nrf70 wifi WPA2-PSK association request has Cisco specific IEs : how to customise these?

[BrianW]

Using NCS 2.9.0, on a custom nrf5340/nrf7002 board.

When connecting using WPA2-PSK to a Cisco AP, it seems the wpa supplicant adds some Cisco specific IEs to the association request:

IEEE 802.11 Wireless Management
    Fixed parameters (4 bytes)
        Capabilities Information: 0x3114
        Listen Interval: 0x0a00
    Tagged parameters (235 bytes)
        Tag: SSID parameter set: "kiosk"
            Tag Number: SSID parameter set (0)
            Tag length: 18
            SSID: "XXXXXXXXXXX_2.4Ghtz"
        Tag: Supported Rates 9, 12, 18, 24, 36, 48, 54, [Mbit/sec]
            Tag Number: Supported Rates (1)
            Tag length: 7
            Supported Rates: 9 (0x12)
            Supported Rates: 12 (0x18)
            Supported Rates: 18 (0x24)
            Supported Rates: 24 (0x30)
            Supported Rates: 36 (0x48)
            Supported Rates: 48 (0x60)
            Supported Rates: 54 (0x6c)
        Tag: Power Capability Min: 0, Max: 31
            Tag Number: Power Capability (33)
            Tag length: 2
            Minimum Transmit Power: 0 dBm
            Maximum Transmit Power: 31 dBm
        Tag: BSS Max Idle Period
            Tag Number: BSS Max Idle Period (90)
            Tag length: 3
            Max Idle Period (1000 TUs): 292
            Idle Options: 0x00
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Operating Mode Notification
            Tag Number: Operating Mode Notification (199)
            Tag length: 1
            Operating Mode Notification: 0x00
        Tag: HT Capabilities
            Tag Number: HT Capabilities (45)
            Tag length: 26
            HT Capabilities Info: 0x880c
            A-MPDU Parameters: 0x1e
            Rx Supported Modulation and Coding Scheme Set: MCS Set
            HT Extended Capabilities: 0x0000
            Transmit Beam Forming (TxBF) Capabilities: 0x00000000
            Antenna Selection (ASEL) Capabilities: 0x00
        Ext Tag: HE Capabilities
            Ext Tag length: 21 (Tag len: 22)
            Ext Tag Number: HE Capabilities (35)
            HE MAC Capabilities Information: 0x000000080003
            HE PHY Capabilities Information
            Supported HE-MCS and NSS Set
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Extended Capabilities (11 octets)
            Tag Number: Extended Capabilities (127)
            Tag length: 11
            Extended Capabilities: 0x00 (octet 1)
            Extended Capabilities: 0x00 (octet 2)
            Extended Capabilities: 0x00 (octet 3)
            Extended Capabilities: 0x00 (octet 4)
            Extended Capabilities: 0x00 (octet 5)
            Extended Capabilities: 0x00 (octet 6)
            Extended Capabilities: 0x40 (octet 7)
            Extended Capabilities: 0x0000 (octets 8 & 9)
            Extended Capabilities: 0x00 (octet 10)
            Extended Capabilities: 0x20 (octet 11)
        Tag: RM Enabled Capabilities (5 octets)
            Tag Number: RM Enabled Capabilities (70)
            Tag length: 5
            RM Capabilities: 0x70 (octet 1)
            RM Capabilities: 0x00 (octet 2)
            RM Capabilities: 0x00 (octet 3)
            RM Capabilities: 0x00 (octet 4)
            RM Capabilities: 0x00 (octet 5)
        Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Information Element
            Tag Number: Vendor Specific (221)
            Tag length: 7
            OUI: 00:50:f2 (Microsoft Corp.)
            Vendor Specific OUI Type: 2
            Type: WMM/WME (0x02)
            WME Subtype: Information Element (0)
            WME Version: 1
            WME QoS Info: 0x00
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (240)
            Tag Number: Vendor Specific (221)
            Tag length: 50
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 240
            Aironet IE type: Unknown (240)
            Aironet IE data: 00000000170000007306000002000000560100000100000000000000000000000000000000000000000000000000
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (235)
            Tag Number: Vendor Specific (221)
            Tag length: 5
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 235
            Aironet IE type: Unknown (235)
            Aironet IE data: 05
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (234)
            Tag Number: Vendor Specific (221)
            Tag length: 8
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 234
            Aironet IE type: Unknown (234)
            Aironet IE data: 24000000

These are not present when it connects to a non-Cisco AP (the MS one is however).

