ath(4): Cannot use WPA in 802.11a mode

[s***@ott.net]

Synopsis: ath(4): Cannot use WPA in 802.11a mode
Category: kernel

System : OpenBSD 6.1
Details : OpenBSD 6.1 (GENERIC) #291: Sat Apr 1 13:49:08 MDT 2017
***@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC

Architecture: OpenBSD.i386
Machine : i386
I am trying to use my OpenBSD machine as a wifi access point with an
ath(4) card. This works fine as long as I either (a) disable WPA or
(b) operate the card in 80211b mode; if I enable WPA in 80211a mode my
clients can no longer connect.

The card is a Wistron DCMA-81. According to the Internet it should come
with an AR5414 chip but dmesg says AR5413 (in case that matters).
This is the configuration without WPA that works:

ath0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:0b:6b:23:35:a5
index 4 priority 4 llprio 3
groups: wlan
media: IEEE802.11 autoselect mode 11a hostap
status: active
ieee80211: nwid test chan 48 bssid 00:0b:6b:23:35:a5

This is the configuration with WPA in 11b mode that works:

ath0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:0b:6b:23:35:a5
index 4 priority 4 llprio 3
groups: wlan
media: IEEE802.11 autoselect mode 11b hostap
status: active
ieee80211: nwid test chan 3 bssid 00:0b:6b:23:35:a5 wpakey 0x08f0cc3ee0003f37f35e4a79e2c7ed56b38f3d3c1de8692e62a8ccd1ab044fd2 wpaprotos wpa2 wpaakms psk wpaciphers ccmp wpagroupcipher ccmp

And this is the configuration with WPA in 11a mode that does not work:

ath0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:0b:6b:23:35:a5
index 4 priority 4 llprio 3
groups: wlan
media: IEEE802.11 autoselect mode 11a hostap
status: active
ieee80211: nwid test chan 48 bssid 00:0b:6b:23:35:a5 wpakey 0x08f0cc3ee0003f37f35e4a79e2c7ed56b38f3d3c1de8692e62a8ccd1ab044fd2 wpaprotos wpa2 wpaakms psk wpaciphers ccmp wpagroupcipher ccmp

This is what a (Linux) client says when it can't connect:

Successfully initialized wpa_supplicant
wlan0: SME: Trying to authenticate with 00:0b:6b:23:35:a5 (SSID='test' freq=5240 MHz)
wlan0: Trying to associate with 00:0b:6b:23:35:a5 (SSID='test' freq=5240 MHz)
wlan0: Associated with 00:0b:6b:23:35:a5
wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlan0: CTRL-EVENT-DISCONNECTED bssid=00:0b:6b:23:35:a5 reason=15
wlan0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
wlan0: CTRL-EVENT-TERMINATING



dmesg:
OpenBSD 6.1 (GENERIC) #291: Sat Apr 1 13:49:08 MDT 2017
***@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Geode(TM) Integrated Processor by AMD PCS ("AuthenticAMD" 586-class) 499 MHz
cpu0: FPU,DE,PSE,TSC,MSR,CX8,SEP,PGE,CMOV,CFLUSH,MMX,MMXX,3DNOW2,3DNOW
real mem = 267931648 (255MB)
avail mem = 250093568 (238MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: date 11/05/08, BIOS32 rev. 0 @ 0xfd088
pcibios0 at bios0: rev 2.1 @ 0xf0000/0x10000
pcibios0: pcibios_get_intr_routing - function not supported
pcibios0: PCI IRQ Routing information unavailable.
pcibios0: PCI bus #0 is the last bus
bios0: ROM list: 0xe0000/0xa800
cpu0 at mainbus0: (uniprocessor)
mtrr: K6-family MTRR support (2 registers)
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 1 function 0 "AMD Geode LX" rev 0x33
glxsb0 at pci0 dev 1 function 2 "AMD Geode LX Crypto" rev 0x00: RNG AES
vr0 at pci0 dev 9 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 10, address 00:0d:b9:29:21:ac
ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034
vr1 at pci0 dev 10 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 11, address 00:0d:b9:29:21:ad
ukphy1 at vr1 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034
vr2 at pci0 dev 11 function 0 "VIA VT6105M RhineIII" rev 0x96: irq 15, address 00:0d:b9:29:21:ae
ukphy2 at vr2 phy 1: Generic IEEE 802.3u media interface, rev. 3: OUI 0x004063, model 0x0034
ath0 at pci0 dev 12 function 0 "Atheros AR5413" rev 0x01: irq 9
ath0: AR5413 10.5 phy 6.1 rf 6.3 eeprom 5.3, WOR0W, address 00:0b:6b:23:35:a5
glxpcib0 at pci0 dev 15 function 0 "AMD CS5536 ISA" rev 0x03: rev 3, 32-bit 3579545Hz timer, watchdog, gpio, i2c
gpio0 at glxpcib0: 32 pins
iic0 at glxpcib0
maxtmp0 at iic0 addr 0x4c: lm86
pciide0 at pci0 dev 15 function 2 "AMD CS5536 IDE" rev 0x01: DMA, channel 0 wired to compatibility, channel 1 wired to compatibility
wd0 at pciide0 channel 0 drive 0: <CF 4GB>
wd0: 1-sector PIO, LBA, 3831MB, 7847280 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 2
pciide0: channel 1 ignored (disabled)
ohci0 at pci0 dev 15 function 4 "AMD CS5536 USB" rev 0x02: irq 12, version 1.0, legacy support
ehci0 at pci0 dev 15 function 5 "AMD CS5536 USB" rev 0x02: irq 12
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 configuration 1 interface 0 "AMD EHCI root hub" rev 2.00/1.00 addr 1
isa0 at glxpcib0
isadma0 at isa0
com0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
com0: console
com1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
usb1 at ohci0: USB revision 1.0
uhub1 at usb1 configuration 1 interface 0 "AMD OHCI root hub" rev 1.00/1.00 addr 1
nvram: invalid checksum
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
scsibus2 at softraid0: 256 targets
root on wd0a (ca07ab0ce74bbe6a.a) swap on wd0b dump on wd0b
clock: unknown CMOS layout

