]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_eap.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: EAP-TTLS with unsupported Phase 2 EAP method in configuration
[thirdparty/hostap.git] / tests / hwsim / test_ap_eap.py
CommitLineData
eac67440 1# -*- coding: utf-8 -*-
9626962d 2# WPA2-Enterprise tests
3b51cc63 3# Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
9626962d
JM		 4#
5# This software may be distributed under the terms of the BSD license.
6# See README for more details.
7
6ea231e6 8import base64
5b3c40a6 9import binascii
9626962d
JM		 10import time
11import subprocess
12import logging
c9aa4308 13logger = logging.getLogger()
873e7c29 14import os
d4c3c055
JM		 15import socket
16import SocketServer
9626962d
JM		 17
18import hwsim_utils
19import hostapd
7c0d66cf 20from utils import HwsimSkip, alloc_fail, fail_test, skip_with_fips, wait_fail_trigger
52352802 21from wpasupplicant import WpaSupplicant
0ceff76e 22from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations, set_test_assoc_ie
9626962d 23
ca27ee09
JM		 24try:
25 import OpenSSL
26 openssl_imported = True
27except ImportError:
28 openssl_imported = False
29
81e787b7
JM		 30def check_hlr_auc_gw_support():
31 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
32 raise HwsimSkip("No hlr_auc_gw available")
33
3b51cc63
JM		 34def check_eap_capa(dev, method):
35 res = dev.get_capability("eap")
36 if method not in res:
37 raise HwsimSkip("EAP method %s not supported in the build" % method)
38
506b2f05
JM		 39def check_subject_match_support(dev):
40 tls = dev.request("GET tls_library")
41 if not tls.startswith("OpenSSL"):
42 raise HwsimSkip("subject_match not supported with this TLS library: " + tls)
43
44def check_altsubject_match_support(dev):
45 tls = dev.request("GET tls_library")
46 if not tls.startswith("OpenSSL"):
47 raise HwsimSkip("altsubject_match not supported with this TLS library: " + tls)
48
e78eb404
JM		 49def check_domain_match(dev):
50 tls = dev.request("GET tls_library")
51 if tls.startswith("internal"):
52 raise HwsimSkip("domain_match not supported with this TLS library: " + tls)
53
54def check_domain_suffix_match(dev):
55 tls = dev.request("GET tls_library")
56 if tls.startswith("internal"):
57 raise HwsimSkip("domain_suffix_match not supported with this TLS library: " + tls)
58
24579e70
JM		 59def check_domain_match_full(dev):
60 tls = dev.request("GET tls_library")
61 if not tls.startswith("OpenSSL"):
62 raise HwsimSkip("domain_suffix_match requires full match with this TLS library: " + tls)
63
4bf4e9db
JM		 64def check_cert_probe_support(dev):
65 tls = dev.request("GET tls_library")
0fc1b583 66 if not tls.startswith("OpenSSL") and not tls.startswith("internal"):
4bf4e9db
JM		 67 raise HwsimSkip("Certificate probing not supported with this TLS library: " + tls)
68
ca27ee09
JM		 69def check_ext_cert_check_support(dev):
70 tls = dev.request("GET tls_library")
71 if not tls.startswith("OpenSSL"):
72 raise HwsimSkip("ext_cert_check not supported with this TLS library: " + tls)
73
0dae8c99
JM		 74def check_ocsp_support(dev):
75 tls = dev.request("GET tls_library")
138903f9
JM		 76 #if tls.startswith("internal"):
77 # raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0c6185fc
JM		 78 #if "BoringSSL" in tls:
79 # raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0dae8c99 80
686eee77
JM		 81def check_pkcs12_support(dev):
82 tls = dev.request("GET tls_library")
16c43d2a
JM		 83 #if tls.startswith("internal"):
84 # raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
686eee77 85
404597e6
JM		 86def check_dh_dsa_support(dev):
87 tls = dev.request("GET tls_library")
88 if tls.startswith("internal"):
89 raise HwsimSkip("DH DSA not supported with this TLS library: " + tls)
90
6ea231e6
JM		 91def read_pem(fname):
92 with open(fname, "r") as f:
93 lines = f.readlines()
94 copy = False
95 cert = ""
96 for l in lines:
97 if "-----END" in l:
98 break
99 if copy:
100 cert = cert + l
101 if "-----BEGIN" in l:
102 copy = True
103 return base64.b64decode(cert)
104
6f939e59
JM		 105def eap_connect(dev, ap, method, identity,
106 sha256=False, expect_failure=False, local_error_report=False,
9dd21d51 107 maybe_local_error=False, **kwargs):
cb33ee14 108 hapd = hostapd.Hostapd(ap['ifname'])
2bb9e283
