Need clarification on WPS IE support

CHui CHui at lbl.gov
Thu Apr 13 15:03:49 EDT 2006


> > When I configure the access point (Cisco 1200 series 1232AG) to
> > support two SSIDs on the same radio, wpa_supplicant started to fail
> > to connect to the second SSID which is not broadcast in the 802.11
> > beacon management frame.
>
> How does it fail?  Debug logs would be good.  What ap_scan mode are you
> using in the config file?
>

I have included the wpa_suplicant.conf and output of the wpa_supplicant
debug logs.  The first debug log used ap_scan=1 and scan_ssid=1.  The second
log used ap_scan=2 which caused wpa_suplicant core dump.  

***** wpa_supplicant.conf
  ##### wpa_supplicant configuration file ###############################
  ctrl_interface=/var/run/wpa_supplicant
  ctrl_interface_group=0
  eapol_version=1
  ap_scan=1
  fast_reauth=1
  # network block
  network={
	ssid="employee"
	mode=0
	scan_ssid=1
	proto=WPA
	key_mgmt=WPA-EAP
	pairwise=TKIP
	group=TKIP
	eap=TTLS
	identity="xxxxxxxxxx"
	password="XXXXXXXXXX"
	phase2="auth=PAP"
	ca_cert="/usr/local/etc/lsgCA_cert.cer"
  }

***** wpa_supplicant debug logs with ap_scan=1
wpa_supplicant -iath0 -c wpa_supplicant.conf -dd

Initializing interface 'ath0' conf 'wpa_supplicant.conf' driver 'default'
ctrl_interface 'N/A' bridge 'N/A'
Configuration file 'wpa_supplicant.conf' -> '/root/wpa_supplicant.conf'
Reading configuration file '/root/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=0
eapol_version=1
ap_scan=1
fast_reauth=1
Line: 264 - start of a new network block
ssid - hexdump_ascii(len=8):
     65 6d 70 6c 6f 79 65 65                           employee        
mode=0 (0x0)
scan_ssid=1 (0x1)
proto: 0x1
key_mgmt: 0x1
pairwise: 0x8
group: 0x8
eap methods - hexdump(len=16): 00 00 00 00 15 00 00 00 00 00 00 00 00 00 00
00
identity - hexdump_ascii(len=10):
     XX XX XX XX XX XX XX XX XX XX                     xxxxxxxxxx      
password - hexdump_ascii(len=8): [REMOVED]
phase2 - hexdump_ascii(len=8):
     61 75 74 68 3d 50 41 50                           auth=PAP        
ca_cert - hexdump_ascii(len=29):
     2f 75 73 72 2f 6c 6f 63 61 6c 2f 65 74 63 2f 6c   /usr/local/etc/l
     73 67 43 41 5f 63 65 72 74 2e 63 65 72            sgCA_cert.cer   
Priority group 0
   id=0 ssid='employee'
Initializing interface (2) 'ath0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Own MAC address: 00:40:96:a9:a0:15
wpa_driver_bsd_set_wpa: enabled=1
wpa_driver_bsd_del_key: keyidx=0
wpa_driver_bsd_del_key: keyidx=1
wpa_driver_bsd_del_key: keyidx=2
wpa_driver_bsd_del_key: keyidx=3
wpa_driver_bsd_set_countermeasures: enabled=0
wpa_driver_bsd_set_drop_unencrypted: enabled=1
Setting scan request: 0 sec 100000 usec
Added interface ath0
State: DISCONNECTED -> SCANNING
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=8):
     65 6d 70 6c 6f 79 65 65                           employee        
Trying to get current scan results first without requesting a new scan to
speed up initial association
Received 0 bytes of scan results (0 BSSes)
Scan results: 0
Selecting BSS from priority group 0
No suitable AP found.
Setting scan request: 0 sec 0 usec
Starting AP scan (broadcast SSID)
Received 0 bytes of scan results (2 BSSes)
Scan results: 2
Selecting BSS from priority group 0
0: 00:15:f9:79:cf:70 ssid='visitor' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
1: 00:16:46:b8:7a:30 ssid='visitor' wpa_ie_len=0 rsn_ie_len=0 caps=0x21
   skip - no WPA/RSN IE
No suitable AP found.
Setting scan request: 5 sec 0 usec
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=8):
     65 6d 70 6c 6f 79 65 65                           employee        
Received 0 bytes of scan results (2 BSSes)
Scan results: 2
Selecting BSS from priority group 0
0: 00:15:f9:79:cf:70 ssid='employee' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
1: 00:16:46:b8:7a:30 ssid='employee' wpa_ie_len=0 rsn_ie_len=0 caps=0x21
   skip - no WPA/RSN IE
No suitable AP found.
Setting scan request: 5 sec 0 usec
Starting AP scan (broadcast SSID)
Received 0 bytes of scan results (3 BSSes)
Scan results: 3
Selecting BSS from priority group 0
0: 00:15:f9:79:cf:70 ssid='visitor' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
1: 00:16:46:b8:7a:30 ssid='visitor' wpa_ie_len=0 rsn_ie_len=0 caps=0x21
   skip - no WPA/RSN IE
2: 00:0b:85:5f:ff:8e ssid='EECS' wpa_ie_len=0 rsn_ie_len=0 caps=0x31
   skip - no WPA/RSN IE
No suitable AP found.
Setting scan request: 5 sec 0 usec
^CCTRL-EVENT-TERMINATING - signal 2 received
Removing interface ath0
State: SCANNING -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_bsd_set_wpa: enabled=0
wpa_driver_bsd_set_drop_unencrypted: enabled=0
wpa_driver_bsd_set_countermeasures: enabled=0
No keys have been configured - skip key clearing
Cancelling scan request


