Re: wds link and Radius authentication issue

[Jouni Malinen <j@w1.fi>]

On Tue, Mar 03, 2020 at 03:28:47PM +0000, Cedric VONCKEN wrote:
> The origin of the issue is  in VLAN sta feature and  WDS sta feature management.
> These both features are managed with the same code.
> 
> In case of we use a WDS sta and 802.1x authentication that don't work.
> When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
> 
> During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.

It is fine to skip that assignment in cases where the RADIUS server does
not assign a specific VLAN for the station.

> I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).

This specific case of WDS with EAP, but without separate VLAN ID
assignment should be fixed in hostapd and this commit takes care of
that:
https://w1.fi/cgit/hostap/commit/?id=43ededa9c74e3762bcf2f78841790eeecfa8ad56

As far as use of WDS and VLAN ID assignment for the same station is
concerned, I'm not sure there is a good solution for that with the
current mac80211 design for the WDS interfaces. Anyway, that is a
separate issue and I guess it is fine to leave that waiting for someone
to come up with a real use case for that before coming up with anything
more complex.

-- 
Jouni Malinen                                            PGP id EFC895FA