From 068669fc92c3c834892684d3c12e48451991aa15 Mon Sep 17 00:00:00 2001 From: Michael Braun Date: Tue, 14 Apr 2015 16:56:38 +0200 Subject: [PATCH] vlan: Verify RADIUS returned VLAN-ID and dynamic_vlan=required This extends dynamic_vlan=required checks to apply for WPA-PSK with macaddr_acl=2 (RADIUS) case. Signed-off-by: Michael Braun --- src/ap/ieee802_11_auth.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c index 56c3ce031..0238257dd 100644 --- a/src/ap/ieee802_11_auth.c +++ b/src/ap/ieee802_11_auth.c @@ -561,6 +561,19 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req, if (hapd->conf->wpa_psk_radius == PSK_RADIUS_REQUIRED && !cache->psk) cache->accepted = HOSTAPD_ACL_REJECT; + + if (cache->vlan_id && + !hostapd_vlan_id_valid(hapd->conf->vlan, cache->vlan_id)) { + hostapd_logger(hapd, query->addr, + HOSTAPD_MODULE_RADIUS, + HOSTAPD_LEVEL_INFO, + "Invalid VLAN ID %d received from RADIUS server", + cache->vlan_id); + cache->vlan_id = 0; + } + if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_REQUIRED && + !cache->vlan_id) + cache->accepted = HOSTAPD_ACL_REJECT; } else cache->accepted = HOSTAPD_ACL_REJECT; cache->next = hapd->acl_cache;