JM		 109 id = dev.connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
110 eap=method, identity=identity,
6f939e59
JM		 111 wait_connect=False, scan_freq="2412", ieee80211w="1",
112 **kwargs)
f10ba3b2
JM		 113 eap_check_auth(dev, method, True, sha256=sha256,
114 expect_failure=expect_failure,
9dd21d51
JM		 115 local_error_report=local_error_report,
116 maybe_local_error=maybe_local_error)
f10ba3b2
JM		 117 if expect_failure:
118 return id
cb33ee14
JM		 119 ev = hapd.wait_event([ "AP-STA-CONNECTED" ], timeout=5)
120 if ev is None:
121 raise Exception("No connection event received from hostapd")
2bb9e283 122 return id
75b2b9cf 123
f10ba3b2 124def eap_check_auth(dev, method, initial, rsn=True, sha256=False,
9dd21d51
JM		 125 expect_failure=False, local_error_report=False,
126 maybe_local_error=False):
9626962d
JM		 127 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
128 if ev is None:
129 raise Exception("Association and EAP start timed out")
06cdd1cd
JM		 130 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD",
131 "CTRL-EVENT-EAP-FAILURE"], timeout=10)
9626962d
JM		 132 if ev is None:
133 raise Exception("EAP method selection timed out")
06cdd1cd
JM		 134 if "CTRL-EVENT-EAP-FAILURE" in ev:
135 if maybe_local_error:
136 return
137 raise Exception("Could not select EAP method")
9626962d
JM		 138 if method not in ev:
139 raise Exception("Unexpected EAP method")
f10ba3b2
JM		 140 if expect_failure:
141 ev = dev.wait_event(["CTRL-EVENT-EAP-FAILURE"])
142 if ev is None:
143 raise Exception("EAP failure timed out")
5f35a5e2 144 ev = dev.wait_disconnected(timeout=10)
9dd21d51
JM		 145 if maybe_local_error and "locally_generated=1" in ev:
146 return
f10ba3b2
JM		 147 if not local_error_report:
148 if "reason=23" not in ev:
149 raise Exception("Proper reason code for disconnection not reported")
150 return
9626962d
JM		 151 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
152 if ev is None:
153 raise Exception("EAP success timed out")
9626962d 154
75b2b9cf
JM		 155 if initial:
156 ev = dev.wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
75b2b9cf 157 else:
bce774ad
JM		 158 ev = dev.wait_event(["WPA: Key negotiation completed"], timeout=10)
159 if ev is None:
160 raise Exception("Association with the AP timed out")
161 status = dev.get_status()
162 if status["wpa_state"] != "COMPLETED":
163 raise Exception("Connection not completed")
75b2b9cf 164
9626962d
JM		 165 if status["suppPortStatus"] != "Authorized":
166 raise Exception("Port not authorized")
167 if method not in status["selectedMethod"]:
168 raise Exception("Incorrect EAP method status")
2b005194
JM		 169 if sha256:
170 e = "WPA2-EAP-SHA256"
171 elif rsn:
71390dc8
JM		 172 e = "WPA2/IEEE 802.1X/EAP"
173 else:
174 e = "WPA/IEEE 802.1X/EAP"
175 if status["key_mgmt"] != e:
176 raise Exception("Unexpected key_mgmt status: " + status["key_mgmt"])
2fc4749c 177 return status
9626962d 178
5b1aaf6c 179def eap_reauth(dev, method, rsn=True, sha256=False, expect_failure=False):
75b2b9cf 180 dev.request("REAUTHENTICATE")
2fc4749c
JM		 181 return eap_check_auth(dev, method, False, rsn=rsn, sha256=sha256,
182 expect_failure=expect_failure)
75b2b9cf 183
9626962d
JM		 184def test_ap_wpa2_eap_sim(dev, apdev):
185 """WPA2-Enterprise connection using EAP-SIM"""
81e787b7 186 check_hlr_auc_gw_support()
9626962d 187 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 188 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 189 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
9626962d 190 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
a8375c94 191 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 192 eap_reauth(dev[0], "SIM")
9626962d 193
a0f350fd
JM		 194 eap_connect(dev[1], apdev[0], "SIM", "1232010000000001",
195 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
196 eap_connect(dev[2], apdev[0], "SIM", "1232010000000002",
197 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
198 expect_failure=True)
199
f10ba3b2
JM		 200 logger.info("Negative test with incorrect key")
201 dev[0].request("REMOVE_NETWORK all")
202 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
203 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
204 expect_failure=True)
205
32747a3e
JM		 206 logger.info("Invalid GSM-Milenage key")
207 dev[0].request("REMOVE_NETWORK all")
208 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
