daemon.debug hostapd: wlan0: WPA rekeying GTK

时间:2023-01-11 15:44:43

现象描述:client连接上AP后,切换接口(譬如lan口的)模式,静态地址和dhcp模式切换后,一段时间后断开连接,再也连接不上,ap侧日志如下:

Wed Nov  8 14:39:31 2017 daemon.debug hostapd: wlan0: WPA rekeying GTK
Wed Nov  8 14:39:31 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: sending 1/2 msg of Group Key Handshake
Wed Nov  8 14:39:31 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: EAPOL-Key timeout
Wed Nov  8 14:39:31 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: sending 1/2 msg of Group Key Handshake
Wed Nov  8 14:39:32 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: EAPOL-Key timeout
Wed Nov  8 14:39:32 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: sending 1/2 msg of Group Key Handshake
Wed Nov  8 14:39:33 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: EAPOL-Key timeout
Wed Nov  8 14:39:33 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: sending 1/2 msg of Group Key Handshake
Wed Nov  8 14:39:34 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: EAPOL-Key timeout
Wed Nov  8 14:39:34 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: WPA_PTK: sm->Disconnect
Wed Nov  8 14:39:34 2017 daemon.debug hostapd: wpa_sta_disconnect 227
Wed Nov  8 14:39:34 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 WPA: event 3 notification
Wed Nov  8 14:39:35 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 IEEE 802.1X: unauthorizing port
Wed Nov  8 14:39:35 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 MLME: MLME-DEAUTHENTICATE.indication(18:99:11:11:11:06, 2)
Wed Nov  8 14:39:35 2017 daemon.debug hostapd: wlan0: STA 18:99:11:11:11:06 MLME: MLME-DELETEKEYS.request(18:99:11:11:11:06)

google下 "wpa rekeying GTK" 发现了好多这个问题,但是始终没有得到解决,反而有一个规避的方法,就是配置/etc/config/wireless文件中

option wpa_group_rekey  '0'

即可。

问题的根本所在:

在使用 wpa/wpa2 加密方式时,完成eapol 四次握手后,还需要定期更新组key导致,规避方式就是使得 组key不更新(wpa_group_rekey值置位0)。

还有没有更好的解决方法呢,查看log日志发现,在于AP侧发送了组更新的1/2握手后,client端未能回应。

抓包如下:

daemon.debug hostapd: wlan0: WPA rekeying GTK

跟踪client端(wpa_supplicant)对eapol报文的处理,查看终极未处理的原因。

跟踪过程如下:

wpa_sm_rx_eapol
wpa_supplicant_rx_eapol
wpa_supplicant_rx_eapol_bridge
wpa_supplicant_driver_init
wpa_supplicant_event_interface_status
supplicant_event(EVENT_INTERFACE_STATUS)
wpa_supplicant_event = supplicant_event;
wpa_supplicant_init
l2_packet_init_bridge --> l2_packet_receive --> wpa_supplicant_rx_eapol_bridge

从中可以看出跟接口状态有关,当接口up时,会绑定接收(l2_packet_receive)所使用的socket等相关信息;当接口down掉时,会解除绑定相关信息。

此处使用的hostapd代码中,接口切换到down掉时,未能够即使解除绑定的相关信息,而接口up起来时,又重新创建了新的socket。导致AP侧和client侧无法正常进行通信,进而client无法及时响应AP的组key更新消息。

解决问题:

在接口down掉时,解除绑定的相关信息。