IEEE 802.11w support in wpa_supplicant ("Management frame protection required, but client did not enable it" error)

[Jouni Malinen]

On Sat, May 05, 2012 at 02:29:56PM +0100, Michael Zintakis wrote:
> I have enabled IEEE 802.11w (management frame protection mode) in my AP 
> - running hostapd - with "ieee80211w=2" (required/mandatory), but when I 
> try to connect using wpa_supplicant I get the following error message: 
> "Management frame protection required, but client did not enable it".

Which driver are you using on the station?

> I searched the man pages as well as any documentation of the supplicant 
> I could find and the only mention of this is that in order to activate 
> it I have to compile the supplicant with "CONFIG_IEEE80211W=y". I did 
> that (I also used "CONFIG_EAP_GPSK_SHA256=y" as well) and restarted the 
> supplicant, but I still get this error.

CONFIG_EAP_GPSK_SHA256=y has nothing to do with IEEE 802.11w, but you do
indeed need to enable CONFIG_IEEE80211W=y build option for this. I added
some more documentation here:
http://w1.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff;h=4732ee3a87a1375fa528f9626c57e3ab41f5f110

> I tried to specify "ieee80211w=2" in the supplicant configuration file 
> as well (a wild guess, I know) and the strange thing is that before I 
> recompiled my supplicant with "CONFIG_IEEE80211W=y" (this option wasn't 
> active before) it used to complain that the option I used - ieee80211w - 
> is "not recognised".

You will need to use either ieee80211w=1 or ieee80211w=2 in the network
block.

> After recompilation when "CONFIG_IEEE80211W=y" was included in my 
> .config file, the supplicant isn't complaining any more, but IEEE 
> 802.11w doesn't seem to be activated/working either (besides, I am not 
> even sure specifying "ieee80211w=2" in my wpa_supplicant.conf is the 
> right thing to do as this "option" is not documented anywhere) - I get 
> exactly the same message on the AP side - "Management frame protection 
> required, but client did not enable it", while on the supplicant side I 
> get a timed-out message.

Please send a debug log from wpa_supplicant showing the failed
connection.

> Is IEEE 802.11w supported in the supplicant and how do I activate it/use 
> it?

Yes, it is supported. Though, this will also require support in the
driver. Example configuration for wpa_supplicant:

network={
    ssid="test"
    key_mgmt=WPA-PSK WPA-PSK-SHA256
    psk="12345678"
    pairwise=CCMP
    group=CCMP
    proto=WPA2
    ieee80211w=1
}

-- 
Jouni Malinen                                            PGP id EFC895FA