***** wpa_supplicant debug logs with ap_scan=2
wpa_supplicant -iath0 -c wpa_supplicant.conf -dd

Initializing interface 'ath0' conf 'wpa_supplicant.conf' driver 'default'
ctrl_interface 'N/A' bridge 'N/A'
Configuration file 'wpa_supplicant.conf' -> '/root/wpa_supplicant.conf'
Reading configuration file '/root/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=0
eapol_version=1
ap_scan=2
fast_reauth=1
Line: 264 - start of a new network block
ssid - hexdump_ascii(len=8):
     65 6d 70 6c 6f 79 65 65                           employee        
mode=0 (0x0)
scan_ssid=1 (0x1)
proto: 0x1
key_mgmt: 0x1
pairwise: 0x8
group: 0x8
eap methods - hexdump(len=16): 00 00 00 00 15 00 00 00 00 00 00 00 00 00 00
00
identity - hexdump_ascii(len=10):
     XX XX XX XX XX XX XX XX XX XX                     xxxxxxxxxx      
password - hexdump_ascii(len=8): [REMOVED]
phase2 - hexdump_ascii(len=8):
     61 75 74 68 3d 50 41 50                           auth=PAP        
ca_cert - hexdump_ascii(len=29):
     2f 75 73 72 2f 6c 6f 63 61 6c 2f 65 74 63 2f 6c   /usr/local/etc/l
     73 67 43 41 5f 63 65 72 74 2e 63 65 72            sgCA_cert.cer   
Priority group 0
   id=0 ssid='employee'
Initializing interface (2) 'ath0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Own MAC address: 00:40:96:a9:a0:15
wpa_driver_bsd_set_wpa: enabled=1
wpa_driver_bsd_del_key: keyidx=0
wpa_driver_bsd_del_key: keyidx=1
wpa_driver_bsd_del_key: keyidx=2
wpa_driver_bsd_del_key: keyidx=3
wpa_driver_bsd_set_countermeasures: enabled=0
wpa_driver_bsd_set_drop_unencrypted: enabled=1
Setting scan request: 0 sec 100000 usec
Added interface ath0
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'employee'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: No WPA/RSN IE available from association info
WPA: Set cipher suites based on configuration
WPA: Selected cipher suites: group 8 pairwise 8 key_mgmt 1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: using GTK TKIP
WPA: using PTK TKIP
WPA: using KEY_MGMT 802.1X
WPA: Set own WPA IE default - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50
f2 02 01 00 00 50 f2 02 01 00 00 50 f2 01
No keys have been configured - skip key clearing
wpa_driver_bsd_set_drop_unencrypted: enabled=1
State: SCANNING -> ASSOCIATING
wpa_driver_bsd_associate
Segmentation fault (core dumped)


> What happens if you configure the AP to have multiple BSSIDs instead of
> using the WPS IE?  That should work with *any* client; the WPS IE only
> works with clients that understand it.  (That's how we have our Cisco
> 1121s and 1231s set up at work, and wpa_supplicant on Windows, using the
> NDIS backend, works fine.)  Though perhaps it's not an option for you...
>
> > Did I miss a configuration option for WPS IE support?  I am running 
> > wpa_supplicant v0.5.2 on FreeBSD 6.0.
>
> Depending on your configuration, and the log that you post, it may not
> have anything to do with wpa_supplicant.  It may be the wireless driver
> that you're using.
>
> I don't think wpa_supplicant handles any of the management frames at
> all.  I believe it does ask the driver what APs are in range, though, so
> the driver would have to add to its internal list of APs based on a WPS
> IE that it gets.  If it doesn't do that, then I don't see any obvious
> way to get wpa_supplicant to work.  (It can't request that the card
> associate to an SSID that it doesn't see in the results.  And the card
> likely won't associate to an SSID that *it* doesn't know about, either,
> so just handling the WPS IE in wpa_supplicant probably won't work.)
>
> That's why multi-BSSID mode is better IMO; you don't have to require
> support for a new IE in the driver or firmware; they just see one beacon
> for each ESSID, each with a different BSSID.  ;-)

I have not given multiple BSSID much thought but it does sound like a viable
option.




More information about the HostAP mailing list