]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
OCV: Include and verify OCI in the FT handshake
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
c8942286 2# Copyright (c) 2013-2017, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
c8942286 13import struct
cd7f1b9a
JM		 14
15import hwsim_utils
16import hostapd
d7f0bef9 17from tshark import run_tshark
c8942286 18from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 19from wlantest import Wlantest
5b3c40a6 20from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 21from test_rrm import check_beacon_req
cd7f1b9a
JM		 22
23def ft_base_rsn():
24 params = { "wpa": "2",
25 "wpa_key_mgmt": "FT-PSK",
26 "rsn_pairwise": "CCMP" }
27 return params
28
29def ft_base_mixed():
30 params = { "wpa": "3",
31 "wpa_key_mgmt": "WPA-PSK FT-PSK",
32 "wpa_pairwise": "TKIP",
33 "rsn_pairwise": "CCMP" }
34 return params
35
36def ft_params(rsn=True, ssid=None, passphrase=None):
37 if rsn:
38 params = ft_base_rsn()
39 else:
40 params = ft_base_mixed()
41 if ssid:
42 params["ssid"] = ssid
43 if passphrase:
44 params["wpa_passphrase"] = passphrase
45
46 params["mobility_domain"] = "a1b2"
47 params["r0_key_lifetime"] = "10000"
48 params["pmk_r1_push"] = "1"
49 params["reassociation_deadline"] = "1000"
50 return params
51
d0175d6e 52def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 53 params = ft_params(rsn, ssid, passphrase)
54 params['nas_identifier'] = "nas1.w1.fi"
55 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 56 return params
57
942b52a8 58def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 59 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 60 if discovery:
61 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
62 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
63 else:
64 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
65 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
66 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 67 return params
68
c95dd8e4
JM		 69def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
70 params = ft_params1a(rsn, ssid, passphrase)
71 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
72 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
73 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
74 return params
75
d0175d6e 76def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 77 params = ft_params(rsn, ssid, passphrase)
78 params['nas_identifier'] = "nas2.w1.fi"
79 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 80 return params
81
942b52a8 82def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 83 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 84 if discovery:
85 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
86 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
87 else:
88 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
89 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
90 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 91 return params
92
c95dd8e4
JM		 93def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
94 params = ft_params2a(rsn, ssid, passphrase)
95 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
96 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
97 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
98 return params
99
3b808945
JM		 100def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
101 params = ft_params(rsn, ssid, passphrase)
102 params['nas_identifier'] = "nas1.w1.fi"
103 params['r1_key_holder'] = "000102030405"
9441a227
MB		 104 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
105 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
106 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 107 return params
108
109def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
110 params = ft_params(rsn, ssid, passphrase)
111 params['nas_identifier'] = "nas2.w1.fi"
112 params['r1_key_holder'] = "000102030406"
9441a227
MB		 113 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
114 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
115 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 116 return params
117
118def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
119 params = ft_params(rsn, ssid, passphrase)
120 params['nas_identifier'] = "nas2.w1.fi"
121 params['r1_key_holder'] = "000102030406"
9441a227
MB		 122 params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
123 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
124 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 125 return params
126
7b741a53
JM		 127def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
128 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 129 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 130 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68
JM		 131 force_initial_conn_to_first_ap=False, sha384=False,
132 group_mgmt=None):
cd7f1b9a 133 logger.info("Connect to first AP")
473e5176
MB		 134
135 copts = {}
136 copts["proto"] = "WPA2"
137 copts["ieee80211w"] = "1"
138 copts["scan_freq"] = "2412"
139 copts["pairwise"] = pairwise_cipher
140 copts["group"] = group_cipher
141 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 142 if group_mgmt:
143 copts["group_mgmt"] = group_mgmt
6f62809b 144 if eap:
55b3cda7 145 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 146 copts["eap"] = "GPSK"
147 copts["identity"] = eap_identity
148 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 149 else:
6f62809b 150 if sae:
473e5176 151 copts["key_mgmt"] = "FT-SAE"
6f62809b 152 else:
473e5176
MB		 153 copts["key_mgmt"] = "FT-PSK"
154 copts["psk"] = passphrase
155 if force_initial_conn_to_first_ap:
156 copts["bssid"] = apdev[0]['bssid']
157 dev.connect(ssid, **copts)
158
cd7f1b9a
JM		 159 if dev.get_status_field('bssid') == apdev[0]['bssid']:
160 ap1 = apdev[0]
161 ap2 = apdev[1]
a8375c94
JM		 162 hapd1ap = hapd0
163 hapd2ap = hapd1
cd7f1b9a
JM		 164 else:
165 ap1 = apdev[1]
166 ap2 = apdev[0]
a8375c94
JM		 167 hapd1ap = hapd1
168 hapd2ap = hapd0
fd7205fa 169 if test_connectivity:
9c50a6d3
MB		 170 if conndev:
171 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
172 else:
173 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 174
655bc8bf 175 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 176
177 for i in range(0, roams):
e0382291
MB		 178 # Roaming artificially fast can make data test fail because the key is
179 # set later.
180 time.sleep(0.01)
40602101
JM		 181 logger.info("Roam to the second AP")
182 if over_ds:
183 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
184 else:
185 dev.roam(ap2['bssid'], fail_test=fail_test)
186 if fail_test:
187 return
188 if dev.get_status_field('bssid') != ap2['bssid']:
189 raise Exception("Did not connect to correct AP")
fd7205fa 190 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 191 if conndev:
192 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
193 else:
194 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 195
e0382291
MB		 196 # Roaming artificially fast can make data test fail because the key is
197 # set later.
198 time.sleep(0.01)
40602101
JM		 199 logger.info("Roam back to the first AP")
200 if over_ds:
201 dev.roam_over_ds(ap1['bssid'])
202 else:
203 dev.roam(ap1['bssid'])
204 if dev.get_status_field('bssid') != ap1['bssid']:
205 raise Exception("Did not connect to correct AP")
fd7205fa 206 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 207 if conndev:
208 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
209 else:
210 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 211
212def test_ap_ft(dev, apdev):
213 """WPA2-PSK-FT AP"""
214 ssid = "test-ft"
215 passphrase="12345678"
216
217 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 218 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 219 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 220 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 221
a8375c94 222 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 223 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
224 raise Exception("Scan results missing RSN element info")
cd7f1b9a 225
c95dd8e4
JM		 226def test_ap_ft_old_key(dev, apdev):
227 """WPA2-PSK-FT AP (old key)"""
228 ssid = "test-ft"
229 passphrase="12345678"
230
231 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
232 hapd0 = hostapd.add_ap(apdev[0], params)
233 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
234 hapd1 = hostapd.add_ap(apdev[1], params)
235
236 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
237
e4612f84
JM		 238def test_ap_ft_multi_akm(dev, apdev):
239 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
240 ssid = "test-ft"
241 passphrase="12345678"
242
243 params = ft_params1(ssid=ssid, passphrase=passphrase)
244 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
245 hapd0 = hostapd.add_ap(apdev[0], params)
246 params = ft_params2(ssid=ssid, passphrase=passphrase)
247 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
248 hapd1 = hostapd.add_ap(apdev[1], params)
249
250 Wlantest.setup(hapd0)
251 wt = Wlantest()
252 wt.flush()
253 wt.add_passphrase(passphrase)
254
255 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
256 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
257 raise Exception("Scan results missing RSN element info")
258 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
259 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
260 scan_freq="2412")
261
d0175d6e
MB		 262def test_ap_ft_local_key_gen(dev, apdev):
263 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
264 ssid = "test-ft"
265 passphrase="12345678"
266
267 params = ft_params1a(ssid=ssid, passphrase=passphrase)
268 params['ft_psk_generate_local'] = "1";
8344ba12 269 del params['pmk_r1_push']
b098542c 270 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e
MB		 271 params = ft_params2a(ssid=ssid, passphrase=passphrase)
272 params['ft_psk_generate_local'] = "1";
8344ba12 273 del params['pmk_r1_push']
b098542c 274 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 275
276 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
277 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
278 raise Exception("Scan results missing RSN element info")
279
473e5176
MB		 280def test_ap_ft_vlan(dev, apdev):
281 """WPA2-PSK-FT AP with VLAN"""
282 ssid = "test-ft"
283 passphrase="12345678"
284
285 params = ft_params1(ssid=ssid, passphrase=passphrase)
286 params['dynamic_vlan'] = "1";
287 params['accept_mac_file'] = "hostapd.accept";
288 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
289
290 params = ft_params2(ssid=ssid, passphrase=passphrase)
291 params['dynamic_vlan'] = "1";
292 params['accept_mac_file'] = "hostapd.accept";
293 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
294
295 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
296 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
297 raise Exception("Scan results missing RSN element info")
298
299def test_ap_ft_vlan_disconnected(dev, apdev):
300 """WPA2-PSK-FT AP with VLAN and local key generation"""
301 ssid = "test-ft"
302 passphrase="12345678"
303
304 params = ft_params1a(ssid=ssid, passphrase=passphrase)
305 params['dynamic_vlan'] = "1";
306 params['accept_mac_file'] = "hostapd.accept";
307 params['ft_psk_generate_local'] = "1";
308 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
309
310 params = ft_params2a(ssid=ssid, passphrase=passphrase)
311 params['dynamic_vlan'] = "1";
312 params['accept_mac_file'] = "hostapd.accept";
313 params['ft_psk_generate_local'] = "1";
314 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
315
316 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
317 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
318 raise Exception("Scan results missing RSN element info")
319
320def test_ap_ft_vlan_2(dev, apdev):
321 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
322 ssid = "test-ft"
323 passphrase="12345678"
324
325 params = ft_params1(ssid=ssid, passphrase=passphrase)
326 params['dynamic_vlan'] = "1";
327 params['accept_mac_file'] = "hostapd.accept";
328 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
329
330 params = ft_params2(ssid=ssid, passphrase=passphrase)
331 params['dynamic_vlan'] = "1";
332 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
333
334 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
335 force_initial_conn_to_first_ap=True)
336 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