209 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
210 expect_failure=True)
211
212 logger.info("Invalid GSM-Milenage key(2)")
213 dev[0].request("REMOVE_NETWORK all")
214 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
215 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581",
216 expect_failure=True)
217
218 logger.info("Invalid GSM-Milenage key(3)")
219 dev[0].request("REMOVE_NETWORK all")
220 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
221 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q",
222 expect_failure=True)
223
224 logger.info("Invalid GSM-Milenage key(4)")
225 dev[0].request("REMOVE_NETWORK all")
226 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
227 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581",
228 expect_failure=True)
229
230 logger.info("Missing key configuration")
231 dev[0].request("REMOVE_NETWORK all")
232 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
233 expect_failure=True)
234
5b1aaf6c
JM		 235def test_ap_wpa2_eap_sim_sql(dev, apdev, params):
236 """WPA2-Enterprise connection using EAP-SIM (SQL)"""
81e787b7 237 check_hlr_auc_gw_support()
5b1aaf6c
JM		 238 try:
239 import sqlite3
240 except ImportError:
81e787b7 241 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 242 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
243 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
244 params['auth_server_port'] = "1814"
245 hostapd.add_ap(apdev[0]['ifname'], params)
246 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
247 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
248
249 logger.info("SIM fast re-authentication")
250 eap_reauth(dev[0], "SIM")
251
252 logger.info("SIM full auth with pseudonym")
253 with con:
254 cur = con.cursor()
255 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
256 eap_reauth(dev[0], "SIM")
257
258 logger.info("SIM full auth with permanent identity")
259 with con:
260 cur = con.cursor()
261 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
262 cur.execute("DELETE FROM pseudonyms WHERE permanent='1232010000000000'")
263 eap_reauth(dev[0], "SIM")
264
265 logger.info("SIM reauth with mismatching MK")
266 with con:
267 cur = con.cursor()
268 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='1232010000000000'")
269 eap_reauth(dev[0], "SIM", expect_failure=True)
270 dev[0].request("REMOVE_NETWORK all")
271
272 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
273 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
274 with con:
275 cur = con.cursor()
276 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
277 eap_reauth(dev[0], "SIM")
278 with con:
279 cur = con.cursor()
280 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
281 logger.info("SIM reauth with mismatching counter")
282 eap_reauth(dev[0], "SIM")
283 dev[0].request("REMOVE_NETWORK all")
284
285 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
286 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
287 with con:
288 cur = con.cursor()
289 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='1232010000000000'")
290 logger.info("SIM reauth with max reauth count reached")
291 eap_reauth(dev[0], "SIM")
292
e2a90a4c
JM		 293def test_ap_wpa2_eap_sim_config(dev, apdev):
294 """EAP-SIM configuration options"""
295 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
296 hostapd.add_ap(apdev[0]['ifname'], params)
297 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
298 identity="1232010000000000",
299 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
300 phase1="sim_min_num_chal=1",
301 wait_connect=False, scan_freq="2412")
302 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
303 if ev is None:
304 raise Exception("No EAP error message seen")
305 dev[0].request("REMOVE_NETWORK all")
306
307 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
308 identity="1232010000000000",
309 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
310 phase1="sim_min_num_chal=4",
311 wait_connect=False, scan_freq="2412")
312 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
313 if ev is None:
314 raise Exception("No EAP error message seen (2)")
315 dev[0].request("REMOVE_NETWORK all")
316
317 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
318 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
