• State Not Answered
  • Replies 13 replies
  • Subscribers 75 subscribers
  • Views 963 views
  • Users 0 members are here
Attachments (2) Download All
Nordic Case Info
  • Case ID: 346173
Options

Can't get WPA2 Enterprise (EAP-TLS) to connect to wifi AP using nrf5340/nrf7002/NCS2.9.0

BrianW

I am trying to get the wifi stack to connect to a wifi AP using WAP2 Enterprise (initially just with identity and eap_password, later with full ca_certificate check and client certificate).

We have a custom PCB with nrf5340, nrf7002, and an application built with NCS2.9.0.

The code will connect ok when using WPA2-PSK and WPA3-SAE, but doesn't manage to connect using WPA2-EAP-TLS?

To try to determine why, I have enabled WPA2-Enterprise connection in the wifi-sta sample but this doesn't connect either.

wifi-sta prj.conf file:

4300.prj.conf

The connection setup code is like this:

static int __wifi_params_wpa2eap(struct wifi_connect_req_params *params)
{

    params->timeout =  CONFIG_STA_CONN_TIMEOUT_SEC * MSEC_PER_SEC;

    if (params->timeout == 0) {
        params->timeout = SYS_FOREVER_MS;
    }

    /* Defaults */
    params->band = WIFI_FREQ_BAND_UNKNOWN;
    params->channel = WIFI_CHANNEL_ANY;
    params->security = WIFI_SECURITY_TYPE_NONE;
    params->mfp = WIFI_MFP_OPTIONAL;

    /* SSID */
    params->ssid =STA_SSID;
    params->ssid_length = strlen(params->ssid);

    params->security = WIFI_SECURITY_TYPE_EAP_TLS;
    params->eap_identity = STA_IDENTITY;        //"cc2-004a";
    params->eap_id_length = strlen(params->eap_identity);
    params->eap_password = STA_PASSWORD;
    params->eap_passwd_length = strlen(params->eap_password);

