CCMP decrypt failed errors with ipw2200

[Tim Sedlmeyer]

I am using an ipw2200 wireless card in conjunction with Network Manager and wpasupplicant. My wireless network uses WPA-PSK with AES. This combination worked great using Flight 5 and the unofficial Network Manger packages. Since upgrading to flight 6 and now with the beta release the network is unuseable. I can establish connectivity to the AP and get an IP address via DHCP. After a few minutes the network becomes slower and slower until it is useless. Occasionally it will then start to work ok for a few minutes and then slow down again. When it is slow the syslog file fills up with "CCMP decrypt failed" errors.

[Reinhard Tartler (siretart)]

could you perhaps tell what version of wpasupplicant you used before?

Please attach the debug log of wpasupplicant to this bug so that we can take a closer look.

[Luka Renko (lure)]

I have the same card and same connection (WPA-PSK+AES=WPA2-PSK) but do not have any problems. I know that in past ipw2200 driver had problems with hw encryption and it helped to turn it off.
Can you try loading your ipw2200 kernel module with "hwcrypto=0" option? (you can also put it into /etc/modprobe.d/ file to make it permanent).

[Tim Sedlmeyer (tsedlmeyer)]

I'm sorry but I don't remember exactly which version I was utilizing. It was the version previously available from the repository pointed to by https://wiki.ubuntu.com/DapperNetworkManager. I have attached copies of my debug log and daemon log which contain entries pertaining to wpasupplicnat and NEtwork Manager.

[Tim Sedlmeyer (tsedlmeyer)]

A copy of my debug log.

[Tim Sedlmeyer (tsedlmeyer)]

A copy of daemon log

[Tim Sedlmeyer (tsedlmeyer)]

As Luka suggested, I tried adding the hwcrypto=0 option and had the same results so, I actually tried the opposite and added the hwcrypto=1 option. This seems to have remedied the issue.

[Reinhard Tartler (siretart)]

Ok, if adding hwcrypt=1 to driver options, this indicates that this is either a configuration or a driver issue. It seems to me that this is not a problem of the wpasupplicant package, since the debug log of wpasupplicant indicates a successful authentication.

I'm reassinging this bug to the kernel, since it seems that on your machine hwcrypt is off by default but should be on for wpa encryption.

[Florian Reichert (florianr)]

Same Problem here with an ipw 2100 and ubuntu 6.10

[17182066.788000] CCMP: replay detected: STA=00:15:0c:6c:1b:8a previous PN 000000001e05 received PN 000000001e04
[17182066.788000] CCMP: replay detected: STA=00:15:0c:6c:1b:8a previous PN 000000001e05 received PN 000000001e05
[17182122.532000] CCMP: replay detected: STA=00:15:0c:6c:1b:8a previous PN 000000002929 received PN 000000002928
[17182339.880000] CCMP: replay detected: STA=00:15:0c:6c:1b:8a previous PN 00000000039b received PN 00000000039a
[17182445.192000] CCMP: decrypt failed: STA=00:15:0c:6c:1b:8a
[...]
[17182495.696000] CCMP: replay detected: STA=00:15:0c:6c:1b:8a previous PN 0000000007fb received PN 0000000007fa

and so on ...

[Caspar Clemens Mierau (leitmedium)]

This is still active on Feisty. As you don't have to configure wpa_supplicant there is actually no way to play around with configuration snippets. I read on the web that this bug might slow down network performance, so this is not just a cosmetic issue.

[Paul (pcatalani)]

I am having the same issue here on Feisty. When using DHCP needed to use dhclient to reconnect after a drop from wireless router (DLink). As a workaround, I am using a static IP, but problem still occurs.

I have tested the break in connection by pinging the router and cable modem (two concurrent sessions). I have seen the round trip delay exceed 10 seconds during the hiccup.

[Adna rim (adnarim)]

Same errors here on gutsy with ipw3945 and 2.6.22-14-generic. But I'm not using NM but wicd. Here my kern.log:
Nov 9 12:56:16 localhost kernel: [10951.340000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:16 localhost kernel: [10951.444000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:16 localhost kernel: [10951.700000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:16 localhost kernel: [10951.704000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:17 localhost kernel: [10951.876000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:23 localhost kernel: [10958.648000] CCMP: decrypt failed: STA=MAC-Address removed
Nov 9 12:56:28 localhost kernel: [10963.292000] CCMP: decrypt failed: STA=MAC-Address removed

I also haven't been disconnected or things like that. I just have many of these errors in my kernlog.

