Re: [PATCH] Don't use 802.11r Fast Transition if the driver doesn't support it

On Wed, Feb 26, 2020 at 5:50 AM Arend Van Spriel
<[email protected]> wrote:
>
> On 2/25/2020 7:45 AM, Alex Henrie wrote:
> > Since version 1.20, NetworkManager supports 802.11r Fast Transition by
> > passing both "wpa-psk-sha256" and "ft-psk" to wpa_supplicant as possible
> > authentication mechanisms. However, wireless adapters such as the
> > Raspberry Pi 3B's BCM43438 do not support Fast Transition and fail to
> > connect when wpa_supplicant tries to use it instead of ordinary (slow)
> > authentication. This patch skips over "ft-psk" in
> > wpa_supplicant_set_suites if the user's hardware doesn't support it,
> > making the latest NetworkManager work seamlessly on the Raspberry Pi.
> >
> > There was already a check in wpa_supplicant_set_suites that disables
> > Fast Transition if neither SME nor IES is available. However, it is
> > evident that support for SME or IES is a necessary but not sufficient
> > condition for supporting Fast Transition.
> >
> > Signed-off-by: Alex Henrie <[email protected]>
> > ---
> >   wpa_supplicant/wpa_supplicant.c | 9 ++++++++-
> >   1 file changed, 8 insertions(+), 1 deletion(-)
> >
> > diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
> > index 634fb290e..567dbfe77 100644
> > --- a/wpa_supplicant/wpa_supplicant.c
> > +++ b/wpa_supplicant/wpa_supplicant.c
> > @@ -1460,8 +1460,15 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
> >   #endif /* CONFIG_SAE */
> >   #ifdef CONFIG_IEEE80211R
> >       if (!(wpa_s->drv_flags & (WPA_DRIVER_FLAGS_SME |
> > -                               WPA_DRIVER_FLAGS_UPDATE_FT_IES)))
> > +                               WPA_DRIVER_FLAGS_UPDATE_FT_IES))) {
> >               sel &= ~WPA_KEY_MGMT_FT;
> > +     } else {
>
> Not sure why you need an else branch. The if conditions check individual
> bits *not* being set. So I think all if statements can be in same
> indentation level:
>
>         if (!x)
>                 clear_x;
>         if (!y)
>                 clear_y;
>         if (!z)
>                 clear_z;

The first branch clears *all* bits related to fast transition, so if
it is executed then there's no need to clear certain specific bits
again. See the definition of WPA_KEY_MGMT_FT in src/common/defs.h:

#define WPA_KEY_MGMT_FT (WPA_KEY_MGMT_FT_PSK | \
             WPA_KEY_MGMT_FT_IEEE8021X | \
             WPA_KEY_MGMT_FT_IEEE8021X_SHA384 | \
             WPA_KEY_MGMT_FT_SAE | \
             WPA_KEY_MGMT_FT_FILS_SHA256 | \
             WPA_KEY_MGMT_FT_FILS_SHA384)

Regardless, it appears that the original code was correct that if the
driver supports SME or IES then it also supports FT-PSK and FT-802.1X,
so my patch is not necessary unless there is some driver out there
where this assumption is not correct.

-Alex