    return 0;
}
Is this correct to set up a WPA2 EAP-TLS connection?
btw my wifi AP is a HP 505H using an internal database for EAP user lookup.
The debug output from wpa_supplient during the connection attempt:
[00:00:00.470,855] <inf> sta: Starting cc2v1 with CPU frequency: 64 MHz
[00:00:00.471,038] <dbg> wpa_supp: wpa_printf_impl: wpa_supplicant v2.11-devel
[00:00:00.471,252] <inf> wifi_supplicant: wpa_supplicant initialized
[00:00:00.471,618] <dbg> wifi_supplicant: add_interface: Adding interface wlan0 [1] (0x200019b8)
[00:00:00.471,710] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: interface_add, argc: 5
[00:00:00.471,771] <dbg> wpa_supp: wpa_printf_impl: argv[0]: interface_add
[00:00:00.471,832] <dbg> wpa_supp: wpa_printf_impl: argv[1]: wlan0
[00:00:00.471,862] <dbg> wpa_supp: wpa_printf_impl: argv[2]: zephyr
[00:00:00.471,893] <dbg> wpa_supp: wpa_printf_impl: argv[3]: zephyr
[00:00:00.471,954] <dbg> wpa_supp: wpa_printf_impl: argv[4]: zephyr
[00:00:00.472,320] <dbg> wpa_supp: wpa_printf_impl: RX global ctrl_iface - hexdump_ascii(len=71):
[00:00:00.472,351] <dbg> wpa_supp: _wpa_hexdump_ascii:
49 4e 54 45 52 46 41 43 45 5f 41 44 44 20 77 6c |INTERFAC E_ADD wl
61 6e 30 09 7a 65 70 68 79 72 09 7a 65 70 68 79 |an0.zeph yr.zephy
72 09 7a 65 70 68 79 72 09 09 09 09 20 77 6c 61 |r.zephyr .... wla
6e 30 20 7a 65 70 68 79 72 20 7a 65 70 68 79 72 |n0 zephy r zephyr
20 7a 65 70 68 79 72 | zephyr
[00:00:00.472,412] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE GLOBAL INTERFACE_ADD 'wlan0 zephyr zephyr zephyr wlan0 zephyr zephyr zephyr'
[00:00:00.472,534] <dbg> wpa_supp: wpa_printf_impl: Initializing interface 'wlan0' conf 'zephyr' driver 'zephyr' ctrl_interface 'zephyr' bridge 'N/A'
[00:00:00.474,517] <dbg> wpa_supp: wpa_printf_impl: Add interface wlan0 to a new radio N/A
[00:00:00.477,966] <dbg> wpa_supp: wpa_printf_impl: wpa_supp: Added 802.11b mode based on 802.11g information
[00:00:00.478,179] <dbg> wpa_supp: wpa_printf_impl: l2_packet_init: iface wlan0 ifindex 1
[00:00:00.478,332] <dbg> wpa_supp: wpa_printf_impl: wlan0: Own MAC address: f0:ce:37:00:00:4a
[00:00:00.478,485] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 0 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.482,025] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 1 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.484,344] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 2 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.486,663] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 3 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.488,983] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 4 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.492,675] <dbg> wpa_supp: wpa_printf_impl: _wpa_drv_zep_set_key: priv:0x2000a450 alg 0 addr 0x0 key_idx 5 set_tx 0 seq 0x0 seq_len 0 key 0x0 key_len 0 key_flag 10
[00:00:00.494,964] <dbg> wpa_supp: wpa_printf_impl: wlan0: RSN: flushing PMKID list in the driver
[00:00:00.495,086] <dbg> wpa_supp: wpa_printf_impl: wlan0: State: DISCONNECTED -> INACTIVE
[00:00:00.557,220] <dbg> wpa_supp: wpa_printf_impl: EAPOL: SUPP_PAE entering state DISCONNECTED
[00:00:00.557,281] <dbg> wpa_supp: wpa_printf_impl: EAPOL: Supplicant port status: Unauthorized
[00:00:00.567,687] <dbg> wpa_supp: wpa_printf_impl: EAPOL: KEY_RX entering state NO_KEY_RECEIVE
[00:00:00.567,749] <dbg> wpa_supp: wpa_printf_impl: EAPOL: SUPP_BE entering state INITIALIZE
[00:00:00.567,779] <dbg> wpa_supp: wpa_printf_impl: EAP: EAP entering state DISABLED
[00:00:00.568,145] <dbg> wpa_supp: wpa_printf_impl: wlan0: Added interface wlan0
[00:00:00.568,267] <dbg> wpa_supp: wpa_printf_impl: wlan0: State: INACTIVE -> DISCONNECTED
[00:00:01.471,008] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: remove_network, argc: 2
[00:00:01.471,069] <dbg> wpa_supp: wpa_printf_impl: argv[0]: remove_network
[00:00:01.471,099] <dbg> wpa_supp: wpa_printf_impl: argv[1]: all
[00:00:01.471,466] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'REMOVE_NETWORK all'
[00:00:01.471,557] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: REMOVE_NETWORK all
[00:00:01.472,076] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'ADD_NETWORK'
[00:00:01.472,167] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: ADD_NETWORK
[00:00:01.472,656] <dbg> wpa_supp: wpa_printf_impl: Received len: 26, msg_len:26 - CTRL-EVENT-NETWORK-ADDED 0->END
[00:00:01.473,022] <dbg> wpa_supp: wpa_printf_impl: NET added: 0
[00:00:01.473,114] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.473,175] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.473,205] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.473,266] <dbg> wpa_supp: wpa_printf_impl: argv[2]: ssid
[00:00:01.473,297] <dbg> wpa_supp: wpa_printf_impl: argv[3]: "kiosk_wpa2_ent"
[00:00:01.473,693] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.473,815] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='ssid'
[00:00:01.473,876] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=16): [REMOVED]
[00:00:01.473,968] <dbg> wpa_supp: wpa_printf_impl: ssid - hexdump_ascii(len=14):
[00:00:01.473,999] <dbg> wpa_supp: _wpa_hexdump_ascii:
6b 69 6f 73 6b 5f 77 70 61 32 5f 65 6e 74 |kiosk_wp a2_ent
[00:00:01.474,273] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.474,304] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.474,365] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.474,395] <dbg> wpa_supp: wpa_printf_impl: argv[2]: scan_ssid
[00:00:01.474,456] <dbg> wpa_supp: wpa_printf_impl: argv[3]: 1
[00:00:01.474,822] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.474,975] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='scan_ssid'
[00:00:01.475,036] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=1): [REMOVED]
[00:00:01.475,097] <dbg> wpa_supp: wpa_printf_impl: scan_ssid=1 (0x1)
[00:00:01.475,372] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.475,402] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.475,463] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.475,494] <dbg> wpa_supp: wpa_printf_impl: argv[2]: key_mgmt
[00:00:01.475,524] <dbg> wpa_supp: wpa_printf_impl: argv[3]: NONE
[00:00:01.475,921] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.476,043] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='key_mgmt'
[00:00:01.476,104] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=4): [REMOVED]
[00:00:01.476,196] <dbg> wpa_supp: wpa_printf_impl: key_mgmt: 0x4
[00:00:01.476,501] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.476,531] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.476,593] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.476,623] <dbg> wpa_supp: wpa_printf_impl: argv[2]: ieee80211w
[00:00:01.476,654] <dbg> wpa_supp: wpa_printf_impl: argv[3]: 0
[00:00:01.477,050] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.477,172] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='ieee80211w'
[00:00:01.477,233] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=1): [REMOVED]
[00:00:01.477,386] <dbg> wpa_supp: wpa_printf_impl: ieee80211w=0 (0x0)
[00:00:01.477,661] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.477,722] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.477,752] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.477,813] <dbg> wpa_supp: wpa_printf_impl: argv[2]: proto