Is there a way to customise the contents of this info? I can't even find the Cisco doc to know what the contents are supposed to be, and haven't managed to find the code in the wpa supplicant pulled in by zephyr which fills in this frame....

In particular, the Cisco type 240 apparently has a bad version number (0x00, should be 0x01 or greater), and the type 235 needs to be 0x02 (CCX RM Capability perhaps?), which is causing a problem for the device to be used with certain Cisco features... 

Anyone point me in the right direction? Thanks!

[Samruddhi Jadhav]

Hi Brian,

Is it possible for you to provide the sniffer captures for this?

Best Regards,

Samruddhi

[BrianW]

The PCAP output (via CAPWAP on the cisco AP)

Frame 810: Packet, 321 bytes on wire (2568 bits), 321 bytes captured (2568 bits)
Ethernet II, Src: CiscoMeraki_90:87:a0 (c4:14:a2:90:87:a0), Dst: VMware_8b:2f:18 (00:0c:29:8b:2f:18)
Internet Protocol Version 4, Src: 192.168.40.101, Dst: 192.168.40.7
User Datagram Protocol, Src Port: 5264, Dst Port: 5247
Control And Provisioning of Wireless Access Points - Data
IEEE 802.11 Association Request, Flags: ........
    Type/Subtype: Association Request (0x0000)
    Frame Control Field: 0x0000(Swapped)
    .000 0000 0011 0100 = Duration: 52 microseconds
    Receiver address: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    Destination address: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    Transmitter address: WTConsulting_1:00:97 (38:b8:eb:e1:00:97)
    Source address: WTConsulting_1:00:97 (38:b8:eb:e1:00:97)
    BSS Id: Cisco_10:cf:44 (70:bc:48:10:cf:44)
    .... .... .... 0000 = Fragment number: 0
    0000 0101 0010 .... = Sequence number: 82
    [WLAN Flags: ........]
IEEE 802.11 Wireless Management
    Fixed parameters (4 bytes)
    Tagged parameters (235 bytes)
        Tag: SSID parameter set: "XXXXXXXXX_2.4Ghtz"
            Tag Number: SSID parameter set (0)
            Tag length: 18
            SSID: "XXXXXXXXX_2.4Ghtz"
        Tag: Supported Rates 9, 12, 18, 24, 36, 48, 54, [Mbit/sec]
            Tag Number: Supported Rates (1)
            Tag length: 7
            Supported Rates: 9 (0x12)
            Supported Rates: 12 (0x18)
            Supported Rates: 18 (0x24)
            Supported Rates: 24 (0x30)
            Supported Rates: 36 (0x48)
            Supported Rates: 48 (0x60)
            Supported Rates: 54 (0x6c)
        Tag: Power Capability Min: 0, Max: 31
            Tag Number: Power Capability (33)
            Tag length: 2
            Minimum Transmit Power: 0 dBm
            Maximum Transmit Power: 31 dBm
        Tag: BSS Max Idle Period
            Tag Number: BSS Max Idle Period (90)
            Tag length: 3
            Max Idle Period (1000 TUs): 292
            Idle Options: 0x00
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Operating Mode Notification
            Tag Number: Operating Mode Notification (199)
            Tag length: 1
            Operating Mode Notification: 0x00
        Tag: HT Capabilities
            Tag Number: HT Capabilities (45)
            Tag length: 26
            HT Capabilities Info: 0x880c
            A-MPDU Parameters: 0x1e
            Rx Supported Modulation and Coding Scheme Set: MCS Set
            HT Extended Capabilities: 0x0000
            Transmit Beam Forming (TxBF) Capabilities: 0x00000000
            Antenna Selection (ASEL) Capabilities: 0x00
        Ext Tag: HE Capabilities
            Ext Tag length: 21 (Tag len: 22)
            Ext Tag Number: HE Capabilities (35)
            HE MAC Capabilities Information: 0x000000080003
            HE PHY Capabilities Information
            Supported HE-MCS and NSS Set
        Tag: RSN Information
            Tag Number: RSN Information (48)
            Tag length: 20
            RSN Version: 1
            Group Cipher Suite: 00:0f:ac (Ieee 802.11) AES (CCM)
            Pairwise Cipher Suite Count: 1
            Pairwise Cipher Suite List 00:0f:ac (Ieee 802.11) AES (CCM)
            Auth Key Management (AKM) Suite Count: 1
            Auth Key Management (AKM) List 00:0f:ac (Ieee 802.11) PSK
            RSN Capabilities: 0x0080
        Tag: Extended Capabilities (11 octets)
            Tag Number: Extended Capabilities (127)
            Tag length: 11
            Extended Capabilities: 0x00 (octet 1)
            Extended Capabilities: 0x00 (octet 2)
            Extended Capabilities: 0x00 (octet 3)
            Extended Capabilities: 0x00 (octet 4)
            Extended Capabilities: 0x00 (octet 5)
            Extended Capabilities: 0x00 (octet 6)
            Extended Capabilities: 0x40 (octet 7)
            Extended Capabilities: 0x0000 (octets 8 & 9)
            Extended Capabilities: 0x00 (octet 10)
            Extended Capabilities: 0x20 (octet 11)
        Tag: RM Enabled Capabilities (5 octets)
            Tag Number: RM Enabled Capabilities (70)
            Tag length: 5
            RM Capabilities: 0x70 (octet 1)
            RM Capabilities: 0x00 (octet 2)
            RM Capabilities: 0x00 (octet 3)
            RM Capabilities: 0x00 (octet 4)
            RM Capabilities: 0x00 (octet 5)
        Tag: Vendor Specific: Microsoft Corp.: WMM/WME: Information Element
            Tag Number: Vendor Specific (221)
            Tag length: 7
            OUI: 00:50:f2 (Microsoft Corp.)
            Vendor Specific OUI Type: 2
            Type: WMM/WME (0x02)
            WME Subtype: Information Element (0)
            WME Version: 1
            WME QoS Info: 0x00
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (240)
            Tag Number: Vendor Specific (221)
            Tag length: 50
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 240
            Aironet IE type: Unknown (240)
            Aironet IE data: 00000000170000007306000002000000560100000100000000000000000000000000000000000000000000000000
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (235)
            Tag Number: Vendor Specific (221)
            Tag length: 5
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 235
            Aironet IE type: Unknown (235)
            Aironet IE data: 05
        Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (234)
            Tag Number: Vendor Specific (221)
            Tag length: 8
            OUI: 00:40:96 (Cisco Systems, Inc)
            Vendor Specific OUI Type: 234
            Aironet IE type: Unknown (234)
            Aironet IE data: 24000000

