Possible bug in Arch Linux's networkmanager

possessedbysatan · 2022-03-24 04:03:43

Hello everyone!

Today I tried to connect to a _pure_ WPA3 WIFI hotspot only to find out that, for some reason, it doesn't work (but it does work flawlessly on Fedora workstation 35). I am using Plasma + networkmanager + wpa_supplicant for now, but the whole thing still fails even if I use networkmanager + iwd backend on my main machine. Even worse, I was able to reproduce the whole thing using Arch's live ISO - iwctl just prints "operation failed" after I tried to connect. At this point I've tried pretty much everything: nmcli to make sure it wasn't plasma randomly failing for some reason, and iwctl to no avail.

lspci says my network adapter is :

03:00.0 Network controller: Intel Corporation Wi-Fi 6 AX210/AX211/AX411 160MHz (rev 1a)

dmesg output:

[  +0.066499] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.009454] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.058926] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008529] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.002652] wlan0: authenticated
[  +0.012839] wlan0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.005360] wlan0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=7)
[  +0.013615] wlan0: associated
[  +0.030361] wlan0: disassociated from 4a:c7:5d:9e:9d:7f (Reason: 1=UNSPECIFIED)
[  +2.585214] wlan0: authenticate with 04:d4:c4:63:16:4c
[  +0.009548] wlan0: send auth to 04:d4:c4:63:16:4c (try 1/3)
[  +0.140089] wlan0: send auth to 04:d4:c4:63:16:4c (try 2/3)
[  +0.002029] wlan0: authenticated
[  +0.000867] wlan0: associate with 04:d4:c4:63:16:4c (try 1/3)
[  +0.002622] wlan0: RX AssocResp from 04:d4:c4:63:16:4c (capab=0x511 status=0 aid=3)
[  +0.012629] wlan0: associated
[  +0.077853] wlan0: Limiting TX power to 30 (30 - 0) dBm as advertised by 04:d4:c4:63:16:4c
[Mar23 21:50] wlan0: disconnect from AP 04:d4:c4:63:16:4c for new auth to 4a:c7:5d:9e:9d:7f
[  +0.059392] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.012139] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.065373] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.007446] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.002897] wlan0: authenticated
[  +0.015078] wlan0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.009051] wlan0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=1)
[  +0.019319] wlan0: associated
[  +0.005960] wlan0: disassociated from 4a:c7:5d:9e:9d:7f (Reason: 1=UNSPECIFIED)
[  +2.568748] wlan0: authenticate with 04:d4:c4:63:16:4c
[  +0.009383] wlan0: send auth to 04:d4:c4:63:16:4c (try 1/3)
[  +0.133674] wlan0: send auth to 04:d4:c4:63:16:4c (try 2/3)
[  +0.002105] wlan0: authenticated
[  +0.001121] wlan0: associate with 04:d4:c4:63:16:4c (try 1/3)
[  +0.002607] wlan0: RX AssocResp from 04:d4:c4:63:16:4c (capab=0x511 status=0 aid=3)
[  +0.021163] wlan0: associated
[  +0.079305] wlan0: Limiting TX power to 30 (30 - 0) dBm as advertised by 04:d4:c4:63:16:4c
[  +7.461553] wlan0: disconnect from AP 04:d4:c4:63:16:4c for new auth to 4a:c7:5d:9e:9d:7f
[  +0.068543] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.011121] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.038068] wlan0: authenticated
[  +0.009405] wlan0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.012525] wlan0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=8)
[  +0.130382] wlan0: associated
[  +0.007216] wlan0: deauthenticating from 4a:c7:5d:9e:9d:7f by local choice (Reason: 17=IE_DIFFERENT)
[  +5.594002] wlan0: authenticate with 04:d4:c4:63:16:4c
[  +0.011957] wlan0: send auth to 04:d4:c4:63:16:4c (try 1/3)
[  +0.139902] wlan0: send auth to 04:d4:c4:63:16:4c (try 2/3)
[  +0.002276] wlan0: authenticated
[  +0.005144] wlan0: associate with 04:d4:c4:63:16:4c (try 1/3)
[  +0.002555] wlan0: RX AssocResp from 04:d4:c4:63:16:4c (capab=0x511 status=0 aid=3)
[  +0.009211] wlan0: associated
[  +0.115333] wlan0: Limiting TX power to 30 (30 - 0) dBm as advertised by 04:d4:c4:63:16:4c
[  +7.326709] wlan0: disconnect from AP 04:d4:c4:63:16:4c for new auth to 4a:c7:5d:9e:9d:7f
[  +0.209155] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008135] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.065484] wlan0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008240] wlan0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.003088] wlan0: authenticated
[  +0.010867] wlan0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.005816] wlan0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=2)
[  +0.019560] wlan0: associated
[  +0.009560] wlan0: disassociated from 4a:c7:5d:9e:9d:7f (Reason: 1=UNSPECIFIED)
[  +2.774465] wlan0: authenticate with 04:d4:c4:63:16:4c
[  +0.011045] wlan0: send auth to 04:d4:c4:63:16:4c (try 1/3)
[  +0.134976] wlan0: send auth to 04:d4:c4:63:16:4c (try 2/3)
[  +0.002045] wlan0: authenticated
[  +0.000563] wlan0: associate with 04:d4:c4:63:16:4c (try 1/3)
[  +0.002489] wlan0: RX AssocResp from 04:d4:c4:63:16:4c (capab=0x511 status=0 aid=3)
[  +0.019750] wlan0: associated
[  +0.046476] wlan0: Limiting TX power to 30 (30 - 0) dBm as advertised by 04:d4:c4:63:16:4c

