WPS connection failure

[Jouni Malinen]

On Fri, Jun 03, 2016 at 05:56:16PM -0400, marc miller wrote:
> I'm currently using wpa_supplicant v2.2 . I'm having a issue connecting to
> a Linksys WRT1200AC router using wpa_supplicant. I'm able to connect to all
> other routers fine but when i try this, the wps_pbc command just times out.
> I ran wpa_supplicant in debug mode and i found this:
> 
> *ra0: 27: c0:56:27:c7:ed:e8 ssid='Linksys00232_5GHz' wpa_ie_len=22
> rsn_ie_len=20 caps=0x11 level=-17 wpsWPS: Invalid Version2 length 0*

Lovely..

> The first one is what i'm trying to connect to. However, i can't understand
> what that error is. What is the invalid version pertaining to ? Please let
> me know how to proceed.
> 
> The router is in mixed wpa/wpa2 mode.

It looks like the AP has quite broken WPS implementation..
wpa_supplicant rejects the WPS information from the AP since it is
invalid (that Version2 attribute is required to have a payload length of
one byte) and consequently, does not allows WPS to be used with it.

Do you know which firmware version is used on the AP? The AP (or at
least a specific snapshot of that model) seems to have Wi-Fi Protected
Setup certification from WFA, so it is a bit surprising to see this type
of an error in the implementation..

Would you be able to to provide a wireless capture log showing the
Beacon and Probe Response frames from that AP? Or at least output of
"sudo iw dev ra0 scan -u" to show scan results?

-- 
Jouni Malinen                                            PGP id EFC895FA