[00:00:01.477,844] <dbg> wpa_supp: wpa_printf_impl: argv[3]: RSN
[00:00:01.478,210] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.478,363] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='proto'
[00:00:01.478,424] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=3): [REMOVED]
[00:00:01.478,485] <dbg> wpa_supp: wpa_printf_impl: proto: 0x2
[00:00:01.478,790] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.478,820] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.478,881] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.478,912] <dbg> wpa_supp: wpa_printf_impl: argv[2]: key_mgmt
[00:00:01.478,973] <dbg> wpa_supp: wpa_printf_impl: argv[3]: WPA-EAP
[00:00:01.479,339] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.479,492] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='key_mgmt'
[00:00:01.479,553] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=7): [REMOVED]
[00:00:01.479,644] <dbg> wpa_supp: wpa_printf_impl: key_mgmt: 0x1
[00:00:01.479,919] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set, argc: 3
[00:00:01.479,949] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set
[00:00:01.480,010] <dbg> wpa_supp: wpa_printf_impl: argv[1]: openssl_ciphers
[00:00:01.480,041] <dbg> wpa_supp: wpa_printf_impl: argv[2]: "DEFAULT:!EXP:!LOW"
[00:00:01.480,438] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET openssl_ciphers "DEFAULT:!EXP:!LOW"'
[00:00:01.480,529] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE SET 'openssl_ciphers'='"DEFAULT:!EXP:!LOW"'
[00:00:01.480,651] <dbg> wpa_supp: wpa_printf_impl: openssl_ciphers='"DEFAULT:!EXP:!LOW"'
[00:00:01.480,926] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.480,987] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.481,018] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.481,048] <dbg> wpa_supp: wpa_printf_impl: argv[2]: group
[00:00:01.481,109] <dbg> wpa_supp: wpa_printf_impl: argv[3]: CCMP
[00:00:01.481,475] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.481,628] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='group'
[00:00:01.481,689] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=4): [REMOVED]
[00:00:01.481,781] <dbg> wpa_supp: wpa_printf_impl: group: 0x10
[00:00:01.482,055] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.482,116] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.482,147] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.482,177] <dbg> wpa_supp: wpa_printf_impl: argv[2]: pairwise
[00:00:01.482,238] <dbg> wpa_supp: wpa_printf_impl: argv[3]: CCMP
[00:00:01.482,604] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.482,757] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='pairwise'
[00:00:01.482,818] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=4): [REMOVED]
[00:00:01.482,910] <dbg> wpa_supp: wpa_printf_impl: pairwise: 0x10
[00:00:01.483,184] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.483,245] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.483,276] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.483,306] <dbg> wpa_supp: wpa_printf_impl: argv[2]: group_mgmt
[00:00:01.483,367] <dbg> wpa_supp: wpa_printf_impl: argv[3]: AES-128-CMAC
[00:00:01.483,734] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.483,917] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='group_mgmt'
[00:00:01.483,978] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=12): [REMOVED]
[00:00:01.484,069] <dbg> wpa_supp: wpa_printf_impl: group_mgmt: 0x20
[00:00:01.484,375] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.484,405] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.484,466] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.484,497] <dbg> wpa_supp: wpa_printf_impl: argv[2]: proto
[00:00:01.484,527] <dbg> wpa_supp: wpa_printf_impl: argv[3]: RSN
[00:00:01.484,924] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.485,076] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='proto'
[00:00:01.485,137] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=3): [REMOVED]
[00:00:01.485,443] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.485,504] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.485,534] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.485,565] <dbg> wpa_supp: wpa_printf_impl: argv[2]: eap
[00:00:01.485,626] <dbg> wpa_supp: wpa_printf_impl: argv[3]: TLS
[00:00:01.486,022] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.486,145] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='eap'
[00:00:01.486,206] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=3): [REMOVED]
[00:00:01.486,511] <dbg> wpa_supp: wpa_printf_impl: eap methods - hexdump(len=16): 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00
[00:00:01.486,846] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.486,877] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.486,938] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.486,968] <dbg> wpa_supp: wpa_printf_impl: argv[2]: identity
[00:00:01.486,999] <dbg> wpa_supp: wpa_printf_impl: argv[3]: "cc2-004a"
[00:00:01.487,396] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.487,548] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='identity'
[00:00:01.487,609] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=10): [REMOVED]
[00:00:01.487,701] <dbg> wpa_supp: wpa_printf_impl: identity - hexdump_ascii(len=8):
[00:00:01.487,731] <dbg> wpa_supp: _wpa_hexdump_ascii:
63 63 32 2d 30 30 34 61 |cc2-004a
[00:00:01.488,037] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.488,067] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.488,128] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.488,159] <dbg> wpa_supp: wpa_printf_impl: argv[2]: password
[00:00:01.488,220] <dbg> wpa_supp: wpa_printf_impl: argv[3]: "infrafon-2022"
[00:00:01.488,616] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.488,739] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='password'
[00:00:01.488,800] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=15): [REMOVED]
[00:00:01.488,922] <dbg> wpa_supp: wpa_printf_impl: password - hexdump_ascii(len=13): [REMOVED]
[00:00:01.489,227] <dbg> wpa_supp: wpa_printf_impl: Calling wpa_cli: set_network, argc: 4
[00:00:01.489,257] <dbg> wpa_supp: wpa_printf_impl: argv[0]: set_network
[00:00:01.489,318] <dbg> wpa_supp: wpa_printf_impl: argv[1]: 0
[00:00:01.489,349] <dbg> wpa_supp: wpa_printf_impl: argv[2]: anonymous_identity
[00:00:01.489,410] <dbg> wpa_supp: wpa_printf_impl: argv[3]: "(null)"
[00:00:01.489,776] <dbg> wpa_supp: wpa_printf_impl: wlan0: Control interface command 'SET_NETWORK [REMOVED]'
[00:00:01.489,929] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: SET_NETWORK id=0 name='anonymous_identity'
[00:00:01.489,990] <dbg> wpa_supp: wpa_printf_impl: CTRL_IFACE: value - hexdump_ascii(len=8): [REMOVED]
[00:00:01.490,081] <dbg> wpa_supp: wpa_printf_impl: anonymous_identity - hexdump_ascii(len=6):
[00:00:01.490,112] <dbg> wpa_supp: _wpa_hexdump_ascii:
28 6e 75 6c 6c 29 |(null)
[00:00:01.490,356] <inf> sta: Connection requested
[00:00:01.490,417] <inf> sta: ==================
[00:00:01.490,447] <inf> sta: State: DISCONNECTED
[00:00:01.568,054] <dbg> wpa_supp: wpa_printf_impl: EAPOL: disable timer tick
[00:00:01.790,557] <inf> sta: ==================
What else should my code do to get this to work?
Thanks!
  • 0 in reply to Marte Myrvold