I get pretty much the same results with iwd too, here's what appeared both in the live ISO and my main machine (journalctl output)

Mar 23 21:39:59 kyla iwd[614]: Connected BSS not in scan results
Mar 23 21:40:00 kyla iwd[614]: 4-Way handshake failed for ifindex: 5, reason: 17

Some pacman output:

$ pacman -Q wpa_supplicant
wpa_supplicant 2:2.10-3

$ pacman -Q | grep network
glib-networking 1:2.72.0-1
networkmanager 1.36.4-1
networkmanager-qt 5.92.0-1

possessedbysatan · 2022-03-24 04:19:49

Here's some more output of networkmanager + wpa_supplicant (now this time I deleted other networks so networkmanager won't try to connect to them):

[  +0.007108] wlp3s0: deauthenticating from 04:d4:c4:63:16:4c by local choice (Reason: 3=DEAUTH_LEAVING)
[  +3.718599] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.011543] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.065485] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.000004] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.004669] wlp3s0: authenticated
[  +0.000709] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.004606] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=13 aid=0)
[  +0.000004] wlp3s0: 4a:c7:5d:9e:9d:7f denied association (code=13)
[  +2.531290] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008854] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.036287] wlp3s0: authenticated
[  +0.001293] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.005134] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=7)
[  +0.016978] wlp3s0: associated
[  +0.000023] wlp3s0: disassociated from 4a:c7:5d:9e:9d:7f (Reason: 1=UNSPECIFIED)
[  +0.825848] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008588] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.036335] wlp3s0: authenticated
[  +0.000607] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.007472] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=1)
[  +0.019501] wlp3s0: associated
[  +0.011271] wlp3s0: deauthenticating from 4a:c7:5d:9e:9d:7f by local choice (Reason: 17=IE_DIFFERENT)
[  +2.430487] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.007568] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.035298] wlp3s0: authenticated
[  +0.000425] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.002595] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=30 aid=1)
[  +0.000007] wlp3s0: 4a:c7:5d:9e:9d:7f rejected association temporarily; comeback duration 1000 TU (1024 ms)
[  +1.028776] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 2/3)
[  +0.007967] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=8)
[  +0.008104] wlp3s0: associated
[  +0.032066] wlp3s0: deauthenticating from 4a:c7:5d:9e:9d:7f by local choice (Reason: 17=IE_DIFFERENT)
[  +5.328389] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.005993] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.062234] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.000009] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.002513] wlp3s0: authenticated
[  +0.000200] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.004529] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=2)
[  +0.014712] wlp3s0: associated
[  +0.000056] wlp3s0: disassociated from 4a:c7:5d:9e:9d:7f (Reason: 1=UNSPECIFIED)
[ +12.175590] wlp3s0: authenticate with 4a:c7:5d:9e:9d:7f
[  +0.008418] wlp3s0: send auth to 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.035140] wlp3s0: authenticated
[  +0.000702] wlp3s0: associate with 4a:c7:5d:9e:9d:7f (try 1/3)
[  +0.005726] wlp3s0: RX AssocResp from 4a:c7:5d:9e:9d:7f (capab=0x1431 status=0 aid=3)
[  +0.023392] wlp3s0: associated
[  +0.015186] wlp3s0: deauthenticating from 4a:c7:5d:9e:9d:7f by local choice (Reason: 17=IE_DIFFERENT)

It's really weird because WPA3 just works on Fedora (live ISO). Also just as a side note, everything works fine if I don't use WPA3.