337 raise Exception("Scan results missing RSN element info")
338
40602101
JM		 339def test_ap_ft_many(dev, apdev):
340 """WPA2-PSK-FT AP multiple times"""
341 ssid = "test-ft"
342 passphrase="12345678"
343
344 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 345 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 346 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 347 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 348
a8375c94 349 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 350
473e5176
MB		 351def test_ap_ft_many_vlan(dev, apdev):
352 """WPA2-PSK-FT AP with VLAN multiple times"""
353 ssid = "test-ft"
354 passphrase="12345678"
355
356 params = ft_params1(ssid=ssid, passphrase=passphrase)
357 params['dynamic_vlan'] = "1";
358 params['accept_mac_file'] = "hostapd.accept";
359 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
360
361 params = ft_params2(ssid=ssid, passphrase=passphrase)
362 params['dynamic_vlan'] = "1";
363 params['accept_mac_file'] = "hostapd.accept";
364 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
365
366 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
367 conndev="brvlan1")
368
cd7f1b9a
JM		 369def test_ap_ft_mixed(dev, apdev):
370 """WPA2-PSK-FT mixed-mode AP"""
371 ssid = "test-ft-mixed"
372 passphrase="12345678"
373
374 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 375 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 376 key_mgmt = hapd.get_config()['key_mgmt']
377 vals = key_mgmt.split(' ')
378 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
379 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 380 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 381 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 382
a8375c94 383 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 384
385def test_ap_ft_pmf(dev, apdev):
386 """WPA2-PSK-FT AP with PMF"""
387 ssid = "test-ft"
388 passphrase="12345678"
389
390 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 391 params["ieee80211w"] = "2"
8b8a1864 392 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 393 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 394 params["ieee80211w"] = "2"
8b8a1864 395 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 396
a8375c94 397 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 398
ffcaca68
JM		 399def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
400 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
401 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
402
403def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
404 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
405 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
406
407def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
408 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
409 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
410
411def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
412 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
413 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
414
415def run_ap_ft_pmf_bip(dev, apdev, cipher):
416 if cipher not in dev[0].get_capability("group_mgmt"):
417 raise HwsimSkip("Cipher %s not supported" % cipher)
418
419 ssid = "test-ft"
420 passphrase="12345678"
421
422 params = ft_params1(ssid=ssid, passphrase=passphrase)
423 params["ieee80211w"] = "2"
424 params["group_mgmt_cipher"] = cipher
425 hapd0 = hostapd.add_ap(apdev[0], params)
426 params = ft_params2(ssid=ssid, passphrase=passphrase)
427 params["ieee80211w"] = "2"
428 params["group_mgmt_cipher"] = cipher
429 hapd1 = hostapd.add_ap(apdev[1], params)
430
431 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
432 group_mgmt=cipher)
433
b553eab1
JM		 434def test_ap_ft_over_ds(dev, apdev):
435 """WPA2-PSK-FT AP over DS"""
436 ssid = "test-ft"
437 passphrase="12345678"
438
439 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 440 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 441 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 442 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 443
a8375c94 444 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
eaf3f9b1
JM		 445 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
446 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
b553eab1 447
55139acb
JM		 448def test_ap_ft_over_ds_disabled(dev, apdev):
449 """WPA2-PSK-FT AP over DS disabled"""
450 ssid = "test-ft"
451 passphrase="12345678"
452
453 params = ft_params1(ssid=ssid, passphrase=passphrase)
454 params['ft_over_ds'] = '0'
455 hapd0 = hostapd.add_ap(apdev[0], params)
456 params = ft_params2(ssid=ssid, passphrase=passphrase)
457 params['ft_over_ds'] = '0'
458 hapd1 = hostapd.add_ap(apdev[1], params)
459
460 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
461 fail_test=True)
462
473e5176
MB		 463def test_ap_ft_vlan_over_ds(dev, apdev):
464 """WPA2-PSK-FT AP over DS with VLAN"""
465 ssid = "test-ft"
466 passphrase="12345678"
467
468 params = ft_params1(ssid=ssid, passphrase=passphrase)
469 params['dynamic_vlan'] = "1";
470 params['accept_mac_file'] = "hostapd.accept";
471 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
472 params = ft_params2(ssid=ssid, passphrase=passphrase)
473 params['dynamic_vlan'] = "1";
474 params['accept_mac_file'] = "hostapd.accept";
475 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
476
477 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
478 conndev="brvlan1")
479 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
480 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
481
40602101
JM		 482def test_ap_ft_over_ds_many(dev, apdev):
483 """WPA2-PSK-FT AP over DS multiple times"""
484 ssid = "test-ft"
485 passphrase="12345678"
486
487 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 488 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 489 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 490 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 491
a8375c94
JM		 492 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
493 roams=50)
40602101 494
473e5176
MB		 495def test_ap_ft_vlan_over_ds_many(dev, apdev):
496 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
497 ssid = "test-ft"
498 passphrase="12345678"
499
500 params = ft_params1(ssid=ssid, passphrase=passphrase)
501 params['dynamic_vlan'] = "1";
502 params['accept_mac_file'] = "hostapd.accept";
503 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
504 params = ft_params2(ssid=ssid, passphrase=passphrase)
505 params['dynamic_vlan'] = "1";
506 params['accept_mac_file'] = "hostapd.accept";
507 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
508
509 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
510 roams=50, conndev="brvlan1")
511
9fd6804d 512@remote_compatible
c337d07a
JM		 513def test_ap_ft_over_ds_unknown_target(dev, apdev):
514 """WPA2-PSK-FT AP"""
515 ssid = "test-ft"
516 passphrase="12345678"
517
518 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 519 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 520
521 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
522 scan_freq="2412")
523 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
524
9fd6804d 525@remote_compatible
211bb7c5
JM		 526def test_ap_ft_over_ds_unexpected(dev, apdev):
527 """WPA2-PSK-FT AP over DS and unexpected response"""
528 ssid = "test-ft"
529 passphrase="12345678"
530
531 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 532 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 533 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 534 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 535
536 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
537 scan_freq="2412")
538 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
539 ap1 = apdev[0]
540 ap2 = apdev[1]
541 hapd1ap = hapd0
542 hapd2ap = hapd1
543 else:
544 ap1 = apdev[1]
545 ap2 = apdev[0]
546 hapd1ap = hapd1
547 hapd2ap = hapd0
548
549 addr = dev[0].own_addr()
550 hapd1ap.set("ext_mgmt_frame_handling", "1")
551 logger.info("Foreign STA address")
552 msg = {}
553 msg['fc'] = 13 << 4
554 msg['da'] = addr
555 msg['sa'] = ap1['bssid']
556 msg['bssid'] = ap1['bssid']
557 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
558 hapd1ap.mgmt_tx(msg)
559
560 logger.info("No over-the-DS in progress")
561 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
562 hapd1ap.mgmt_tx(msg)
563
564 logger.info("Non-zero status code")
565 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
566 hapd1ap.mgmt_tx(msg)
567
568 hapd1ap.dump_monitor()
569
570 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
571 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
572 raise Exception("FT_DS failed")
573
574 req = hapd1ap.mgmt_rx()
575
576 logger.info("Foreign Target AP")
577 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
578 hapd1ap.mgmt_tx(msg)
579
580 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
581
582 logger.info("No IEs")
583 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
584 hapd1ap.mgmt_tx(msg)
585
586 logger.info("Invalid IEs (trigger parsing failure)")
587 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
588 hapd1ap.mgmt_tx(msg)
589
590 logger.info("Too short MDIE")
591 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
592 hapd1ap.mgmt_tx(msg)
593
594 logger.info("Mobility domain mismatch")
595 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
596 hapd1ap.mgmt_tx(msg)
597
598 logger.info("No FTIE")
599 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
600 hapd1ap.mgmt_tx(msg)
601
602 logger.info("FTIE SNonce mismatch")
603 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
604 hapd1ap.mgmt_tx(msg)
605
606 logger.info("No R0KH-ID subelem in FTIE")
607 snonce = binascii.hexlify(req['payload'][111:111+32])
608 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
609 hapd1ap.mgmt_tx(msg)
610
611 logger.info("No R0KH-ID subelem mismatch in FTIE")
612 snonce = binascii.hexlify(req['payload'][111:111+32])
613 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
614 hapd1ap.mgmt_tx(msg)
615
616 logger.info("No R1KH-ID subelem in FTIE")
617 r0khid = binascii.hexlify(req['payload'][145:145+10])
618 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
619 hapd1ap.mgmt_tx(msg)
620
621 logger.info("No RSNE")
622 r0khid = binascii.hexlify(req['payload'][145:145+10])
623 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
624 hapd1ap.mgmt_tx(msg)
625
b553eab1
JM		 626def test_ap_ft_pmf_over_ds(dev, apdev):
627 """WPA2-PSK-FT AP over DS with PMF"""
628 ssid = "test-ft"
629 passphrase="12345678"
630
631 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 632 params["ieee80211w"] = "2"
8b8a1864 633 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 634 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 635 params["ieee80211w"] = "2"
8b8a1864 636 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 637
ffcaca68
JM		 638def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
639 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
640 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
641
642def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
643 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
644 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
645
646def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
647 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
648 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
649
650def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
651 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
652 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
653
654def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
655 if cipher not in dev[0].get_capability("group_mgmt"):
656 raise HwsimSkip("Cipher %s not supported" % cipher)
657
658 ssid = "test-ft"
659 passphrase="12345678"
660
661 params = ft_params1(ssid=ssid, passphrase=passphrase)
662 params["ieee80211w"] = "2"
663 params["group_mgmt_cipher"] = cipher
664 hapd0 = hostapd.add_ap(apdev[0], params)
665 params = ft_params2(ssid=ssid, passphrase=passphrase)
666 params["ieee80211w"] = "2"
667 params["group_mgmt_cipher"] = cipher
668 hapd1 = hostapd.add_ap(apdev[1], params)
669
670 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
671 group_mgmt=cipher)
6e658cc4 672
aaba98d3
JM		 673def test_ap_ft_over_ds_pull(dev, apdev):
674 """WPA2-PSK-FT AP over DS (pull PMK)"""
675 ssid = "test-ft"
676 passphrase="12345678"