    The project is exactly the code in NCS3.0.0 in nrf/samples/wifi/shell, which I copied to my directory wifi_shell_30.

    I updated the prj.conf to add I2C support when building for my board (one of the nrf70 control IOs is on a ioexpander).

    #
# Copyright (c) 2022 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
#BW add I2C driver to allow ioexpander to work
CONFIG_I2C=y

CONFIG_WIFI=y
CONFIG_WIFI_NRF70=y

# WPA supplicant
CONFIG_WIFI_NM_WPA_SUPPLICANT=y
CONFIG_NET_L2_WIFI_SHELL=y

# Networking
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_LOG=y
CONFIG_NET_IPV6=y
CONFIG_NET_IPV4=y
CONFIG_NET_UDP=y
CONFIG_NET_TCP=y
CONFIG_NET_DHCPV4=y
CONFIG_DNS_RESOLVER=y

CONFIG_NET_STATISTICS=y
CONFIG_NET_STATISTICS_WIFI=y
CONFIG_NET_STATISTICS_USER_API=y

CONFIG_NET_PKT_RX_COUNT=8
CONFIG_NET_PKT_TX_COUNT=8

# Below section is the primary contributor to SRAM and is currently
# tuned for performance, but this will be revisited in the future.
CONFIG_NET_BUF_RX_COUNT=16
CONFIG_NET_BUF_TX_COUNT=16
CONFIG_NRF70_RX_NUM_BUFS=16
CONFIG_NRF70_MAX_TX_AGGREGATION=4
CONFIG_NET_TC_TX_COUNT=1

CONFIG_NET_IF_UNICAST_IPV6_ADDR_COUNT=4
CONFIG_NET_IF_MCAST_IPV6_ADDR_COUNT=5
CONFIG_NET_MAX_CONTEXTS=5
CONFIG_NET_CONTEXT_SYNC_RECV=y

