Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Cedric VONCKEN <cedric.voncken@acksys.fr>
To:     Cedric VONCKEN <cedric.voncken@acksys.fr>,
        "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: RE: [mac80211]: wds link and Radius authentication issue
Thread-Topic: [mac80211]: wds link and Radius authentication issue
Thread-Index: AdXth2dk69/BCqj0R+ekTWaEqaibqgACfSLgAAC+e3A=
Date:   Thu, 27 Feb 2020 17:37:24 +0000
Message-ID: <DB8PR01MB5529D69C90706C78D3B66BA490EB0@DB8PR01MB5529.eurprd01.prod.exchangelabs.com>
References: <DB8PR01MB5529DDE77726C997EAAC3F3C90EB0@DB8PR01MB5529.eurprd01.prod.exchangelabs.com>
 <DB8PR01MB55290E6894E532ABA3748A5590EB0@DB8PR01MB5529.eurprd01.prod.exchangelabs.com>
In-Reply-To: <DB8PR01MB55290E6894E532ABA3748A5590EB0@DB8PR01MB5529.eurprd01.prod.exchangelabs.com>
Accept-Language: fr-FR, en-US
Content-Language: fr-FR
received-spf: None (protection.outlook.com: acksys.fr does not designate
 permitted sender hosts)
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 9ad1adf6-57c3-42d9-a4d5-08d7bbabb4d8
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Feb 2020 17:37:24.3053
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f18a6414-d5f3-4b5c-9345-f30c01d87e32
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: iFLsPeJfe7pfhgXQHqmzE5VKwfmdZFevofDtfPvebsJ9S+Kd5IThzNr2Z5Aj3psz+P3Y+NcmHBqzx7LP3+ZIHBhg7KXsWQLB1icEQUyLr6E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR01MB6423
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Where can I found some information on how the wds system should work? I loo=
ked in 802.11-2012 standard and I didn't found any informations.

-----Message d'origine-----
De=A0: linux-wireless-owner@vger.kernel.org <linux-wireless-owner@vger.kern=
el.org> De la part de Cedric VONCKEN
Envoy=E9=A0: jeudi 27 f=E9vrier 2020 18:24
=C0=A0: linux-wireless@vger.kernel.org
Objet=A0: RE: [mac80211]: wds link and Radius authentication issue

	Please find in attachment 2 wireshark capture

	The file broadcast_V5.4-rc8-1 contain a broadcast frame capture with the l=
atest backport used in my system.
	The file broadcast_V2015-07-21 contain a broadcast frame capture with an o=
ld backport (backport 2015-07-21).

	With the old backport I be able to ping my sta from the AP.

	If we compare the frame
		- In the old backport the bit TODS and FROMDS are set to 1, In latest ver=
sion only the bit FROMDS is set to 1.
		- In old backport the addr1 is set to the mac address of my sta, in lates=
t backport the addr1 is set to broadcast addr (ff:ff:ff:ff:ff:ff)

	In old version the same test doesn't drop the broadcast frame, but I think=
 the AP should send one broadcast per wds sta.

	All comment will be appreciated.

-----Message d'origine-----
De=A0: Cedric VONCKEN <cedric.voncken@acksys.fr> Envoy=E9=A0: jeudi 27 f=E9=
vrier 2020 17:21 =C0=A0: Cedric VONCKEN <cedric.voncken@acksys.fr>; linux-w=
ireless@vger.kernel.org Objet=A0: [mac80211]: wds link and Radius authentic=
ation issue

	 Hi,=20

	Now I identified the origin of the issue but  I need some help to fix.

	For memo the condition to have this issue:
		My sta is still connected to my AP. The sta use the 4addr (wds) system an=
d the sta if device (wlan0) is bridged with my eth0 interface.
		In this condition I'm not able to ping the sta from the AP.

	The origin of the issue is in rx.c from driver/net/mac80211. In function _=
_ieee80211_data_to_8023
	if (sdata->vif.type =3D=3D NL80211_IFTYPE_STATION &&
	     !!sdata->u.mgd.use_4addr !=3D !!ieee80211_has_a4(hdr->frame_control))=
 {
		if (!sdata->u.mgd.use_4addr)
			return -1;
		else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr)){   ------> this =
test is the origin of my issue
			check_port_control =3D true;
    	}

	The ARP frame are sent in broadcast. The broadcast are sent without addr4 =
(the flag TODS and FROMDS are not set) and addr1 =3D=3D ff:ff:ff:ff:ff:ff.
	In this case check_port_control is set to true and several line below in t=
he same function the packet is dropped.

	I can add a test with  is_broadcast_ether_addr in "else if (!ether_addr_eq=
ual(hdr->addr1, sdata->vif.addr)){", but I'm not sure that is the best solu=
tion.=20

	What are your comments?

	Regards.
-----Message d'origine-----
De=A0: linux-wireless-owner@vger.kernel.org <linux-wireless-owner@vger.kern=
el.org> De la part de Cedric VONCKEN Envoy=E9=A0: mercredi 26 f=E9vrier 202=
0 11:29 =C0=A0: linux-wireless@vger.kernel.org Objet=A0: wds link and Radiu=
s authentication issue

	Dear mailing list,=20

	I'm facing an issue when my equipement are configured with WDS and radius =
authentication.

	My both product (the AP and the sta) are using the same hostapd/wpa_suppli=
cant and wifi driver version.
	The wifi driver version is openwrt backport-5.4-rc8-1 package.

	My AP is configured to accept the WDS sta. In the AP side the ifname wlan0=
.sta1 are created and added in the bridge.
	My sta is configured to use the WDS addresses.

	If the security policy is configured to WPA-PSK and in the client side the=
 client if is added to the bridge, the communication work (I can ping my AP=
 from my sta).
	If the security policy is configured to WPA-EAP (I tested PEAP-MSCHAPV2 an=
d EAP-TLS) and the client if is in a bridge, the communication doesn't work=
.

	I did a Wireshark capture on other WIFI interface, the packet seem sent by=
 the AP and by the sta (I can see a broadcast frame sent, and the packet ty=
pe is data. I think it is the arp request). But these frames are not receiv=
ed (I make a wireshar capture on the sta and AP if, no arp frame are receiv=
ed).

	I don't know where I need to search to fix this issue. Could you give me s=
ome pointer/help to fix it.

	Thanks for your help.