677
678 params = ft_params1(ssid=ssid, passphrase=passphrase)
679 params["pmk_r1_push"] = "0"
8b8a1864 680 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 681 params = ft_params2(ssid=ssid, passphrase=passphrase)
682 params["pmk_r1_push"] = "0"
8b8a1864 683 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 684
a8375c94 685 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 686
c95dd8e4
JM		 687def test_ap_ft_over_ds_pull_old_key(dev, apdev):
688 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
689 ssid = "test-ft"
690 passphrase="12345678"
691
692 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
693 params["pmk_r1_push"] = "0"
694 hapd0 = hostapd.add_ap(apdev[0], params)
695 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
696 params["pmk_r1_push"] = "0"
697 hapd1 = hostapd.add_ap(apdev[1], params)
698
699 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
700
473e5176
MB		 701def test_ap_ft_over_ds_pull_vlan(dev, apdev):
702 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
703 ssid = "test-ft"
704 passphrase="12345678"
705
706 params = ft_params1(ssid=ssid, passphrase=passphrase)
707 params["pmk_r1_push"] = "0"
708 params['dynamic_vlan'] = "1";
709 params['accept_mac_file'] = "hostapd.accept";
710 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
711 params = ft_params2(ssid=ssid, passphrase=passphrase)
712 params["pmk_r1_push"] = "0"
713 params['dynamic_vlan'] = "1";
714 params['accept_mac_file'] = "hostapd.accept";
715 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
716
717 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
718 conndev="brvlan1")
719
6e658cc4
JM		 720def test_ap_ft_sae(dev, apdev):
721 """WPA2-PSK-FT-SAE AP"""
b9749b6a
JM		 722 if "SAE" not in dev[0].get_capability("auth_alg"):
723 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 724 ssid = "test-ft"
725 passphrase="12345678"
726
727 params = ft_params1(ssid=ssid, passphrase=passphrase)
728 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 729 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 730 params = ft_params2(ssid=ssid, passphrase=passphrase)
731 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 732 hapd = hostapd.add_ap(apdev[1], params)
65038313
JM		 733 key_mgmt = hapd.get_config()['key_mgmt']
734 if key_mgmt.split(' ')[0] != "FT-SAE":
735 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 736
17ffdf39 737 dev[0].request("SET sae_groups ")
a8375c94 738 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
6e658cc4
JM		 739
740def test_ap_ft_sae_over_ds(dev, apdev):
741 """WPA2-PSK-FT-SAE AP over DS"""
b9749b6a
JM		 742 if "SAE" not in dev[0].get_capability("auth_alg"):
743 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 744 ssid = "test-ft"
745 passphrase="12345678"
746
747 params = ft_params1(ssid=ssid, passphrase=passphrase)
748 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 749 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 750 params = ft_params2(ssid=ssid, passphrase=passphrase)
751 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 752 hapd1 = hostapd.add_ap(apdev[1], params)
6e658cc4 753
17ffdf39 754 dev[0].request("SET sae_groups ")
a8375c94
JM		 755 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
756 over_ds=True)
6f62809b 757
d269740a
MB		 758def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
759 discovery=False, roams=1):
6f62809b
JM		 760 ssid = "test-ft"
761 passphrase="12345678"
9c50a6d3
MB		 762 if vlan:
763 identity="gpsk-vlan1"
764 conndev="brvlan1"
d269740a
MB		 765 elif cui:
766 identity="gpsk-cui"
767 conndev=False
9c50a6d3
MB		 768 else:
769 identity="gpsk user"
770 conndev=False
6f62809b
JM		 771
772 radius = hostapd.radius_params()
942b52a8 773 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 774 params['wpa_key_mgmt'] = "FT-EAP"
775 params["ieee8021x"] = "1"
9c50a6d3
MB		 776 if vlan:
777 params["dynamic_vlan"] = "1"
6f62809b 778 params = dict(radius.items() + params.items())
8b8a1864 779 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 780 key_mgmt = hapd.get_config()['key_mgmt']
781 if key_mgmt.split(' ')[0] != "FT-EAP":
782 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 783 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 784 params['wpa_key_mgmt'] = "FT-EAP"
785 params["ieee8021x"] = "1"
9c50a6d3
MB		 786 if vlan:
787 params["dynamic_vlan"] = "1"
6f62809b 788 params = dict(radius.items() + params.items())
8b8a1864 789 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 790
942b52a8 791 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3
MB		 792 over_ds=over_ds, roams=roams, eap_identity=identity,
793 conndev=conndev)
91bc6c36
JM		 794 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
795 raise Exception("Scan results missing RSN element info")
eaf3f9b1
JM		 796 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
797 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
aaba98d3 798
4013d688
JM		 799 # Verify EAPOL reauthentication after FT protocol
800 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
801 ap = hapd
802 else:
803 ap = hapd1
804 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
805 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
806 if ev is None:
807 raise Exception("EAP authentication did not start")
808 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
809 if ev is None:
810 raise Exception("EAP authentication did not succeed")
811 time.sleep(0.1)
9c50a6d3
MB		 812 if conndev:
813 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
814 else:
815 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 816
942b52a8
MB		 817def test_ap_ft_eap(dev, apdev):
818 """WPA2-EAP-FT AP"""
819 generic_ap_ft_eap(dev, apdev)
820
d269740a
MB		 821def test_ap_ft_eap_cui(dev, apdev):
822 """WPA2-EAP-FT AP with CUI"""
823 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
824
9c50a6d3
MB		 825def test_ap_ft_eap_vlan(dev, apdev):
826 """WPA2-EAP-FT AP with VLAN"""
827 generic_ap_ft_eap(dev, apdev, vlan=True)
828
829def test_ap_ft_eap_vlan_multi(dev, apdev):
830 """WPA2-EAP-FT AP with VLAN"""
831 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
832
942b52a8
MB		 833def test_ap_ft_eap_over_ds(dev, apdev):
834 """WPA2-EAP-FT AP using over-the-DS"""
835 generic_ap_ft_eap(dev, apdev, over_ds=True)
836
837def test_ap_ft_eap_dis(dev, apdev):
838 """WPA2-EAP-FT AP with AP discovery"""
839 generic_ap_ft_eap(dev, apdev, discovery=True)
840
841def test_ap_ft_eap_dis_over_ds(dev, apdev):
842 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
843 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
844
9c50a6d3
MB		 845def test_ap_ft_eap_vlan(dev, apdev):
846 """WPA2-EAP-FT AP with VLAN"""
847 generic_ap_ft_eap(dev, apdev, vlan=True)
848
849def test_ap_ft_eap_vlan_multi(dev, apdev):
850 """WPA2-EAP-FT AP with VLAN"""
851 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
852
853def test_ap_ft_eap_vlan_over_ds(dev, apdev):
854 """WPA2-EAP-FT AP with VLAN + over_ds"""
855 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
856
857def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
858 """WPA2-EAP-FT AP with VLAN + over_ds"""
859 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
860
861def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 862 """WPA2-EAP-FT AP (pull PMK)"""
863 ssid = "test-ft"
864 passphrase="12345678"
9c50a6d3
MB		 865 if vlan:
866 identity="gpsk-vlan1"
867 conndev="brvlan1"
868 else:
869 identity="gpsk user"
870 conndev=False
aaba98d3
JM		 871
872 radius = hostapd.radius_params()
873 params = ft_params1(ssid=ssid, passphrase=passphrase)
874 params['wpa_key_mgmt'] = "FT-EAP"
875 params["ieee8021x"] = "1"
876 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 877 if vlan:
878 params["dynamic_vlan"] = "1"
aaba98d3 879 params = dict(radius.items() + params.items())
8b8a1864 880 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 881 key_mgmt = hapd.get_config()['key_mgmt']
882 if key_mgmt.split(' ')[0] != "FT-EAP":
883 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
884 params = ft_params2(ssid=ssid, passphrase=passphrase)
885 params['wpa_key_mgmt'] = "FT-EAP"
886 params["ieee8021x"] = "1"
887 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 888 if vlan:
889 params["dynamic_vlan"] = "1"
aaba98d3 890 params = dict(radius.items() + params.items())
8b8a1864 891 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 892
9c50a6d3
MB		 893 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
894 eap_identity=identity, conndev=conndev)
895
896def test_ap_ft_eap_pull(dev, apdev):
897 """WPA2-EAP-FT AP (pull PMK)"""
898 generic_ap_ft_eap_pull(dev, apdev)
899
900def test_ap_ft_eap_pull_vlan(dev, apdev):
901 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 902
f81c1411
JM		 903def test_ap_ft_eap_pull_wildcard(dev, apdev):
904 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
905 ssid = "test-ft"
906 passphrase="12345678"
907
908 radius = hostapd.radius_params()
909 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
910 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
911 params["ieee8021x"] = "1"
912 params["pmk_r1_push"] = "0"
913 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
914 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
915 params["ft_psk_generate_local"] = "1"
916 params["eap_server"] = "0"
917 params = dict(radius.items() + params.items())
918 hapd = hostapd.add_ap(apdev[0], params)
919 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
920 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
921 params["ieee8021x"] = "1"
922 params["pmk_r1_push"] = "0"
923 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
924 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
925 params["ft_psk_generate_local"] = "1"
926 params["eap_server"] = "0"
927 params = dict(radius.items() + params.items())
928 hapd1 = hostapd.add_ap(apdev[1], params)
929
930 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
931
9fd6804d 932@remote_compatible
3b808945
JM		 933def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
934 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
935 ssid = "test-ft"
936 passphrase="12345678"
937
938 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 939 params["ieee80211w"] = "2"
8b8a1864 940 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 941 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 942 params["ieee80211w"] = "2"
8b8a1864 943 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 944
a8375c94
JM		 945 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
946 fail_test=True)
3b808945 947
9fd6804d 948@remote_compatible
3b808945
JM		 949def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
950 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
951 ssid = "test-ft"
952 passphrase="12345678"
953
954 params = ft_params1(ssid=ssid, passphrase=passphrase)
955 params["pmk_r1_push"] = "0"
8b8a1864 956 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 957 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
958 params["pmk_r1_push"] = "0"
8b8a1864 959 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 960
a8375c94
JM		 961 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
962 fail_test=True)
3b808945 963
9fd6804d 964@remote_compatible
ae14a2e2
JM		 965def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
966 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
967 ssid = "test-ft"
968 passphrase="12345678"
969
970 params = ft_params1(ssid=ssid, passphrase=passphrase)
971 params["pmk_r1_push"] = "0"
972 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 973 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 974 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
975 scan_freq="2412")
ae14a2e2
JM		 976
977 params = ft_params2(ssid=ssid, passphrase=passphrase)
978 params["pmk_r1_push"] = "0"
8b8a1864 979 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 980
981 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
982 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
983
9fd6804d 984@remote_compatible
3b808945
JM		 985def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
986 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
987 ssid = "test-ft"
988 passphrase="12345678"
989
990 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 991 params["ieee80211w"] = "2"
8b8a1864 992 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 993 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 994 params["ieee80211w"] = "2"
