Allow client isolation to be configured (ap_isolate=1)

Client isolation can be used to prevent low-level bridging of frames
between associated stations in the BSS. By default, this bridging is
allowed.

diff --git a/hostapd/config_file.c b/hostapd/config_file.c
index c2083f676b47198977424d7210f63d56bcd529c0..36b75e50c3d1e231604855f5f89d284a2d2ddbc0 100644 (file)
--- a/hostapd/config_file.c
+++ b/hostapd/config_file.c
@@ -1282,6 +1282,8 @@ struct hostapd_config * hostapd_config_read(const char *fname)
                        }
                } else if (os_strcmp(buf, "wds_sta") == 0) {
                        bss->wds_sta = atoi(pos);
+               } else if (os_strcmp(buf, "ap_isolate") == 0) {
+                       bss->isolate = atoi(pos);
                } else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
                        bss->ap_max_inactivity = atoi(pos);
                } else if (os_strcmp(buf, "country_code") == 0) {

diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
index afeb20657bc2c1437fa172ba4720398394396fd8..fe97ea87eafaf7b8a0929bcf2fb1d99b234010db 100644 (file)
--- a/hostapd/hostapd.conf
+++ b/hostapd/hostapd.conf
@@ -357,6 +357,10 @@ wmm_ac_vo_acm=0
 # use a separate bridge.
 #wds_bridge=wds-br0
 
+# Client isolation can be used to prevent low-level bridging of frames between
+# associated stations in the BSS. By default, this bridging is allowed.
+#ap_isolate=1
+
 ##### IEEE 802.11n related configuration ######################################
 
 # ieee80211n: Whether IEEE 802.11n (HT) is enabled

diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index be2e33465e04966563b1434dac0dfe145c941f53..a95ebe9acb8829371977b8b1b4f6348925be3336 100644 (file)
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -199,6 +199,7 @@ struct hostapd_bss_config {
        struct mac_acl_entry *deny_mac;
        int num_deny_mac;
        int wds_sta;
+       int isolate;
 
        int auth_algs; /* bitfield of allowed IEEE 802.11 authentication
                        * algorithms, WPA_AUTH_ALG_{OPEN,SHARED,LEAP} */

diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
index 001c4c79914664b100a22fb03f1cd31ee2634398..0ac5289d4c8807aec4540d6630dc6092eff72aed 100644 (file)
--- a/src/ap/ap_drv_ops.c
+++ b/src/ap/ap_drv_ops.c
@@ -281,6 +281,14 @@ static int hostapd_set_radius_acl_expire(struct hostapd_data *hapd,
 }
 
 
+static int hostapd_set_ap_isolate(struct hostapd_data *hapd, int value)
+{
+       if (hapd->driver == NULL || hapd->driver->set_intra_bss == NULL)
+               return 0;
+       return hapd->driver->set_intra_bss(hapd->drv_priv, !value);
+}
+
+
 static int hostapd_set_bss_params(struct hostapd_data *hapd,
                                  int use_protection)
 {
@@ -331,6 +339,13 @@ static int hostapd_set_bss_params(struct hostapd_data *hapd,
                ret = -1;
        }
 
+       if (hostapd_set_ap_isolate(hapd, hapd->conf->isolate) &&
+           hapd->conf->isolate) {
+               wpa_printf(MSG_ERROR, "Could not enable AP isolation in "
+                          "kernel driver");
+               ret = -1;
+       }
+
        return ret;
 }