319 phase1="sim_min_num_chal=2")
320 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
321 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
322 anonymous_identity="345678")
323
72cbc684
JM		 324def test_ap_wpa2_eap_sim_ext(dev, apdev):
325 """WPA2-Enterprise connection using EAP-SIM and external GSM auth"""
47dcb118 326 try:
81e787b7 327 _test_ap_wpa2_eap_sim_ext(dev, apdev)
47dcb118
JM		 328 finally:
329 dev[0].request("SET external_sim 0")
330
331def _test_ap_wpa2_eap_sim_ext(dev, apdev):
81e787b7 332 check_hlr_auc_gw_support()
72cbc684
JM		 333 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
334 hostapd.add_ap(apdev[0]['ifname'], params)
335 dev[0].request("SET external_sim 1")
336 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
337 identity="1232010000000000",
338 wait_connect=False, scan_freq="2412")
339 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
340 if ev is None:
341 raise Exception("Network connected timed out")
342
343 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
344 if ev is None:
345 raise Exception("Wait for external SIM processing request timed out")
346 p = ev.split(':', 2)
347 if p[1] != "GSM-AUTH":
348 raise Exception("Unexpected CTRL-REQ-SIM type")
349 rid = p[0].split('-')[3]
350
351 # IK:CK:RES
352 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
353 # This will fail during processing, but the ctrl_iface command succeeds
354 dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTH:" + resp)
355 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
356 if ev is None:
357 raise Exception("EAP failure not reported")
358 dev[0].request("DISCONNECT")
90ad11e6
JM		 359 dev[0].wait_disconnected()
360 time.sleep(0.1)
72cbc684
JM		 361
362 dev[0].select_network(id, freq="2412")
363 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
364 if ev is None:
365 raise Exception("Wait for external SIM processing request timed out")
366 p = ev.split(':', 2)
367 if p[1] != "GSM-AUTH":
368 raise Exception("Unexpected CTRL-REQ-SIM type")
369 rid = p[0].split('-')[3]
370 # This will fail during GSM auth validation
371 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:q"):
372 raise Exception("CTRL-RSP-SIM failed")
373 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
374 if ev is None:
375 raise Exception("EAP failure not reported")
376 dev[0].request("DISCONNECT")
90ad11e6
JM		 377 dev[0].wait_disconnected()
378 time.sleep(0.1)
72cbc684
JM		 379
380 dev[0].select_network(id, freq="2412")
381 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
382 if ev is None:
383 raise Exception("Wait for external SIM processing request timed out")
384 p = ev.split(':', 2)
385 if p[1] != "GSM-AUTH":
386 raise Exception("Unexpected CTRL-REQ-SIM type")
387 rid = p[0].split('-')[3]
388 # This will fail during GSM auth validation
389 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:34"):
390 raise Exception("CTRL-RSP-SIM failed")
391 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
392 if ev is None:
393 raise Exception("EAP failure not reported")
394 dev[0].request("DISCONNECT")
90ad11e6
JM		 395 dev[0].wait_disconnected()
396 time.sleep(0.1)
72cbc684
JM		 397
398 dev[0].select_network(id, freq="2412")
399 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
400 if ev is None:
401 raise Exception("Wait for external SIM processing request timed out")
402 p = ev.split(':', 2)
403 if p[1] != "GSM-AUTH":
404 raise Exception("Unexpected CTRL-REQ-SIM type")
405 rid = p[0].split('-')[3]
406 # This will fail during GSM auth validation
407 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677"):
408 raise Exception("CTRL-RSP-SIM failed")
409 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
410 if ev is None:
411 raise Exception("EAP failure not reported")
412 dev[0].request("DISCONNECT")
90ad11e6
JM		 413 dev[0].wait_disconnected()
414 time.sleep(0.1)
72cbc684
JM		 415
416 dev[0].select_network(id, freq="2412")
417 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
418 if ev is None:
419 raise Exception("Wait for external SIM processing request timed out")
420 p = ev.split(':', 2)
421 if p[1] != "GSM-AUTH":
422 raise Exception("Unexpected CTRL-REQ-SIM type")
423 rid = p[0].split('-')[3]
424 # This will fail during GSM auth validation
425 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:q"):