CONFIG_INIT_STACKS=y

CONFIG_NET_L2_ETHERNET=y
CONFIG_NET_SHELL=y

# Memories
CONFIG_MAIN_STACK_SIZE=5200
CONFIG_SHELL_STACK_SIZE=5400

CONFIG_NET_TX_STACK_SIZE=4096
CONFIG_NET_RX_STACK_SIZE=4096

# Debugging
CONFIG_STACK_SENTINEL=y
CONFIG_DEBUG_COREDUMP=y
CONFIG_DEBUG_COREDUMP_BACKEND_LOGGING=y
CONFIG_DEBUG_COREDUMP_MEMORY_DUMP_MIN=y
CONFIG_SHELL_CMDS_RESIZE=n
#CONFIG_DEBUG=y
CONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_INF=y

# Kernel options
CONFIG_ENTROPY_GENERATOR=y
CONFIG_REBOOT=y

# Logging
CONFIG_LOG=y
CONFIG_PRINTK=y
CONFIG_SHELL=y
CONFIG_SHELL_GETOPT=y
CONFIG_DEVICE_SHELL=y
CONFIG_POSIX_CLOCK=y
CONFIG_DATE_SHELL=y
CONFIG_NET_CONFIG_AUTO_INIT=n
CONFIG_POSIX_API=y

CONFIG_WIFI_CREDENTIALS=y
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_NVS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_NVS=y

# printing of scan results puts pressure on queues in new locking
# design in net_mgmt. So, use a higher timeout for a crowded
# environment.
CONFIG_NET_MGMT_EVENT_QUEUE_TIMEOUT=5000
CONFIG_NET_SOCKETS_POLL_MAX=12
CONFIG_NET_MGMT_EVENT_QUEUE_SIZE=16

    Updated the zephyr tree with my certifs:

    BrianW said:
    ca.pem, client.pem, client_key.pem into zephyr/samples/net/wifi/test_cert

    and built as 

    west build --build-dir wifi_shell_30/build wifi_shell_30 -S wifi-enterprise --board <board reference> --pristine   -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y

  • 0 in reply to BrianW

    Hi,

    I should have clarified. I meant the app code, so I can compare it with the shell sample to see why it tries to connect while your application does not.

    Best regards,
    Marte

  • 0 in reply to Marte Myrvold

    Ah ok.

    Full application code is a bit large (I will try again with the wifi 'sta' sample next week), but heres the connect function:

    // Here we support only EAP-TLS
static bool _connect_wpa2_eap(struct _netwifi_ctx* ctx, char* ssid, char* client_private_key_pass, char* client_identity, char* eap_pass) {
	if (_isConnected(ctx)) {
		// already connected
		log_warn("netwifi: Connection request WPA2-EAP to AP[%s] but already connected!", ssid);
		return true;
	}
	// MUST provide client private key, identity and eap_pass or no go
	if (client_private_key_pass==NULL || client_identity==NULL || eap_pass==NULL) {
		log_warn("netwifi: Connection request WPA2-EAP to AP[%s] but missing private key or identity or eap password!", ssid);
		return false;
	}
	int ret = 0;
	ctx->connect_requested = true;
	ctx->ip_ok=false;		// No IP yet

	memset(&(ctx->cnx_params), 0, sizeof(struct wifi_connect_req_params));
	ctx->cnx_params.security = WIFI_SECURITY_TYPE_EAP_TLS;	// ==WIFI_SECURITY_TYPE_EAP ie WPA2-Enterprise with EAP_TLS authentication

	// Note : this timeout does not seem to have any effect, the connect timeout in the WPA is always 10s (but we have a connect timer to shorten it if required)
	// But don't set it less than the 10s as the wpa_supp doesn't like being disconnected while its still trying...
	ctx->cnx_params.timeout = wvmgr_get_item_as_int("devcfg.wifi.connect_timeout_seconds", 30)* 1000;		//SYS_FOREVER_MS;

	/* Defaults */
	ctx->cnx_params.band = WIFI_FREQ_BAND_2_4_GHZ;		// WIFI_FREQ_BAND_UNKNOWN;
	ctx->cnx_params.channel = WIFI_CHANNEL_ANY;
	ctx->cnx_params.mfp = WIFI_MFP_OPTIONAL;

	/* SSID */
	ctx->cnx_params.ssid = ssid;
	ctx->cnx_params.ssid_length = strlen(ctx->cnx_params.ssid);