8b8a1864 995 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 996
a8375c94
JM		 997 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
998 fail_test=True)
3b808945 999
9fd6804d 1000@remote_compatible
3b808945
JM		 1001def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1002 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1003 ssid = "test-ft"
1004 passphrase="12345678"
1005
1006 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1007 params["pmk_r1_push"] = "0"
8b8a1864 1008 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1009 params = ft_params2(ssid=ssid, passphrase=passphrase)
1010 params["pmk_r1_push"] = "0"
8b8a1864 1011 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1012
a8375c94
JM		 1013 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1014 fail_test=True)
c6b6e105 1015
150948e6
MB		 1016def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1017 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1018 ssid = "test-ft"
1019 passphrase="12345678"
1020
1021 radius = hostapd.radius_params()
1022 params = ft_params1(ssid=ssid, passphrase=passphrase)
1023 params["ieee80211w"] = "2";
1024 params['wpa_key_mgmt'] = "FT-EAP"
1025 params["ieee8021x"] = "1"
1026 params = dict(radius.items() + params.items())
b098542c 1027 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1028 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1029 params["ieee80211w"] = "2";
1030 params['wpa_key_mgmt'] = "FT-EAP"
1031 params["ieee8021x"] = "1"
1032 params = dict(radius.items() + params.items())
b098542c 1033 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1034
1035 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1036 fail_test=True, eap=True)
1037
1038def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1039 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1040 ssid = "test-ft"
1041 passphrase="12345678"
1042
1043 radius = hostapd.radius_params()
1044 params = ft_params1(ssid=ssid, passphrase=passphrase)
1045 params["pmk_r1_push"] = "0"
1046 params['wpa_key_mgmt'] = "FT-EAP"
1047 params["ieee8021x"] = "1"
1048 params = dict(radius.items() + params.items())
b098542c 1049 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1050 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1051 params["pmk_r1_push"] = "0"
1052 params['wpa_key_mgmt'] = "FT-EAP"
1053 params["ieee8021x"] = "1"
1054 params = dict(radius.items() + params.items())
b098542c 1055 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1056
1057 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1058 fail_test=True, eap=True)
1059
1060def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1061 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1062 ssid = "test-ft"
1063 passphrase="12345678"
1064
1065 radius = hostapd.radius_params()
1066 params = ft_params1(ssid=ssid, passphrase=passphrase)
1067 params["pmk_r1_push"] = "0"
1068 params["nas_identifier"] = "nas0.w1.fi"
1069 params['wpa_key_mgmt'] = "FT-EAP"
1070 params["ieee8021x"] = "1"
1071 params = dict(radius.items() + params.items())
b098542c 1072 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1073 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1074 eap="GPSK", identity="gpsk user",
1075 password="abcdefghijklmnop0123456789abcdef",
1076 scan_freq="2412")
1077
1078 params = ft_params2(ssid=ssid, passphrase=passphrase)
1079 params["pmk_r1_push"] = "0"
1080 params['wpa_key_mgmt'] = "FT-EAP"
1081 params["ieee8021x"] = "1"
1082 params = dict(radius.items() + params.items())
b098542c 1083 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1084
1085 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1086 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1087
1088def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1089 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1090 ssid = "test-ft"
1091 passphrase="12345678"
1092
1093 radius = hostapd.radius_params()
1094 params = ft_params1(ssid=ssid, passphrase=passphrase)
1095 params["ieee80211w"] = "2";
1096 params['wpa_key_mgmt'] = "FT-EAP"
1097 params["ieee8021x"] = "1"
1098 params = dict(radius.items() + params.items())
b098542c 1099 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1100 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1101 params["ieee80211w"] = "2";
1102 params['wpa_key_mgmt'] = "FT-EAP"
1103 params["ieee8021x"] = "1"
1104 params = dict(radius.items() + params.items())
b098542c 1105 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1106
1107 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1108 fail_test=True, eap=True)
1109
1110def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1111 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1112 ssid = "test-ft"
1113 passphrase="12345678"
1114
1115 radius = hostapd.radius_params()
1116 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1117 params["pmk_r1_push"] = "0"
1118 params['wpa_key_mgmt'] = "FT-EAP"
1119 params["ieee8021x"] = "1"
1120 params = dict(radius.items() + params.items())
b098542c 1121 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1122 params = ft_params2(ssid=ssid, passphrase=passphrase)
1123 params["pmk_r1_push"] = "0"
1124 params['wpa_key_mgmt'] = "FT-EAP"
1125 params["ieee8021x"] = "1"
1126 params = dict(radius.items() + params.items())
b098542c 1127 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1128
1129 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1130 fail_test=True, eap=True)
1131
c6b6e105
JM		 1132def test_ap_ft_gtk_rekey(dev, apdev):
1133 """WPA2-PSK-FT AP and GTK rekey"""
1134 ssid = "test-ft"
1135 passphrase="12345678"
1136
1137 params = ft_params1(ssid=ssid, passphrase=passphrase)
1138 params['wpa_group_rekey'] = '1'
8b8a1864 1139 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1140
1141 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1142 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1143
1144 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1145 if ev is None:
1146 raise Exception("GTK rekey timed out after initial association")
a8375c94 1147 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1148
1149 params = ft_params2(ssid=ssid, passphrase=passphrase)
1150 params['wpa_group_rekey'] = '1'
8b8a1864 1151 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1152
1153 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1154 dev[0].roam(apdev[1]['bssid'])
1155 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1156 raise Exception("Did not connect to correct AP")
a8375c94 1157 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1158
1159 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1160 if ev is None:
1161 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1162 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1163
1164def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1165 """WPA2-PSK-FT and key lifetime in memory"""
1166 ssid = "test-ft"
1167 passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1168 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1169 pmk = binascii.unhexlify(psk)
1170 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1171 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1172 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1173 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1174
1175 pid = find_wpas_process(dev[0])
1176
1177 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1178 scan_freq="2412")
8e416cec
JM		 1179 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1180 # event has been delivered, so verify that wpa_supplicant has returned to
1181 # eloop before reading process memory.
54f2cae2 1182 time.sleep(1)
8e416cec 1183 dev[0].ping()
5b3c40a6
JM		 1184
1185 buf = read_process_memory(pid, pmk)
1186
1187 dev[0].request("DISCONNECT")
1188 dev[0].wait_disconnected()
1189
1190 dev[0].relog()
1191 pmkr0 = None
1192 pmkr1 = None
1193 ptk = None
1194 gtk = None
1195 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1196 for l in f.readlines():
1197 if "FT: PMK-R0 - hexdump" in l:
1198 val = l.strip().split(':')[3].replace(' ', '')
1199 pmkr0 = binascii.unhexlify(val)
1200 if "FT: PMK-R1 - hexdump" in l:
1201 val = l.strip().split(':')[3].replace(' ', '')
1202 pmkr1 = binascii.unhexlify(val)
f918b95b 1203 if "FT: KCK - hexdump" in l:
5b3c40a6 1204 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1205 kck = binascii.unhexlify(val)
1206 if "FT: KEK - hexdump" in l:
1207 val = l.strip().split(':')[3].replace(' ', '')
1208 kek = binascii.unhexlify(val)
1209 if "FT: TK - hexdump" in l:
1210 val = l.strip().split(':')[3].replace(' ', '')
1211 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1212 if "WPA: Group Key - hexdump" in l:
1213 val = l.strip().split(':')[3].replace(' ', '')
1214 gtk = binascii.unhexlify(val)
f918b95b 1215 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1216 raise Exception("Could not find keys from debug log")
1217 if len(gtk) != 16:
1218 raise Exception("Unexpected GTK length")
1219
5b3c40a6
JM		 1220 logger.info("Checking keys in memory while associated")
1221 get_key_locations(buf, pmk, "PMK")
1222 get_key_locations(buf, pmkr0, "PMK-R0")
1223 get_key_locations(buf, pmkr1, "PMK-R1")
1224 if pmk not in buf:
81e787b7 1225 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1226 if pmkr0 not in buf:
81e787b7 1227 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1228 if pmkr1 not in buf:
81e787b7 1229 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1230 if kck not in buf:
1231 raise Exception("KCK not found while associated")
1232 if kek not in buf:
1233 raise Exception("KEK not found while associated")
b74f82a4
JM		 1234 #if tk in buf:
1235 # raise Exception("TK found from memory")
5b3c40a6
JM		 1236
1237 logger.info("Checking keys in memory after disassociation")
1238 buf = read_process_memory(pid, pmk)
1239 get_key_locations(buf, pmk, "PMK")
1240 get_key_locations(buf, pmkr0, "PMK-R0")
1241 get_key_locations(buf, pmkr1, "PMK-R1")
1242
1243 # Note: PMK/PSK is still present in network configuration
1244
1245 fname = os.path.join(params['logdir'],
1246 'ft_psk_key_lifetime_in_memory.memctx-')
1247 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1248 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1249 verify_not_present(buf, kck, fname, "KCK")
1250 verify_not_present(buf, kek, fname, "KEK")
1251 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1252 if gtk in buf:
1253 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1254 verify_not_present(buf, gtk, fname, "GTK")
1255
1256 dev[0].request("REMOVE_NETWORK all")
1257
1258 logger.info("Checking keys in memory after network profile removal")
1259 buf = read_process_memory(pid, pmk)
1260 get_key_locations(buf, pmk, "PMK")
1261 get_key_locations(buf, pmkr0, "PMK-R0")
1262 get_key_locations(buf, pmkr1, "PMK-R1")
1263
1264 verify_not_present(buf, pmk, fname, "PMK")
1265 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1266 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1267 verify_not_present(buf, kck, fname, "KCK")
1268 verify_not_present(buf, kek, fname, "KEK")
1269 verify_not_present(buf, tk, fname, "TK")
1270 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1271
9fd6804d 1272@remote_compatible
664093b5
JM		 1273def test_ap_ft_invalid_resp(dev, apdev):
1274 """WPA2-PSK-FT AP and invalid response IEs"""
1275 ssid = "test-ft"
1276 passphrase="12345678"
1277
1278 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1279 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1280 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1281 scan_freq="2412")
1282
1283 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1284 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1285
1286 tests = [
1287 # Various IEs for test coverage. The last one is FTIE with invalid
1288 # R1KH-ID subelement.
1289 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1290 # FTIE with invalid R0KH-ID subelement (len=0).
1291 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1292 # FTIE with invalid R0KH-ID subelement (len=49).
1293 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1294 # Invalid RSNE.
1295 "020002000000" + "3000",
1296 # Required IEs missing from protected IE count.
1297 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1298 # RIC missing from protected IE count.
1299 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1300 # Protected IE missing.