Trilby · 2022-03-24 04:24:41

https://wiki.archlinux.org/title/Wpa_su … ess_points

possessedbysatan · 2022-03-24 04:48:42

Trilby wrote:

https://wiki.archlinux.org/title/Wpa_su … ess_points

Just tried this (although I configured it using networkmanager) but nothing changed. To be honest I highly doubt this is causing the error since even iwctl fails to connect, whereas Fedora's networkmanager + wpa_supplicant work out of the box with the default config. I wonder if they included some black magic compile flag, but who knows.

Also I tried connecting to the same network using another laptop (AX201 chip, using Ubuntu 20.04) through nmcli and everything worked just fine, so I'm more inclined to say that this is either an upstream bug or something is missing in Arch's networkmanager/wpa_supplicant/iwd packages.

Last edited by possessedbysatan (2022-03-24 04:53:11)

seth · 2022-03-24 07:27:39

If just iwd shows the same problem it can't be NM and either there's the same bug in iwd and wpa_supplicant or it's the kernel module.
Eg. https://wiki.archlinux.org/title/Networ … s#Cause_#6
Also: can you actually connect to a WPA2 AP (ie. how sure are you that this is WPA3 specific to begin with)?

possessedbysatan · 2022-03-24 14:48:16

seth wrote:

Also: can you actually connect to a WPA2 AP (ie. how sure are you that this is WPA3 specific to begin with)?

Yeah, I can connect just to about anything that isn't WPA3. WPA2 works flawlessly and I can pull transfer rates of about ~700Mb/s, no disconnection issues, no power saving issues as well, literally nothing bad at all. I am not using TLP or any power-saving tool for that matter.

I am 100% sure it's a WPA3 AP because that's coming from my phone (A12 introduced an option that lets you select Open/WPA2/WPA3). Also nmcli lists the endpoint as WPA3 too.

Edit: Tried downgrading my kernel to linux-lts but got the same results. There must be something missing in Arch Linux's iwd/wpa_supplicant.

Last edited by possessedbysatan (2022-03-24 15:00:32)

seth · 2022-03-24 15:02:09

Again: how likely do you think it is that two different carrier implementation expose the very same bug on, but only on one distro.
Do you have linux-firmware installed?

possessedbysatan · 2022-03-24 15:22:22

seth wrote:

Again: how likely do you think it is that two different carrier implementation expose the very same bug on, but only on one distro.
Do you have linux-firmware installed?

Maybe it's some other "backend" package being buggy? I am not talking about iwd/wpa_supplicant, but something else. I don't know for sure, though. Maybe the iwlwifi driver is buggy?

I do have linux-firmware installed:

$ pacman -Q | grep linux
archlinux-keyring 20220224-1
linux-api-headers 5.16.8-1
linux-firmware 20220309.cd01f85-1
linux-firmware-whence 20220309.cd01f85-1
linux-zen 5.16.16.zen1-1
util-linux 2.37.4-1
util-linux-libs 2.37.4-1

I tried using Arch's live ISO (to rule out possible stuff I might have caused) and I get the same results - E17 error. I also downgraded to linux-lts but stil got the same results, so it's pretty unlikely this is a kernel issue since Fedora 35 uses roughly the same kernel (5.15.x).

seth · 2022-03-24 16:06:30

https://archlinux.org/packages/community/x86_64/iwd/
https://archlinux.org/packages/core/x86 … upplicant/
Common deps are glibc and readline …

Maybe the iwlwifi driver is buggy?

What would be the kernel and was my initial guess.

Do you have a spare wifi dongle w/ a different chip that you could test?

Otherwise stop NM and try to connect w/ wpa_supplicant manually and use "-dd" for a lot of debug output.
https://wiki.archlinux.org/title/Wpa_supplicant

possessedbysatan · 2022-03-24 18:24:48

seth wrote:

Otherwise stop NM and try to connect w/ wpa_supplicant manually and use "-dd" for a lot of debug output.
https://wiki.archlinux.org/title/Wpa_supplicant

Thanks for the response. I gave wpa_supplicant a shot but still got the same results - Error 17 (4-way handshake error). By looking at wpa_supplicant's logs it does look like a bug in Arch's wpa_supplicant/iwd. I don't know if manually downgrading wpa_supplicant would work given the recent glibc changes.

Here are the logs: https://0x0.st/oNnW.txt

ewaller · 2022-03-24 18:41:12

In case you were wondering where your first post went, you used the report link rather than the reply link

progandy · 2022-03-24 19:07:08

Does iwd work on fedora or did you not test that?