	/** Private key passwd for enterprise mode */
	ctx->cnx_params.key_passwd = client_private_key_pass;
	/** Private key passwd length, max 128 */
	ctx->cnx_params.key_passwd_length = strlen(ctx->cnx_params.key_passwd);
	// client identity is default device id
	ctx->cnx_params.eap_identity = client_identity;	// "[email protected]",
	/** eap identity length, max 64 */
	ctx->cnx_params.eap_id_length = strlen(ctx->cnx_params.eap_identity);
	/** Password string for EAP. */
	ctx->cnx_params.eap_password = eap_pass;		// "password",
	/** eap passwd length, max 128 */
	ctx->cnx_params.eap_passwd_length = strlen(ctx->cnx_params.eap_password);
	ctx->eap_conf.type = WIFI_EAP_TYPE_TLS;
	ctx->eap_conf.eap_type_phase1 = WIFI_EAP_TYPE_TLS;
	ctx->eap_conf.eap_type_phase2 = WIFI_EAP_TYPE_TLS; // No inner method needed for TLS

	if ((ret=net_mgmt(NET_REQUEST_WIFI_CONNECT, ctx->iface,
		     &ctx->cnx_params, sizeof(struct wifi_connect_req_params)))!=0) {
		log_warn("netwifi: Connection request WPA2-EAP failed (%d) to AP[%s] for [%s]; reset wifi", ret, ctx->cnx_params.ssid, ctx->cnx_params.eap_identity);
		ctx->connect_requested = false;
		_wifi_reset(ctx);
		return false;
	}
	netmgr_net_event(ctx->name, NET_EVT_CONNECT_START);

	log_cpdbg("netwifi: Connection requested WPA2-EAP to AP[%s] for [%s]", ctx->cnx_params.ssid, ctx->cnx_params.eap_identity);
	// Start the connection timer. This only stops when we get a DHCP IP address...
	wsched_timer_start(ctx->connect_timer, wvmgr_get_item_as_int("devcfg.wifi.connect_timeout_seconds", 5)*1000, 1000, _connect_timeout_cb, ctx);
	return true;
}

    It sets up the certificates like this:

    static uint8_t* _load_pem(char* name, uint32_t* buf_szp) {
	char* file_id = Util_sprintf("certs/wifi/%s", name);
	int fsize = usb_fs_get_file_size(file_id);
	if (fsize>0) {
		uint8_t* buf = Util_amalloc(fsize+4);
		if (buf!=NULL) {
			file_handle_t fh = usb_fs_open_file(file_id, true);
			if (fh!=NULL) {
				uint32_t blen = usb_fs_read_file(fh, buf, fsize);
				usb_fs_close_file(fh);
				if (blen==fsize) {
					*buf_szp = fsize;
					return buf;
				}
			}
			Util_afree(buf);
		}
	}
	return NULL;
}

// Need to have all 3 elements or no go
static bool _setup_ent_creds(struct _netwifi_ctx* ctx, char* ca_cert_name, char* client_cert_name, char* client_key_name) {
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
	if (ca_cert_name==NULL || client_cert_name==NULL || client_key_name==NULL) {
		log_warn("netwifi: Wi-Fi enterprise but missing certs config!");
		return false;
	}
	// Free old ones
	if (ctx->enterprise_creds_params.ca_cert!=NULL) {
		Util_afree(ctx->enterprise_creds_params.ca_cert);
	}
	if (ctx->enterprise_creds_params.client_cert!=NULL) {
		Util_afree(ctx->enterprise_creds_params.client_cert);
	}
	if (ctx->enterprise_creds_params.client_key!=NULL) {
		Util_afree(ctx->enterprise_creds_params.client_key);
	}
	// Ensure all null and 0 len
	memset(&ctx->enterprise_creds_params, 0, sizeof(struct wifi_enterprise_creds_params));
	// Load creds from /certs/wifi/<filename in config>
	if ((ctx->enterprise_creds_params.ca_cert = _load_pem(ca_cert_name, &ctx->enterprise_creds_params.ca_cert_len))==NULL) {
		log_warn("netwifi: no CA cert found @[%s]", ca_cert_name);
		return false;
	}
	if ((ctx->enterprise_creds_params.client_cert = _load_pem(client_cert_name, &ctx->enterprise_creds_params.client_cert_len))==NULL) {
		log_warn("netwifi: no client cert found @[%s]", client_cert_name);
		return false;
	}
	if ((ctx->enterprise_creds_params.client_key = _load_pem(client_key_name, &ctx->enterprise_creds_params.client_key_len))==NULL) {
		log_warn("netwifi: no client key found @[%s]", client_key_name);
		return false;
	}
	int retreq = net_mgmt(NET_REQUEST_WIFI_ENTERPRISE_CREDS, ctx->iface, &ctx->enterprise_creds_params, sizeof(struct wifi_enterprise_creds_params));
	if (retreq!=0) {
		log_warn("netwifi: Failed to set Wi-Fi enterprise credentials: %d", retreq);
		return false;
	}
	log_cpdbg("netwifi: set Wi-Fi enterprise credentials: %d", retreq);
	return true;
#else 
	log_warn("netwifi: Wi-Fi enterprise but not built with code!");
	return false;
#endif
}

