hostap mode and wpa-psk with ral(4) problem

[Sam Leffler]

Jacco Braat wrote:
> Hi,
> 
> more people have problem with ral driver in hostap mode. the maintainer
> knows about it and promised to look into it before 6.1 release
> http://damien.bergamini.free.fr/ral/forum/read.php?f=1&i=225&t=163#reply_225
> 
> authentication is succesfull, but there is a problem with arp and dhcp.
> 
> in sys/net80211/ieee80211_input.c (ieee80211_deliver_data) there is some
> code to bridge incomming packets to other connected stations. It looks
> like the driver does not handle these packets correctly.  
> 
> ifconfig wifi0 -apbridge
> 
> disables this feature, then you should be able to connect normally

I just tested both ath and ral in hostap w/ wpa-psk and both worked fine 
for me (powerbook as sta/supplicant, tkip for ptk+gtk).  I did notice 
one bogon in ieee80211_deliver_data that might be causing the problem. 
When apbridge is enabled multicast frames are duplicated with 
m_copypacket which does a shallow copy and not a deep copy of the frame. 
  If the data resides in a cluster (as is typical) then when the frame 
is turned around for retransmit over the wireless interface the output 
path may alter the mbuf contents.  If this happens before the original 
packet gets passed through the bridge and out the wired interface then I 
can imagine problems of the sort reported.  Not sure why this never 
surfaced before but if I'm right the attached change should fix the 
problem (the patch is against stable but should be usable on head).

	Sam
-------------- next part --------------
Index: ieee80211_input.c
===================================================================
RCS file: /usr/ncvs/src/sys/net80211/ieee80211_input.c,v
retrieving revision 1.62.2.9
diff -u -r1.62.2.9 ieee80211_input.c
--- ieee80211_input.c	16 Feb 2006 16:57:24 -0000	1.62.2.9
+++ ieee80211_input.c	6 Mar 2006 20:25:29 -0000
@@ -674,7 +674,7 @@
 		struct mbuf *m1 = NULL;
 
 		if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
-			m1 = m_copypacket(m, M_DONTWAIT);
+			m1 = m_dup(m, M_DONTWAIT);
 			if (m1 == NULL)
 				ifp->if_oerrors++;
 			else