Daemon.err hostapd: nl80211: kernel reports: key addition failed - is this a problem?

[fodiator]

Still having to make the final test.

In the meantime I’d be interested to learn if the code above improves your roaming, and - if so - if you see any throughput degradation (I don’t)…

Will take this up and notify you once I got the new patch working.

[andybjackson]

Sorry for not replying already. Have been fighting the LUA bug in recent days. Thus not making progress with testing the patch.

[andybjackson]

Snapshot seems now to incorporate mac80211: update to linux 6.1-rc8. Updating my WiFi infra produces daemon.notice hostapd: phy0-ap0: AP-STA-CONNECTED [snip MAC addr] auth_alg=ft.

I still get key addition failed, but it seems at last an official fix is coming down the pipe. I'm excited to investigate what the actual code changes might be.

[-updated-]

The pattern as I roam away and back (with buttery fast transitions) is now:

Mon Dec 12 11:57:40 2022 daemon.notice hostapd: phy0-ap0: AP-STA-DISCONNECTED [-mac snip-]
Mon Dec 12 11:57:40 2022 daemon.err hostapd: nl80211: kernel reports: key addition failed
Mon Dec 12 11:57:40 2022 daemon.notice hostapd: phy0-ap0: STA-OPMODE-N_SS-CHANGED [-mac snip-] 1
Mon Dec 12 11:57:40 2022 daemon.notice hostapd: phy0-ap0: STA-OPMODE-N_SS-CHANGED [-mac snip-] 2
Mon Dec 12 11:57:40 2022 daemon.info hostapd: phy0-ap0: STA [-mac snip-] IEEE 802.11: associated (aid 1)
Mon Dec 12 11:57:40 2022 daemon.notice hostapd: phy0-ap0: AP-STA-CONNECTED [-mac snip-] auth_alg=ft
Mon Dec 12 11:57:52 2022 daemon.notice hostapd: phy0-ap0: AP-STA-DISCONNECTED [-mac snip-]
Mon Dec 12 11:57:52 2022 daemon.err hostapd: nl80211: kernel reports: key addition failed
Mon Dec 12 11:57:52 2022 daemon.notice hostapd: phy0-ap0: STA-OPMODE-N_SS-CHANGED [-mac snip-] 1
Mon Dec 12 11:57:52 2022 daemon.notice hostapd: phy0-ap0: STA-OPMODE-N_SS-CHANGED [-mac snip-] 2
Mon Dec 12 11:57:52 2022 daemon.info hostapd: phy0-ap0: STA [-mac snip-] IEEE 802.11: associated (aid 1)
Mon Dec 12 11:57:52 2022 daemon.notice hostapd: phy0-ap0: AP-STA-CONNECTED [-mac snip-] auth_alg=ft

Does anyone know what STA-OPMODE-N_SS-CHANGED means?

Note this is under WPA2+PSK and not yet WPA3+SAE. At least not yet working for me. Guessing the latter still has something to do with 802.11w Protected Management Frames or/& the extra authentication exchange WPA3 involves.

[umayer]

Also, could some savvy person explain why there is still deamon.err [...] key addition failed?

[fodiator]

Because:

• reassociation is a multistage process, and
• key exchange happens before re-association, and
• key get’s rejected if not associated, because of (some AP’s) not activating hardware decryption

The existing workaround is to have retry cycles that succeed when the association is established. This may time out.

The patch above accepts the key on first offer, which may suffice. In my case it does not affect throughput.

Hope that clarifies.

[andybjackson]

Have started a new thread on next steps now that FT is back working. That said, it would still be nice to get rid of key addition failed by getting @fodiator's patch finalised & accepted. And to know what STA-OPMODE-N_SS-CHANGED means, albeit the number of times it appears has reduced in my setup under later snapshots.

