--- /dev/null
+--- a/hostapd/config.c
++++ b/hostapd/config.c
+@@ -1526,6 +1526,8 @@ struct hostapd_config * hostapd_config_r
+ line, pos);
+ errors++;
+ }
++ } else if (os_strcmp(buf, "wds_sta") == 0) {
++ bss->wds_sta = atoi(pos);
+ } else if (os_strcmp(buf, "ap_max_inactivity") == 0) {
+ bss->ap_max_inactivity = atoi(pos);
+ } else if (os_strcmp(buf, "country_code") == 0) {
+--- a/hostapd/config.h
++++ b/hostapd/config.h
+@@ -198,6 +198,7 @@ struct hostapd_bss_config {
+ int num_accept_mac;
+ struct mac_acl_entry *deny_mac;
+ int num_deny_mac;
++ int wds_sta;
+
+ int auth_algs; /* bitfield of allowed IEEE 802.11 authentication
+ * algorithms, WPA_AUTH_ALG_{OPEN,SHARED,LEAP} */
+--- a/src/drivers/driver.h
++++ b/src/drivers/driver.h
+@@ -1305,6 +1305,7 @@ struct wpa_driver_ops {
+ const char *ifname, const u8 *addr);
+ int (*set_sta_vlan)(void *priv, const u8 *addr, const char *ifname,
+ int vlan_id);
++ int (*set_wds_sta)(void *priv, const u8 *addr, int aid, int val);
+ /**
+ * commit - Optional commit changes handler
+ * @priv: driver private data
+--- a/src/drivers/driver_nl80211.c
++++ b/src/drivers/driver_nl80211.c
+@@ -2755,7 +2755,7 @@ static void nl80211_remove_iface(struct
+ static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
+ const char *ifname,
+ enum nl80211_iftype iftype,
+- const u8 *addr)
++ const u8 *addr, int wds)
+ {
+ struct nl_msg *msg, *flags = NULL;
+ int ifidx;
+@@ -2786,6 +2786,8 @@ static int nl80211_create_iface_once(str
+
+ if (err)
+ goto nla_put_failure;
++ } else if (wds) {
++ NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
+ }
+
+ ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+@@ -2816,11 +2818,11 @@ static int nl80211_create_iface_once(str
+ }
+ static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
+ const char *ifname, enum nl80211_iftype iftype,
+- const u8 *addr)
++ const u8 *addr, int wds)
+ {
+ int ret;
+
+- ret = nl80211_create_iface_once(drv, ifname, iftype, addr);
++ ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
+
+ /* if error occured and interface exists already */
+ if (ret == -ENFILE && if_nametoindex(ifname)) {
+@@ -2830,7 +2832,7 @@ static int nl80211_create_iface(struct w
+ nl80211_remove_iface(drv, if_nametoindex(ifname));
+
+ /* Try to create the interface again */
+- ret = nl80211_create_iface_once(drv, ifname, iftype, addr);
++ ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
+ }
+
+ return ret;
+@@ -3055,7 +3057,7 @@ static struct sock_filter msock_filter_i
+
+ #if 0
+ /*
+- * drop non-data frames, WDS frames
++ * drop non-data frames
+ */
+ /* load the lower byte of the frame control field */
+ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
+@@ -3063,13 +3065,13 @@ static struct sock_filter msock_filter_i
+ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0c),
+ /* drop non-data frames */
+ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 8, 0, FAIL),
++#endif
+ /* load the upper byte of the frame control field */
+- BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
++ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 1),
+ /* mask off toDS/fromDS */
+ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x03),
+- /* drop WDS frames */
+- BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, FAIL, 0),
+-#endif
++ /* accept WDS frames */
++ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, PASS, 0),
+
+ /*
+ * add header length to index
+@@ -3175,7 +3177,7 @@ nl80211_create_monitor_interface(struct
+ buf[IFNAMSIZ - 1] = '\0';
+
+ drv->monitor_ifidx =
+- nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL);
++ nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL, 0);
+
+ if (drv->monitor_ifidx < 0)
+ return -1;
+@@ -4155,7 +4157,7 @@ static int i802_bss_add(void *priv, cons
+ if (bss == NULL)
+ return -1;
+
+- ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid);
++ ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid, 0);
