Received-SPF: pass (google.com: domain of linux-wireless+bounces-8752-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
From: "Sperling, Tobias" <Tobias.Sperling@Softing.com>
To: "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
CC: "Le Suire, Michael" <Michael.Suire@Softing.com>, "pkshih@realtek.com"
	<pkshih@realtek.com>, "johannes@sipsolutions.net" <johannes@sipsolutions.net>
Subject: wifi: mac80211: unencrypted message in 4-way handshake
Thread-Topic: wifi: mac80211: unencrypted message in 4-way handshake
Thread-Index: Adq7OqrIXwNmhc6ZT92PlJydhITGNgAAMsqA
Date: Mon, 10 Jun 2024 13:50:53 +0000
Message-ID:
 <BE1P281MB2420DA2C6AFF94E525306302EFC62@BE1P281MB2420.DEUP281.PROD.OUTLOOK.COM>
References:
 <BE1P281MB24208AB02DAEACAE9AF4B5C5EFC62@BE1P281MB2420.DEUP281.PROD.OUTLOOK.COM>
In-Reply-To:
 <BE1P281MB24208AB02DAEACAE9AF4B5C5EFC62@BE1P281MB2420.DEUP281.PROD.OUTLOOK.COM>
Accept-Language: de-DE, en-US
Content-Language: de-DE
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?us-ascii?Q?r0qeyWeL0ab87Uw7b3r281AuvkOl5yM6NaIgvXJ6MQtTc3QLFqvoX096aGbo?=
 =?us-ascii?Q?zBUP9SrjizqzwskF2XTtSr2RMJPBg8E4YBw7GKuiVtVfAykcvCZtLUfx4Y/V?=
 =?us-ascii?Q?8S9MW/EpKZlc73U2goMg8p1j9LQmhUDkYhbjNo/Q2PGVtd4ac7ii6ocMqzD+?=
 =?us-ascii?Q?YgdqAef8o4it4rNyOOz/zudA0kq+kUjXag5qXvTH8/Mq0iex/UQpLk8Suzlx?=
 =?us-ascii?Q?xtUc+JfK4tcPSMkWS2OxQJZN19ZzZjbevWYhcBRDGVG8Z0ehZ4kgcM2PapHa?=
 =?us-ascii?Q?jtViRW+LM9+BIBdWGKswOPu67s79Xb65pa2G5cZNcUQU5vqQuQ5M3PJd8lwT?=
 =?us-ascii?Q?HZuG9oex9LYHrZg3MPZG18YAzJYNSEaMolT6aoHLncfauCzTSG1AYTLPgP5T?=
 =?us-ascii?Q?0bxDOPip2nl5Zy4gpvuO9n+Tb82rtcUkN9cflFTtFh4YsSGsaPFqrTK1bVcQ?=
 =?us-ascii?Q?0pI13ba8vnPWBaVvhS+gwIcVc0Lulg4sOGp1wt9Qg+RiXs27+CcjLflZeu/t?=
 =?us-ascii?Q?SOmeyjo4bqcK0Acw7gv4xRDtOkCbhfS7Mr5f0pn+qS1EtaUlsRtKM5j8q4LU?=
 =?us-ascii?Q?bpFZJSZcIxRzkTPEttA57rOrVHj+XjOHz2u9TB03AV6XMfoVdbfaBZbUQJL3?=
 =?us-ascii?Q?sp2/8W8DS4ighP+puewTSJML+VWTrs3kcfrA5VCCSTTdltBRR/n00lj5pa8d?=
 =?us-ascii?Q?rJ1bh/tzGUUWXZGGsa25WT21Rp6CHpSdTMLEbWZLwNLqYuD03b7JXBponjip?=
 =?us-ascii?Q?KTHyjG72Q64w4Wdar9OI+xxsgYZI/pyVZNGKV0A9ledazNlCGWlAZA9F3nzZ?=
 =?us-ascii?Q?4r58wQvjBxU3k1hb+AeQ8J0apJ/nh0t3NBS9XrEZK+LJ7PQoN3isttNP11on?=
 =?us-ascii?Q?IH+IStCtNDTFjjp2iVUTOzk0HvqQ98ytf1JaE5CkZ7vIDUfZYEji8BvGffdO?=
 =?us-ascii?Q?E8GVvf9b/bFexbl+KKC3D4DlWhrV8BIVMm0OlN+fcF1UZu0h4FbTjctYw5r/?=
 =?us-ascii?Q?+mLgTTYTDJf94CHRaghLIogP5cQhow9b+BAu4LNzY9Ta8g5ep9U6RAvtKsWE?=
 =?us-ascii?Q?nE2T71UEyY9TjKbdwDa3Y2qZdIuU5PeqTYRv7EwFvA0ST5r4j12JpObH1cgN?=
 =?us-ascii?Q?acoG/Kjrmi1d0V0Ix9pCd0S26BKXUcRRrHRbDhRK5kqwI6oZ+mhXfjAN4Byf?=
 =?us-ascii?Q?7clcznres9ByCjXXNy7mVOtbqrLUwYx80tnTDPdNezFy0wa/M0zi9poVWnMa?=
 =?us-ascii?Q?ZsmFOu8S1elUwoDFydcJdaErBwNp0htImDEDCojGHPgXnCWNt9ChuSPAZ1B1?=
 =?us-ascii?Q?rzQSSkIFGXa/j6pTghmNdImbIZykJ0VlGYi7s6cgJC390ZegCGCtj8t+UGYT?=
 =?us-ascii?Q?fdWfx7zhzUmuJBQObJmPEyAD4sjaBA9VfNgMa46gwMW2hZFt0RXwPfeM1hzQ?=
 =?us-ascii?Q?2T/EBKDrj+3t8GCJTQoZhYk/p8lH5BK6QDUnZI9px+UN/28KsW4Ql7LNl3Lv?=
 =?us-ascii?Q?KLFpzU98brQpMq55R1JVeDJm9dD6lKJLBIfs9IXJxUickKMemUih8VBTETof?=
 =?us-ascii?Q?0LRLpJx+kRTwa46b5skXnaUdj9lRwO9DBDjky5CtSRn+011t0v4fxiY+eWvh?=
 =?us-ascii?Q?R5QOEXhagQhBqI20+ST++3YC6nT6AS5Y9zG/pbBl/99JBR1V9y4DsNNxG2YD?=
 =?us-ascii?Q?uqUzbw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk
X-Mailing-List: linux-wireless@vger.kernel.org
List-Id: <linux-wireless.vger.kernel.org>
List-Subscribe: <mailto:linux-wireless+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-wireless+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-OriginatorOrg: softing.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BE1P281MB2420.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 1af9a39e-c503-4e7b-10be-08dc895458a6
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jun 2024 13:50:53.6929
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: fe3606fa-d397-4238-9997-68dcd7851f64
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: cpSVAVAvoWq0lkqa4t5A7KswnoFRnAW/mcbvIDWydaEQwaayB1EQ+fFkiZflynroY+kgfdjdDvQ1KFRx+1MAF72K0gssrovx8XlFP5QGbiw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR2P281MB1979

