Re: Weird wireless/wpa_supplicant screw-up.

[Valdis.Kletnieks@vt.edu]

[-- Attachment #1: Type: text/plain, Size: 2194 bytes --]

On Fri, 12 Mar 2010 19:09:09 PST, Johannes Berg said:
> No ... look at _all_ that it produces.
> 
> [   98.592575] In giwencode idx=0 keys=ffff88001b304000 cipher=0
> [   98.592580] And we're going home...
> *****
> [   98.592633] In giwencode idx=1 keys=ffff88001b304000 cipher=fac04
> *****
> [   98.592749] In giwencode idx=2 keys=ffff88001b304000 cipher=0
> [   98.592751] And we're going home...
> [   98.592803] In giwencode idx=3 keys=ffff88001b304000 cipher=0
> [   98.592805] And we're going home...
> [   98.592856] In giwencode idx=0 keys=ffff88001b304000 cipher=0
> [   98.592859] And we're going home...
> 
> See? It reports one key which is the RX-only group key which is
> absolutely correct.

It matches what 'iwlist keys' reports, but I remain unconvinced of
its "correctness".  If a TX key has been set anyplace, what allows me
to verify that it was in fact set?

> > So the root cause has something to do with params[idx].cipher being unset.
> 
> Not at all.

I was referring to the root cause of why 'iwlist keys' wasn't reporting
anything for the other 3 key slots.

> GIWENCODE is 100% unsuitable for WPA. Just forget about "iwlist key".

Feel free to point me at the officially approved substitute.

> And then we'd like to know what the actual problem is.

The problem is that I do 'iwconfig', and I see:

Encryption key:off

And if I do 'iwlist keys', I don't see a TX key listed, which certainly gives
the at least the impression that we're not encrypting outbound traffic.  If I'm
not supposed to trust 'iwconfig' or 'iwlist key' to tell me whether WPA2
traffic is in fact encrypted or not, what *am* I supposed to use instead?

There's two possibilities:

1) iwconfig and iwlist keys are correctly reporting I don't have a TX key
set - which means wpa_supplicant and/or the kernel is failing to get the
key set, which is a problem.

2) iwconfig and iwlist are lying through their teeth, and reporting there
isn't any key set when in fact there is.  This is still a problem because it
implies to users their traffic isn't secured.

I'll point out that until fairly recently 'iwconfig' *did* report a key for
WPA2, so this looks like a regression on somebody's part.


[-- Attachment #2: Type: application/pgp-signature, Size: 227 bytes --]