426 raise Exception("CTRL-RSP-SIM failed")
427 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
428 if ev is None:
429 raise Exception("EAP failure not reported")
430 dev[0].request("DISCONNECT")
90ad11e6
JM		 431 dev[0].wait_disconnected()
432 time.sleep(0.1)
72cbc684
JM		 433
434 dev[0].select_network(id, freq="2412")
435 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
436 if ev is None:
437 raise Exception("Wait for external SIM processing request timed out")
438 p = ev.split(':', 2)
439 if p[1] != "GSM-AUTH":
440 raise Exception("Unexpected CTRL-REQ-SIM type")
441 rid = p[0].split('-')[3]
442 # This will fail during GSM auth validation
443 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233"):
444 raise Exception("CTRL-RSP-SIM failed")
445 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
446 if ev is None:
447 raise Exception("EAP failure not reported")
448 dev[0].request("DISCONNECT")
90ad11e6
JM		 449 dev[0].wait_disconnected()
450 time.sleep(0.1)
72cbc684
JM		 451
452 dev[0].select_network(id, freq="2412")
453 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
454 if ev is None:
455 raise Exception("Wait for external SIM processing request timed out")
456 p = ev.split(':', 2)
457 if p[1] != "GSM-AUTH":
458 raise Exception("Unexpected CTRL-REQ-SIM type")
459 rid = p[0].split('-')[3]
460 # This will fail during GSM auth validation
461 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233:q"):
462 raise Exception("CTRL-RSP-SIM failed")
463 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
464 if ev is None:
465 raise Exception("EAP failure not reported")
466
486f4e3c
JM		 467def test_ap_wpa2_eap_sim_oom(dev, apdev):
468 """EAP-SIM and OOM"""
469 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
470 hostapd.add_ap(apdev[0]['ifname'], params)
471 tests = [ (1, "milenage_f2345"),
472 (2, "milenage_f2345"),
473 (3, "milenage_f2345"),
474 (4, "milenage_f2345"),
475 (5, "milenage_f2345"),
476 (6, "milenage_f2345"),
477 (7, "milenage_f2345"),
478 (8, "milenage_f2345"),
479 (9, "milenage_f2345"),
480 (10, "milenage_f2345"),
481 (11, "milenage_f2345"),
482 (12, "milenage_f2345") ]
483 for count, func in tests:
484 with alloc_fail(dev[0], count, func):
485 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
486 identity="1232010000000000",
487 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
488 wait_connect=False, scan_freq="2412")
489 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
490 if ev is None:
491 raise Exception("EAP method not selected")
492 dev[0].wait_disconnected()
493 dev[0].request("REMOVE_NETWORK all")
494
9626962d
JM		 495def test_ap_wpa2_eap_aka(dev, apdev):
496 """WPA2-Enterprise connection using EAP-AKA"""
81e787b7 497 check_hlr_auc_gw_support()
9626962d 498 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 499 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 500 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
9626962d 501 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
a8375c94 502 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 503 eap_reauth(dev[0], "AKA")
9626962d 504
f10ba3b2
JM		 505 logger.info("Negative test with incorrect key")
506 dev[0].request("REMOVE_NETWORK all")
507 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
508 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
509 expect_failure=True)
510
32747a3e
JM		 511 logger.info("Invalid Milenage key")
512 dev[0].request("REMOVE_NETWORK all")
513 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
514 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
515 expect_failure=True)
516
517 logger.info("Invalid Milenage key(2)")
518 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
519 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581:000000000123",
520 expect_failure=True)
521
522 logger.info("Invalid Milenage key(3)")
523 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
524 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q:000000000123",
525 expect_failure=True)
526
527 logger.info("Invalid Milenage key(4)")
528 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
529 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:00000000012q",
530 expect_failure=True)
531
532 logger.info("Invalid Milenage key(5)")
