Only in src/hostapd: .config
diff -aur hostapd-0.7.3/hostapd/config_file.c src/hostapd/config_file.c
--- hostapd-0.7.3/hostapd/config_file.c	2010-09-07 17:43:39.000000000 +0200
+++ src/hostapd/config_file.c	2012-03-22 15:19:28.185455300 +0100
@@ -1493,6 +1493,50 @@
 		} else if (os_strcmp(buf, "radius_retry_primary_interval") ==
 			   0) {
 			bss->radius->retry_primary_interval = atoi(pos);
+		} else if (os_strcmp(buf, "radius_freewifi_gw") ==
+			   0) {
+			struct in_addr in;
+			char *p;
+			u32 bits;
+			u32 ip;
+
+			bits = 32;
+			if ((p = strchr(pos, '/'))) {
+				struct in_addr imask;
+
+				*p++ = 0;
+
+				/* netmask in address format or number
+				 * of bits */
+				if (inet_aton(p, &imask) == 0) {
+					bits = atoi(p);
+					if (bits > 32 || bits < 1) {
+						errors++;
+						wpa_printf(MSG_ERROR,
+							   "Line %d: bad mask",
+							   line);
+						bits = 32;
+					}
+
+				} else {
+					u32 mask;
+
+					mask = ntohl(imask.s_addr);
+					bits = 33 - ffs(mask);
+				}
+			}
+
+			if (inet_aton(pos, &in) == 0) {
+				wpa_printf(MSG_ERROR,
+					   "Line %d: bad freewifi ip %s", line,
+					   pos);
+				errors++;
+			}
+			ip = in.s_addr;
+
+			bss->radius->freewifi_gw = ip;
+			bss->radius->freewifi_gw_count = 1 << (32 - bits);
+
 		} else if (os_strcmp(buf, "radius_acct_interim_interval") == 0)
 		{
 			bss->acct_interim_interval = atoi(pos);
diff -aur hostapd-0.7.3/src/ap/ieee802_1x.c src/src/ap/ieee802_1x.c
--- hostapd-0.7.3/src/ap/ieee802_1x.c	2010-09-07 17:43:39.000000000 +0200
+++ src/src/ap/ieee802_1x.c	2012-03-22 15:27:26.518264827 +0100
@@ -549,6 +551,57 @@
 		}
 	}
 
+	/* add private Freewifi AVP */
+	if (hapd->conf->radius->freewifi_gw) {
+		struct radius_attr_vendor *vhdr;
+		unsigned int hlen;
+		u8 *buf, *pos;
+		u8 last_byte;
+		u32 vendor_id = htonl(RADIUS_VENDOR_ID_FREEBOX);
+		struct in_addr in;
+		u32 gw;
+
+		hlen = sizeof(vendor_id) +  sizeof(*vhdr) + sizeof (gw);
+
+		buf = os_malloc(hlen);
+		if (!buf)
+			goto fail;
+
+		pos = buf;
+		os_memcpy(pos, &vendor_id, sizeof(vendor_id));
+		pos += sizeof(vendor_id);
+
+		vhdr = (struct radius_attr_vendor *)pos;
+		vhdr->vendor_type = RADIUS_VENDOR_ATTR_FBX_FREEWIFI_GW;
+		vhdr->vendor_length = sizeof (*vhdr) + sizeof (gw);
+
+		/* compute freewifi gw from mac */
+		last_byte = sta->addr[5];
+		last_byte %= hapd->conf->radius->freewifi_gw_count;
+
+		gw = hapd->conf->radius->freewifi_gw;
+		gw = htonl(ntohl(gw) + last_byte);
+
+		pos = (u8 *) (vhdr + 1);
+		os_memcpy(pos, &gw, sizeof(gw));
+
+		if (!radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC,
+					 buf, hlen)) {
+			wpa_printf(MSG_DEBUG, "Could not add Freewifi AVP");
+			os_free(buf);
+			goto fail;
+		}
+		os_free(buf);
+
+		in.s_addr = gw;
+		hostapd_logger(hapd, sm->addr, HOSTAPD_MODULE_IEEE8021X,
+			       HOSTAPD_LEVEL_INFO,
+			       "will send STA " MACSTR  " to gw %s",
+			       MAC2STR(sta->addr),
+			       inet_ntoa(in));
+	}
+
+
 	radius_client_send(hapd->radius, msg, RADIUS_AUTH, sta->addr);
 	return;
 
diff -aur hostapd-0.7.3/src/radius/radius_client.h src/src/radius/radius_client.h
--- hostapd-0.7.3/src/radius/radius_client.h	2010-09-07 17:43:39.000000000 +0200
+++ src/src/radius/radius_client.h	2012-03-22 15:16:08.465777034 +0100
@@ -180,6 +180,10 @@
 	 * force_client_addr - Whether to force client (local) address
 	 */
 	int force_client_addr;
+
+
+	u32 freewifi_gw;
+	u32 freewifi_gw_count;
 };
 
 
diff -aur hostapd-0.7.3/src/radius/radius.h src/src/radius/radius.h
--- hostapd-0.7.3/src/radius/radius.h	2010-09-07 17:43:39.000000000 +0200
+++ src/src/radius/radius.h	2012-03-22 15:15:35.457169110 +0100
@@ -161,6 +161,11 @@
        RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY = 17
 };
 
+#define RADIUS_VENDOR_ID_FREEBOX 32456
+
+enum { RADIUS_VENDOR_ATTR_FBX_FREEWIFI_GW = 1,
+};
+
 #ifdef _MSC_VER
 #pragma pack(pop)
 #endif /* _MSC_VER */