The origin of the issue is in VLAN sta feature and WDS sta feature management.
These both features are managed with the same code.
In case of we use a WDS sta and 802.1x authentication that don't work.
When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.
In the sta side all frames received with 3 addr is droped if the sta is configured to use 4 addr header format.
So no IP communication is possible between the AP and the STA.
I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).
Finally, I found a workaround, in hostapd if I disabled the VLAN feature the issue is fixed (because the second call is not present). For the moment I don't use this feature so I can disabled it.
I hope an mac80211/hostapd expert will fix this issue in next version.
Thinks for your help.
> -----Message d'origine-----
> De : Johannes Berg <[email protected]>
> Envoyé : mardi 3 mars 2020 10:31
> À : Cedric VONCKEN <[email protected]>; Steve deRosier
> <[email protected]>
> Cc : [email protected]
> Objet : Re: [mac80211]: wds link and Radius authentication issue
>
> Hi Cedric,
>
> Umm, that was hard to read. You should quote my writing, not your own :)
>
>
> > > The wlan0.sta1 net dev was created by hostapd to manage the wds sta.
> > > This netdev type is AP VLAN. The function ieee80211_lookup_ra_sta
> > > return -ENOLINK because the pointer sdata->u.vlan.sta was not
> > > defined.
>
> Right.
>
> > > In mac80211, where this rcu pointer is allocated? Which NL message the
> user space use ?
>
> Look at ieee80211_change_station(), called from nl80211_set_station() with
>
> params.vlan = get_vlan(info, rdev);
>
> johannes
consider my answer to you
have you tried to revert the patches i mentioned?
Sebastian
Am 03.03.2020 um 16:28 schrieb Cedric VONCKEN:
> The origin of the issue is in VLAN sta feature and WDS sta feature management.
> These both features are managed with the same code.
>
> In case of we use a WDS sta and 802.1x authentication that don't work.
> When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
>
> During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.
> In the sta side all frames received with 3 addr is droped if the sta is configured to use 4 addr header format.
>
> So no IP communication is possible between the AP and the STA.
>
> I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).
> Finally, I found a workaround, in hostapd if I disabled the VLAN feature the issue is fixed (because the second call is not present). For the moment I don't use this feature so I can disabled it.
>
> I hope an mac80211/hostapd expert will fix this issue in next version.
>
> Thinks for your help.
>> -----Message d'origine-----
>> De : Johannes Berg <[email protected]>
>> Envoyé : mardi 3 mars 2020 10:31
>> À : Cedric VONCKEN <[email protected]>; Steve deRosier
>> <[email protected]>
>> Cc : [email protected]
>> Objet : Re: [mac80211]: wds link and Radius authentication issue
>>
>> Hi Cedric,
>>
>> Umm, that was hard to read. You should quote my writing, not your own :)
>>
>>
>>>> The wlan0.sta1 net dev was created by hostapd to manage the wds sta.
>>>> This netdev type is AP VLAN. The function ieee80211_lookup_ra_sta
>>>> return -ENOLINK because the pointer sdata->u.vlan.sta was not
>>>> defined.
>> Right.
>>
>>>> In mac80211, where this rcu pointer is allocated? Which NL message the
>> user space use ?
>>
>> Look at ieee80211_change_station(), called from nl80211_set_station() with
>>
>> params.vlan = get_vlan(info, rdev);
>>
>> johannes
On Tue, Mar 03, 2020 at 03:28:47PM +0000, Cedric VONCKEN wrote:
> The origin of the issue is in VLAN sta feature and WDS sta feature management.
> These both features are managed with the same code.
>
> In case of we use a WDS sta and 802.1x authentication that don't work.
> When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
>
> During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.
It is fine to skip that assignment in cases where the RADIUS server does
not assign a specific VLAN for the station.
> I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).
This specific case of WDS with EAP, but without separate VLAN ID
assignment should be fixed in hostapd and this commit takes care of
that:
https://w1.fi/cgit/hostap/commit/?id=43ededa9c74e3762bcf2f78841790eeecfa8ad56
As far as use of WDS and VLAN ID assignment for the same station is
concerned, I'm not sure there is a good solution for that with the
current mac80211 design for the WDS interfaces. Anyway, that is a
separate issue and I guess it is fine to leave that waiting for someone
to come up with a real use case for that before coming up with anything
more complex.
--
Jouni Malinen PGP id EFC895FA
On Sat, 2020-03-07 at 14:57 +0200, Jouni Malinen wrote:
> As far as use of WDS and VLAN ID assignment for the same station is
> concerned, I'm not sure there is a good solution for that with the
> current mac80211 design for the WDS interfaces.
Not sure we should even try to solve this on a wireless level? You could
still put the new VLAN interface into an appropriate VLAN bridge, I
guess?
I mean, even for radius VLANs you could theoretically assign each
station a separate AP_VLAN netdev on the wireless level, and put them
into an appropriate bridge, where you have one bridge for each radius
VLAN. This would "port" to a combined WDS AP_VLAN with radius VLAN?
johannes