533 dev[0].request("REMOVE_NETWORK all")
534 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
535 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581q000000000123",
536 expect_failure=True)
537
538 logger.info("Invalid Milenage key(6)")
539 dev[0].request("REMOVE_NETWORK all")
540 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
541 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581q000000000123",
542 expect_failure=True)
543
544 logger.info("Missing key configuration")
545 dev[0].request("REMOVE_NETWORK all")
546 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
547 expect_failure=True)
548
5b1aaf6c
JM		 549def test_ap_wpa2_eap_aka_sql(dev, apdev, params):
550 """WPA2-Enterprise connection using EAP-AKA (SQL)"""
81e787b7 551 check_hlr_auc_gw_support()
5b1aaf6c
JM		 552 try:
553 import sqlite3
554 except ImportError:
81e787b7 555 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 556 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
557 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
558 params['auth_server_port'] = "1814"
559 hostapd.add_ap(apdev[0]['ifname'], params)
560 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
561 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
562
563 logger.info("AKA fast re-authentication")
564 eap_reauth(dev[0], "AKA")
565
566 logger.info("AKA full auth with pseudonym")
567 with con:
568 cur = con.cursor()
569 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
570 eap_reauth(dev[0], "AKA")
571
572 logger.info("AKA full auth with permanent identity")
573 with con:
574 cur = con.cursor()
575 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
576 cur.execute("DELETE FROM pseudonyms WHERE permanent='0232010000000000'")
577 eap_reauth(dev[0], "AKA")
578
579 logger.info("AKA reauth with mismatching MK")
580 with con:
581 cur = con.cursor()
582 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='0232010000000000'")
583 eap_reauth(dev[0], "AKA", expect_failure=True)
584 dev[0].request("REMOVE_NETWORK all")
585
586 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
587 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
588 with con:
589 cur = con.cursor()
590 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
591 eap_reauth(dev[0], "AKA")
592 with con:
593 cur = con.cursor()
594 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
595 logger.info("AKA reauth with mismatching counter")
596 eap_reauth(dev[0], "AKA")
597 dev[0].request("REMOVE_NETWORK all")
598
599 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
600 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
601 with con:
602 cur = con.cursor()
603 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='0232010000000000'")
604 logger.info("AKA reauth with max reauth count reached")
605 eap_reauth(dev[0], "AKA")
606
e2a90a4c
JM		 607def test_ap_wpa2_eap_aka_config(dev, apdev):
608 """EAP-AKA configuration options"""
609 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
610 hostapd.add_ap(apdev[0]['ifname'], params)
611 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
612 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
613 anonymous_identity="2345678")
614
d314bedf
JM		 615def test_ap_wpa2_eap_aka_ext(dev, apdev):
616 """WPA2-Enterprise connection using EAP-AKA and external UMTS auth"""
47dcb118 617 try:
81e787b7 618 _test_ap_wpa2_eap_aka_ext(dev, apdev)
47dcb118
JM		 619 finally:
620 dev[0].request("SET external_sim 0")
621
622def _test_ap_wpa2_eap_aka_ext(dev, apdev):
81e787b7 623 check_hlr_auc_gw_support()
d314bedf
JM		 624 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
625 hostapd.add_ap(apdev[0]['ifname'], params)
626 dev[0].request("SET external_sim 1")
627 id = dev[0].connect("test-wpa2-eap", eap="AKA", key_mgmt="WPA-EAP",
628 identity="0232010000000000",
629 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
630 wait_connect=False, scan_freq="2412")
631 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
632 if ev is None:
633 raise Exception("Network connected timed out")
634
635 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
636 if ev is None:
637 raise Exception("Wait for external SIM processing request timed out")
638 p = ev.split(':', 2)
639 if p[1] != "UMTS-AUTH":
640 raise Exception("Unexpected CTRL-REQ-SIM type")
641 rid = p[0].split('-')[3]
