Can't connect to wifi Raspberry Pi 3A+

[Tim Curtis]

At this point, I'm not yet convinced it is a bug in wpa_supplicant per se but in the way it's built/and or configured. It's ubiquitous in Linux-based systems including Android and I see that recent Android releases explicitly claim they support the various WPA3 modes including this mixed WPA2/WPA3 mode (aka transition mode in some of the things read).

In any case, you're the man of the hour for bringing up the issue and doing the digging. Without a suitable WiFi testbed, either a commercial router or a openwrt install, I'm not in a position to do what you can do.
F
Sadly, the documentation of the WiFi subsystem of Linux is as obscurely documented as the ALSA subsystem. If you like waltzing through alphabet soup, have a look at the wpa_supplicant.conf docs: /usr/share/doc/wpa_supplicant/examples/wpa_supplicant.conf

Regards,
Kent

Thanks, haven't checked the docs yet, but it would be amazing if you could add a flag to the network so it goes through all encryption methods from most secure to least until it finds a match.

I have achieved the same effect though with priorities in wpa_supplicant.conf. I was assuming the priority flag is for when you have different networks and want to have a fallback in case one is down, but you can also configure the same network multiple times just for different encryptions giving priority to the most secure. 

This will make it easier for a new user to set up Moode since they wouldn't need to go and check in their router to find out what to chose from the dropdown, or have to try each option and restart multiple times until they get it right.

I've tested the below and seems to be working fine for all the different encryption methods, everything except WPA3-SAE, that one not only it didn't work for me (I've  tried the example from the ArchLinux website) but it wouldn't try the next priority in line either, instead the Moode's access point popped up, so I had to comment it. 
I'll have to dig deeper and maybe do the ethernet cable trick again to be able to see what's happening with WPA3-SAE, maybe some other time. 
But this should already be an improvement to the solution I've suggested before of adding a new dropdown option in the UI. 

Maybe one of you can also test it and see if it doesn't blow up when your router doesn't support WPA2-PSK/WPA3-SAE mixed mode 

Code:

#pure WPA3-SAE
#network={
#ssid="HOMENETWORK"
#key_mgmt=SAE
#priority=110
#scan_ssid=1
#sae_password="clearTextPassword"
#ieee80211w=2
#}

#WPA2-PSK/WPA3-SAE mixed mode
network={
ssid="HOMENETWORK"
key_mgmt=WPA-PSK-SHA256
priority=109
scan_ssid=1
psk=psk
ieee80211w=2
}

#WPA/WPA2-PSK mixed mode or pure WPA or pure WPA2-PSK
network={
ssid="HOMENETWORK"
key_mgmt=WPA-PSK
priority=108
scan_ssid=1
psk=psk
}

#No encryption
network={
ssid="HOMENETWORK"
key_mgmt=NONE
priority=-999
scan_ssid=1
}

Edit: The options could also be placed in the same network section, separated by space, see "Catch all" example here: https://linux.die.net/man/5/wpa_supplicant.conf

This works well with my Router, the same as with the config with priorities above, I was able to connect to most of the encryption methods on my router except for WPA3. The global pmf=1 is to handle the different ieee80211w settings in the network section.

Code:

country=NL
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

pmf=1

#Catch all
network={
   ssid="HOMENETWORK"
   scan_ssid=1
   key_mgmt=WPA-EAP WPA-PSK-SHA256 WPA-PSK IEEE8021X NONE
   pairwise=CCMP TKIP NONE
   group=CCMP TKIP WEP104 WEP40
   psk=psk
   eap=TTLS PEAP TLS
}

Edit 2: ChatGPT suggested to use this for WPA3-SAE, I'm not sure if it is correct and I don't think the Raspberry Pi supports WPA3 so not sure if it's worth to add it but at least with this one Moode access point doesn't start and it will try the next priority and connect successfully to the others.

Code:

network={
   ssid="your_network_name"
   key_mgmt=WPA-PSK
   proto=RSN
   pairwise=CCMP
   group=CCMP
   psk="your_network_password"
}

Going forward the list should be like below. I'm not sure why "No security" is still in the list. It should prolly be deleted.

WPA2-Personal
WPA3-Personal Transition Mode
No Security

I don't think it will be difficult to pick the right protocol because the vast majority of Routers only support WPA2. When WPA3 becomes more prevalent then the word will get out and people will start looking for it in the products they use.

The idea for automated protocol selection is prolly good as long as the process doesn't take too long. I'll add to the TODO list.