1301 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1302 for t in tests:
1303 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1304 hapd1.set("ext_mgmt_frame_handling", "1")
1305 hapd1.dump_monitor()
1306 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1307 raise Exception("ROAM failed")
1308 auth = None
1309 for i in range(20):
1310 msg = hapd1.mgmt_rx()
1311 if msg['subtype'] == 11:
1312 auth = msg
1313 break
1314 if not auth:
1315 raise Exception("Authentication frame not seen")
1316
1317 resp = {}
1318 resp['fc'] = auth['fc']
1319 resp['da'] = auth['sa']
1320 resp['sa'] = auth['da']
1321 resp['bssid'] = auth['bssid']
1322 resp['payload'] = binascii.unhexlify(t)
1323 hapd1.mgmt_tx(resp)
1324 hapd1.set("ext_mgmt_frame_handling", "0")
1325 dev[0].wait_disconnected()
1326
1327 dev[0].request("RECONNECT")
1328 dev[0].wait_connected()
7b741a53
JM		 1329
1330def test_ap_ft_gcmp_256(dev, apdev):
1331 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1332 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1333 raise HwsimSkip("Cipher GCMP-256 not supported")
1334 ssid = "test-ft"
1335 passphrase="12345678"
1336
1337 params = ft_params1(ssid=ssid, passphrase=passphrase)
1338 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1339 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1340 params = ft_params2(ssid=ssid, passphrase=passphrase)
1341 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1342 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1343
1344 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1345 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54
JM		 1346
1347def test_ap_ft_oom(dev, apdev):
1348 """WPA2-PSK-FT and OOM"""
38934ed1 1349 skip_with_fips(dev[0])
cf671d54
JM		 1350 ssid = "test-ft"
1351 passphrase="12345678"
1352
1353 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1354 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1355 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1356 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1357
1358 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1359 scan_freq="2412")
1360 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1361 dst = apdev[1]['bssid']
1362 else:
1363 dst = apdev[0]['bssid']
1364
1365 dev[0].scan_for_bss(dst, freq="2412")
1366 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1367 dev[0].roam(dst)
7cbc8e67 1368 with fail_test(dev[0], 1, "wpa_ft_mic"):
cf671d54
JM		 1369 dev[0].roam(dst, fail_test=True)
1370 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1371 dev[0].roam(dst, fail_test=True)
34d3eaa8 1372
dcbb5d80
JM		 1373 dev[0].request("REMOVE_NETWORK all")
1374 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1375 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1376 scan_freq="2412")
1377
682a79f0
JM		 1378def test_ap_ft_ap_oom(dev, apdev):
1379 """WPA2-PSK-FT and AP OOM"""
1380 ssid = "test-ft"
1381 passphrase="12345678"
1382
1383 params = ft_params1(ssid=ssid, passphrase=passphrase)
1384 hapd0 = hostapd.add_ap(apdev[0], params)
1385 bssid0 = hapd0.own_addr()
1386
1387 dev[0].scan_for_bss(bssid0, freq="2412")
1388 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1389 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1390 scan_freq="2412")
1391
1392 params = ft_params2(ssid=ssid, passphrase=passphrase)
1393 hapd1 = hostapd.add_ap(apdev[1], params)
1394 bssid1 = hapd1.own_addr()
1395 dev[0].scan_for_bss(bssid1, freq="2412")
1396 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1397 dev[0].roam(bssid1)
1398
1399def test_ap_ft_ap_oom2(dev, apdev):
1400 """WPA2-PSK-FT and AP OOM 2"""
1401 ssid = "test-ft"
1402 passphrase="12345678"
1403
1404 params = ft_params1(ssid=ssid, passphrase=passphrase)
1405 hapd0 = hostapd.add_ap(apdev[0], params)
1406 bssid0 = hapd0.own_addr()
1407
1408 dev[0].scan_for_bss(bssid0, freq="2412")
1409 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1410 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1411 scan_freq="2412")
1412
1413 params = ft_params2(ssid=ssid, passphrase=passphrase)
1414 hapd1 = hostapd.add_ap(apdev[1], params)
1415 bssid1 = hapd1.own_addr()
1416 dev[0].scan_for_bss(bssid1, freq="2412")
1417 dev[0].roam(bssid1)
1418 if dev[0].get_status_field('bssid') != bssid1:
1419 raise Exception("Did not roam to AP1")
1420 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1421 dev[0].roam(bssid0)
1422
1423def test_ap_ft_ap_oom3(dev, apdev):
1424 """WPA2-PSK-FT and AP OOM 3"""
1425 ssid = "test-ft"
1426 passphrase="12345678"
1427
1428 params = ft_params1(ssid=ssid, passphrase=passphrase)
1429 hapd0 = hostapd.add_ap(apdev[0], params)
1430 bssid0 = hapd0.own_addr()
1431
1432 dev[0].scan_for_bss(bssid0, freq="2412")
1433 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1434 scan_freq="2412")
1435
1436 params = ft_params2(ssid=ssid, passphrase=passphrase)
1437 hapd1 = hostapd.add_ap(apdev[1], params)
1438 bssid1 = hapd1.own_addr()
1439 dev[0].scan_for_bss(bssid1, freq="2412")
1440 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1441 # This will fail due to not being able to send out PMK-R1 pull request
1442 dev[0].roam(bssid1)
1443
ba88dd65 1444 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1445 # This will fail due to not being able to send out PMK-R1 pull request
1446 dev[0].roam(bssid1)
1447
ba88dd65
MB		 1448 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1449 # This will fail due to not being able to send out PMK-R1 pull request
1450 dev[0].roam(bssid1)
1451
1452def test_ap_ft_ap_oom3b(dev, apdev):
1453 """WPA2-PSK-FT and AP OOM 3b"""
1454 ssid = "test-ft"
1455 passphrase="12345678"
1456
1457 params = ft_params1(ssid=ssid, passphrase=passphrase)
1458 hapd0 = hostapd.add_ap(apdev[0], params)
1459 bssid0 = hapd0.own_addr()
1460
1461 dev[0].scan_for_bss(bssid0, freq="2412")
1462 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1463 scan_freq="2412")
1464
1465 params = ft_params2(ssid=ssid, passphrase=passphrase)
1466 hapd1 = hostapd.add_ap(apdev[1], params)
1467 bssid1 = hapd1.own_addr()
1468 dev[0].scan_for_bss(bssid1, freq="2412")
1469 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1470 # This will fail due to not being able to send out PMK-R1 pull request
1471 dev[0].roam(bssid1)
1472
1473def test_ap_ft_ap_oom4(dev, apdev):
1474 """WPA2-PSK-FT and AP OOM 4"""
1475 ssid = "test-ft"
1476 passphrase="12345678"
1477
1478 params = ft_params1(ssid=ssid, passphrase=passphrase)
1479 hapd0 = hostapd.add_ap(apdev[0], params)
1480 bssid0 = hapd0.own_addr()
1481
1482 dev[0].scan_for_bss(bssid0, freq="2412")
1483 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1484 scan_freq="2412")
1485
1486 params = ft_params2(ssid=ssid, passphrase=passphrase)
1487 hapd1 = hostapd.add_ap(apdev[1], params)
1488 bssid1 = hapd1.own_addr()
1489 dev[0].scan_for_bss(bssid1, freq="2412")
1490 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1491 dev[0].roam(bssid1)
1492 if dev[0].get_status_field('bssid') != bssid1:
1493 raise Exception("Did not roam to AP1")
1494
1495 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1496 dev[0].roam(bssid0)
1497 if dev[0].get_status_field('bssid') != bssid0:
1498 raise Exception("Did not roam to AP0")
1499
1500 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1501 dev[0].roam(bssid1)
1502 if dev[0].get_status_field('bssid') != bssid1:
1503 raise Exception("Did not roam to AP1")
1504
1505def test_ap_ft_ap_oom5(dev, apdev):
1506 """WPA2-PSK-FT and AP OOM 5"""
1507 ssid = "test-ft"
1508 passphrase="12345678"
1509
1510 params = ft_params1(ssid=ssid, passphrase=passphrase)
1511 hapd0 = hostapd.add_ap(apdev[0], params)
1512 bssid0 = hapd0.own_addr()
1513
1514 dev[0].scan_for_bss(bssid0, freq="2412")
1515 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1516 scan_freq="2412")
1517
1518 params = ft_params2(ssid=ssid, passphrase=passphrase)
1519 hapd1 = hostapd.add_ap(apdev[1], params)
1520 bssid1 = hapd1.own_addr()
1521 dev[0].scan_for_bss(bssid1, freq="2412")
1522 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1523 # This will fail to roam
1524 dev[0].roam(bssid1)
1525
1526 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1527 # This will fail to roam
1528 dev[0].roam(bssid1)
1529
1530 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1531 # This will fail to roam
1532 dev[0].roam(bssid1)
1533
1534 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1535 # This will fail to roam
1536 dev[0].roam(bssid1)
1537
1538 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1539 # This will fail to roam
1540 dev[0].roam(bssid1)
1541
1542def test_ap_ft_ap_oom6(dev, apdev):
1543 """WPA2-PSK-FT and AP OOM 6"""
1544 ssid = "test-ft"
1545 passphrase="12345678"
1546
1547 params = ft_params1(ssid=ssid, passphrase=passphrase)
1548 hapd0 = hostapd.add_ap(apdev[0], params)
1549 bssid0 = hapd0.own_addr()
1550
1551 dev[0].scan_for_bss(bssid0, freq="2412")
1552 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1553 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1554 scan_freq="2412")
1555 dev[0].request("REMOVE_NETWORK all")
1556 dev[0].wait_disconnected()
1557 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1558 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1559 scan_freq="2412")
1560 dev[0].request("REMOVE_NETWORK all")
1561 dev[0].wait_disconnected()
1562 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1563 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1564 scan_freq="2412")
1565
c5262648
JM		 1566def test_ap_ft_ap_oom7a(dev, apdev):
1567 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0
JM		 1568 ssid = "test-ft"
1569 passphrase="12345678"
1570
1571 params = ft_params1(ssid=ssid, passphrase=passphrase)
1572 params["ieee80211w"] = "2"
1573 hapd0 = hostapd.add_ap(apdev[0], params)
1574 bssid0 = hapd0.own_addr()
1575
1576 dev[0].scan_for_bss(bssid0, freq="2412")
1577 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1578 ieee80211w="2", scan_freq="2412")
1579
1580 params = ft_params2(ssid=ssid, passphrase=passphrase)
1581 params["ieee80211w"] = "2"
1582 hapd1 = hostapd.add_ap(apdev[1], params)
1583 bssid1 = hapd1.own_addr()
1584 dev[0].scan_for_bss(bssid1, freq="2412")
1585 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1586 # This will fail to roam
1587 dev[0].roam(bssid1)
c5262648
JM		 1588
1589def test_ap_ft_ap_oom7b(dev, apdev):
1590 """WPA2-PSK-FT and AP OOM 7b"""
