wds link and Radius authentication issue

wds link and Radius authentication issue

[Cedric VONCKEN]

The origin of the issue is  in VLAN sta feature and  WDS sta feature management.
These both features are managed with the same code.

In case of we use a WDS sta and 802.1x authentication that don't work.
When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.

During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.
In the sta side all frames received with 3 addr is droped if the sta is configured to use 4 addr header format.

So no IP communication is possible between the AP and the STA.

I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).
Finally, I found a workaround, in hostapd if I disabled the VLAN feature the issue is fixed (because the second call is not present). For the moment I don't use this feature so I can disabled it.

I hope an mac80211/hostapd expert will fix this issue in next version.

Thinks for your help.
> -----Message d'origine-----
> De : Johannes Berg <johannes@sipsolutions.net>
> Envoyé : mardi 3 mars 2020 10:31
> À : Cedric VONCKEN <cedric.voncken@acksys.fr>; Steve deRosier
> <derosier@gmail.com>
> Cc : linux-wireless@vger.kernel.org
> Objet : Re: [mac80211]: wds link and Radius authentication issue
> 
> Hi Cedric,
> 
> Umm, that was hard to read. You should quote my writing, not your own :)
> 
> 
> > > The wlan0.sta1 net dev was created by hostapd to manage the wds sta.
> > > This netdev type is AP VLAN. The function ieee80211_lookup_ra_sta
> > > return -ENOLINK because the pointer sdata->u.vlan.sta was not
> > > defined.
> 
> Right.
> 
> > > In mac80211, where this rcu pointer is allocated? Which NL message the
> user space use ?
> 
> Look at ieee80211_change_station(), called from nl80211_set_station() with
> 
> 	params.vlan = get_vlan(info, rdev);
> 
> johannes

Re: wds link and Radius authentication issue

[Sebastian Gottschall]

consider my answer to you
have you tried to revert the patches i mentioned?

Sebastian

Am 03.03.2020 um 16:28 schrieb Cedric VONCKEN:
> The origin of the issue is  in VLAN sta feature and  WDS sta feature management.
> These both features are managed with the same code.
>
> In case of we use a WDS sta and 802.1x authentication that don't work.
> When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
>
> During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.
> In the sta side all frames received with 3 addr is droped if the sta is configured to use 4 addr header format.
>
> So no IP communication is possible between the AP and the STA.
>
> I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).
> Finally, I found a workaround, in hostapd if I disabled the VLAN feature the issue is fixed (because the second call is not present). For the moment I don't use this feature so I can disabled it.
>
> I hope an mac80211/hostapd expert will fix this issue in next version.
>
> Thinks for your help.
>> -----Message d'origine-----
>> De : Johannes Berg <johannes@sipsolutions.net>
>> Envoyé : mardi 3 mars 2020 10:31
>> À : Cedric VONCKEN <cedric.voncken@acksys.fr>; Steve deRosier
>> <derosier@gmail.com>
>> Cc : linux-wireless@vger.kernel.org
>> Objet : Re: [mac80211]: wds link and Radius authentication issue
>>
>> Hi Cedric,
>>
>> Umm, that was hard to read. You should quote my writing, not your own :)
>>
>>
>>>> The wlan0.sta1 net dev was created by hostapd to manage the wds sta.
>>>> This netdev type is AP VLAN. The function ieee80211_lookup_ra_sta
>>>> return -ENOLINK because the pointer sdata->u.vlan.sta was not
>>>> defined.
>> Right.
>>
>>>> In mac80211, where this rcu pointer is allocated? Which NL message the
>> user space use ?
>>
>> Look at ieee80211_change_station(), called from nl80211_set_station() with
>>
>> 	params.vlan = get_vlan(info, rdev);
>>
>> johannes

Re: wds link and Radius authentication issue

[Jouni Malinen]

On Tue, Mar 03, 2020 at 03:28:47PM +0000, Cedric VONCKEN wrote:
> The origin of the issue is  in VLAN sta feature and  WDS sta feature management.
> These both features are managed with the same code.
> 
> In case of we use a WDS sta and 802.1x authentication that don't work.
> When the AP side receive the null function frame in 4addr format from the sta, hostapd create the sta netdev and call the NL message NL80211_CMD_SET_STATION. In mac80211 the function ieee80211_change_station assign the pointer vlansdata->u.vlan.sta.
> 
> During the 802.1x authentication hostapd send the NL80211_CMD_SET_STATION message for add vlan management. I didn't understand why hostapd require this call, because in the msg no vlan information is given. With this second call, ieee80211_change_station function, set the vlansdata->u.vlan.sta to NULL . After that no frames are sent through the wds sta netdev and all frame are sent with 3 addr.

It is fine to skip that assignment in cases where the RADIUS server does
not assign a specific VLAN for the station.

> I tried to fix this issue, but I'm not sure where I should fix the issue (hostapd or mac80211).

This specific case of WDS with EAP, but without separate VLAN ID
assignment should be fixed in hostapd and this commit takes care of
that:
https://w1.fi/cgit/hostap/commit/?id=43ededa9c74e3762bcf2f78841790eeecfa8ad56

As far as use of WDS and VLAN ID assignment for the same station is
concerned, I'm not sure there is a good solution for that with the
current mac80211 design for the WDS interfaces. Anyway, that is a
separate issue and I guess it is fine to leave that waiting for someone
to come up with a real use case for that before coming up with anything
more complex.

-- 
Jouni Malinen                                            PGP id EFC895FA

Re: wds link and Radius authentication issue

[Johannes Berg]

On Sat, 2020-03-07 at 14:57 +0200, Jouni Malinen wrote:

> As far as use of WDS and VLAN ID assignment for the same station is
> concerned, I'm not sure there is a good solution for that with the
> current mac80211 design for the WDS interfaces.

Not sure we should even try to solve this on a wireless level? You could
still put the new VLAN interface into an appropriate VLAN bridge, I
guess?

I mean, even for radius VLANs you could theoretically assign each
station a separate AP_VLAN netdev on the wireless level, and put them
into an appropriate bridge, where you have one bridge for each radius
VLAN. This would "port" to a combined WDS AP_VLAN with radius VLAN?

johannes

wds link and Radius authentication issue

[Cedric VONCKEN]

	Dear mailing list, 

	I'm facing an issue when my equipement are configured with WDS and radius authentication.

	My both product (the AP and the sta) are using the same hostapd/wpa_supplicant and wifi driver version.
	The wifi driver version is openwrt backport-5.4-rc8-1 package.

	My AP is configured to accept the WDS sta. In the AP side the ifname wlan0.sta1 are created and added in the bridge.
	My sta is configured to use the WDS addresses.

	If the security policy is configured to WPA-PSK and in the client side the client if is added to the bridge, the communication work (I can ping my AP from my sta).
	If the security policy is configured to WPA-EAP (I tested PEAP-MSCHAPV2 and EAP-TLS) and the client if is in a bridge, the communication doesn't work.

	I did a Wireshark capture on other WIFI interface, the packet seem sent by the AP and by the sta (I can see a broadcast frame sent, and the packet type is data. I think it is the arp request). But these frames are not received (I make a wireshar capture on the sta and AP if, no arp frame are received).

	I don't know where I need to search to fix this issue. Could you give me some pointer/help to fix it.

	Thanks for your help.