From: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
To: Antonio Quartulli <ordex@autistici.org>
Cc: <linville@tuxdriver.com>, <johannes@sipsolutions.net>,
<linux-wireless@vger.kernel.org>
Subject: Re: [PATCH 2/2] cfg80211/nl80211: Enable drivers to implement mac address based ACL
Date: Wed, 12 Dec 2012 16:37:43 +0530 [thread overview]
Message-ID: <50C8657F.60606@qca.qualcomm.com> (raw)
In-Reply-To: <20121212101415.GH3458@ritirata.org>
On Wednesday 12 December 2012 03:44 PM, Antonio Quartulli wrote:
> Hello Vasanthakumar,
>
> On Fri, Dec 07, 2012 at 05:16:03PM +0530, Vasanthakumar Thiagarajan wrote:
>> This patch enables drivers to implement mac address based
>> access control in AP/P2P GO mode. There is a new flag in
>> nl80211_ap_sme_features (NL80211_AP_SME_FEATURE_MAC_ACL)
>> for drivers to advertise this capability. There are two acl
>> policies, white and black list under which an acl list can
>> be configured in the driver. Driver has to advertise the
>> maximum number of mac address entries in acl list through
>> max_acl_mac_addrs of wiphy.
>>
>> Driver can enable its ACL either with the initial list passed
>> through NL80211_CMD_START_AP or a list passed through
>> NL80211_CMD_SET_MAC_ACL. ACL information passed in these
>> commands is an array of acl configuration containing acl
>> policy and list of mac address. With the acl policy as
>> NL80211_ACL_POLICY_ACCEPT, driver will accept Auth request
>> from any client matching any one of the mac addresses in the acl list.
>> When acl policy is NL80211_ACL_POLICY_DENY, driver will reject any
>> Auth request from the clients having their mac address listed in the
>> acl list. Driver must make sure to clear it's acl list when doing
>> stop ap.
>>
>
> I'm curious about this feature: at the moment mac ACL is implemented and working
> in hostapd. What would the advantage of implementing this in the driver?
> I don't think this can be offloaded on the device, so the advantage is that this
> would move the ACL mechanism from the user to the kernel-space? Or am I missing
> something else?
This is mainly for the devices which have the AP SME in fw like ath6kl.
So that the auth request will be dropped after checking the acl instead
instead of doing it in hostapd where it could be done only after
the connection with the station goes through successfully.
Vasanth
prev parent reply other threads:[~2012-12-12 11:08 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-07 11:46 [PATCH 1/2] cfg80211: Move the definition of struct mac_address up Vasanthakumar Thiagarajan
2012-12-07 11:46 ` [PATCH 2/2] cfg80211/nl80211: Enable drivers to implement mac address based ACL Vasanthakumar Thiagarajan
2012-12-11 19:57 ` Johannes Berg
2012-12-12 5:16 ` Vasanthakumar Thiagarajan
2012-12-12 11:26 ` Johannes Berg
2012-12-12 11:27 ` Johannes Berg
2012-12-13 4:56 ` Vasanthakumar Thiagarajan
2012-12-13 4:52 ` Vasanthakumar Thiagarajan
2012-12-13 5:47 ` Sujith Manoharan
2012-12-13 5:56 ` Vasanthakumar Thiagarajan
2012-12-12 10:14 ` Antonio Quartulli
2012-12-12 11:07 ` Vasanthakumar Thiagarajan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50C8657F.60606@qca.qualcomm.com \
--to=vthiagar@qca.qualcomm.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=ordex@autistici.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).