WPA3 - wolfssl fail, openssl success!

For Developers
1

Here are some test results for WPA3:

  • Router model TL-WDR4300
  • Architecture Atheros AR9344
  • OpenWrt 19.07.0-rc2

tests with wolfssl - all FAIL:
opkg update && opkg remove wpad-basic && opkg install wpad-wolfssl

  • Pixel 3 - doesn't connect
  • Samsung A70 - doesn't connect

tests with openssl - great SUCCESS!
opkg update && opkg remove wpad-basic && opkg install wpad-openssl

  • Pixel 3 - connects&works, shows "WPA3-Personal"
  • Samsung A70 - connects&works, shows "WPA3-Personal"
2 Likes
2

Oh why? Ml m

3

This has been noted before. “Why” will require someone to dig into the code and its behavior.

4 Likes
4

I can confirm that behaviour with wpad-mesh-wolfssl while trying to setup a 802.11s network with SAE
2 x TP-Link RE450v2
1 x TP-Link Archer A7v5
all on openwrt-19.07.0-rc2-ath79

I have a working mesh config, which works with wpad-mesh-openssl on all 3 devices

config wifi-iface 'mesh_radio1'
	option encryption 'sae'
	option device 'radio1'
	option mode 'mesh'
	option mesh_fwding '1'
	option mesh_id 'MY_MESH'
	option network 'mesh'
	option mesh_rssi_threshold '0'
	option key '<pwmesh>'

When i change the image to wpad-mesh-wolfssl the trouble begins.

  • flash image on all 3 devices
  • reboot
  • MESH-SAE-AUTH-FAILURE all the time

REVERT

  • flashing back to an openssl-image
  • reboot
  • works
5

ping @cotequeiroz

6

I am aware of the problem, but unable to figure out what is wrong. I can't run WPA3 here, so there's not much I can do.
There's a new version of wolfssl out. I'm currently testing it then I'll send an update patch to openwrt-devel. Here's the patch for it if you want to give it a try:

--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=wolfssl
-PKG_VERSION:=4.2.0-stable
+PKG_VERSION:=4.3.0-stable
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
-PKG_HASH:=3562af485c26cd7abe94d9404fbfc0c5c9bceb4aab29b81ebf5e6c2467507e12
+PKG_HASH:=6896f8ad6c44aff3e583006eeee839600848a0e37118ebbb7514eca9409ae08b

 PKG_FIXUP:=libtool
 PKG_INSTALL:=1
@@ -44,7 +44,7 @@ define Package/libwolfssl
   MENU:=1
   PROVIDES:=libcyassl
   DEPENDS:=+WOLFSSL_HAS_DEVCRYPTO:kmod-cryptodev +WOLFSSL_HAS_AFALG:kmod-crypto-user
-  ABI_VERSION:=23
+  ABI_VERSION:=24
 endef

 define Package/libwolfssl/description
1 Like
7

I've made an image with your "version-patch". WPA3 Personal is working with that version.

Didn't try my mesh-setup yet.

Kind regards

8

Mesh-Auth fails on openwrt-19.07.0-rc2 with wolfssl

  • 3.15.7-stable
  • 4.2.0-stable
  • 4.3.0-stable

I have TP-LINK TL-WA860RE on OpenWrt-Tiny 18.06.5, r7897-9d401013fc with libwolfssl_3.15.3 which works out of the box with 802.11s. So i don't know if wolfssl is the problem here.
The other box in this setup has openwrt-19.07.0-rc2 with wpad-openssl.

9

This didn't work for me. I got the following error: that file is already provided by package * libubox 20170601* opkg_install_cmd: Cannot install package wpad-openssl on both my devices running 19.07:
-Linksys WRT3200ACM
-TP-Link TL-WDR3500 v1

I used opkg install libubox20191228 libubus20191227 --force-overwrite then

opkg update && opkg remove wpad-basic && opkg install wpad-openssl and it installed with no issues.

10

Good news! Since this commit to master a few hours ago...

https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=631c437a91c20df678b25dcc34fe23636116a35a

...compiling with hostapd-wolfssl full running on an AP (UniFi AC LR ath79 k5.4) set to use SAE-only (WPA3) and now I have no problem getting or staying connected. Previously this was most definitely not the case.

1 Like
11

A bit late .. but i can confirm it, too.

Works on my 2 TP-Link RE450v2 on 19.07

Thanks for the good work. I'm enjoying the free space on the device now :wink: