Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: wpa_supplicant 2.8 fails in brcmf_cfg80211_set_pmk
To:     Arend Van Spriel <arend.vanspriel@broadcom.com>,
        Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>,
        Marcel Holtmann <marcel@holtmann.org>
Cc:     Stanley Hsu <Stanley.Hsu@cypress.com>,
        Franky Lin <franky.lin@broadcom.com>,
        Hante Meuleman <hante.meuleman@broadcom.com>,
        Wright Feng <Wright.Feng@cypress.com>,
        "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>,
        "brcm80211-dev-list.pdl@broadcom.com" 
        <brcm80211-dev-list.pdl@broadcom.com>,
        brcm80211-dev-list <brcm80211-dev-list@cypress.com>,
        Jouni Malinen <j@w1.fi>
References: <06f7bda7-eeaf-536b-a583-7c9bc5f681f5@gmx.net>
 <9da02861-9151-9700-2c09-b312d74155fa@gmx.net>
 <605ea0a8-3303-b810-6223-18ccc7eb7af4@cypress.com>
 <2AF2E0A7-23F0-4FFE-A658-4906FF546199@holtmann.org>
 <d6bfe313-3aa7-82bb-dfac-25e6261dbf63@cypress.com>
 <d0263c6f-97d0-6571-32e9-778392eafe69@broadcom.com>
From:   Stefan Wahren <wahrenst@gmx.net>
Message-ID: <ab26ac30-e49c-8712-f124-8cf996b32a76@gmx.net>
Date:   Tue, 18 Jun 2019 19:03:39 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.0
MIME-Version: 1.0
In-Reply-To: <d0263c6f-97d0-6571-32e9-778392eafe69@broadcom.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Hi,

Am 18.06.19 um 10:27 schrieb Arend Van Spriel:
> + Jouni
>
> On 6/18/2019 7:33 AM, Chi-Hsien Lin wrote:
>>
>>
>> On 06/17/2019 10:33, Marcel Holtmann wrote:
>>> Hi Chi-hsien,
>>>
>>>>>> i was able to reproduce an (maybe older issue) with 4-way handshake
>>>>>> offloading for 802.1X in the brcmfmac driver. My setup consists of
>>>>>> Raspberry Pi 3 B (current linux-next, arm64/defconfig) on STA
>>>>>> side and a
>>>>>> Raspberry Pi 3 A+ (Linux 4.19) on AP side.
>>>>>
>>>>> Looks like Raspberry Pi isn't the only affected platform [3], [4].
>>>>>
>>>>> [3] - https://bugzilla.redhat.com/show_bug.cgi?id=3D1665608
>>>>> [4] - https://bugzilla.kernel.org/show_bug.cgi?id=3D202521
>>>>
>>>> Stefan,
>>>>
>>>> Could you please try the attached patch for your wpa_supplicant? We'l=
l
>>>> upstream if it works for you.
i've forward this patch to the Arch Linux board hoping someone else has
currently more time.
>>>
>>> I hope that someone is also providing a kernel patch to fix the
>>> issue. Hacking around a kernel issue in userspace is not enough. Fix
>>> the root cause in the kernel.
>>
>> Marcel,
>>
>> This is a kernel warning for invalid application PMK set actions, so th=
e
>> fix is to only set PMK to wifi driver when 4-way is offloaded. I think
>> Arend added the WARN_ON() intentionally to catch application misuse of
> =C2=A0> PMK setting.
>>
>> You may also remove the warnings with the attached patch, but let's see
>> what Arend says first.
Instead of removing the WARN_ON i suggest to replace it with a more user
friendly dev_warn().
>>
>>
>> Arend,
>>
>> Any comment?
>
> Hi Chi-Hsien, Marcel
>
> From the kernel side I do not see an issue. In order to use 802.1X
> offload the NL80211_ATTR_WANT_1X_4WAY_HS flag must be set in
> NL80211_CMD_CONNECT. Otherwise, NL80211_CMD_SET_PMK is not accepted.
> The only improvement would be to document this more clearly in the
> "WPA/WPA2 EAPOL handshake offload" DOC section in nl80211.h.

I missed to add my expectation as a user. At first i assume this new
behavior in wpa_supplicant 2.8 has been tested successful with at least
one Linux wifi driver. So i'm curious if all drivers behave that way?

Another point is that in my wpa_supplicant.conf i never enforced 802.1X
offload and i assume this feature is optional. So can't we do some kind
of fallback in this case?

Stefan

>
> As for the wpa_supplicant behavior it seemed a good idea to reuse the
> req_key_mgmt_offload parameter at the time, but it seems to bite each
> other. Maybe it is better to have a separate flag like
> 'req_handshake_offload'. Jouni, any thoughts on this?
>
> Regards,
> Arend