There are some differences between wpa_supplicant configuration in fedora and arch:
fedora has CONFIG_OCV, CONFIG_MESH, CONFIG_WEP, and CONFIG_SUITEB192 enabled, arch does not have them.
arch has CONFIG_DRIVER_NL80211_QCA, CONFIG_DRIVER_NONE, CONFIG_EAP_SIM, CONFIG_EAP_PSK, CONFIG_EAP_AKA_PRIME, CONFIG_WPS_ER, CONFIG_EAP_EKE, CONFIG_HT_OVERRIDES, CONFIG_VHT_OVERRIDES, CONFIG_WNM, CONFIG_FST and some others that are not set in fedora.
CONFIG_TLS_DEFAULT_CIPHERS is a bit different.
Edit: There is also a patch that doubles the timeout for IBSS during association.
https://koji.fedoraproject.org/koji/bui … ID=1908829
Nothing stands out as a reason for the failure. Maybe CONFIG_WNM?
If you think wpa_supplicant is at fault, try to build the arch package with the configuration (and maybe patches) from fedora.

Last edited by progandy (2022-03-24 19:24:38)

seth · 2022-03-24 19:34:39

wlp3s0: WPA: RSNXE mismatch between Beacon/ProbeResp and EAPOL-Key msg 3/4
RSNXE in Beacon/ProbeResp - hexdump(len=0): [NULL]
RSNXE in EAPOL-Key msg 3/4 - hexdump(len=3): f4 01 20

Do you have/have you tried a different WPA3 AP?

Try

iwlwifi.swcrypto=1

…
Ideally post the sameconneciton for the working fedora setup for comparism…

possessedbysatan · 2022-03-24 20:17:14

@progandy @seth

Thanks for your help. I tried building wpa_supplicant 2.10 (including Fedora's patches) and unfortunately I get the same results - error 17. I used the official Arch PKGBUILD from the svn-to-git repo, but no luck. I see their patches have hardcoded stuff (such as wpa_supplicant/0.7.4/blahblah) in some paths so I guess most of the patches weren't applied at all. I manually added some of their options to the config file, though.

HOWEVER, since Ubuntu uses wpa_supplicant 2.9, I compiled that version from scratch (including Fedora's patches) and surprisingly I was able to connect to my WPA3 AP without issues. It worked as flawlessly as it did on Ubuntu and Fedora. I'll test later on today an up-to-date version of wpa_supplicant and iwd on Fedora Rawhide, just to make sure it's wpa_supplicant being buggy and not Arch's build of wpa_supplicant, since Fedora Workstation might be using the same outdated, but not buggy version of wpa_supplicant that Ubuntu uses.

Here are the logs of a (working) wpa_supplicant on Arch: https://0x0.st/oN5t.txt

Edit: I tested an old version of wpa_supplicant (https://archive.archlinux.org/packages/ … kg.tar.zst) and it worked as well, so I guess this is a bug in both wpa_supplicant (2.10) and iwd.

Last edited by possessedbysatan (2022-03-24 20:25:42)

seth · 2022-03-24 20:38:27

The version simply has no RSNXE support, so it doesn't run into the error.
https://w1.fi/cgit/hostap/commit/src/rs … daa89d4d24

Arch Linux

#1 2022-03-24 04:03:43

Possible bug in Arch Linux's networkmanager

#2 2022-03-24 04:19:49

Re: Possible bug in Arch Linux's networkmanager

#3 2022-03-24 04:24:41

Re: Possible bug in Arch Linux's networkmanager

#4 2022-03-24 04:48:42

Re: Possible bug in Arch Linux's networkmanager

#5 2022-03-24 07:27:39

Re: Possible bug in Arch Linux's networkmanager

#6 2022-03-24 14:48:16

Re: Possible bug in Arch Linux's networkmanager

#7 2022-03-24 15:02:09

Re: Possible bug in Arch Linux's networkmanager

#8 2022-03-24 15:22:22

Re: Possible bug in Arch Linux's networkmanager

#9 2022-03-24 16:06:30

Re: Possible bug in Arch Linux's networkmanager

#10 2022-03-24 18:24:48

Re: Possible bug in Arch Linux's networkmanager

#11 2022-03-24 18:41:12

Re: Possible bug in Arch Linux's networkmanager

#12 2022-03-24 19:07:08

Re: Possible bug in Arch Linux's networkmanager

#13 2022-03-24 19:34:39

Re: Possible bug in Arch Linux's networkmanager

#14 2022-03-24 20:17:14

Re: Possible bug in Arch Linux's networkmanager

#15 2022-03-24 20:38:27

Re: Possible bug in Arch Linux's networkmanager

Board footer