On Thu, 2019-08-22 at 09:00 +0200, Johannes Berg wrote: > > Perhaps it expects the 4-way-HS to already be in 4-addr frame format, or > something else special in the 4-way-HS if you have WDS? I think this is actually the right guess. The working capture you sent me has the EAPOL 2/4 in a 4-addr frame: ToDS=1, FromDS=1 A1/RA = AP A2/TA = STA A3/DA = AP A4/SA = STA The non-working capture has the EAPOL 2/4 in 3-addr format, as you'd expect in the Linux 4-addr AP/STA case: ToDS=1, FromDS=0 A1/RA = AP A2/TA,SA = STA A3/DA = AP Since it's basically ignoring the message 2 (it just says "handshake timed out" later) it's almost certainly expecting *only* the 4-addr format. As a hack, you could do --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2623,8 +2623,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN); hdrlen = 24; - } else if (sdata->u.mgd.use_4addr && - cpu_to_be16(ethertype) != sdata->control_port_protocol) { + } else if (sdata->u.mgd.use_4addr) { fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); /* RA TA DA SA */ in mac80211, then it should send 4-addr frames even for EAPOL. johannes