Same here on multiple MT7621 (xiaomi)
Error gone with latest OpenWRT snapshot. No more 4way-Handshakes 
1 Like
Possible to note the snapshot you using? So we know in the future?
OpenWrt SNAPSHOT r21950-90dbdb4941 / LuCI Master git-23.013.73089-9634086 on Xiaomi Mi Router 4A Gigabit Edition in connection with DAWN (luci-app-dawn, dawn).
While I still see the "key addition failed"-message, there is no more 4way handshake and my clients seem to roam fast.
2 Likes
I guess we wait for v23.0
Is there a date set for stable release ? 
Yup, here, recent snapshot, still have the key error but roaming works, no more 4way handshakes
3 Likes
Anyone tested already if it's mergedd with 23.0.4? Or still not working there?
The latest build available for my devices(A7, A6) is 22.03.
I still get kernel reports: key addition failed
Sun Apr 30 18:56:15 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 18:56:15 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 18:56:15 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 18:56:48 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 18:56:48 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 18:56:48 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 18:56:48 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Roaming feels a bit smoother/faster after the upgrade. I am not sure if any thing was improved or if I am imagining it.
One thing that's missing is, My omada APs move my devices straight to 5ghz if I am connected to 2.4ghz where as openwrt only transfer me to 2.4ghz radio of other AP and then it takes I think around ~30s for band steering to take over.
Edit: I see I have to sysupgrade to 22.03.4. I'll try that out.
Tested on 22.03.4 as well and It's still there.
root@Openwrt-AP2:~# logread -f
Sun Apr 30 19:24:37 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:24:37 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:24:37 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:24:57 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:24:57 2023 kern.info kernel: [ 244.827319] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0 arvif->paused: 0x0
Sun Apr 30 19:24:57 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:24:57 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:24:57 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:08 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:08 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:25:08 2023 kern.info kernel: [ 256.004100] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0 arvif->paused: 0x0
Sun Apr 30 19:25:08 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:25:08 2023 daemon.notice hostapd: wlan0-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:25:15 2023 daemon.info hostapd: wlan1-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan1-3: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan0-3: Prune association for 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:15 2023 daemon.notice hostapd: wlan0-3: AP-STA-DISCONNECTED 3e:f1:8a:66:86:1d
Sun Apr 30 19:25:17 2023 kern.info kernel: [ 264.421905] ath10k_pci 0000:00:00.0: mac flush vdev 3 drop 0 queues 0x8 ar->paused: 0x0 arvif->paused: 0x0
Sun Apr 30 19:25:45 2023 daemon.info hostapd: wlan0-3: STA 3e:f1:8a:66:86:1d IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
and on another AP
Sun Apr 30 19:26:50 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:50 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:50 2023 daemon.notice hostapd: handle_assoc_cb: STA 3e:f1:8a:66:86:1d not found
Sun Apr 30 19:26:53 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sun Apr 30 19:26:53 2023 daemon.info hostapd: wlan0-2: STA 3e:f1:8a:66:86:1d IEEE 802.11: associated (aid 1)
Sun Apr 30 19:26:53 2023 daemon.notice hostapd: wlan0-2: AP-STA-CONNECTED 3e:f1:8a:66:86:1d
Well it still shows the error but it seems fast roaming still works
Holdin off here on going to release as reealse is a major downgrade from my current snapshot where it seems everything is working 
1 Like
Did you mean like this?
Patch for snapshot. I builded firmware for wr740n, but not tested in rouming...
[buildroot]/openwrt/package/kernel/mac80211/patches/subsys/100-allow_key_without_assoc.patch
diff -Naru backports-6.1.24-a/net/mac80211/cfg.c backports-6.1.24-b/net/mac80211/cfg.c
--- backports-6.1.24-a/net/mac80211/cfg.c 2023-04-17 17:56:39.000000000 +0300
+++ backports-6.1.24-b/net/mac80211/cfg.c 2023-07-09 00:46:36.244775571 +0300
@@ -524,11 +524,16 @@
* TODO: accept the key if we have a station entry and
* add it to the device after the station.