usbdevs:
Controller /dev/usb0:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000), AMD(0x1022), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
Controller /dev/usb1:
addr 1: full speed, self powered, config 1, OHCI root hub(0x0000), AMD(0x1022), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered

[Stefan Sperling]

Post by s***@ott.net
I am trying to use my OpenBSD machine as a wifi access point with an
ath(4) card. This works fine as long as I either (a) disable WPA or
(b) operate the card in 80211b mode; if I enable WPA in 80211a mode my
clients can no longer connect.

I don't see anything obviously wrong with your configuration.
And yes, WPA is expected to work regardless of the underlying channel.

Post by s***@ott.net
wlan0: CTRL-EVENT-DISCONNECTED bssid=00:0b:6b:23:35:a5 reason=15

Reason 15 means the WPA 4-way handshake timed out from the AP's point of view.
This indicates the AP is unable to receive any (or some) frames sent by the
client during the WPA authentication phase.

Can you run 'ifconfig ath0 debug' on the AP and show additional lines
printed to dmesg while a client tries to connect?

Can you show the output of 'netstat -W ath0' and 'netstat -I ath0' twice?
Once from before the client tries to connect, and once after.

Are you sure that communication on 5 GHz works well in general?
Does an unecrypted network on 5GHz perform worse than a 2GHz one?
What is the packet loss rate for a ping to the AP's IP address on
unencrypted 5GHz?

[Stefan Ott]

Post by Stefan Sperling
Reason 15 means the WPA 4-way handshake timed out from the AP's point of view.
This indicates the AP is unable to receive any (or some) frames sent by the
client during the WPA authentication phase.
Are you sure that communication on 5 GHz works well in general?
Does an unecrypted network on 5GHz perform worse than a 2GHz one?
What is the packet loss rate for a ping to the AP's IP address on
unencrypted 5GHz?

You are right, I only tested whether the client can connect to the AP,
I didn't try to actually use the connection. Now that I tried it seems
that the 5 Ghz mode does not work correctly at all, i.e. I can't even
run DHCP.

Post by Stefan Sperling
Can you run 'ifconfig ath0 debug' on the AP and show additional lines
printed to dmesg while a client tries to connect?

Sure. This is what a connection attempts looks like on the AP side
in debug mode:

ath0: sending auth to 04:f0:21:17:39:92 on channel 48 mode 11a
ath0: station 04:f0:21:17:39:92 already authenticated (open)
ath0: sending assoc_resp to 04:f0:21:17:39:92 on channel 48 mode 11a
ath0: sending msg 1/4 of the 4-way handshake to 04:f0:21:17:39:92
ath0: received auth from 04:f0:21:17:39:92 rssi 56 mode 11a
ath0: received assoc_req from 04:f0:21:17:39:92 rssi 50 mode 11a
ath0: sending msg 1/4 of the 4-way handshake to 04:f0:21:17:39:92
ath0: sending msg 1/4 of the 4-way handshake to 04:f0:21:17:39:92
ath0: station 04:f0:21:17:39:92 deauthenticate (reason 15)
ath0: sending deauth to 04:f0:21:17:39:92 on channel 48 mode 11a

Post by Stefan Sperling
Can you show the output of 'netstat -W ath0' and 'netstat -I ath0' twice?
Once from before the client tries to connect, and once after.

