Re: brcmfmac SAE/WPA3 negotiation - Part 2

[James Prestwood <prestwoj@gmail.com>]

Hi Keith,

On 1/27/25 8:47 PM, KeithG wrote:
> James,
>
> I patched the latest iwd-git. First time after reboot, it will
> connect. If I remove the config in connman:
> connmanctl
> config wifi_blah_blah --remove
> then try again:
> connect wifi_blah_blah
> it will not connect and I get the error:
>
> Jan 27 22:24:01 Pi4 kernel: ieee80211 phy0:
> brcmf_cfg80211_external_auth: External authentication failed: status=1
>
> It will not get a DHCP address.
>
> When I add the directive in the main.conf, even with this patch, it
> seems to connect every time.
> DisablePMKSA=true

Thanks for testing this. I've got yet another patch which should avoid 
the need to use DisablePMKSA anymore. If you have a chance to try it out 
to confirm that would be appreciated. Again, remove the DisablePMKSA 
option for this test and IWD _should_ be able to connect/reconnect 
without an issue.

Thanks,

James

>
> Keith
>
> On Mon, Jan 27, 2025 at 10:21 AM James Prestwood <prestwoj@gmail.com> wrote:
>> Hi Keith,
>>
>> On 1/27/25 7:09 AM, KeithG wrote:
>>> I just tried this and it connected 2x once from a saved key and a
>>> second time from a new key.
>>> Will continue testing and let you know, but this may be it!
>>> Thanks so much for all the support.
>> Would you mind testing the latest RFC patch I put on the mailing list?
>> Please remove the DisablePMKSA option in main.conf with that patch. I'd
>> like to see if PMKSA will actually function with brcmfmac without
>> external auth, or if we're stuck disabling it entirely.
>>
>> Thanks,
>>
>> James
>>
>>> On Mon, Jan 27, 2025 at 8:29 AM James Prestwood <prestwoj@gmail.com> wrote:
>>>> Hi Keith,
>>>>
>>>> On 1/25/25 8:37 AM, KeithG wrote:
>>>>
>>>> <snip>
>>>>>> With wpa_supplincant, before the AP sends the 'PAE:', we get this
>>>>>> which is not in any of the iwmon logs with iwd:
>>>>>> < Request: Set PMKSA (0x34) len 92 [ack]                              14.561627
>>>>>>        Interface Index: 3 (0x00000003)
>>>>>>        PMKID: len 16
>>>>>>            05 cb 9d 0d 9a c6 7c 42 77 b5 d2 23 f0 62 f7 4d  ......|Bw..#.b.M
>>>>>>        MAC Address D8:3A:DD:60:A3:0C
>>>>>>        Unknown: 287 len 4
>>>>>>            c0 a8 00 00                                      ....
>>>>>>        Unknown: 288 len 1
>>>>>>            46                                               F
>>>>>>        PMK: 254 len 32
>>>>>>            35 28 07 cb 94 de 82 e7 0a 5c 73 d3 e4 1f 88 ae  5(.......\s.....
>>>>>>            74 84 82 66 86 8d b5 aa 79 cb 75 d9 75 8d da 3a  t..f....y.u.u..:
>>>>>>> Response: Set PMKSA (0x34) len 4 [0x100]                            14.562171
>>>>>>        Status: Success (0)
>>>>>>
>>>>>> Is there any more info or help I can provide?
>>>> Looks like the only difference between IWD working and not working is
>>>> when it includes the PMKID. This is due to the new PMKSA feature which
>>>> looks like it requires some extra work on brcmfmac (using SET_PMKSA).
>>>> Try disabling PMKSA in main.conf with:
>>>>
>>>> [General].DisablePMKSA=true
>>>>
>>>> This should hopefully get IWD reliably connecting.
>>>>
>>>> Thanks,
>>>>
>>>> James
>>>>