1591 ssid = "test-ft"
1592 passphrase="12345678"
1593
1594 params = ft_params1(ssid=ssid, passphrase=passphrase)
1595 params["ieee80211w"] = "2"
1596 hapd0 = hostapd.add_ap(apdev[0], params)
1597 bssid0 = hapd0.own_addr()
1598
1599 dev[0].scan_for_bss(bssid0, freq="2412")
1600 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1601 ieee80211w="2", scan_freq="2412")
1602
1603 params = ft_params2(ssid=ssid, passphrase=passphrase)
1604 params["ieee80211w"] = "2"
1605 hapd1 = hostapd.add_ap(apdev[1], params)
1606 bssid1 = hapd1.own_addr()
1607 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1608 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1609 # This will fail to roam
1610 dev[0].roam(bssid1)
c5262648
JM		 1611
1612def test_ap_ft_ap_oom7c(dev, apdev):
1613 """WPA2-PSK-FT and AP OOM 7c"""
1614 ssid = "test-ft"
1615 passphrase="12345678"
1616
1617 params = ft_params1(ssid=ssid, passphrase=passphrase)
1618 params["ieee80211w"] = "2"
1619 hapd0 = hostapd.add_ap(apdev[0], params)
1620 bssid0 = hapd0.own_addr()
1621
1622 dev[0].scan_for_bss(bssid0, freq="2412")
1623 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1624 ieee80211w="2", scan_freq="2412")
1625
1626 params = ft_params2(ssid=ssid, passphrase=passphrase)
1627 params["ieee80211w"] = "2"
1628 hapd1 = hostapd.add_ap(apdev[1], params)
1629 bssid1 = hapd1.own_addr()
1630 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1631 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1632 # This will fail to roam
1633 dev[0].roam(bssid1)
c5262648
JM		 1634
1635def test_ap_ft_ap_oom7d(dev, apdev):
1636 """WPA2-PSK-FT and AP OOM 7d"""
1637 ssid = "test-ft"
1638 passphrase="12345678"
1639
1640 params = ft_params1(ssid=ssid, passphrase=passphrase)
1641 params["ieee80211w"] = "2"
1642 hapd0 = hostapd.add_ap(apdev[0], params)
1643 bssid0 = hapd0.own_addr()
1644
1645 dev[0].scan_for_bss(bssid0, freq="2412")
1646 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1647 ieee80211w="2", scan_freq="2412")
1648
1649 params = ft_params2(ssid=ssid, passphrase=passphrase)
1650 params["ieee80211w"] = "2"
1651 hapd1 = hostapd.add_ap(apdev[1], params)
1652 bssid1 = hapd1.own_addr()
1653 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1654 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1655 # This will fail to roam
1656 dev[0].roam(bssid1)
1657
1658def test_ap_ft_ap_oom8(dev, apdev):
1659 """WPA2-PSK-FT and AP OOM 8"""
1660 ssid = "test-ft"
1661 passphrase="12345678"
1662
1663 params = ft_params1(ssid=ssid, passphrase=passphrase)
1664 params['ft_psk_generate_local'] = "1";
1665 hapd0 = hostapd.add_ap(apdev[0], params)
1666 bssid0 = hapd0.own_addr()
1667
1668 dev[0].scan_for_bss(bssid0, freq="2412")
1669 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1670 scan_freq="2412")
1671
1672 params = ft_params2(ssid=ssid, passphrase=passphrase)
1673 params['ft_psk_generate_local'] = "1";
1674 hapd1 = hostapd.add_ap(apdev[1], params)
1675 bssid1 = hapd1.own_addr()
1676 dev[0].scan_for_bss(bssid1, freq="2412")
1677 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1678 # This will fail to roam
1679 dev[0].roam(bssid1)
1680 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1681 # This will fail to roam
1682 dev[0].roam(bssid1)
1683
1684def test_ap_ft_ap_oom9(dev, apdev):
1685 """WPA2-PSK-FT and AP OOM 9"""
1686 ssid = "test-ft"
1687 passphrase="12345678"
1688
1689 params = ft_params1(ssid=ssid, passphrase=passphrase)
1690 hapd0 = hostapd.add_ap(apdev[0], params)
1691 bssid0 = hapd0.own_addr()
1692
1693 dev[0].scan_for_bss(bssid0, freq="2412")
1694 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1695 scan_freq="2412")
1696
1697 params = ft_params2(ssid=ssid, passphrase=passphrase)
1698 hapd1 = hostapd.add_ap(apdev[1], params)
1699 bssid1 = hapd1.own_addr()
1700 dev[0].scan_for_bss(bssid1, freq="2412")
1701
1702 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1703 # This will fail to roam
1704 if "OK" not in dev[0].request("FT_DS " + bssid1):
1705 raise Exception("FT_DS failed")
1706 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1707
1708 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1709 # This will fail to roam
1710 if "OK" not in dev[0].request("FT_DS " + bssid1):
1711 raise Exception("FT_DS failed")
1712 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1713
1714 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1715 # This will fail to roam
1716 if "OK" not in dev[0].request("FT_DS " + bssid1):
1717 raise Exception("FT_DS failed")
1718 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1719
1720def test_ap_ft_ap_oom10(dev, apdev):
1721 """WPA2-PSK-FT and AP OOM 10"""
1722 ssid = "test-ft"
1723 passphrase="12345678"
1724
1725 params = ft_params1(ssid=ssid, passphrase=passphrase)
1726 hapd0 = hostapd.add_ap(apdev[0], params)
1727 bssid0 = hapd0.own_addr()
1728
1729 dev[0].scan_for_bss(bssid0, freq="2412")
1730 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1731 scan_freq="2412")
1732
1733 params = ft_params2(ssid=ssid, passphrase=passphrase)
1734 hapd1 = hostapd.add_ap(apdev[1], params)
1735 bssid1 = hapd1.own_addr()
1736 dev[0].scan_for_bss(bssid1, freq="2412")
1737
9441a227 1738 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1739 # This will fail to roam
1740 if "OK" not in dev[0].request("FT_DS " + bssid1):
1741 raise Exception("FT_DS failed")
1742 wait_fail_trigger(hapd0, "GET_FAIL")
1743
1744 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1745 # This will fail to roam
1746 if "OK" not in dev[0].request("FT_DS " + bssid1):
1747 raise Exception("FT_DS failed")
1748 wait_fail_trigger(hapd0, "GET_FAIL")
1749
9441a227 1750 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1751 # This will fail to roam
1752 if "OK" not in dev[0].request("FT_DS " + bssid1):
1753 raise Exception("FT_DS failed")
1754 wait_fail_trigger(hapd0, "GET_FAIL")
1755
9441a227 1756 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 1757 # This will fail to roam
1758 if "OK" not in dev[0].request("FT_DS " + bssid1):
1759 raise Exception("FT_DS failed")
1760 wait_fail_trigger(hapd1, "GET_FAIL")
1761
1762def test_ap_ft_ap_oom11(dev, apdev):
1763 """WPA2-PSK-FT and AP OOM 11"""
1764 ssid = "test-ft"
1765 passphrase="12345678"
1766
1767 params = ft_params1(ssid=ssid, passphrase=passphrase)
1768 hapd0 = hostapd.add_ap(apdev[0], params)
1769 bssid0 = hapd0.own_addr()
1770
1771 dev[0].scan_for_bss(bssid0, freq="2412")
1772 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1773 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1774 scan_freq="2412")
1775 wait_fail_trigger(hapd0, "GET_FAIL")
1776
1777 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 1778 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 1779 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1780 scan_freq="2412")
1781 wait_fail_trigger(hapd0, "GET_FAIL")
1782
a04e6f3d
JM		 1783def test_ap_ft_over_ds_proto_ap(dev, apdev):
1784 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1785 ssid = "test-ft"
1786 passphrase="12345678"
1787
1788 params = ft_params1(ssid=ssid, passphrase=passphrase)
1789 hapd0 = hostapd.add_ap(apdev[0], params)
1790 bssid0 = hapd0.own_addr()
1791 _bssid0 = bssid0.replace(':', '')
1792 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1793 scan_freq="2412")
1794 addr = dev[0].own_addr()
1795 _addr = addr.replace(':', '')
1796
1797 params = ft_params2(ssid=ssid, passphrase=passphrase)
1798 hapd1 = hostapd.add_ap(apdev[1], params)
1799 bssid1 = hapd1.own_addr()
1800 _bssid1 = bssid1.replace(':', '')
1801
1802 hapd0.set("ext_mgmt_frame_handling", "1")
1803 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1804 valid = "0601" + _addr + _bssid1
1805 tests = [ "0601",
1806 "0601" + _addr,
1807 "0601" + _addr + _bssid0,
1808 "0601" + _addr + "ffffffffffff",
1809 "0601" + _bssid0 + _bssid0,
1810 valid,
1811 valid + "01",
1812 valid + "3700",
1813 valid + "3600",
1814 valid + "3603ffffff",
1815 valid + "3603a1b2ff",
1816 valid + "3603a1b2ff" + "3700",
1817 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
1818 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
1819 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
1820 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
1821 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
1822 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1823 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1824 valid + "0001" ]
1825 for t in tests:
1826 hapd0.dump_monitor()
1827 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
1828 raise Exception("MGMT_RX_PROCESS failed")
1829
1830 hapd0.set("ext_mgmt_frame_handling", "0")
1831
34d3eaa8
JM		 1832def test_ap_ft_over_ds_proto(dev, apdev):
1833 """WPA2-PSK-FT AP over DS protocol testing"""
1834 ssid = "test-ft"
1835 passphrase="12345678"
1836
1837 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1838 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 1839 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1840 scan_freq="2412")
1841
1842 # FT Action Response while no FT-over-DS in progress
1843 msg = {}
1844 msg['fc'] = 13 << 4
1845 msg['da'] = dev[0].own_addr()
1846 msg['sa'] = apdev[0]['bssid']
1847 msg['bssid'] = apdev[0]['bssid']
1848 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
1849 hapd0.mgmt_tx(msg)
1850
1851 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1852 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 1853 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1854 hapd0.set("ext_mgmt_frame_handling", "1")
1855 hapd0.dump_monitor()
1856 dev[0].request("FT_DS " + apdev[1]['bssid'])
1857 for i in range(0, 10):
1858 req = hapd0.mgmt_rx()
1859 if req is None:
1860 raise Exception("MGMT RX wait timed out")
1861 if req['subtype'] == 13:
1862 break
1863 req = None
1864 if not req:
1865 raise Exception("FT Action frame not received")
1866
1867 # FT Action Response for unexpected Target AP
1868 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
1869 hapd0.mgmt_tx(msg)
1870
1871 # FT Action Response without MDIE
1872 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
1873 hapd0.mgmt_tx(msg)
1874
1875 # FT Action Response without FTIE
1876 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
1877 hapd0.mgmt_tx(msg)
1878
1879 # FT Action Response with FTIE SNonce mismatch
1880 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1881 hapd0.mgmt_tx(msg)
6f3815c0 1882