[Leann Ogasawara (leannogasawara)]

Tim, can you comment if this is still an issue for you in the current Gutsy Gibbon 7.10 ubuntu release. You can download and try the new version of Ubuntu from http://www.ubuntu.com/getubuntu/download . Please report back your results. Thanks!

[Leann Ogasawara (leannogasawara)]

This bug report is being closed because we received no reponse to the last inquiry for information. Please reopen it if this is still an issue in the current Ubuntu release. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Please don't hesitate to submit bug reports in the future, we really appreciate it. Thanks again!

[Caspar Clemens Mierau (leitmedium)]

I hereby reopen this bug as it is still an issue. A current snippet from dmesg says something like:

[ 2903.812000] printk: 8 messages suppressed.
[ 2903.812000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 2906.172000] printk: 3 messages suppressed.
[ 2906.172000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 2915.380000] printk: 12 messages suppressed.
[ 2915.380000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 2930.848000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 2939.348000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3003.348000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3012.048000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3217.164000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3238.260000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3240.204000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3242.252000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3244.196000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3246.244000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3246.248000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3246.252000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3255.564000] CCMP: decrypt failed: STA=00:12:17:cc:06:03
[ 3497.236000] CCMP: decrypt failed: STA=00:12:17:cc:06:03

Hardware details:

[ccm@hasung:0:~]$ lspci [19:33:04]
00:00.0 Host bridge: Intel Corporation 82855PM Processor to I/O Controller (rev 03)
00:01.0 PCI bridge: Intel Corporation 82855PM Processor to AGP Controller (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #3 (rev 01)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 81)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge (rev 01)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 01)
00:1f.3 SMBus: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) SMBus Controller (rev 01)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 01)
01:00.0 VGA compatible controller: nVidia Corporation NV34M [GeForce FX Go5200 32M/64M] (rev a1)
02:03.0 CardBus bridge: Ricoh Co Ltd RL5c476 II (rev ac)
02:03.1 CardBus bridge: Ricoh Co Ltd RL5c476 II (rev ac)
02:03.2 FireWire (IEEE 1394): Ricoh Co Ltd R5C552 IEEE 1394 Controller (rev 04)
02:05.0 Ethernet controller: Broadcom Corporation BCM4401 100Base-T (rev 01)
02:07.0 Network controller: Intel Corporation PRO/Wireless 2200BG Network Connection (rev 05)

Kernel:
Linux hasung 2.6.22-14-generic #1 SMP Tue Dec 18 08:02:57 UTC 2007 i686 GNU/Linu

[Leann Ogasawara (leannogasawara)]

Hardy Heron Alpha2 was recently released. It contains an updated version of the kernel. You can download and try the new Hardy Heron Alpha2 release from http://cdimage.ubuntu.com/releases/hardy/alpha-2/ . You should be able to then test the new kernel via the LiveCD. If you can, please verify if this bug still exists or not and report back your results. General information regarding the release can also be found here: http://www.ubuntu.com/testing/hardy/alpha2 . Thanks!

[Leann Ogasawara (leannogasawara)]

I'm opened a new task against the actively developed kernel and am closing the report against linux-source-2.6.22. Thanks!

[Rolla Selbak (rolla-n-selbak)]

Casper: 2 qs

1- Do you see any bug in the wireless performance when these msg appear? (i.e. get disconnected, lag in connection, etc.) or are these msg just annoying noise in the logs?

2- Can you retest with a 2.6.24 kernel and see if the problem still occurs? (see Leann's comments on 1/5 on how to test with Hardy Alpha 2, or you can wait for Alpha 3 which should be out this week)

In the meantime, I'll ask the wireless team what the root of these messages is. Thanks.

[kgerstl (kgerstl-deactivatedaccount)]

Still present (but for iwl3945) on an up-to-date Hardy Heron system.

@Rolla Selbak:
1. I didn't come accross any performance loss. It's just spamming the log with a new line every two seconds.
2. Tested with 2.6.24-8-generic.

[Leann Ogasawara (leannogasawara)]

Hi Klaus,

Care to test the latest kernel, 2.6.24-12, as I think bug 190475 may have resolved the issues you have since you are using iwl3945 which is a different driver than what this bug was originally about. I wasn't sure of the exact messages you were seeing since there was not dmesg output attached with your comment. Thanks.

[kgerstl (kgerstl-deactivatedaccount)]

Yes it's fixed, thanks.