    The certificates seem to be maybe the issue for the shell (0x3d00 error)

    the root CA (ca.pem)

    -----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIUSPHDcjKwnzJwpPNKqqJ9CZ6z8y0wDQYJKoZIhvcNAQEL
BQAwSzELMAkGA1UEBhMCRlIxEjAQBgNVBAgMCUZpbmlzdGVyZTERMA8GA1UECgwI
SW5mcmFmb24xFTATBgNVBAMMDGluZnJhZm9uLmNvbTAeFw0yNTA2MDMwODU5MzRa
Fw0yNTA3MDMwODU5MzRaMEsxCzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlGaW5pc3Rl
cmUxETAPBgNVBAoMCEluZnJhZm9uMRUwEwYDVQQDDAxpbmZyYWZvbi5jb20wggEi
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDIsfqHWTOvEbipYL/ReZGcuYZ/
QTtzdqZvOUE10121QDM9yCIEN1xzcq16Dlfs+HmrXSFmHSZhMK2xrnd59DzuyDq5
snQg2BPfEJUqxDJg+ON055j57GXp8dUKZrCY9VSZa17jtJHYThYZpUoxqDjFlWvO
Shqcw/9rkf3z+/6nCF1uNV7vwife4mo1okY4SNUuxPBiEhZBZOg6d5Ydb0fxsxYj
qMN+vu3ELHPnHzzcEMzY/iA5qahPigACbm4NwXRrfdvTFfcqgJ43WWZr9FLlj3TO
5BX1HHYRerI+MhPIK/PJmQbbJy4VC91Z414XJElXAya5myMmwd8qDFc9NQqRAgMB
AAGjUzBRMB0GA1UdDgQWBBSNNMZnwGIr73sGUr5ZcccVGkD3LTAfBgNVHSMEGDAW
gBSNNMZnwGIr73sGUr5ZcccVGkD3LTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
DQEBCwUAA4IBAQBOyrJ2iQpkycm0gsL+Z/Ueu3BA1sUGUC3cbIeluuPybzmsjTrA
dqnaymJJbcRz+Ge39VpZpeVrQO5IwVLAWrzg2Vyyyv5uOdf2VjakfUlneAF0U+zK
nZaaaLdwjj93wV14U+8JGF1Lb6Q41+fjQ5eIF/1OtV4gI8G9qQ46TwTsR+DSkKol
Z/5AOWkg4TarfKzghS7O6llwV+mfwXKQtsQbGQVhscXKRsAVPE/OaqkYCSXgLRTf
5pcYCeRky/fhUJV6BKy4VLac40u5luKOGSjNV4Ycnqr0o4vIexuPCKw21cCpGqnk
11Y85cQqpF2DzU7gFW/ovVGl2ygcjjjeVg3V
-----END CERTIFICATE-----

    The client key (client_key.pem)

