Can't connect to wifi Raspberry Pi 3A+

[adam_zzz]

I think I am getting closer to the possible cause...
I connected to my router through ethernet cable and changed the wpa_supplicant.config directly and then ran wpa_supplicant manually. After rebooting, the Moode access point didn't start, probably because since I edited the file manually, the entry is missing from the db, so at least we can determine this part is not causing any issues.

Code:

systemctl stop wpa_supplicant
sudo rm wlan0
/var/run/wpa_supplicant $ sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -d

So I could reproduce the same situation and get more verbose logs (I've obfuscated some parts)

Code:

nl80211: Connect (ifindex=3)
 * bssid_hint=xx:xx:xx:xx:xx:xx
 * freq_hint=xxxx
 * SSID=HOMENETWORK
 * IEs - hexdump(len=44): xxxx
 * WPA Versions 0x2
 * pairwise=0xxxxx
 * group=0xxxxx
 * akm=0xxxxx
 * PSK - hexdump(len=32): [REMOVED]
 * htcaps - hexdump(len=26): xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 * htcaps_mask - hexdump(len=26): xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 * vhtcaps - hexdump(len=12): 00 00 00 00 00 00 00 00 00 00 00 00
 * vhtcaps_mask - hexdump(len=12): 00 00 00 00 00 00 00 00 00 00 00 00
 * Auth Type 0
nl80211: Connect request send successfully
wlan0: Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - EAP success=0
EAPOL: External notification - EAP fail=0
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: ifi_index=3 ifname=wlan0 wext ifi_family=0 ifi_flags=0xXXXX ([UP][LOWER_UP])
nl80211: Drv Event 46 (NL80211_CMD_CONNECT) received for wlan0
nl80211: Connect event (status=16 ignore_next_local_disconnect=0)
wlan0: Event ASSOC_REJECT (12) received
wlan0: CTRL-EVENT-ASSOC-REJECT bssid=xx:xx:xx:xx:xx:xx status_code=16
wlan0: Radio work 'connect'@0xXXXXXXX done in 7.465529 seconds
wlan0: radio_work_free('connect'@0xXXXXXXX): num_active_works --> 0
Added BSSID xx:xx:xx:xx:xx:xx into blacklist
wlan0: Blacklist count 1 --> request scan in 100 ms
wlan0: Setting scan request: 0.100000 sec
nl80211: Data frame filter flags=0x0
wlan0: State: ASSOCIATING -> DISCONNECTED
nl80211: Set wlan0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0

After looking more online, seems to be related to the Broadcom firmware, then I checked if Kerberos.io is using the same firmware and it's not, it's actually using outdated versions that actually work better at least for me...

Moode firmware:

Code:

pi@moode:~ $ dmesg | grep -i firmware
[    0.144699] raspberrypi-firmware soc:firmware: Attached to firmware from 2023-01-05T10:48:31, variant start
[    0.148717] raspberrypi-firmware soc:firmware: Firmware hash is 8ba17717fbcedd4c3b6d4bce7e50c7af4155cba9
[    9.494103] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov  1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60

Kerberos.io firmware:

Code:

[root@kios-48b2fa60 ~]# dmesg | grep -i firmware
[    0.090289] raspberrypi-firmware soc:firmware: Attached to firmware from 2019-11-14 15:27, variant start_x
[    0.100126] raspberrypi-firmware soc:firmware: Firmware hash is 2354eac70a98807e06bed2149bc0c5613e751c15
[   21.678962] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Feb 27 2018 03:15:32 version 7.45.154 (r684107 CY) FWID 01-4fbe0b04

I'm going to try and install a previous version for the driver later to see if it fixes it, I couldn't figure out how to do that so far...
-*
Tim, would you mind checking if the Raspberry Pi 3A+ that you've tested has the same firmware? I find it weird that no one else had this issue 

For reference, this is my Pi version:
Hardware        : BCM2835
Revision        : 9020e0
Model           : Raspberry Pi 3 Model A Plus Rev 1.0

[TheOldPresbyope]

@adam_zzz 

My Pi3A+ Rev 1.0  has worked flawlessly for several years in WiFi client-mode against various access points from both my old and my new ISP, in both cases with WPA2-PSK. A quick check now with moOde 8.2.5 and I see the same firmware info in the dmesg output that you reported.

ETA I should have mentioned the connection is using CCMP Group and Pairwise ciphers, not TKIP. Some refer to this mode as WPA2-AES.

