From: Johannes Berg <johannes.berg@xxxxxxxxx> Currently, driver_nl80211 sets NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT in AP mode, to get 802.1X frames out unencrypted. However, due to the way nl80211/cfg80211 is implemented, this attribute is ignored by the kernel if NL80211_ATTR_CONTROL_PORT_ETHERTYPE isn't specified as well. Fix this by including NL80211_ATTR_CONTROL_PORT_ETHERTYPE set to ETH_P_PAE. This can be done unconditionally, since the kernel will allow ETH_P_PAE to be set even when the driver didn't advertise support for arbitrary ethertypes. Additionally, the params->pairwise_ciphers appear to not be set at this point, so relax the check and allow them to be zero. In client mode, this whole thing was missing, so add it. Again, the pairwise suite can be WPA_CIPHER_NONE, so allow that case as well. Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> --- src/drivers/driver_nl80211.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c index 3391012047df..338cdc9c8d49 100644 --- a/src/drivers/driver_nl80211.c +++ b/src/drivers/driver_nl80211.c @@ -3587,8 +3587,10 @@ static int wpa_driver_nl80211_set_ap(void *priv, goto fail; if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA && - params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40) && - nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)) + (!params->pairwise_ciphers || + params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40)) && + (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) || + nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) goto fail; wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x", @@ -4904,6 +4906,14 @@ static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv, if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT)) return -1; + if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_NO_WPA && + (params->pairwise_suite == WPA_CIPHER_NONE || + params->pairwise_suite == WPA_CIPHER_WEP104 || + params->pairwise_suite == WPA_CIPHER_WEP40) && + (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) || + nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) + return -1; + if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED && nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED)) return -1; -- 2.8.1 _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
