Host AP driver for Intersil Prism2/2.5/3

michael-dev | 24 Jul 2012 00:23

group rekeying failing

Hi,

I'm currently facing trouble using hostapd from git (2012-07-07), 
though the problem has been present for quite some time with openwrt.
The setup is a multi-ssid with wpa-psk (radius) and wpa-eap (radius) 
using WPA-2 and multi-vlan. peerkey, okc and rsn_preauth are enabled, 
but the problem persists even without and across psk and 802.1X. The 
STAs are wpa-supplicant 0.6.10 and 0.7.3, but the problem has also been 
seen with MacOS 10.6, the AP is OpenWRT von P1020WLAN with two AR9300 
cards.

After authentication, all stations receive broadcast frames sent by the 
AP. Then, group key renegotiation occurs, and _some_ stations are now 
failing to receive broadcast frames. This then breaks IPv6 soon after, 
because neighbourhood discovery does no longer work.

I've patched driver_nl80211.c to debug the broadcast key actually set 
by the driver, and it differs between ap and sta during rekeying but not 
during auth.
Further, I looks like the stations not failing are those, for whose BSS 
hostap did not issue an set_key command during rekeying. Even though, on 
the stations failing, wpa supplicant sets the same key as already set 
before again, but hostap uses a different key than before. I further 
seen some warnings on GKeyDoneStations>1, which I guess are related.

There are also ap and sta logs for single-sta logged-in failing 
(log-sta and log-ap) and an ap log for two-stas, where only one is 
failing (log-ap-2).
For size reasons, those are downloadable here:
   http://pastebin.com/tCiTvBrT (log-ap)

(Continue reading)

headers

michael-dev | 24 Jul 2012 20:10

[PATCH] fix wpa group rekeying

Hi,

I'm currently facing

  wpa_group_setkeys: Unexpected GKeyDoneStations=2 when starting new GTK 
rekey

warnings with two STAs connected in different VLANs, but only 
wpa_group_setkeys: GKeyDoneStations=1 messages.
I can only explain this with wpa_group_update_sta being called multiple 
times per sta, as GKeyDoneStations is only incremented there and after 
each wpa_group_setkeys, the GKeyDoneStations of the driven group is 
correct (= the number of stas in the processed vlan).

Looking at wpa_auth_for_each_sta and its for_each implementation on 
wpa_auth_glue.c, I find that this code iterates over all sta and not 
just those of the given group. This can be verified by printing debug 
messages in wpa_group_update_sta giving the group vlan_id, which shows 
both vlans (of both stas) in each wpa_group_setkeys call.

Please find attached a patch that fixes this by giving the group 
pointer as callback context in wpa_group_setkeys and let 
wpa_group_update_sta skip those stas that are not in the correct group.
It works for me and fixes the wpa group keying issues seen before.

Signed-hostap: Michael Braun <michael-dev <at> fami-braun.de>

Regards,
   M. Braun

(Continue reading)

headers

michael-dev | 9 Aug 2012 11:42

[PATCHv2] fix wpa group rekeying

Hi,

here comes the refreshed patch, as upstream uses wpa_group_update_sta 
now in a second place, too.

Signed-hostap: Michael Braun <michael-dev <at> fami-braun.de>

Regards,
  M. Braun

Am 24.07.2012 20:10, schrieb michael-dev:
> Hi,
>
> I'm currently facing
>
>  wpa_group_setkeys: Unexpected GKeyDoneStations=2 when starting new 
> GTK rekey
>
> warnings with two STAs connected in different VLANs, but only
> wpa_group_setkeys: GKeyDoneStations=1 messages.
> I can only explain this with wpa_group_update_sta being called
> multiple times per sta, as GKeyDoneStations is only incremented there
> and after each wpa_group_setkeys, the GKeyDoneStations of the driven
> group is correct (= the number of stas in the processed vlan).
>
> Looking at wpa_auth_for_each_sta and its for_each implementation on
> wpa_auth_glue.c, I find that this code iterates over all sta and not
> just those of the given group. This can be verified by printing debug
> messages in wpa_group_update_sta giving the group vlan_id, which 
> shows

(Continue reading)

headers

Jouni Malinen | 10 Aug 2012 15:53

Re: [PATCHv2] fix wpa group rekeying

On Thu, Aug 09, 2012 at 11:42:13AM +0200, michael-dev wrote:
> here comes the refreshed patch, as upstream uses
> wpa_group_update_sta now in a second place, too.

Thanks! Applied.

--

-- 
Jouni Malinen                                            PGP id EFC895FA