控制允许连接hostapd软AP的站点及读取厂商特定IE技术问询

Alright, let's walk through a practical implementation for your 802.11 infrastructure setup with interactive AP access control and vendor-specific IE handling. I'll break this down into AP-side (hostapd) and station-side (wpa_supplicant) steps, with code snippets and actionable commands.

1.1 Inject Vendor-Specific IE into Beacon/Probe Response Frames #

hostapd supports adding custom vendor IEs directly via its config file. You'll define the IE using hex-encoded values:

• First 3 bytes: Your unique OUI (Organizationally Unique Identifier)
• 1 byte: IE type (custom for your use case)
• Remaining bytes: Your payload (hex-encoded ASCII or binary data)

Here's an example hostapd.conf snippet:

interface=wlan0
driver=nl80211
ssid=ControlledAP
hw_mode=g
channel=6
wpa=2
wpa_passphrase=SecurePass123
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

# Vendor IE: OUI 00:11:22, type 0x01, payload "ALLOW" (hex: 414C4C4F57)
vendor_elements=00112201414C4C4F57

You can dynamically update this IE later using hostapd_cli if needed:

hostapd_cli -i wlan0 set vendor_elements 00112201424C4F434B  # Switches payload to "BLOCK"

1.2 Read Vendor-Specific IEs from Connecting Stations #

To capture vendor IEs sent by stations during association, you can either:

Option A: Use hostapd's Control Interface #

Listen for STA connection events and parse IE data via hostapd_cli:

hostapd_cli -i wlan0 event STA_CONNECTED

When a station connects, retrieve its association request IEs (including vendor IEs) using:

hostapd_cli -i wlan0 get_sta <STA_MAC> assoc_req_ies

Option B: Patch hostapd Source Code #

For deeper integration, modify the hostapd code to automatically parse vendor IEs on connection. Add this snippet to src/ap/sta_info.c in the sta_associated function:

struct ieee802_11_elems elems;
if (ieee802_11_parse_elems(sta->assoc_req_ies, sta->assoc_req_ies_len, &elems, 0) == 0) {
    if (elems.vendor_specific) {
        // Check for our OUI (00:11:22)
        if (elems.vendor_specific[0] == 0x00 && elems.vendor_specific[1] == 0x11 && elems.vendor_specific[2] == 0x22) {
            u8 ie_type = elems.vendor_specific[3];
            u8 *payload = elems.vendor_specific + 4;
            size_t payload_len = elems.vendor_specific_len - 4;
            wpa_printf(MSG_INFO, "STA " MACSTR " sent vendor IE (type %d): %.*s",
                       MAC2STR(sta->addr), ie_type, (int)payload_len, payload);
        }
    }
}

Recompile hostapd to apply changes.

1.3 Interactive Access Control for Stations #

Build a simple bash script to interactively allow/block stations using hostapd's MAC filtering:

#!/bin/bash
HOSTAPD_CTRL="/var/run/hostapd/wlan0"

echo "=== AP Interactive Access Control ==="
echo "Commands: allow <MAC>, block <MAC>, list, quit"

while true; do
    read -p "> " cmd arg
    case $cmd in
        allow)
            hostapd_cli -i wlan0 macaddr add $arg
            echo "✅ Allowed MAC: $arg"
            ;;
        block)
            hostapd_cli -i wlan0 macaddr remove $arg
            echo "❌ Blocked MAC: $arg"
            ;;
        list)
            echo "📋 Allowed MACs:"
            hostapd_cli -i wlan0 macaddr list
            ;;
        quit)
            echo "👋 Exiting..."
            exit 0
            ;;
        *)
            echo "❓ Unknown command. Try allow/block/list/quit."
            ;;
    esac
done

Make it executable with chmod +x ap_control.sh and run it. This script uses hostapd's built-in MAC whitelisting to control access.

2.1 Parse AP Vendor IEs and Decide Connection #

wpa_supplicant doesn't natively filter APs by vendor IEs, so you have two options:

Option A: External Script with wpa_cli #

Write a bash script to scan for APs, parse their vendor IEs, and only connect to allowed ones:

#!/bin/bash
WPA_CTRL="/var/run/wpa_supplicant/wlan0"
TARGET_SSID="ControlledAP"
ALLOWED_VENDOR_IE="00112201414C4C4F57"  # OUI 00:11:22 + type 0x01 + "ALLOW"

# Trigger scan
wpa_cli -i wlan0 scan
sleep 2

# Parse scan results
wpa_cli -i wlan0 scan_results | while read line; do
    bssid=$(echo $line | awk '{print $1}')
    ssid=$(echo $line | awk '{print $4}')
    ies=$(echo $line | awk '{print $NF}')
    
    if [[ "$ssid" == "$TARGET_SSID" && "$ies" == *"$ALLOWED_VENDOR_IE"* ]]; then
        echo "🔌 Connecting to allowed AP: $bssid"
        wpa_cli -i wlan0 connect "$TARGET_SSID"
        exit 0
    fi
done

echo "❌ No allowed AP found matching criteria."

Option B: Patch wpa_supplicant Source Code #

For seamless integration, modify wpa_supplicant to automatically filter APs based on vendor IEs:

1. Add a flag to mark allowed APs in src/wpa_supplicant/bss.c (update bss_update function):

struct ieee802_11_elems elems;
if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) == 0) {
    if (elems.vendor_specific) {
        if (elems.vendor_specific[0] == 0x00 && elems.vendor_specific[1] == 0x11 && elems.vendor_specific[2] == 0x22) {
            if (elems.vendor_specific_len >= 9 && memcmp(elems.vendor_specific+4, "ALLOW", 5) == 0) {
                bss->flags |= BSS_FLAG_USER1;  // Reuse an unused flag to mark allowed APs
            } else {
                bss->flags &= ~BSS_FLAG_USER1;
            }
        }
    }
}

2. Filter allowed APs in src/wpa_supplicant/wpa_supplicant.c (update wpa_supplicant_select_bss function):

if (!(bss->flags & BSS_FLAG_USER1)) {
    continue;  // Skip non-allowed APs
}

Recompile wpa_supplicant to apply changes.

2.2 Send Vendor-Specific IEs from Station (Optional) #

If your AP needs to read vendor IEs from the station, add this to your wpa_supplicant.conf network block:

network={
    ssid="ControlledAP"
    psk="SecurePass123"
    # Send vendor IE: OUI 00:11:22, type 0x02, payload "STATION" (hex: 53544154494F4E)
    vendor_elements=0011220253544154494F4E
}

1. Start hostapd in debug mode to verify IE injection:

   hostapd /etc/hostapd/hostapd.conf -dd
   

2. Start wpa_supplicant in debug mode to check IE parsing:

   wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf -dd
   

3. Run the interactive AP control script to allow/block MAC addresses and test station connections.
4. Check logs for vendor IE-related messages to confirm everything works as expected.

内容的提问来源于stack exchange，提问作者oh.dae.su