As suggested previously, this seems an issue better raised in the Raspberry Pi forum (or even their github repos) where the RPF's code jockeys hang out.

Regards,
Kent

[Tim Curtis]

I think I am getting closer to the possible cause...
I connected to my router through ethernet cable and changed the wpa_supplicant.config directly and then ran wpa_supplicant manually. After rebooting, the Moode access point didn't start, probably because since I edited the file manually, the entry is missing from the db, so at least we can determine this part is not causing any issues.

Code:

systemctl stop wpa_supplicant
sudo rm wlan0
/var/run/wpa_supplicant $ sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -d

So I could reproduce the same situation and get more verbose logs (I've obfuscated some parts)

Code:

nl80211: Connect (ifindex=3)
 * bssid_hint=xx:xx:xx:xx:xx:xx
 * freq_hint=xxxx
 * SSID=HOMENETWORK
 * IEs - hexdump(len=44): xxxx
 * WPA Versions 0x2
 * pairwise=0xxxxx
 * group=0xxxxx
 * akm=0xxxxx
 * PSK - hexdump(len=32): [REMOVED]
 * htcaps - hexdump(len=26): xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 * htcaps_mask - hexdump(len=26): xx 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 * vhtcaps - hexdump(len=12): 00 00 00 00 00 00 00 00 00 00 00 00
 * vhtcaps_mask - hexdump(len=12): 00 00 00 00 00 00 00 00 00 00 00 00
 * Auth Type 0
nl80211: Connect request send successfully
wlan0: Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - EAP success=0
EAPOL: External notification - EAP fail=0
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: ifi_index=3 ifname=wlan0 wext ifi_family=0 ifi_flags=0xXXXX ([UP][LOWER_UP])
nl80211: Drv Event 46 (NL80211_CMD_CONNECT) received for wlan0
nl80211: Connect event (status=16 ignore_next_local_disconnect=0)
wlan0: Event ASSOC_REJECT (12) received
wlan0: CTRL-EVENT-ASSOC-REJECT bssid=xx:xx:xx:xx:xx:xx status_code=16
wlan0: Radio work 'connect'@0xXXXXXXX done in 7.465529 seconds
wlan0: radio_work_free('connect'@0xXXXXXXX): num_active_works --> 0
Added BSSID xx:xx:xx:xx:xx:xx into blacklist
wlan0: Blacklist count 1 --> request scan in 100 ms
wlan0: Setting scan request: 0.100000 sec
nl80211: Data frame filter flags=0x0
wlan0: State: ASSOCIATING -> DISCONNECTED
nl80211: Set wlan0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0

After looking more online, seems to be related to the Broadcom firmware, then I checked if Kerberos.io is using the same firmware and it's not, it's actually using outdated versions that actually work better at least for me...

Moode firmware:

Code:

pi@moode:~ $ dmesg | grep -i firmware
[    0.144699] raspberrypi-firmware soc:firmware: Attached to firmware from 2023-01-05T10:48:31, variant start
[    0.148717] raspberrypi-firmware soc:firmware: Firmware hash is 8ba17717fbcedd4c3b6d4bce7e50c7af4155cba9
[    9.494103] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Nov  1 2021 00:37:25 version 7.45.241 (1a2f2fa CY) FWID 01-703fd60

Kerberos.io firmware:

Code:

[root@kios-48b2fa60 ~]# dmesg | grep -i firmware
[    0.090289] raspberrypi-firmware soc:firmware: Attached to firmware from 2019-11-14 15:27, variant start_x
[    0.100126] raspberrypi-firmware soc:firmware: Firmware hash is 2354eac70a98807e06bed2149bc0c5613e751c15
[   21.678962] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4345/6 wl0: Feb 27 2018 03:15:32 version 7.45.154 (r684107 CY) FWID 01-4fbe0b04

I'm going to try and install a previous version for the driver later to see if it fixes it, I couldn't figure out how to do that so far...
-*
Tim, would you mind checking if the Raspberry Pi 3A+ that you've tested has the same firmware? I find it weird that no one else had this issue 

For reference, this is my Pi version:
Hardware        : BCM2835
Revision        : 9020e0
Model           : Raspberry Pi 3 Model A Plus Rev 1.0

The constituent parts of the firmware are listed here https://github.com/raspberrypi/firmware. Since the firmware is a software component of the OS image all Pi models running the same unmodified image will report the same firmware version.