at the end of the association payload, you have:

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (240)
Tag Number: Vendor Specific (221)
Tag length: 50
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 240
Aironet IE type: Unknown (240)
Aironet IE data: 00000000170000007306000002000000560100000100000000000000000000000000000000000000000000000000

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (235)
Tag Number: Vendor Specific (221)
Tag length: 5
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 235
Aironet IE type: Unknown (235)
Aironet IE data: 05

Tag: Vendor Specific: Cisco Systems, Inc: Aironet Unknown (234)
Tag Number: Vendor Specific (221)
Tag length: 8
OUI: 00:40:96 (Cisco Systems, Inc)
Vendor Specific OUI Type: 234
Aironet IE type: Unknown (234)
Aironet IE data: 24000000

The device is mine, but I don't know how the cisco IEs get added in the wpa_supplicant code.... so that I can fix the version number in Aironet IE type 240 and the 'tag type' which is Aironet IE 235 (apparently)

[Samruddhi Jadhav]

Hi,

A quick update from the team. These Cisco IEs don't seem to be added by wpa_supplicant or UMAC. 

With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided. 

With non-Cisco AP: There is no CAPWAP/Controller here, so how is the association request being confirmed? Again, the OTA sniffer capture would be needed to check.

Best Regards,

Samruddhi

[BrianW]

Hi

Samruddhi Jadhav said:

With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided. 

I will try to get these to confirm if this is the case. Good to know however I didn't just miss code that adds them...

Samruddhi Jadhav said:

With non-Cisco AP: There is no CAPWAP/Controller here, so how is the association request being confirmed?

It is confirmed (by a Orange box in the office case), but indeed there are no Cisco IE in the association request. No problem in this case...

[Samruddhi Jadhav]

Hi Brian,

Let me know when you get the OTA capture.

Best Regards,

Samruddhi

[BrianW]

BrianW said:

Samruddhi Jadhav said:

With Cisco AP: As the pcap is between AP and controller, we think that the AP itself might be adding these for the consumption of the controller. In order to confirm this, it would be great if an over the air sniffer (OTA) capture between DUT and AP can be provided. 

I will try to get these to confirm if this is the case. Good to know however I didn't just miss code that adds them...

Confirmed that it was the Cisco AP adding these IEs, they are NOT present in the association request OTA!

thanks for the help