WL1807MOD: Shielding De-Auth Attack

Hi Anuj,

The best protection against deauth attacks is to enable 802.11w (Protected Management Frames [PMF]). The feature is supported on WL18xx devices and can be enabled from hostapd and wpa_supplicant. In the hostapd.conf and wpa_supplicant.conf, see sections on 802.11W and/or PMF to enable it. 

Sabeeh Khan1
We aren't using hostapd but using Network manager to initialize the interface below is the conf file
cat /etc/NetworkManager/system-connections/wifi_ap.conf

[connection]
id=REDACTED
uuid=26638c65-ff0e-434c-a900-30a9c1404130
type=wifi
interface-name=ap0
autoconnect=false

[wifi]
band=bg
channel=auto
mode=ap
ssid=REDACTED

[wifi-security]
wpa=3
key-mgmt=sae
psk=REDACTED

[ipv4]
address1=192.168.10.1/28
method=shared

[ipv6]
addr-gen-mode=stable-privacy
method=auto

[proxy]

Hi Anuj,

Have you used networkmanager to start an AP role before? I don't believe this is possible. 

hostapd is necessary because it has the wireless stack to control AP mode. NetworkManager is a wrapper for a supplicant, which I don't believe that is what you want. So you should likely use hostapd. 

Hi Sabeeh Khan1,

We've been using Network manager for almost 2yrs for AP, so yes NM can be used for AP.

Can you give an example hostapd.conf file which works with 1807 and has "ieee80211w=2" enable with wpa=2
below is what I've tried already and didn't succeed:
interface=ap0
driver=nl80211
ssid=ap_hotspot
hw_mode=g
channel=6
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
ieee80211w=2
wpa=2
wpa_passphrase=Abcd@1234
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
rsn_pairwise=CCMP

Along with ieee80211w=2 we have tried following key_mgmt values:
WPA-PSK, WPA-PSK-SHA256, SAE, FT-PSK

they result in following below errors:

Error-1:
nl80211: kernel reports: key setting validation failed
Interface initialization failed
ap0: interface state UNINITIALIZED->DISABLED
ap0: AP-DISABLED
ap0: Unable to setup interface.
ap0: interface state DISABLED->DISABLED
ap0: AP-DISABLED
ap0: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface ap0 wasn't started
nl80211: deinit ifname=ap0 disabled_11b_rates=0


Error-2:
Could not generate WPA IE.
WPA initialization failed.
Interface initialization failed
ap0: interface state UNINITIALIZED->DISABLED
ap0: AP-DISABLED
ap0: Unable to setup interface.
ap0: interface state DISABLED->DISABLED
ap0: AP-DISABLED
ap0: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface ap0 wasn't started
nl80211: deinit ifname=ap0 disabled_11b_rates=0

Can you let me know of your earliest available time so we can schedule a meeting,
you can reply to meeting invite forwarded to you by Saurabh Kapoor.

Hi Anuj, Which hostapd version are you using? Can you ensure you are using 2.10?

Yes we have v2.10 of hostapd.

Hi Anuj,

I have a hostapd.conf file where I was able to get 80211w enabled and working. Please let me know if you experienced any errors using this file. https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/968/hostapd.conf

Initially we ran 
root@am335x-saturn-proto2:/etc# hostapd /etc/custom_hostapd.conf
Line 925: unknown configuration item 'wps_state'
Line 929: unknown configuration item 'ap_setup_locked'
Line 934: unknown configuration item 'uuid'
Line 950: unknown configuration item 'device_name'
Line 953: unknown configuration item 'manufacturer'
Line 956: unknown configuration item 'model_name'
Line 959: unknown configuration item 'model_number'
Line 962: unknown configuration item 'serial_number'
Line 974: unknown configuration item 'device_type'
Line 984: unknown configuration item 'config_methods'
10 errors found in configuration file '/etc/custom_hostapd.conf'
Failed to set up interface with /etc/custom_hostapd.conf
Failed to initialize interface
root@am335x-saturn-proto2:/etc#

after commenting all above:
root@am335x-saturn-proto2:/etc# hostapd /etc/custom_hostapd.conf
ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
nl80211: kernel reports: key setting validation failed
Interface initialization failed
ap0: interface state COUNTRY_UPDATE->DISABLED
ap0: AP-DISABLED
ap0: interface state DISABLED->DISABLED
ap0: AP-DISABLED
ap0: CTRL-EVENT-TERMINATING
hostapd_free_hapd_data: Interface ap0 wasn't started
nl80211: deinit ifname=ap0 disabled_11b_rates=0
root@am335x-saturn-proto2:/etc#

current file has wpa_key_mgmt=WPA-PSK
also tried with wpa_key_mgmt=WPA-PSK-SHA256

Hi Anuj,

I found the print 'key setting validation failed' in the kernel, it is net/wireless/nl80211.c. It seems function "cfg80211_validate_key_settings" is failing. Let me debug further to understand why the kernel is reporting this. I am assuming there is a crypto module missing from your kernel defconfig. 

Hi Anuj,

I'm now seeing the same issue you are describing. Can you inform me which firmware version you are using?

wl8xx-fw 8.9.1.0.0-r0
Wlconf - 8.8-r0 

Wlconf - git://git.ti.com/wilink8-wlan/18xx-ti-utils.git,  Commit id - 7325bf0b7b2d462e334437d2c7f9198d0ac55ce2
wl8xx-fw - git://git.ti.com/wilink8-wlan/wl18xx_fw.git  , Commit id - d2588c16809ecca8e0dc7ea011fc6180c7b08a92

Hi Anuj,

I can't comment about the upstream patches, but as we discussed, I will work on forward porting our patches from k4.19 to k6.1 with our latest firmware to resolve the issue. 

Could you also share the link and commit tag to your kernel if possible?

github.com/.../mp-93-linux-v6.1.y