[Stefano Spinucci (virgo977virgo)]

Hi,
I'm also having the "CCMP: decrypt failed" error with Ubuntu 8.04 and a laptop Dell D610, using ipw2200 with WPA2-PSK + AES + DHCP.

furthermore, I'd like to point out that the wifi connection never goes up automatically, but everytime I reboot I have to reset one or more times the connection manually with the command "sudo /etc/init.d/networking restart".

following some suggestion on ubuntuforums.org I installed also Wicd, but I was never able to connect with it.

[Stefano Spinucci (virgo977virgo)]

I wish to add some info to the previous comment:

the problems I'm having now are with Ubuntu 8.04, but I was having the same problems (CCMP and connection always down) also with Ubuntu 7.10.

[jerico (jerico-dev)]

I cannot confirm kgerstl's experience. I am using kernel 2.6.24-16 and still have got the same problems as Stefano Spinucci:
1) syslog:
kernel: [ 160.192089] ieee80211_crypt: registered algorithm 'CCMP'
kernel: [ 160.318886] padlock: VIA PadLock not detected.
modprobe: WARNING: Error inserting padlock_aes (/lib/modules/2.6.24-16-generic/kernel/drivers/crypto/padlock-aes.ko): No such device
<snip>
kernel: [ 460.111376] CCMP: decrypt failed: STA=
<repeats every few seconds>
2) connection is down after boot. May be started manually like:
# /etc/init.d/networking restart
or using ifdown ... ifup

[jerico (jerico-dev)]

eth1 Scan completed :
          Cell 01 - Address: ...
                    ESSID:"..."
                    Protocol:IEEE 802.11bg
                    Mode:Master
                    Frequency:2.457 GHz (Channel 10)
                    Encryption key:on
                    Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 6 Mb/s; 9 Mb/s
                              11 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                              48 Mb/s; 54 Mb/s
                    Quality=94/100 Signal level=-33 dBm
                    IE: WPA Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
                    Extra: Last beacon: 4516ms ago

  *-network:1
       description: Wireless interface
       product: PRO/Wireless 2200BG Network Connection
       vendor: Intel Corporation
       physical id: 2
       bus info: pci@0000:02:02.0
       logical name: eth1
       version: 05
       serial: ...
       width: 32 bits
       clock: 33MHz
       capabilities: pm bus_master cap_list ethernet physical wireless
       configuration: broadcast=yes driver=ipw2200 driverversion=1.2.2kmprq firmware=ABG:9.0.2.6 (Mar 22 2005) ip=... latency=32 link=yes maxlatency=24 mingnt=3 module=ipw2200 multicast=yes wireless=IEEE 802.11g

auto eth1
iface eth1 inet static
address ...
netmask ...
gateway ...
wpa-driver wext
wpa-ap-scan 2
wpa-pairwise CCMP
wpa-group CCMP
wpa-key-mgmt WPA-PSK
wpa-proto WPA
wpa-ssid ...
wpa-psk ...

[jerico (jerico-dev)]

wpa_supplicant v0.5.8
Copyright (c) 2003-2007, Jouni Malinen <email address hidden> and contributors

... hope this info is now complete ...

[jerico (jerico-dev)]

I tried the following:
- uninstalling NetworkManager -> network still doesn't go up automatically
- reinstalling + reconfiguring NetworkManager -> again no result
- blacklisting padlock_aes: This keeps the modprobe warning out of my log but does not resolve my problems
- blacklisting intel_rng (to avoid another error message in my kern.log): the above problems persist

Especially the fact that the network is not starting automatically is really annoying as I am not using my computer on the console. I use it as a local samba server. Now every time I want to start the server I have to go to another room, log in on the console and start the network before I can access the server...

[jerico (jerico-dev)]

Problem part 2 (connection is down after boot) seems to be a duplicate of the following:
- Ubuntu #53387 (https://bugs.launchpad.net/ubuntu/+source/wpasupplicant/+bug/53387)
- Ubuntu #50099 (https://bugs.launchpad.net/ubuntu/+source/ifupdown/+bug/50099)
- Ubuntu #69839 (https://bugs.launchpad.net/ubuntu/+bug/69839)
(These bugs again include references to forum entries with similar problems.)

I will try out the fixes given in these threads and then report back.

Problem part 1 (CCMP: decrypt failed) seems to be unrelated.

[jerico (jerico-dev)]

And again problem part 2 (connection is down after boot) is a duplicate of https://bugs.launchpad.net/ubuntu/+source/wpasupplicant/+bug/44194.