9fd6804d 1883@remote_compatible
6f3815c0
JM		 1884def test_ap_ft_rrb(dev, apdev):
1885 """WPA2-PSK-FT RRB protocol testing"""
1886 ssid = "test-ft"
1887 passphrase="12345678"
1888
1889 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1890 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 1891
1892 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1893 scan_freq="2412")
1894
1895 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
1896 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
1897 proto = '\x89\x0d'
1898 ehdr = _dst_ll + _src_ll + proto
1899
1900 # Too short RRB frame
1901 pkt = ehdr + '\x01'
1902 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1903 raise Exception("DATA_TEST_FRAME failed")
1904
1905 # RRB discarded frame wikth unrecognized type
1906 pkt = ehdr + '\x02' + '\x02' + '\x01\x00' + _src_ll
1907 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1908 raise Exception("DATA_TEST_FRAME failed")
1909
1910 # RRB frame too short for action frame
1911 pkt = ehdr + '\x01' + '\x02' + '\x01\x00' + _src_ll
1912 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1913 raise Exception("DATA_TEST_FRAME failed")
1914
1915 # Too short RRB frame (not enough room for Action Frame body)
1916 pkt = ehdr + '\x01' + '\x02' + '\x00\x00' + _src_ll
1917 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1918 raise Exception("DATA_TEST_FRAME failed")
1919
1920 # Unexpected Action frame category
1921 pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1922 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1923 raise Exception("DATA_TEST_FRAME failed")
1924
1925 # Unexpected Action in RRB Request
1926 pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1927 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1928 raise Exception("DATA_TEST_FRAME failed")
1929
1930 # Target AP address in RRB Request does not match with own address
1931 pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1932 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1933 raise Exception("DATA_TEST_FRAME failed")
1934
1935 # Not enough room for status code in RRB Response
1936 pkt = ehdr + '\x01' + '\x01' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1937 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1938 raise Exception("DATA_TEST_FRAME failed")
1939
1940 # RRB discarded frame with unknown packet_type
1941 pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1942 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1943 raise Exception("DATA_TEST_FRAME failed")
1944
1945 # RRB Response with non-zero status code; no STA match
1946 pkt = ehdr + '\x01' + '\x01' + '\x10\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
1947 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1948 raise Exception("DATA_TEST_FRAME failed")
1949
1950 # RRB Response with zero status code and extra data; STA match
1951 pkt = ehdr + '\x01' + '\x01' + '\x11\x00' + _src_ll + '\x06\x01' + _src_ll + '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
1952 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1953 raise Exception("DATA_TEST_FRAME failed")
1954
1955 # Too short PMK-R1 pull
1956 pkt = ehdr + '\x01' + '\xc8' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1957 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1958 raise Exception("DATA_TEST_FRAME failed")
1959
1960 # Too short PMK-R1 resp
1961 pkt = ehdr + '\x01' + '\xc9' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1962 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1963 raise Exception("DATA_TEST_FRAME failed")
1964
1965 # Too short PMK-R1 push
1966 pkt = ehdr + '\x01' + '\xca' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1967 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1968 raise Exception("DATA_TEST_FRAME failed")
1969
1970 # No matching R0KH address found for PMK-R0 pull response
1971 pkt = ehdr + '\x01' + '\xc9' + '\x5a\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
1972 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1973 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 1974
9fd6804d 1975@remote_compatible
ecafa0cf
JM		 1976def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
1977 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
1978 bssid = apdev[0]['bssid']
1979 ssid = "test-ft"
1980 passphrase="12345678"
1981
1982 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1983 params["ieee80211w"] = "1"
ecafa0cf
JM		 1984 # This is the RSN element used normally by hostapd
1985 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 1986 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 1987 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1988 ieee80211w="1", scan_freq="2412",
1989 pairwise="CCMP", group="CCMP")
1990
1991 tests = [ ('PMKIDCount field included',
1992 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
1993 ('Extra IE before RSNE',
1994 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
1995 ('PMKIDCount and Group Management Cipher suite fields included',
1996 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
1997 ('Extra octet after defined fields (future extensibility)',
1998 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
1999 ('No RSN Capabilities field (PMF disabled in practice)',
2000 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2001 for txt,ie in tests:
2002 dev[0].request("DISCONNECT")
2003 dev[0].wait_disconnected()
2004 logger.info(txt)
2005 hapd.disable()
2006 hapd.set('own_ie_override', ie)
2007 hapd.enable()
2008 dev[0].request("BSS_FLUSH 0")
2009 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2010 dev[0].select_network(id, freq=2412)
2011 dev[0].wait_connected()
2012
2013 dev[0].request("DISCONNECT")
2014 dev[0].wait_disconnected()
2015
2016 logger.info('Invalid RSNE causing internal hostapd error')
2017 hapd.disable()
2018 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2019 hapd.enable()
2020 dev[0].request("BSS_FLUSH 0")
2021 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2022 dev[0].select_network(id, freq=2412)
2023 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2024 # complete.
2025 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2026 if ev is not None:
2027 raise Exception("Unexpected connection")
2028 dev[0].request("DISCONNECT")
2029
2030 logger.info('Unexpected PMKID causing internal hostapd error')
2031 hapd.disable()
2032 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2033 hapd.enable()
2034 dev[0].request("BSS_FLUSH 0")
2035 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2036 dev[0].select_network(id, freq=2412)
2037 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2038 # complete.
2039 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2040 if ev is not None:
2041 raise Exception("Unexpected connection")
2042 dev[0].request("DISCONNECT")
1025603b
JM		 2043
2044def test_ap_ft_ptk_rekey(dev, apdev):
2045 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2046 ssid = "test-ft"
2047 passphrase="12345678"
2048
2049 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2050 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2051 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2052 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2053
2054 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2055
2056 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2057 "WPA: Key negotiation completed"], timeout=5)
2058 if ev is None:
2059 raise Exception("No event received after roam")
2060 if "CTRL-EVENT-DISCONNECTED" in ev:
2061 raise Exception("Unexpected disconnection after roam")
2062
2063 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2064 hapd = hapd0
2065 else:
2066 hapd = hapd1
2067 hwsim_utils.test_connectivity(dev[0], hapd)
2068
2069def test_ap_ft_ptk_rekey_ap(dev, apdev):
2070 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2071 ssid = "test-ft"
2072 passphrase="12345678"
2073
2074 params = ft_params1(ssid=ssid, passphrase=passphrase)
2075 params['wpa_ptk_rekey'] = '2'
8b8a1864 2076 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b
JM		 2077 params = ft_params2(ssid=ssid, passphrase=passphrase)
2078 params['wpa_ptk_rekey'] = '2'
8b8a1864 2079 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2080
2081 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2082
2083 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2084 "WPA: Key negotiation completed"], timeout=5)
2085 if ev is None:
2086 raise Exception("No event received after roam")
2087 if "CTRL-EVENT-DISCONNECTED" in ev:
2088 raise Exception("Unexpected disconnection after roam")
2089
2090 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2091 hapd = hapd0
2092 else:
2093 hapd = hapd1
2094 hwsim_utils.test_connectivity(dev[0], hapd)
186ca473
MB		 2095
2096def test_ap_ft_internal_rrb_check(dev, apdev):
2097 """RRB internal delivery only to WPA enabled BSS"""
2098 ssid = "test-ft"
2099 passphrase="12345678"
2100
2101 radius = hostapd.radius_params()
2102 params = ft_params1(ssid=ssid, passphrase=passphrase)
2103 params['wpa_key_mgmt'] = "FT-EAP"
2104 params["ieee8021x"] = "1"
2105 params = dict(radius.items() + params.items())
8b8a1864 2106 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2107 key_mgmt = hapd.get_config()['key_mgmt']
2108 if key_mgmt.split(' ')[0] != "FT-EAP":
2109 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2110
8b8a1864 2111 hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
186ca473
MB		 2112
2113 # Connect to WPA enabled AP
2114 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2115 eap="GPSK", identity="gpsk user",
2116 password="abcdefghijklmnop0123456789abcdef",
2117 scan_freq="2412")
2118
2119 # Try over_ds roaming to non-WPA-enabled AP.
2120 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2121 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2122
2123def test_ap_ft_extra_ie(dev, apdev):
2124 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2125 ssid = "test-ft"
2126 passphrase="12345678"
2127
2128 params = ft_params1(ssid=ssid, passphrase=passphrase)
2129 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2130 hapd0 = hostapd.add_ap(apdev[0], params)
2131 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2132 scan_freq="2412")
2133 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2134 scan_freq="2412")
2135 try:
2136 # Add Mobility Domain element to test AP validation code.