*/
- if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
+ if (!sta) {
+ sdata_info(sdata, "mwv1 - no sta\n");
ieee80211_key_free_unused(key);
err = -ENOENT;
goto out_unlock;
}
+ if (!test_sta_flag(sta, WLAN_STA_ASSOC)) {
+ sdata_info(sdata, "mwv2 - no sta assoc\n");
+ }
+
}
switch (sdata->vif.type) {
1 Like
Did it finally make it into stable? had issues with fast roaming in 22..03, couldnt get it working, works in snapsnots.
Now with release of 22.0.5, did i finally got solved?
1 Like
I have OpenWrt version 23.05 installed, configured with mixed WPA2/WPA3 PSK, SAE and 802.11r enabled. Also, External key holder lists are configured. Can confirm this issue still persist:
daemon.err hostapd: nl80211: kernel reports: key addition failed
Roaming doesn't work, devices are persistently active in a weaker signal AP. Hardware two Extreme Networks AP-3825i.
1 Like
I too use the Extreme Networks AP-3825i AP's. Although those log entries are still there fast transition is working as expected on my WPA2 wireless.
snapshot or stable?
Upgraded from 22.03.5 to 23.05.0 stable release.
Tue Oct 17 08:47:21 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## IEEE 802.11: binding station to interface 'phy1-ap0'
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## IEEE 802.11: authentication OK (FT)
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## MLME: MLME-AUTHENTICATE.indication(##:##:##:##:##:##, FT)
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## IEEE 802.11: association OK (aid 1)
Tue Oct 17 08:47:21 2023 daemon.info hostapd: phy1-ap0: STA ##:##:##:##:##:## IEEE 802.11: associated (aid 1)
Tue Oct 17 08:47:21 2023 daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED ##:##:##:##:##:## auth_alg=ft
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## MLME: MLME-REASSOCIATE.indication(##:##:##:##:##:##)
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## IEEE 802.11: binding station to interface 'phy1-ap0'
Tue Oct 17 08:47:21 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## WPA: event 6 notification
Tue Oct 17 08:47:22 2023 daemon.debug hostapd: phy1-ap0: STA ##:##:##:##:##:## WPA: FT authentication already completed - do not start 4-way handshake
root@AP-Media-Rm:~# ubus call system board
{
"kernel": "5.15.134",
"hostname": "######",
"system": "e500v2",
"model": "Extreme Networks WS-AP3825i",
"board_name": "extreme-networks,ws-ap3825i",
"rootfs_type": "squashfs",
"release": {
"distribution": "OpenWrt",
"version": "23.05.0",
"revision": "r23497-6637af95aa",
"target": "mpc85xx/p1020",
"description": "OpenWrt 23.05.0 r23497-6637af95aa"
}
}
With stable 23.05 it seems I can't get FT working on my setup. Snipped from the log:
Sat Oct 21 11:01:09 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sat Oct 21 11:02:17 2023 daemon.info hostapd: phy0-ap0: STA xx:xx:xx:xx:xx:xx IEEE 802.11: associated (aid 1)
Sat Oct 21 11:02:17 2023 daemon.notice hostapd: phy0-ap0: AP-STA-CONNECTED xx:xx:xx:xx:xx:xx auth_alg=sae
Sat Oct 21 11:02:17 2023 daemon.info hostapd: phy0-ap0: STA xx:xx:xx:xx:xx:xx RADIUS: starting accounting session 68A28840E2D42061
Sat Oct 21 11:02:17 2023 daemon.info hostapd: phy0-ap0: STA xx:xx:xx:xx:xx:xx WPA: pairwise key handshake completed (RSN)
Sat Oct 21 11:02:17 2023 daemon.notice hostapd: phy0-ap0: EAPOL-4WAY-HS-COMPLETED xx:xx:xx:xx:xx:xx
Sat Oct 21 11:03:02 2023 daemon.info hostapd: phy0-ap0: STA xx:xx:xx:xx:xx:xx IEEE 802.11: disconnected due to excessive missing ACKs
Sat Oct 21 11:03:02 2023 daemon.notice hostapd: phy0-ap0: AP-STA-DISCONNECTED xx:xx:xx:xx:xx:xx
Sat Oct 21 11:03:02 2023 kern.info kernel: [85157.799987] ath10k_pci a000:03:00.0: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
802.11w (optional) is configured on as Apple devices are not connecting when disabled. Also, I have separate VLANs for management and wireless clients.