Hello,

recently we moved from a 4.9 kernel to 5.4 kernel and observed the followin=
g issue. To rule out that the issue was already fixed we then tried it with=
 a 6.6 kernel and observed the same issue there, too. To sum it up, the fol=
lowing issue can be observed with kernel 5.4 and 6.6 but not with 4.9.

We are using a Cisco AP with EWC (C9210) and EAP-PEAP as authentication met=
hod. Additionally, a session timeout is configured in the AP (300 s) after =
which a rekeying is taking place. So every 5 minutes a new four-way handsha=
ke is taking place which usually is completely encrypted. However, while sn=
iffing with an external device we saw that the fourth packet of the four-wa=
y handshake is send unencrypted by our clients, when it comes to EAP-PEAP. =
The first three packets are encrypted as expected. In case of the Cisco AP =
the attempt is then rejected with a 4WAY_HANDSHAKE_TIMEOUT leading to a com=
pletely new authentication.

On our clients we are using wpa_supplicant 2.10 with the same config on all=
 kernels and therefore would rule out an issue in the supplicant, as it is =
working with the same supplicant in kernel 4.9.
As driver we are using ath9k for QCA2066 (starting at kernel 4.9) and rtw88=
 for RTL8822CE (backported, starting at kernel 5.4). The issue exists for b=
oth drivers for kernel 5.4 and 6.6. Furthermore, we were also able to test =
a proprietary driver for the RTL8822CE chipset on kernel 5.4 where the issu=
e does not appear. However, latter driver is a full-mac driver not using th=
e mac80211 driver in comparison to the soft-mac drivers of the mainline. Co=
nsidering all the details we highly assume that the issue is to be found in=
 the mac80211 driver.

Do you have some hints where to look at to solve the issue? Otherwise pleas=
e let us know if we can provide some logs or config files.

Thanks in advance

Tobias Sperling