2137 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2138 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2139 scan_freq="2412", wait_connect=False)
2140 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2141 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2142 if ev is None:
2143 raise Exception("No connection result")
2144 if "CTRL-EVENT-CONNECTED" in ev:
2145 raise Exception("Non-FT association accepted with MDE")
2146 if "status_code=43" not in ev:
2147 raise Exception("Unexpected status code: " + ev)
2148 dev[0].request("DISCONNECT")
2149 finally:
2150 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2151
2152def test_ap_ft_ric(dev, apdev):
2153 """WPA2-PSK-FT AP and RIC"""
2154 ssid = "test-ft"
2155 passphrase="12345678"
2156
2157 params = ft_params1(ssid=ssid, passphrase=passphrase)
2158 hapd0 = hostapd.add_ap(apdev[0], params)
2159 params = ft_params2(ssid=ssid, passphrase=passphrase)
2160 hapd1 = hostapd.add_ap(apdev[1], params)
2161
2162 dev[0].set("ric_ies", "")
2163 dev[0].set("ric_ies", '""')
2164 if "FAIL" not in dev[0].request("SET ric_ies q"):
2165 raise Exception("Invalid ric_ies value accepted")
2166
2167 tests = [ "3900",
2168 "3900ff04eeeeeeee",
2169 "390400000000",
2170 "390400000000" + "390400000000",
2171 "390400000000" + "dd050050f20202",
2172 "390400000000" + "dd3d0050f2020201" + 55*"00",
2173 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2174 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2175 for t in tests:
2176 dev[0].set("ric_ies", t)
2177 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2178 test_connectivity=False)
2179 dev[0].request("REMOVE_NETWORK all")
2180 dev[0].wait_disconnected()
2181 dev[0].dump_monitor()
c8942286
JM		 2182
2183def ie_hex(ies, id):
2184 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id])
2185
2186def test_ap_ft_reassoc_proto(dev, apdev):
2187 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2188 ssid = "test-ft"
2189 passphrase="12345678"
2190
2191 params = ft_params1(ssid=ssid, passphrase=passphrase)
2192 hapd0 = hostapd.add_ap(apdev[0], params)
2193 params = ft_params2(ssid=ssid, passphrase=passphrase)
2194 hapd1 = hostapd.add_ap(apdev[1], params)
2195
2196 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2197 ieee80211w="1", scan_freq="2412")
2198 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2199 hapd1ap = hapd0
2200 hapd2ap = hapd1
2201 else:
2202 hapd1ap = hapd1
2203 hapd2ap = hapd0
2204
2205 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2206 hapd2ap.set("ext_mgmt_frame_handling", "1")
2207 dev[0].request("ROAM " + hapd2ap.own_addr())
2208
2209 while True:
2210 req = hapd2ap.mgmt_rx()
2211 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2212 if req['subtype'] == 11:
2213 break
2214
2215 while True:
2216 req = hapd2ap.mgmt_rx()
2217 if req['subtype'] == 2:
2218 break
2219 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2220
2221 # IEEE 802.11 header + fixed fields before IEs
2222 hdr = binascii.hexlify(req['frame'][0:34])
2223 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2224 # First elements: SSID, Supported Rates, Extended Supported Rates
2225 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2226
2227 rsne = ie_hex(ies, 48)
2228 mde = ie_hex(ies, 54)
2229 fte = ie_hex(ies, 55)
2230 tests = [ ]
2231 # RSN: Trying to use FT, but MDIE not included
2232 tests += [ rsne ]
2233 # RSN: Attempted to use unknown MDIE
2234 tests += [ rsne + "3603000000" ]
2235 # Invalid RSN pairwise cipher
2236 tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2237 # FT: No PMKID in RSNIE
2238 tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2239 # FT: Invalid FTIE
2240 tests += [ rsne + mde ]
2241 # FT: RIC IE(s) in the frame, but not included in protected IE count
2242 # FT: Failed to parse FT IEs
2243 tests += [ rsne + mde + fte + "3900" ]
2244 # FT: SNonce mismatch in FTIE
2245 tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2246 # FT: ANonce mismatch in FTIE
2247 tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2248 # FT: No R0KH-ID subelem in FTIE
2249 tests += [ rsne + mde + "3752" + fte[4:168] ]
2250 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2251 tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2252 # FT: No R1KH-ID subelem in FTIE
2253 tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") ]
2254 # FT: Unknown R1KH-ID used in ReassocReq
2255 tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") + "0106000000000000" ]
2256 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2257 tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2258 # Invalid MIC in FTIE
2259 tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2260 for t in tests:
2261 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2262
2263def test_ap_ft_reassoc_local_fail(dev, apdev):
2264 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2265 ssid = "test-ft"
2266 passphrase="12345678"
2267
2268 params = ft_params1(ssid=ssid, passphrase=passphrase)
2269 hapd0 = hostapd.add_ap(apdev[0], params)
2270 params = ft_params2(ssid=ssid, passphrase=passphrase)
2271 hapd1 = hostapd.add_ap(apdev[1], params)
2272
2273 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2274 ieee80211w="1", scan_freq="2412")
2275 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2276 hapd1ap = hapd0
2277 hapd2ap = hapd1
2278 else:
2279 hapd1ap = hapd1
2280 hapd2ap = hapd0
2281
2282 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2283 # FT: Failed to calculate MIC
2284 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2285 dev[0].request("ROAM " + hapd2ap.own_addr())
2286 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2287 dev[0].request("DISCONNECT")
2288 if ev is None:
2289 raise Exception("Association reject not seen")
d7f0bef9
JM		 2290
2291def test_ap_ft_reassoc_replay(dev, apdev, params):
2292 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2293 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2294 ssid = "test-ft"
2295 passphrase="12345678"
2296
2297 params = ft_params1(ssid=ssid, passphrase=passphrase)
2298 hapd0 = hostapd.add_ap(apdev[0], params)
2299 params = ft_params2(ssid=ssid, passphrase=passphrase)
2300 hapd1 = hostapd.add_ap(apdev[1], params)
2301
2302 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2303 scan_freq="2412")
2304 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2305 hapd1ap = hapd0
2306 hapd2ap = hapd1
2307 else:
2308 hapd1ap = hapd1
2309 hapd2ap = hapd0
2310
2311 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2312 hapd2ap.set("ext_mgmt_frame_handling", "1")
2313 dev[0].dump_monitor()
2314 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2315 raise Exception("ROAM failed")
2316
2317 reassocreq = None
2318 count = 0
2319 while count < 100:
2320 req = hapd2ap.mgmt_rx()
2321 count += 1
2322 hapd2ap.dump_monitor()
2323 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2324 if req['subtype'] == 2:
2325 reassocreq = req
2326 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2327 if ev is None:
2328 raise Exception("No TX status seen")
2329 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2330 if "OK" not in hapd2ap.request(cmd):
2331 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2332 break
2333 hapd2ap.set("ext_mgmt_frame_handling", "0")
2334 if reassocreq is None:
2335 raise Exception("No Reassociation Request frame seen")
2336 dev[0].wait_connected()
2337 dev[0].dump_monitor()
2338 hapd2ap.dump_monitor()
2339
2340 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2341
2342 logger.info("Replay the last Reassociation Request frame")
2343 hapd2ap.dump_monitor()
2344 hapd2ap.set("ext_mgmt_frame_handling", "1")
2345 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2346 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2347 if ev is None:
2348 raise Exception("No TX status seen")
2349 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2350 if "OK" not in hapd2ap.request(cmd):
2351 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2352 hapd2ap.set("ext_mgmt_frame_handling", "0")
2353
2354 try:
2355 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2356 ok = True
2357 except:
2358 ok = False
2359
2360 ap = hapd2ap.own_addr()
2361 sta = dev[0].own_addr()
2362 filt = "wlan.fc.type == 2 && " + \
2363 "wlan.da == " + sta + " && " + \
2364 "wlan.sa == " + ap
2365 fields = [ "wlan.ccmp.extiv" ]
2366 res = run_tshark(capfile, filt, fields)
2367 vals = res.splitlines()
2368 logger.info("CCMP PN: " + str(vals))
2369 if len(vals) < 2:
2370 raise Exception("Could not find all CCMP protected frames from capture")
2371 if len(set(vals)) < len(vals):
2372 raise Exception("Duplicate CCMP PN used")
2373
2374 if not ok:
2375 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2376
2377def test_ap_ft_psk_file(dev, apdev):
2378 """WPA2-PSK-FT AP with PSK from a file"""
2379 ssid = "test-ft"
2380 passphrase="12345678"
2381
2382 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2383 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2384 hapd = hostapd.add_ap(apdev[0], params)
2385
2386 dev[1].connect(ssid, psk="very secret",
2387 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2388 scan_freq="2412", wait_connect=False)
2389 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2390 ieee80211w="1", scan_freq="2412")
2391 dev[0].request("REMOVE_NETWORK all")
2392 dev[0].wait_disconnected()
2393 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2394 ieee80211w="1", scan_freq="2412")
2395 dev[0].request("REMOVE_NETWORK all")
2396 dev[0].wait_disconnected()
2397 dev[0].connect(ssid, psk="secret passphrase",
2398 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2399 scan_freq="2412")
2400 dev[2].connect(ssid, psk="another passphrase for all STAs",
2401 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2402 scan_freq="2412")
2403 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2404 if ev is None:
2405 raise Exception("Timed out while waiting for failure report")
2406 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2407
2408def test_ap_ft_eap_ap_config_change(dev, apdev):
2409 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2410 ssid = "test-ft"
2411 passphrase="12345678"
2412 bssid = apdev[0]['bssid']
2413
2414 radius = hostapd.radius_params()
2415 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2416 params['wpa_key_mgmt'] = "WPA-EAP"
2417 params["ieee8021x"] = "1"
2418 params["pmk_r1_push"] = "0"
2419 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2420 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2421 params["eap_server"] = "0"
2422 params = dict(radius.items() + params.items())
2423 hapd = hostapd.add_ap(apdev[0], params)
2424
2425 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2426 eap="GPSK", identity="gpsk user",
2427 password="abcdefghijklmnop0123456789abcdef",
2428 scan_freq="2412")
2429 dev[0].request("DISCONNECT")
2430 dev[0].wait_disconnected()
2431 dev[0].dump_monitor()
2432
2433 hapd.disable()
2434 hapd.set('wpa_key_mgmt', "FT-EAP")
2435 hapd.enable()
2436
2437 dev[0].request("BSS_FLUSH 0")
2438 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2439
2440 dev[0].request("RECONNECT")
2441 dev[0].wait_connected()
55b3cda7
JM		 2442
2443def test_ap_ft_eap_sha384(dev, apdev):
2444 """WPA2-EAP-FT with SHA384"""
2445 ssid = "test-ft"
2446 passphrase="12345678"
2447
2448 radius = hostapd.radius_params()
2449 params = ft_params1(ssid=ssid, passphrase=passphrase)
2450 params["ieee80211w"] = "2";
2451 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2452 params["ieee8021x"] = "1"
2453 params = dict(radius.items() + params.items())
2454 hapd0 = hostapd.add_ap(apdev[0], params)
2455 params = ft_params2(ssid=ssid, passphrase=passphrase)
2456 params["ieee80211w"] = "2";
2457 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2458 params["ieee8021x"] = "1"
2459 params = dict(radius.items() + params.items())
2460 hapd1 = hostapd.add_ap(apdev[1], params)
2461
2462 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2463 sha384=True)
2464
2465def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2466 """WPA2-EAP-FT with SHA384 over DS"""
2467 ssid = "test-ft"
2468 passphrase="12345678"
2469
2470 radius = hostapd.radius_params()
2471 params = ft_params1(ssid=ssid, passphrase=passphrase)
2472 params["ieee80211w"] = "2";
2473 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2474 params["ieee8021x"] = "1"
2475 params = dict(radius.items() + params.items())
2476 hapd0 = hostapd.add_ap(apdev[0], params)
2477 params = ft_params2(ssid=ssid, passphrase=passphrase)
2478 params["ieee80211w"] = "2";
2479 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2480 params["ieee8021x"] = "1"
2481 params = dict(radius.items() + params.items())
2482 hapd1 = hostapd.add_ap(apdev[1], params)
2483
2484 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2485 eap=True, sha384=True)
392aba4e
JM		 2486
2487def test_ap_ft_roam_rrm(dev, apdev):
2488 """WPA2-PSK-FT AP and radio measurement request"""
2489 ssid = "test-ft"
2490 passphrase="12345678"
2491
2492 params = ft_params1(ssid=ssid, passphrase=passphrase)
2493 params["rrm_beacon_report"] = "1"
2494 hapd0 = hostapd.add_ap(apdev[0], params)
2495 bssid0 = hapd0.own_addr()
2496
2497 addr = dev[0].own_addr()
2498 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2499 scan_freq="2412")
2500 check_beacon_req(hapd0, addr, 1)
2501
2502 params = ft_params2(ssid=ssid, passphrase=passphrase)
2503 params["rrm_beacon_report"] = "1"
2504 hapd1 = hostapd.add_ap(apdev[1], params)
2505 bssid1 = hapd1.own_addr()
2506
2507 dev[0].scan_for_bss(bssid1, freq=2412)
2508 dev[0].roam(bssid1)
2509 check_beacon_req(hapd1, addr, 2)
2510
2511 dev[0].scan_for_bss(bssid0, freq=2412)
2512 dev[0].roam(bssid0)
2513 check_beacon_req(hapd0, addr, 3)
Unnamed repository; edit this file 'description' to name the repository.