         Crit Protocol Start [98]
         Crit Protocol Stop [99]
         Update Connect Params [122]

So I'm even more confused now. But as Denis said, we do need a iwmon 
pcap of wpa_supplicant working I think to see how its actually 
connecting successfully.

Thanks,

James

>   I tried connecting
> with my Samsung phone and was able to connect so it seems that the AP
> is working and allows a
> connection from my phone.
>
> I tried to connect from the Pi with iwctl:
> https://drive.google.com/file/d/1f1jnD0EUOJSaJXd8l7uYG9nisAxCPeo4/view?usp=drivesdk
>
> I uninstalled iwd, installed wpa_supplicant (built from git) rebooted
> and tried to connect with connman and collected another pcap and it
> did not connect:
> https://drive.google.com/file/d/1zuVSF0xu4Nk2fN9ketBSv1tiquT-Sc-p/view?usp=drivesdk
>
> I then tried from wpa_cli and did not connect. I tried again with a
> wpa_supplicant.conf and also could not connect.
>
> Now I am trying to figure out what I did to allow this connection to a
> sae AP... Now that I have nlmon
> module and iwmon, I will see if I can re-connect, somehow.
> The brcmfmac is such a pain.
> When I get a wpa3/SAE connection, I will make a pcap and post it.
> I actually was able to make one with wpa_supplicant once and actually
> passed data, but it does not seem to work today.
>
> Keith