Next steps now that Fast Transition is working again

Now that Fast Transition (802.11r) is working again, my attention moves on to further advances in my home WiFi setup. I'd like to adopt WPA3. WPA3 requires Protected Management Frames (OpenWRT terms 802.11w Management Frame Protection). It seems that OpenWRT requires more than just the default wpad-basic-wolfssl for PMF. I have now replaced that with wpad-wolfssl and . Yet Analiti suggests that PMF is still "Not supported". This on BT Home Hub 5A (lantiq/xrx-200) & TP-Link EAP235-Wall & EAP615-…

[ishan]

Hi, Has this patch been upstreamed yet? I have 3 APs(Archer A7 v5, Archer A6) and all of them give the same key addition failed on roaming and it do a full 4 way handshake when it shouldn't.

[andybjackson]

@ishan Don't think the patch is upstreamed yet. For me it seems it wasn't the root cause of FT not working. I get good roaming behaviour even with key addition failed.

[zagi-tng]

If you don't get 2way then it's not FT.

i am also waiting for this feature in next stable release.
Everything else is set and prepared (FT protocol, domain, PMK, DS,...) for this on my APs (100+). :-E

[ishan]

I have the same experience. Roaming works reasonably well even with this error. Elsewhere on the forum, Some one had specified that while roaming, it should not do full 4 way authentication and that ios devices may act a bit weird but my apple devices have mostly been fine with this.
i hope eventually this is merged.

[sadisticpandabear]

Same here on multiple MT7621 (xiaomi)

[Double-G]

Error gone with latest OpenWRT snapshot. No more 4way-Handshakes

[sadisticpandabear]

Possible to note the snapshot you using? So we know in the future?

[Double-G]

OpenWrt SNAPSHOT r21950-90dbdb4941 / LuCI Master git-23.013.73089-9634086 on Xiaomi Mi Router 4A Gigabit Edition in connection with DAWN (luci-app-dawn, dawn).
While I still see the "key addition failed"-message, there is no more 4way handshake and my clients seem to roam fast.

[zagi-tng]

I guess we wait for v23.0

Is there a date set for stable release ?

[sadisticpandabear]

Yup, here, recent snapshot, still have the key error but roaming works, no more 4way handshakes

[sadisticpandabear]

Anyone tested already if it's mergedd with 23.0.4? Or still not working there?

[ishan]

The latest build available for my devices(A7, A6) is 22.03.
I still get kernel reports: key addition failed

Sun Apr 30 18:56:15 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 18:56:15 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 18:56:15 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 18:56:48 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 18:56:48 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 18:56:48 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 18:56:48 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d

Roaming feels a bit smoother/faster after the upgrade. I am not sure if any thing was improved or if I am imagining it.

One thing that's missing is, My omada APs move my devices straight to 5ghz if I am connected to 2.4ghz where as openwrt only transfer me to 2.4ghz radio of other AP and then it takes I think around ~30s for band steering to take over.

Edit: I see I have to sysupgrade to 22.03.4. I'll try that out.

[ishan]

Tested on 22.03.4 as well and It's still there.

root@Openwrt-AP2:~# logread -f
Sun Apr 30 19:24:37 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:24:37 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:24:37 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:24:57 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:24:57 2023 kern.info kernel: [  244.827319] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0  arvif->paused: 0x0
Sun Apr 30 19:24:57 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:24:57 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:24:57 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:08 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:08 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:25:08 2023 kern.info kernel: [  256.004100] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0  arvif->paused: 0x0
Sun Apr 30 19:25:08 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:25:08 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:25:15 2023 daemon.info hostapd: wlan1-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan1-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan0-3: Prune association for 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:17 2023 kern.info kernel: [  264.421905] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0  arvif->paused: 0x0
Sun Apr 30 19:25:45 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)

and on another AP

Sun Apr 30 19:26:50 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:50 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:50 2023 daemon.notice hostapd: handle_assoc_cb: STA 3e:f1:8a:66:86:1d not found
Sun Apr 30 19:26:53 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:53 2023 daemon.info hostapd: wlan0-2: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:26:53 2023 daemon.notice hostapd: wlan0-2: AP-STA-CONNECTED 3e:f1:8a:66:86:1d

[sadisticpandabear]

Well it still shows the error but it seems fast roaming still works

Holdin off here on going to release as reealse is a major downgrade from my current snapshot where it seems everything is working