+ if (ifidx < 0) {
+ os_free(bss);
+ return -1;
+@@ -4264,7 +4266,7 @@ static int i802_if_add(const char *iface
+ enum hostapd_driver_if_type type, char *ifname,
+ const u8 *addr)
+ {
+- if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr) < 0)
++ if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr, 0) < 0)
+ return -1;
+ return 0;
+ }
+@@ -4310,6 +4312,21 @@ static int i802_set_sta_vlan(void *priv,
+ return -ENOBUFS;
+ }
+
++static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val)
++{
++ struct wpa_driver_nl80211_data *drv = priv;
++ char name[16];
++
++ sprintf(name, "%s.sta%d", drv->ifname, aid);
++ if (val) {
++ if (nl80211_create_iface(priv, name, NL80211_IFTYPE_AP_VLAN, NULL, 1) < 0)
++ return -1;
++ return i802_set_sta_vlan(priv, addr, name, 0);
++ } else {
++ i802_set_sta_vlan(priv, addr, drv->ifname, 0);
++ return i802_if_remove(priv, HOSTAPD_IF_VLAN, name, NULL);
++ }
++}
+
+ static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
+ {
+@@ -4536,5 +4553,6 @@ const struct wpa_driver_ops wpa_driver_n
+ .if_update = i802_if_update,
+ .if_remove = i802_if_remove,
+ .set_sta_vlan = i802_set_sta_vlan,
++ .set_wds_sta = i802_set_wds_sta,
+ #endif /* HOSTAPD */
+ };
+--- a/hostapd/driver_i.h
++++ b/hostapd/driver_i.h
+@@ -453,6 +453,14 @@ hostapd_set_sta_vlan(const char *ifname,
+ }
+
+ static inline int
++hostapd_set_wds_sta(struct hostapd_data *hapd, const u8 *addr, int aid, int val)
++{
++ if (hapd->driver == NULL || hapd->driver->set_wds_sta == NULL)
++ return 0;
++ return hapd->driver->set_wds_sta(hapd->drv_priv, addr, aid, val);
++}
++
++static inline int
+ hostapd_driver_commit(struct hostapd_data *hapd)
+ {
+ if (hapd->driver == NULL || hapd->driver->commit == NULL)
+--- a/hostapd/drv_callbacks.c
++++ b/hostapd/drv_callbacks.c
+@@ -167,6 +167,7 @@ static const u8 * get_hdr_bssid(const st
+ if (len < 24)
+ return NULL;
+ switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
++ case WLAN_FC_FROMDS|WLAN_FC_TODS:
+ case WLAN_FC_TODS:
+ return hdr->addr1;
+ case WLAN_FC_FROMDS:
+@@ -213,6 +214,7 @@ void hostapd_rx_from_unknown_sta(struct
+ {
+ struct sta_info *sta;
+ const u8 *addr;
++ u16 fc = le_to_host16(hdr->frame_control);
+
+ hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
+ if (hapd == NULL || hapd == HAPD_BROADCAST)
+@@ -231,6 +233,14 @@ void hostapd_rx_from_unknown_sta(struct
+ hostapd_sta_deauth(
+ hapd, addr,
+ WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
++ } else {
++ if (!sta->wds_sta) {
++ if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
++ (WLAN_FC_TODS | WLAN_FC_FROMDS)) {
++ sta->wds_sta = 1;
++ hostapd_set_wds_sta(hapd, addr, sta->aid, 1);
++ }
++ }
+ }
+ }
+
+--- a/hostapd/sta_info.c
++++ b/hostapd/sta_info.c
+@@ -120,6 +120,7 @@ void ap_free_sta(struct hostapd_data *ha
+
+ accounting_sta_stop(hapd, sta);
+
++ hostapd_set_wds_sta(hapd, sta->addr, sta->aid, 0);
+ if (!ap_sta_in_other_bss(hapd, sta, WLAN_STA_ASSOC) &&
+ !(sta->flags & WLAN_STA_PREAUTH))
+ hostapd_sta_remove(hapd, sta->addr);
+--- a/hostapd/sta_info.h
++++ b/hostapd/sta_info.h
+@@ -78,6 +78,7 @@ struct sta_info {
+ struct hostapd_ssid *ssid_probe; /* SSID selection based on ProbeReq */
+
+ int vlan_id;
++ int wds_sta;
+
+ #ifdef CONFIG_IEEE80211N
+ struct ht_cap_ie ht_capabilities; /* IEEE 802.11n capabilities */
+--- a/src/common/nl80211_copy.h
++++ b/src/common/nl80211_copy.h
+@@ -584,6 +584,8 @@ enum nl80211_commands {
+ * changed then the list changed and the dump should be repeated
+ * completely from scratch.
+ *
++ * @NL80211_ATTR_4ADDR: Use 4-address frames on a virtual interface
++ *
+ * @NL80211_ATTR_MAX: highest attribute number currently defined
+ * @__NL80211_ATTR_AFTER_LAST: internal use
+ */
+@@ -714,6 +716,8 @@ enum nl80211_attrs {
+
+ NL80211_ATTR_PID,
+
++ NL80211_ATTR_4ADDR,
++
+ /* add attributes here, update the policy in nl80211.c */
+
+ __NL80211_ATTR_AFTER_LAST,