Re: brcmfmac SAE/WPA3 negotiation - Part 2

James,

I patched the latest iwd-git. First time after reboot, it will
connect. If I remove the config in connman:
connmanctl
config wifi_blah_blah --remove
then try again:
connect wifi_blah_blah
it will not connect and I get the error:

Jan 27 22:24:01 Pi4 kernel: ieee80211 phy0:
brcmf_cfg80211_external_auth: External authentication failed: status=1

It will not get a DHCP address.

When I add the directive in the main.conf, even with this patch, it
seems to connect every time.
DisablePMKSA=true

Keith

On Mon, Jan 27, 2025 at 10:21 AM James Prestwood <[email protected]> wrote:
>
> Hi Keith,
>
> On 1/27/25 7:09 AM, KeithG wrote:
> > I just tried this and it connected 2x once from a saved key and a
> > second time from a new key.
> > Will continue testing and let you know, but this may be it!
> > Thanks so much for all the support.
>
> Would you mind testing the latest RFC patch I put on the mailing list?
> Please remove the DisablePMKSA option in main.conf with that patch. I'd
> like to see if PMKSA will actually function with brcmfmac without
> external auth, or if we're stuck disabling it entirely.
>
> Thanks,
>
> James
>
> >
> > On Mon, Jan 27, 2025 at 8:29 AM James Prestwood <[email protected]> wrote:
> >> Hi Keith,
> >>
> >> On 1/25/25 8:37 AM, KeithG wrote:
> >>
> >> <snip>
> >>>> With wpa_supplincant, before the AP sends the 'PAE:', we get this
> >>>> which is not in any of the iwmon logs with iwd:
> >>>> < Request: Set PMKSA (0x34) len 92 [ack]                              14.561627
> >>>>       Interface Index: 3 (0x00000003)
> >>>>       PMKID: len 16
> >>>>           05 cb 9d 0d 9a c6 7c 42 77 b5 d2 23 f0 62 f7 4d  ......|Bw..#.b.M
> >>>>       MAC Address D8:3A:DD:60:A3:0C
> >>>>       Unknown: 287 len 4
> >>>>           c0 a8 00 00                                      ....
> >>>>       Unknown: 288 len 1
> >>>>           46                                               F
> >>>>       PMK: 254 len 32
> >>>>           35 28 07 cb 94 de 82 e7 0a 5c 73 d3 e4 1f 88 ae  5(.......\s.....
> >>>>           74 84 82 66 86 8d b5 aa 79 cb 75 d9 75 8d da 3a  t..f....y.u.u..:
> >>>>> Response: Set PMKSA (0x34) len 4 [0x100]                            14.562171
> >>>>       Status: Success (0)
> >>>>
> >>>> Is there any more info or help I can provide?
> >> Looks like the only difference between IWD working and not working is
> >> when it includes the PMKID. This is due to the new PMKSA feature which
> >> looks like it requires some extra work on brcmfmac (using SET_PMKSA).
> >> Try disabling PMKSA in main.conf with:
> >>
> >> [General].DisablePMKSA=true
> >>
> >> This should hopefully get IWD reliably connecting.
> >>
> >> Thanks,
> >>
> >> James
> >>