Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Cedric VONCKEN <cedric.voncken@acksys.fr>
To:     Cedric VONCKEN <cedric.voncken@acksys.fr>,
        "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: [mac80211]: wds link and Radius authentication issue
Thread-Topic: [mac80211]: wds link and Radius authentication issue
Thread-Index: AdXth2dk69/BCqj0R+ekTWaEqaibqg==
Date:   Thu, 27 Feb 2020 16:21:14 +0000
Message-ID: <DB8PR01MB5529DDE77726C997EAAC3F3C90EB0@DB8PR01MB5529.eurprd01.prod.exchangelabs.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
received-spf: None (protection.outlook.com: acksys.fr does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 8b677413-327a-49d5-3164-08d7bba11121
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Feb 2020 16:21:14.6192
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f18a6414-d5f3-4b5c-9345-f30c01d87e32
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: pZgIdZJ+0zusGL0mK76UnuP4eqzrtMAtVRtCiaHgbmVxZz9DKeiGd3wwuanerpj/ye6SZLljXQoVvEXDMCQCy3bYUPFiiODKM3q6I4UkE4s=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR01MB5659
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

	 Hi,=20

	Now I identified the origin of the issue but  I need some help to fix.

	For memo the condition to have this issue:
		My sta is still connected to my AP. The sta use the 4addr (wds) system an=
d the sta if device (wlan0) is bridged with my eth0 interface.
		In this condition I'm not able to ping the sta from the AP.

	The origin of the issue is in rx.c from driver/net/mac80211. In function _=
_ieee80211_data_to_8023
	if (sdata->vif.type =3D=3D NL80211_IFTYPE_STATION &&
	     !!sdata->u.mgd.use_4addr !=3D !!ieee80211_has_a4(hdr->frame_control))=
 {
		if (!sdata->u.mgd.use_4addr)
			return -1;
		else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr)){   ------> this =
test is the origin of my issue
			check_port_control =3D true;
    	}

	The ARP frame are sent in broadcast. The broadcast are sent without addr4 =
(the flag TODS and FROMDS are not set) and addr1 =3D=3D ff:ff:ff:ff:ff:ff.
	In this case check_port_control is set to true and several line below in t=
he same function the packet is dropped.

	I can add a test with  is_broadcast_ether_addr in "else if (!ether_addr_eq=
ual(hdr->addr1, sdata->vif.addr)){", but I'm not sure that is the best solu=
tion.=20

	What are your comments?

	Regards.
-----Message d'origine-----
De=A0: linux-wireless-owner@vger.kernel.org <linux-wireless-owner@vger.kern=
el.org> De la part de Cedric VONCKEN
Envoy=E9=A0: mercredi 26 f=E9vrier 2020 11:29
=C0=A0: linux-wireless@vger.kernel.org
Objet=A0: wds link and Radius authentication issue

	Dear mailing list,=20

	I'm facing an issue when my equipement are configured with WDS and radius =
authentication.

	My both product (the AP and the sta) are using the same hostapd/wpa_suppli=
cant and wifi driver version.
	The wifi driver version is openwrt backport-5.4-rc8-1 package.

	My AP is configured to accept the WDS sta. In the AP side the ifname wlan0=
.sta1 are created and added in the bridge.
	My sta is configured to use the WDS addresses.

	If the security policy is configured to WPA-PSK and in the client side the=
 client if is added to the bridge, the communication work (I can ping my AP=
 from my sta).
	If the security policy is configured to WPA-EAP (I tested PEAP-MSCHAPV2 an=
d EAP-TLS) and the client if is in a bridge, the communication doesn't work=
.

	I did a Wireshark capture on other WIFI interface, the packet seem sent by=
 the AP and by the sta (I can see a broadcast frame sent, and the packet ty=
pe is data. I think it is the arp request). But these frames are not receiv=
ed (I make a wireshar capture on the sta and AP if, no arp frame are receiv=
ed).

	I don't know where I need to search to fix this issue. Could you give me s=
ome pointer/help to fix it.

	Thanks for your help.