Another thing I noticed, can not set wireless region to my location, it is forced to US. Perhaps an ath10k firmware issue but it is a different case, I think.
That issue does not actually prevent 802.11r roaming. (at least in main/master. I am not using 23.05)
With my Android 11 tablet, I have success with "WPA2 only" roaming, but not with WPA2/WPA3 mixed or WPA3 only. (My newer phone roams WPA3 ok.)
See the log, there is first the key addition error and then the successful FT roaming.
Sat Oct 21 11:27:44 2023 kern.info kernel: [ 1640.508581] br-lan: port 5(hn5wpa2r) entered forwarding state
Sat Oct 21 11:27:54 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 IEEE 802.11: binding station to interface 'hn5wpa2r'
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 IEEE 802.11: authentication OK (FT)
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 MLME: MLME-AUTHENTICATE.indication(e0:c3:77:ae:0a:30, FT)
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 IEEE 802.11: association OK (aid 1)
Sat Oct 21 11:27:54 2023 daemon.info hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 IEEE 802.11: associated (aid 1)
Sat Oct 21 11:27:54 2023 daemon.notice hostapd: hn5wpa2r: AP-STA-CONNECTED e0:c3:77:ae:0a:30 auth_alg=ft
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 MLME: MLME-REASSOCIATE.indication(e0:c3:77:ae:0a:30)
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 IEEE 802.11: binding station to interface 'hn5wpa2r'
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 WPA: event 6 notification
Sat Oct 21 11:27:54 2023 daemon.debug hostapd: hn5wpa2r: STA e0:c3:77:ae:0a:30 WPA: FT authentication already completed - do not start 4-way handshake
Also the key management is properly recognised as FT=802.11r:
root@router4:~# /etc/wifi-suite.sh
Associated wifi stations' AKM suites:
hn5wpa2r: AKM suite of e0:c3:77:ae:0a:30 is 00-0f-ac-4 (WPA-PSK-FT)
Example of my working config:
option ssid 'WPA2RKOE'
option encryption 'psk2'
option key 'XXXXXXXXXXXXXX'
option ieee80211r '1'
option ieee80211w '2'
option ieee80211k '1'
option wnm_sleep_mode '1'
option wnm_sleep_mode_no_keys '1'
option bss_transition '1'
option max_inactivity '4500'
option ft_over_ds '0'
option ft_psk_generate_local '0'
option reassociation_deadline '20000'
option disassoc_low_ack '0'
option sae_pwe '2'
option ocv '1'
option pmk_r1_push '1'
option nasid 'rt3200'
option mobility_domain '4488'
option r1_key_holder 'c4411EF8A521'
list r0kh 'DE:EF:09:EF:F3:E6,r7800,3ed67e18b353c6d80f5242e98e58a7efae9b9bc93903ecc32473c90c3c136ac6'
list r1kh 'DE:EF:09:EF:F3:E6,DE:EF:09:EF:F3:E6,3ed67e18b353c6d80f5242e98e58a7efae9b9bc93903ecc32473c90c3c136ac6'
list r0kh 'C4:41:1E:F8:A5:21,rt3200,3ed67e18b353c6d80f5242e98e58a7efae9b9bc93903ecc32473c90c3c136ac6'
list r1kh 'C4:41:1E:F8:A5:21,C4:41:1E:F8:A5:21,3ed67e18b353c6d80f5242e98e58a7efae9b9bc93903ecc32473c90c3c136ac6'
I have noticed that sometimes the automatically allocated MACs slightly change, e.g. C6:41:1E:F8:A5:21 instead of C4:41:1E:F8:A5:21 according to the enabled SSIDs enabled etc., so you may need to check the key_holder and r01kh and r1kh data.
(I should probably assign permanent MACs to avoid that kind of trouble.)
For me since 22.03 and also in 23.05 roaming is only working for one of my two devices that try to roam. And only in WPA2.
