It took a little while to determine the root cause, but, ...
I am rebuilding an old windows workstation into a Linux based router/firewall/access-point using
hostapd to provide wireless interfaces. Normally, this is a straight-forward
configuration. The twist in this case is that I am using
Open vSwitch to handle layer 2 functions. The box has an existing
Atheros AR5B22 based PCIe 1 card with two antenna connections on the rear face. Which translates into a Qualcomm Atheros AR9462 chipset.
I added the wireless interface to OVS on vlan 10 with a command like:
ovs-vsctl add-port ovsbr0 wlp4s0 tag=10
I used a simple hosted configuration file like:
# cat /etc/hostapd/hostapd.conf
interface=wlp4s0
driver=nl80211
ssid=test
auth_algs=1
wpa=1
#wpa_psk_file=/etc/hostapd/hostapd.psk
wpa_passphrase=testtest
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP TKIP
rsn_pairwise=CCMP
When running in debug mode:
hostapd -d -K -t /etc/hostapd/hostapd.conf
I was seeing EAPoL (Extensible Authentication Protocol over LAN) based retries. It took some research to come across the interaction about openvswitch and hostapd. Bottom line, is that hostapd uses a control channel to control the wireless device. EAPoL is a packet based function. AS such, hostapd needs to monitor the packets to pick out the EAPoL packets. A mechanism is built in for working with regular Linux bridged networking. That code does not work with Open vSwitch. Someone created a
patch to work around the issue.
This patch isn't found in mainline hostapd, nor as a patch in the Debian repository. So... I need to apply it manually. I used the documentation found at Debian Building Tutorial as a starting point. The divergence is that the documentation uses a non-functional, deprecated tool called dpatch. I used
quilt to handle patching.
As a sidebar, this server I am building uses LXC containers to segregate functionality, compartmentalise security, and to make it easier to keep the main install minimal. As patching and rebuilding the package requires a bunch of build tools, the tools can be easily installed, and then the whole build environment deleted when complete.
The annotated series of steps. I have a number of commented-out entries which I plan to play with later, once I understand more the nuances. One thing, there appears to be a lock out of 5gig frequencies when acting as a host.
apt update
apt install build-essential fakeroot devscripts # install tools
apt-get source hostapd #obtain source
# review the source directory, then
apt-get build-dep wpa # install the build dependencies
cd wpa-2.4/
debuild -b -uc -us # build with existing source
dpkg -i ../hostapd_2.4-1_amd64.deb # install the package as a test
apt install quilt # install patch manager
quilt top # inspect the current latest patch
ls -alt debian/patches/ # most patches kept here
ls -alt patches/ # some are here as well
quilt new rpb_hostapd_openvswitch # create a new patch
# in the following edit, I removed the content, and pasted the source from
# https://github.com/helmut-jacob/hostapd/blob/master/src/drivers/linux_ioctl.c
quilt edit src/drivers/linux_ioctl.c # source file to change
quilt refresh # refresh
quilt top # my new patch is at the top
cat debian/patches/rpb_hostapd_openvswitch |less # this is my patch
quilt diff # show the diff colorized
quilt push # add the patch to the list of patches
dch -n # update the changelog and version
debuild -b -uc -us # build with the new patch
# the patch can then be applied and tested (direct from the lxc container):
dpkg -i /var/lib/lxc/apd/rootfs/usr/src/hostapd_2.4-1.1_amd64.deb
With the patch, clients can now successfully associate and authenticate with hostapd when the wireless port is connected to an Open vSwitch bridge.
hostapd sample configurations:
