Skip to content

RFC WPA_NONE support in mac80211/ath9k

Sven Eckelmann linux-wireless 1 version In review

Get series with b4
b4 am 30210911.93HAZKKtRJ@bentobox

Versions newest first

  1. v1 RFC Latest3 patches 2 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/3mac80211: Allow group key for IBSS WPA_NONEnet/mac80211/rx.c+3 -10 replies
2/3mac80211: Ignore CCMP replays for IBSS WPA_NONEnet/mac80211/wpa.c+3 -10 replies
3/3nl80211: Allow to set IBSS key even before IBSS_JOINnet/wireless/nl80211.c+0 -30 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [RFC 0/3] WPA_NONE support in mac80211/ath9k

Hi,

I've tried to use WPA_NONE together with ath9k (other people reported problems, but said it would be batman-adv related [1]). I ran into three smaller problems and worked around them. I am not sure what kind of support mac80211 should have for WPA_NONE, but maybe also someone else is trying it and could use this as a reference. Nevertheless, IBSS/RSN should be preferred.

I've used a wpa_supplicant with fixed-ibss support [2,3] on an vif configured as adhoc device.

ap_scan=2
fast_reauth=1

	network={
	ssid="ESSID"
	mode=1
	proto=WPA
	frequency=2422
	key_mgmt=WPA-NONE
	pairwise=NONE
	group=CCMP
	psk="abcd1234"
	bssid=02:00:de:ad:be:fe
}

First problem was related in the way the decryption is done. No unicast frames could be decrypted because the group key (the only one set for WPA_NONE) wasn't allowed to be used for unicast decryption.

The second problem was the replay detection. Replay detection doesn't work with WPA_NONE and therefore has to be disabled.

The third problem was the inability to set the key when no link was established. This lead to unencrypted broadcast packets sent over the air... not really nice. Therefore, I've just disabled the check [4] for now.

I was informed by Antonio Quartulli about the controversy to use
!sta->sdata->u.ibss.control_port to check for for non-IBSS/RSN mode. Just
think about it is a placeholder for the imaginary function "ieee80211_ibss_is_wpanone(...)".

Is the inability to use WPA_NONE with ath9k/mac80211 intended or just a regression nobody noticed? In the latter case, any things which should be changed to make the patches upstream ready?

Kind regards,
Sven

[1] https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2013-January/008895.html
[2] http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=913e3cf794cccf19d551d936a16c7d91acb5e834
[3] http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=9e2af29f9bf065099b9a2abceaf40ac0e1bf86fa
[4] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=fffd0934b9390f34bec45762192b7edd3b12b4b5