This is the log of the router I roam into for the device that works (Xiaomi Mi5):
Thu Nov 16 19:57:39 2023 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX
Thu Nov 16 19:57:39 2023 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX device2
Thu Nov 16 19:58:00 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:58:00 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: associated (aid 2)
Thu Nov 16 19:58:00 2023 daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED XX:XX:XX:XX:XX:XX auth_alg=ft
and then for the device that doesn't work (Oneplus 8T):
Summary
Thu Nov 16 19:52:47 2023 daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED XX:XX:XX:XX:XX:XX
Thu Nov 16 19:52:47 2023 kern.info kernel: [ 2364.568417] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
Thu Nov 16 19:52:53 2023 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX
Thu Nov 16 19:52:53 2023 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX device1
Thu Nov 16 19:52:54 2023 daemon.info dnsmasq-dhcp[1]: DHCPREQUEST(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX
Thu Nov 16 19:52:54 2023 daemon.info dnsmasq-dhcp[1]: DHCPACK(br-lan) X.X.X.X XX:XX:XX:XX:XX:XX device1
Thu Nov 16 19:53:01 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:53:01 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: Station sent an invalid association request
Thu Nov 16 19:53:01 2023 daemon.notice hostapd: handle_assoc_cb: STA XX:XX:XX:XX:XX:XX not found
Thu Nov 16 19:53:01 2023 kern.info kernel: [ 2378.478331] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
Thu Nov 16 19:53:02 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:53:02 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: Station sent an invalid association request
Thu Nov 16 19:53:02 2023 daemon.notice hostapd: handle_assoc_cb: STA XX:XX:XX:XX:XX:XX not found
Thu Nov 16 19:53:02 2023 kern.info kernel: [ 2379.498326] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
Thu Nov 16 19:53:04 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:53:04 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: Station sent an invalid association request
Thu Nov 16 19:53:04 2023 daemon.notice hostapd: handle_assoc_cb: STA XX:XX:XX:XX:XX:XX not found
Thu Nov 16 19:53:04 2023 kern.info kernel: [ 2381.278308] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
Thu Nov 16 19:53:26 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:53:26 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: Station sent an invalid association request
Thu Nov 16 19:53:26 2023 daemon.notice hostapd: handle_assoc_cb: STA XX:XX:XX:XX:XX:XX not found
Thu Nov 16 19:53:26 2023 kern.info kernel: [ 2403.748192] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
Thu Nov 16 19:53:31 2023 daemon.err hostapd: nl80211: kernel reports: key addition failed
Thu Nov 16 19:53:31 2023 daemon.info hostapd: phy1-ap0: STA XX:XX:XX:XX:XX:XX IEEE 802.11: Station sent an invalid association request
Thu Nov 16 19:53:31 2023 daemon.notice hostapd: handle_assoc_cb: STA XX:XX:XX:XX:XX:XX not found
Thu Nov 16 19:53:31 2023 kern.info kernel: [ 2408.368157] ath10k_ahb a800000.wifi: mac flush vdev 0 drop 0 queues 0x1 ar->paused: 0x0 arvif->paused: 0x0
This handle_assoc_cb not foud and station sent an invalid association request mean that is problem of the device and not OpenWRT, maybe?
My config:
Summary
router 1
config wifi-device 'radio1'
option type 'mac80211'
option path 'platform/soc/a800000.wifi'
option channel 'auto'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
option txpower '15'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'wifi'
option encryption 'psk2'
option key 'password'
option ieee80211r '1'
option mobility_domain 'F63F'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option ieee80211k '1'
option wmm '0'
option wpa_disable_eapol_key_retries '1'
option ieee80211w '2'
option ieee80211k '1'
router 2
config wifi-device 'radio1'
option type 'mac80211'
option path '1e140000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0'
option band '5g'
option htmode 'VHT80'
option cell_density '0'
option channel 'auto'
option txpower '10'
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
option ssid 'wifi'
option ieee80211r '1'
option ft_over_ds '0'
option ft_psk_generate_local '1'
option key 'password'
option mobility_domain 'F63F'
option encryption 'psk2'
option wmm '0'
option wpa_disable_eapol_key_retries '1'
option ieee80211w '2'
option ieee80211k '1'