[PATCH wireless] wifi: mac80211: apply ap_isolate to AP_VLAN stations

[Christopher Hill <ch6574@gmail.com>]

ap_isolate is set via nl80211 SET_BSS, which is only accepted on AP and
P2P GO interfaces, so ieee80211_change_bss() stores it as
IEEE80211_SDATA_DONT_BRIDGE_PACKETS on the AP sdata. AP_VLAN interfaces
never inherit it, but the intra-BSS forwarding decisions in
ieee80211_deliver_skb() and ieee80211_check_fast_rx() test the flag on
the station's own sdata, which is the AP_VLAN for stations assigned to a
VLAN (e.g. hostapd dynamic_vlan). As a result, mac80211 keeps forwarding
frames between stations of the same AP_VLAN although ap_isolate is
enabled, and client isolation is silently ineffective for them.

Store the setting in struct ieee80211_if_ap, next to
multicast_to_unicast, and read it via sdata->bss so that it applies to
the AP and all of its AP_VLAN interfaces. The now unused
IEEE80211_SDATA_DONT_BRIDGE_PACKETS flag is removed, as was done for
IEEE80211_SDATA_OPERATING_GMODE in commit 39eac2de0098 ("wifi: mac80211:
move IEEE80211_SDATA_OPERATING_GMODE to link").
__ieee80211_check_fast_rx_iface() already re-evaluates the fast-rx state
of AP_VLAN stations when ap_isolate changes.

The issue was found and this change drafted with the help of an AI
coding assistant (Kiro); it was reviewed, built and tested on hardware
by the submitter.

Fixes: 7b7b5e56d7bd ("mac80211: implement ap isolation support")
Closes: https://lore.kernel.org/linux-wireless/20E87267-920A-4FD9-9443-050AE7676E45@gmail.com/
Signed-off-by: Christopher Hill <ch6574@gmail.com>
---
Tested on a Linksys E8450 (MT7622 + MT7915E, mt76), OpenWrt 25.12.6 with
mac80211 from backports 6.18.55 (patch applied with line offsets only),
hostapd dynamic_vlan=2, VLANs from wpa_psk_file, ap_isolate=1,
multicast_to_unicast=1, two stations on the same radio and VLAN:

- AP_VLAN bridge port with hairpin on: stations reach each other via the
  bridge, one copy per frame (before: every multicast frame duplicated).
- hairpin off: no unicast or multicast replies between the stations
  (before: replies received, i.e. isolation bypassed).

Build-tested on wireless/main (c4328134f) with W=1 (net/wireless and
net/mac80211, x86_64 defconfig + CFG80211/MAC80211=m): no new warnings;
also applies to wireless-next/main. Not tested with mac80211_hwsim.

The debugfs "flags" file no longer shows the isolation bit, as the flag
is removed. An alternative that keeps the flag would be to evaluate the
AP's flag for AP_VLAN interfaces in both rx.c places instead.

 net/mac80211/cfg.c         | 5 +----
 net/mac80211/ieee80211_i.h | 5 +----
 net/mac80211/rx.c          | 4 ++--
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 9608c07bce..cc9d2384d5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -3706,10 +3706,7 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
 	}
 
 	if (params->ap_isolate >= 0) {
-		if (params->ap_isolate)
-			sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
-		else
-			sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+		sdata->u.ap.isolate = params->ap_isolate;
 		ieee80211_check_fast_rx_iface(sdata);
 	}
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 1a6cbbb5a1..e74e30c070 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -344,6 +344,7 @@ struct ieee80211_if_ap {
 	atomic_t num_mcast_sta; /* number of stations receiving multicast */
 
 	bool multicast_to_unicast;
+	bool isolate;
 	bool active;
 };
 
@@ -871,9 +872,6 @@ struct ieee80211_if_mesh {
  * enum ieee80211_sub_if_data_flags - virtual interface flags
  *
  * @IEEE80211_SDATA_ALLMULTI: interface wants all multicast packets
- * @IEEE80211_SDATA_DONT_BRIDGE_PACKETS: bridge packets between
- *	associated stations and deliver multicast frames both
- *	back to wireless media and to the local net stack.
  * @IEEE80211_SDATA_DISCONNECT_RESUME: Disconnect after resume.
  * @IEEE80211_SDATA_IN_DRIVER: indicates interface was added to driver
  * @IEEE80211_SDATA_DISCONNECT_HW_RESTART: Disconnect after hardware restart
@@ -881,7 +879,6 @@ struct ieee80211_if_mesh {
  */
 enum ieee80211_sub_if_data_flags {
 	IEEE80211_SDATA_ALLMULTI		= BIT(0),
-	IEEE80211_SDATA_DONT_BRIDGE_PACKETS	= BIT(3),
 	IEEE80211_SDATA_DISCONNECT_RESUME	= BIT(4),
 	IEEE80211_SDATA_IN_DRIVER		= BIT(5),
 	IEEE80211_SDATA_DISCONNECT_HW_RESTART	= BIT(6),
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ecee9348c7..a36d0f64c6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2799,7 +2799,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 
 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
-	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
+	    !(sdata->bss && sdata->bss->isolate) &&
 	    ehdr->h_proto != rx->sdata->control_port_protocol &&
 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
 		if (is_multicast_ether_addr(ehdr->h_dest) &&
@@ -4826,7 +4826,7 @@ void ieee80211_check_fast_rx(struct sta_info *sta)
 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
 
 		fastrx.internal_forward =
-			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
+			!(sdata->bss && sdata->bss->isolate) &&
 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
 			 !sdata->u.vlan.sta);
 
-- 
2.50.1