    -----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,5BD79331E8C31EE0

dBjnzKTP9Ww1RSJYxgExTmMvPKb2iWPjNw6tYbzXS+LrvecHZ7rhb9zUq3Giouwq
PJ0Hv2XC8gzWqHvcaXHNytOYlvPzVMJqeoK3HRgTJi5v4ywBj73/Q9uKXPOQ1sFY
N81ZJjIBDuGk0xMtlP4UJ6qGXrgEUzo/HgXN0mtdqDt8OFiVq9J1PztiYBCn0vpj
VYBnwPCkBF/nngxMPKjsbWhFRXnANkwWluRI+R2fH+JjrYEars2LVThidWjCx3ej
9Y9Ih9yE217/+ONWBDCgjs8Dh+rgMnvMsA13siwLfyXRfZvoC0Lymt17dvsDiaAc
FTDB9gNtUh7ZnNoQ/7outlgcn9cRTAHVjq2dG5qO5KBwFCmU5RYBGK1uu43lpuL/
08pGvCwJ7u4UCoLjk7Q68kAcBqCmqPX3Y9Qk4zgVMeXOeiA969t4VbNaUNq2ri2q
fxH0Lbl34b3FGt/F9j9bCYdYak0V0846bC8jCOT5dMwz05bBvG1+5Erw2NCk9k2L
B9ovTQeLdchFoJNrl9nPkh0ipxvtlyzyJLvKjJ0RGJJytkAbI173+OM7cQgsq1uz
iOrY/f/cKEzyltpISZfARPmpzh/HflIGiiqpsv//0ITIl2X40RyNBXU7iTVKoMob
4yuNDVQCoOXjyosJ6rir9Ou39BWY0qiY5njyXHrannMmjCeN9xcIztEN1TF1m6+Z
znqhkc8e+fQlPIVNM15wH+WEw5egZSUWMDU3g8AsxiLxiRe/zdTnpXe+0hbAH4s+
7iYes1/yD2p0rOTAh3Sg0htBXnUUK6M/OXTtcantG1SmwvENSV13rPXsTTnPhgIl
GdGg/jGjW23iU6ztEkKEO/2v5+5wFNmFFrDAY5Pl3jElnoFwEnnA/n8ndCfboB+r
wQJYrrU8WP1BsaEFrdU/yZuHqfO9Z3fFG/BqPUTe9MGksJF921ID3fDTdeo8RGY3
leuDjiXRISgEc8a7BE0NYnkNnMMkKNkfa0zbgRJMg9NfJjNh+MsvesDUexwEgUOK
2eRvVuXcyhFZ+SyN3ijY7EmGAGgCMI9FEQ+HbOZa+nQeUw1Rks8vZPYHPdHPYfac
Hn+DyGZ4tpeMFEIzdjennEwEQj7uW7kB5eZvWp7kTpXbxZMI785ZGnS2Pfe1V9v5
y6+PGvuBvkSdIKwtQDXyAd8WdnjVmBpfb/kFbpWqC8PytPr1bsMd6YPyaNo6pP/8
fLmZ103gO5PFYathFRCV2/W/xsjunvLC1jt+og6iSzxzboFDhpO6Y2M6RsTjhk4c
ybKfNt0UbLH5LW1+XYdqdLGSecefe6NBq/OWxkhXs9Om79Sv1+1qPoajVe+oIB2B
MxcR78V8eE3OoymAT7mWAqiGokukFtMEaHbtkZtjBOEkLvVdiSG6y4uS2c6yE/e0
chLwuCNgIa+uoHVh5Osc70RlRbhfkxzR3rkZxDeniIxCokO6iIi12l357mja2TM0
uE8D2QMc16nvg9IsFy7bMc5Ehf6TSEmAfDhHTGDmpEEK/lEqIUSH0QeGVXh8w6ge
Viy3qzpFg9ddjGIXl2TJt8nrWMqdMFvZMrHGKXRKujXLsctEB5FbeQ==
-----END RSA PRIVATE KEY-----

    and the client signed certificate (client.pem)

    -----BEGIN CERTIFICATE-----
MIIDKDCCAhACFA36ysYJv6exm5n1jADbn3MLNCyrMA0GCSqGSIb3DQEBCwUAMEsx
CzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlGaW5pc3RlcmUxETAPBgNVBAoMCEluZnJh
Zm9uMRUwEwYDVQQDDAxpbmZyYWZvbi5jb20wHhcNMjUwNjAzMDkxMDA5WhcNMjUw
NzAzMDkxMDA5WjBWMQswCQYDVQQGEwJGUjESMBAGA1UECAwJRmluaXN0ZXJlMREw
DwYDVQQKDAhJbmZyYWZvbjENMAsGA1UECwwEVGVzdDERMA8GA1UEAwwIY2MyLTAw
NGEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7bN5Jy8kx7z3LU/qH
IO1+QR/hjtx3sHQKp4ni6m+Mqv/PElxWEaxx8D3NThMmftGvDEbkDaV1G10KZODL
maY0ExsUnaTewgk+nBs0rMfsJnbhxMBiaFstHYKPsqAF4JtvdKfTN05BkHDDHULI
5N5DXP2Orty2Lh5866JfNywmDbcamDrbp1TcpJL7atc7ukrkPwZZU0tA9YAnkeYj
sd9R/TUNA7UEo7wb4a+r+xiv+ECrzK5KJz+icYgQPbF52PFVrJX8rG/PrSqZGsr9
XhWoZF7MzlmYRmqZijbB0khVHFn0x5lsXYyQL+5AXeoF/SbPFC65/qLdWTZSXWrr
5RFdAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAIai4nNCWtX+94jeX00a36qUffPW
+neYi3aVZU9xestlvLhjhSf9bU5MO7w8JnRQaIzd2jh3NV+Ab4Yizrn7Zmr3bARY
VPs1Uswf2HHoS5YIJqF/us6Px1wljNWi7hspyPpwFKPIWMXvMfAO4ZT+5mQ7ksYR
aS3MuervINOwa166Sb64JgwQ9bWabKX14Wj03/VrVIkxzVzQjVsFFEH9abepao7w
WQhxl3Sl+dFHH0IuGMC2cABhW69EynsF7LxvKZwFhgksVblHubOg6Ekq2KI79Mj8
Su1KG4PXt8UX0scIn2Z8amxIHj+t2jz5+IYw0MDPHYtBMm9MPZkOBqmG1bk=
-----END CERTIFICATE-----

    I don't see any issue with these but maybe something isn't dealt with by the mbedtls parser?

    thanks!

Related
Terms of service