From 65c9384b58a75461990f529a102885509b6672eb Mon Sep 17 00:00:00 2001 From: Tomaz Zaman Date: Sun, 16 Aug 2026 19:07:22 +0200 Subject: [PATCH 67/72] wifi-scripts: route fullmac EAPOL to the VLAN iface on filtering bridges Fullmac drivers carry EAPOL over the netdev, not nl80211's control port. On a vlan_filtering bridge the client's 4-way-handshake frames arrive VLAN-tagged on the raw bridge, so hostapd -- whose EAPOL socket listens on network_bridge -- never matches them and the handshake stalls (client associates, then "wrong password"). Point hostapd's bridge at the network's VLAN interface (bridge-ifname, e.g. br-lan.10) where those frames surface untagged. Gate on fullmac (mac80211 uses the control port and is unaffected); no-op when the network is not a bridge-VLAN. Co-Authored-By: Claude Opus 4.8 --- .../usr/share/ucode/wifi/hostapd.uc | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc index cfd652cc2f..d8bf369fdc 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc @@ -552,6 +552,12 @@ function setup_interface(interface, data, config, vlans, stas, phy_features, fix ap.generate(interface, data, config, vlans, stas, phy_features); } +function is_fullmac_phy(phy) { + let idx = int(fs.readfile(`/sys/class/ieee80211/${phy}/index`)); + let info = nl80211.request(nl80211.const.NL80211_CMD_GET_WIPHY, 0, { wiphy: idx }); + return info && info.software_iftypes && !info.software_iftypes.monitor; +} + export function setup(data) { let file_name = `/var/run/hostapd-${data.phy}${data.vif_phy_suffix}.conf`; @@ -577,6 +583,20 @@ export function setup(data) { interface.config.network_bridge = interface.bridge; interface.config.network_ifname = interface['bridge-ifname']; + /* + * bug #2: fullmac vendor drivers (e.g. NXP mwifiex) carry EAPOL over the + * netdev, not nl80211's control port. On a vlan_filtering bridge the + * client's 4-way-handshake frames arrive VLAN-tagged on the raw bridge, + * so hostapd -- whose EAPOL socket listens there -- never matches them and + * the handshake stalls (client associates, then "wrong password"). Point + * hostapd's bridge at the VLAN interface (br-lan.X) where those frames + * surface untagged. mac80211 uses the control port and is unaffected, so + * gate on fullmac; no-op when the network is not a bridge-VLAN. + */ + if (interface.bridge && interface.bridge != interface['bridge-ifname'] && + is_fullmac_phy(data.phy)) + interface.config.network_bridge = interface['bridge-ifname']; + let owe = interface.config.encryption == 'owe' && interface.config.owe_transition; setup_interface(k, data, interface.config, interface.vlans, interface.stas, phy_features, owe ? 'owe' : null ); -- 2.47.3