The workaround/solutions proposed there work for me:
1) If you do not need p&p wireless (e.g. using a pcmcia card) then you can work around the issue like that:
# sudo mv 85-ifupdown.rules 85-ifupdown.rules.bak
2) Otherwise follow the directions given in https://bugs.launchpad.net/ubuntu/+source/wpasupplicant/+bug/44194/comments/10. (I didn't test this solution myself but several other report it to be working as well.)

This workaround does NOT solve problem part 1 (CCMP: decrypt failed). So please keep the bug report open.

[Leann Ogasawara (leannogasawara)]

Hi Everyone,

So unfortunately it looks like this bug didn't get resolved for Hardy. The upcoming Intrepid Ibex 8.10 release is actively being worked on and contains an updated 2.6.26 kernel. Would someone care to confirm this is still an issue with the latest Alpha for the upcoming Intrepid Ibex 8.10 ? I can then try to get the kernel team to take a look. You should be able to test via a LiveCD - http://www.ubuntu.com/testing. Please let us know your results. If the issue still exists, if you could include your dmesg output after experiencing these issues that would be great. Also, I'm closing the linux-ubuntu-modules-2.6.24 task as this is already properly reported against the "linux" source package. Thanks.

[Stefano Spinucci (virgo977virgo)]

Hi,

I tried Intrepid Ibex 8.10 Alpha 4 Live and my wireless connection does not work at all, using the network manager applet or manually setting the connection.

The error showed by dmesg when resetting the network is:

  ipw2200: Failed to send SYSTEM_CONFIG: Already sending a command.

any idea for a solution ???

[Leann Ogasawara (leannogasawara)]

The Ubuntu Kernel Team is planning to move to the 2.6.27 kernel for the upcoming Intrepid Ibex 8.10 release. As a result, the kernel team would appreciate it if you could please test this newer 2.6.27 Ubuntu kernel. There are one of two ways you should be able to test:

1) If you are comfortable installing packages on your own, the linux-image-2.6.27-* package is currently available for you to install and test.

--or--

2) The upcoming Alpha5 for Intrepid Ibex 8.10 will contain this newer 2.6.27 Ubuntu kernel. Alpha5 is set to be released Thursday Sept 4. Please watch http://www.ubuntu.com/testing for Alpha5 to be announced. You should then be able to test via a LiveCD.

Please let us know immediately if this newer 2.6.27 kernel resolves the bug reported here or if the issue remains. More importantly, please open a new bug report for each new bug/regression introduced by the 2.6.27 kernel and tag the bug report with 'linux-2.6.27'. Also, please specifically note if the issue does or does not appear in the 2.6.26 kernel. Thanks again, we really appreicate your help and feedback.

[Mike Lay (mikelay2000)]

I received the same

CCMP: decrypt failed: STA=00:11:50:43:28:83

Also, my belkin54g router will stop traffic on port 80 only to all machines connected(both wifi and landline) after two or three loads of the map grid image files on a map website such as google maps or mapquest. All other ports continue to work. Also, other pages with a high number of same dimension image files will also cause this problem. Very small image files >75px does not seem to cause the problem. Not sure if this is related but figured I would drop it here.

[Stefano Spinucci (virgo977virgo)]

the network problem is resolved with Alpha 5 using the network manager applet.

test executed with a Dell Latitude D610 with an ipw2200 wireless card.

many thanks to Kernel and Ubuntu developers.

[Andreas Gnau (rondom)]

Changing status to Fix Released because it was reported that it works in latest intrepid.

[Daniel Dumitrache (dandu)]

I think maybe the bug should be reopened, I still get the same message on Intrepid with the latest updates installed:

Dec 16 21:45:58 ddumitrache kernel: [39017.087440] CCMP: decrypt failed: STA=00:18:f3:32:8d:32

I can easily reproduce it by starting some torrent downloads with high traffic. Sometimes the connection drops immediately after I see this error, but not always. I'm testing with a Dell Latitude D510.

The only "workaround" I could find is:
# sudo rmmod ipw2200; sudo modprobe ipw2200

Please let me know if you need any more info.

[Valentin Neacsu (valentin.neacsu)]

Same here, using a HP nc6220 and ipw2200 wireless card on a fresh Intrepid x86 I get random disconnects that I can only resolve with a reboot. I'll try the rmmod/modprobe workaround the next time it happens.

Please take a look at my latest posts (and attachments) in this bug and see if it is related: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/226415