# This is a 3B
pi@pb1:~ $ sudo vcgencmd version
Jan  5 2023 10:48:31 
Copyright © 2012 Broadcom
version 8ba17717fbcedd4c3b6d4bce7e50c7af4155cba9 (clean) (release) (start)

The kerberos OS is prolly running an old kernel.

Our release images are based on current Raspberry Pi OS Lite release plus APT upgrade which may include new kernel, boot loader, libs, etc. The 8.2.5 release shipped with kernel 5.15.84.

[adam_zzz]

Thanks for checking @TheOldPresbyope, @Tim Curtis. I checked now Moode 8.2.5 version on a Raspberry Pi 3 Model B+ and I have the same issue with the connection, so maybe there is an incompatibility between the kernel/firmware and some settings on my router. 
Raspberry Pi OS latest version has the same issue for me.

I've also tried 2 different power supplies, an original Raspberry Pi (5.1V) and an ifi iPower (5V) with no improvement for the wi-fi.

For Kerberos.io I just followed the download link from their website, section "Etcher", that points to an archived repository with the last release being Dec 31, 2019, so no wonder it's using old kernel/firmware: https://doc.kerberos.io/opensource/installation/#kios

[Tim Curtis]

Thanks for checking @TheOldPresbyope, @Tim Curtis. I checked now Moode 8.2.5 version on a Raspberry Pi 3 Model B+ and I have the same issue with the connection, so maybe there is an incompatibility between the kernel/firmware and some settings on my router. 
Raspberry Pi OS latest version has the same issue for me.

I've also tried 2 different power supplies, an original Raspberry Pi (5.1V) and an ifi iPower (5V) with no improvement for the wi-fi.

For Kerberos.io I just followed the download link from their website, section "Etcher", that points to an archived repository with the last release being Dec 31, 2019, so no wonder it's using old kernel/firmware: https://doc.kerberos.io/opensource/installation/#kios

It sounds like Pi has trouble with Routers running the dual authentication protocols.
Try posting an issue in the Raspberry Pi Linux Git in case its some sort of kernel bug.
https://github.com/raspberrypi/linux/issues

[TheOldPresbyope]

It takes two to tango, so be sure to include your AP/router's make/model and firmware rev when you post to the repo.


Regards,
Kent

[adam_zzz]

Not sure what I was missing before but I finally managed to connect it... I didn't had to change anything in Moode, I only set my router to accept WPA2-PSK and restarted the router and the Raspberry Pi.

I double checked and having WPA2-PSK/WPA3-SAE mixed mode still won't work with the Raspberry Pi, none of my other devices in my home ever complained about this, only the 2 raspberry PIs and even those won't complain with older firmware like I said...


Not sure if this can be fixed in Moode, but I guess this should be at least reproducible if you have a router that supports WPA2-PSK/WPA3-SAE mixed mode.

Edit: Moode also connects without problems to WPA-PSK/WPA2-PSK mixed mode.

[TheOldPresbyope]

I was toying with the idea of spinning up an instance of OpenWrt (open-source router/AP code) on a spare SBC just to see what's up with the mixed mode. I've used OpenWrt in experiments in the past so I figured grokking WPA3 configuration wouldn't be too big a hurdle.

Went off to visit their documentation and stumbled across this issue: FS#3108 - some devices unable to connect in mixed mode (WPA3/WPA2 Personal) which was opened almost 3 years ago and has been commented at various times since.

Yes, I see RPis mentioned but a number of other devices are mentioned too. Clearly details matter: which release of which OS yada yada yada.

Given the ongoing messiness of this issue I think I'll back away quietly and dream up some other project instead.

Regards,
Kent

[adam_zzz]

Ok, so I tried again Tim's suggestion to add the extra parameters to the wpa_supplicant.conf mentioned here:
https://github.com/raspberrypi/linux/iss...1279951709

 I've added these 2 lines and with my router set to WPA2-PSK/WPA3-SAE all is well, it was able to connect after restart:

Code:

key_mgmt=WPA-PSK-SHA256
ieee80211w=2

Maybe an improvement for Moode would be to be able to select WPA2-PSK/WPA3-SAE in the dropdown and update wpa_supplicant.conf with these 2 lines when selected... 

[TheOldPresbyope]

So it's actually working the way it's supposed to. I thought that wasn't the case.

For reference, the ever helpful Arch LInux wiki wpa_supplicant page gives exactly the same instructions for connections to mixed WPA2-PSK/WPA3-SAE access points so it's not just a Pi thing.

Regards,
Kent