Before:

# netstat -W ath0
ieee80211 on ath0:
0 input packets with bad version
0 input packets too short
0 input packets from wrong bssid
30 input packet duplicates discarded
34 input packets with wrong direction
0 input multicast echo packets discarded
13 input packets from unassociated station discarded
0 input encrypted packets without wep/wpa config discarded
34 input unencrypted packets with wep/wpa config discarded
0 input wep/wpa packets processing failed
16 input packet decapsulations failed
2 input management packets discarded
3 input control packets discarded
0 input packets with truncated rate set
0 input packets with missing elements
0 input packets with elements too big
0 input packets with elements too small
11 input packets with invalid channel
241 input packets with mismatched channel
0 node allocations failed
157 input packets with mismatched ssid
0 input packets with unsupported auth algorithm
0 input authentications failed
0 input associations from wrong bssid
0 input associations without authentication
0 input associations with mismatched capabilities
0 input associations without matching rates
0 input associations with bad rsn ie
1 input deauthentication packet
8 input disassociation packets
0 input packets with unknown subtype
0 input packets failed for lack of mbufs
0 input decryptions failed on crc
0 input ahdemo management packets discarded
0 input packets with bad auth request
4 input eapol-key packets
0 input eapol-key packets with bad mic
0 input eapol-key packets replayed
0 input packets with bad tkip mic
0 input tkip mic failure notifications
0 input packets on unauthenticated port
0 output packets failed for lack of mbufs
15 output packets failed for no nodes
0 output packets of unknown management type
1 output packet on unauthenticated port
1 active scan started
2 passive scans started
6 nodes timed out
0 failures with no memory for crypto ctx
0 ccmp decryption errors
0 ccmp replayed frames
0 cmac icv errors
0 cmac replayed frames
0 tkip icv errors
0 tkip replays
0 pbac errors
0 HT negotiation failures because peer does not support MCS 0-7
0 HT negotiation failures because we do not support basic MCS set
0 HT negotiation failures because peer uses bad crypto
0 HT protection changes
0 new input block ack agreements
0 new output block ack agreements
0 input frames below block ack window start
0 input frames above block ack window end
0 input block ack window slides
0 input block ack window jumps
0 duplicate input block ack frames
0 expected input block ack frames never arrived
0 input block ack window gaps timed out
0 input block ack agreements timed out
0 output block ack agreements timed out
# netstat -I ath0
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Colls
ath0 1500 <Link> 00:0b:6b:23:35:a5 6696 47 4215 16 0


After:

# netstat -W ath0
ieee80211 on ath0:
0 input packets with bad version
0 input packets too short
0 input packets from wrong bssid
30 input packet duplicates discarded
34 input packets with wrong direction
0 input multicast echo packets discarded
13 input packets from unassociated station discarded
0 input encrypted packets without wep/wpa config discarded
34 input unencrypted packets with wep/wpa config discarded
0 input wep/wpa packets processing failed
16 input packet decapsulations failed
2 input management packets discarded
3 input control packets discarded
0 input packets with truncated rate set
0 input packets with missing elements
0 input packets with elements too big
0 input packets with elements too small
11 input packets with invalid channel
241 input packets with mismatched channel
0 node allocations failed
161 input packets with mismatched ssid
0 input packets with unsupported auth algorithm
0 input authentications failed
0 input associations from wrong bssid
0 input associations without authentication
0 input associations with mismatched capabilities
0 input associations without matching rates
0 input associations with bad rsn ie
1 input deauthentication packet
8 input disassociation packets
0 input packets with unknown subtype
0 input packets failed for lack of mbufs
0 input decryptions failed on crc
0 input ahdemo management packets discarded
0 input packets with bad auth request
4 input eapol-key packets
0 input eapol-key packets with bad mic
0 input eapol-key packets replayed
0 input packets with bad tkip mic
0 input tkip mic failure notifications
0 input packets on unauthenticated port
0 output packets failed for lack of mbufs
15 output packets failed for no nodes
0 output packets of unknown management type
1 output packet on unauthenticated port
1 active scan started
2 passive scans started
6 nodes timed out
0 failures with no memory for crypto ctx
0 ccmp decryption errors
0 ccmp replayed frames
0 cmac icv errors
0 cmac replayed frames
0 tkip icv errors
0 tkip replays
0 pbac errors
0 HT negotiation failures because peer does not support MCS 0-7
0 HT negotiation failures because we do not support basic MCS set
0 HT negotiation failures because peer uses bad crypto
0 HT protection changes
0 new input block ack agreements
0 new output block ack agreements
0 input frames below block ack window start
0 input frames above block ack window end
0 input block ack window slides
0 input block ack window jumps
0 duplicate input block ack frames
0 expected input block ack frames never arrived
0 input block ack window gaps timed out
0 input block ack agreements timed out
0 output block ack agreements timed out
# netstat -I ath0
Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Colls
ath0 1500 <Link> 00:0b:6b:23:35:a5 6708 47 4241 16 0