lost connectivity until "wpa_cli reassociate" is issued

[David Mosberger]

On Wed, Jan 6, 2016 at 4:03 AM, Jouni Malinen <j at w1.fi> wrote:
> On Tue, Jan 05, 2016 at 04:43:54PM -0700, David Mosberger wrote:
>> Is it normal that "only" the key for broadcast/multicast would be
>> re-keyed once an hour?  Or is there a separate key for the AP that
>> should be re-keyed?  I'm trying to understand what the difference is
>> between the re-keying that is happening and what "reassociate" does.
>> I'm hoping that will help me narrow down what to look at in the
>> driver.
>
> Yes, this is a normal AP configuration especially when using TKIP as the
> group cipher. The pairwise keys between the AP and each station for
> unicast frame do not really need to be rekeyed in practice when using
> CCMP as the cipher.

OK, thanks for explaining that!

> There have been bugs in drivers where group rekeying mess up something
> in the key configuration either for the group key itself or maybe even
> for the pairwise keys. In other words, this does not really sound
> anything new, but obviously the exact reason in the driver is likely to
> be specific to the driver. In any case, it's probably best to confirm
> with a full sniffer trace what is the exact frame that uses incorrect
> keying material or if no such frame is found, that the issue is only on
> the receiver processing on decryption.

I looked through the changelog for nl80211.c and even though our kernel is
quite old (3.7.0), I couldn't find any newer changesets that seem related (we
do have the changeset to "Fix set_key regression with some drivers", for
example).

Maybe it's not (directly) related to encryption at all.  One thing that's been
interesting that sometimes when connectivity is lost, I can "ping" our gateway
to get *exactly* one ping response and then either nothing, or no response for,
say, 60 seconds or more when suddenly the floodgate opens and most/all
pending ping responses are received.  Just curious that "wpa_cli reassociate"
gets this all unstuck.

Anyhow, I guess it's time to look at the next lower level.

  --david
-- 
eGauge Systems LLC, http://egauge.net/, 1.877-EGAUGE1, fax 720.545.9768