642
643 # IK:CK:RES
644 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
645 # This will fail during processing, but the ctrl_iface command succeeds
646 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
647 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
648 if ev is None:
649 raise Exception("EAP failure not reported")
650 dev[0].request("DISCONNECT")
584e4197 651 dev[0].wait_disconnected()
90ad11e6 652 time.sleep(0.1)
a359c7bb 653 dev[0].dump_monitor()
d314bedf 654
d8e02214
JM		 655 dev[0].select_network(id, freq="2412")
656 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
657 if ev is None:
658 raise Exception("Wait for external SIM processing request timed out")
659 p = ev.split(':', 2)
660 if p[1] != "UMTS-AUTH":
661 raise Exception("Unexpected CTRL-REQ-SIM type")
662 rid = p[0].split('-')[3]
663 # This will fail during UMTS auth validation
664 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:112233445566778899aabbccddee"):
665 raise Exception("CTRL-RSP-SIM failed")
666 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
667 if ev is None:
668 raise Exception("Wait for external SIM processing request timed out")
669 p = ev.split(':', 2)
670 if p[1] != "UMTS-AUTH":
671 raise Exception("Unexpected CTRL-REQ-SIM type")
672 rid = p[0].split('-')[3]
673 # This will fail during UMTS auth validation
674 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:12"):
675 raise Exception("CTRL-RSP-SIM failed")
676 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
677 if ev is None:
678 raise Exception("EAP failure not reported")
679 dev[0].request("DISCONNECT")
584e4197 680 dev[0].wait_disconnected()
90ad11e6 681 time.sleep(0.1)
a359c7bb 682 dev[0].dump_monitor()
d8e02214 683
0258cf10
JM		 684 tests = [ ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344",
685 ":UMTS-AUTH:34",
686 ":UMTS-AUTH:00112233445566778899aabbccddeeff.00112233445566778899aabbccddeeff:0011223344",
687 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddee:0011223344",
688 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff.0011223344",
689 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff0011223344",
690 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:001122334q" ]
691 for t in tests:
692 dev[0].select_network(id, freq="2412")
693 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
694 if ev is None:
695 raise Exception("Wait for external SIM processing request timed out")
696 p = ev.split(':', 2)
697 if p[1] != "UMTS-AUTH":
698 raise Exception("Unexpected CTRL-REQ-SIM type")
699 rid = p[0].split('-')[3]
700 # This will fail during UMTS auth validation
701 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + t):
702 raise Exception("CTRL-RSP-SIM failed")
703 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
704 if ev is None:
705 raise Exception("EAP failure not reported")
706 dev[0].request("DISCONNECT")
707 dev[0].wait_disconnected()
90ad11e6 708 time.sleep(0.1)
a359c7bb 709 dev[0].dump_monitor()
d314bedf 710
9626962d
JM		 711def test_ap_wpa2_eap_aka_prime(dev, apdev):
712 """WPA2-Enterprise connection using EAP-AKA'"""
81e787b7 713 check_hlr_auc_gw_support()
9626962d 714 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 715 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 716 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
9626962d 717 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
a8375c94 718 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 719 eap_reauth(dev[0], "AKA'")
9626962d 720
8583d664
JM		 721 logger.info("EAP-AKA' bidding protection when EAP-AKA enabled as well")
722 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="AKA' AKA",
723 identity="6555444333222111@both",
724 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
725 wait_connect=False, scan_freq="2412")
5f35a5e2 726 dev[1].wait_connected(timeout=15)
8583d664 727
f10ba3b2
JM		 728 logger.info("Negative test with incorrect key")
729 dev[0].request("REMOVE_NETWORK all")
730 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
731 password="ff22250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
732 expect_failure=True)
733
5b1aaf6c
JM		 734def test_ap_wpa2_eap_aka_prime_sql(dev, apdev, params):
735 """WPA2-Enterprise connection using EAP-AKA' (SQL)"""
81e787b7 736 check_hlr_auc_gw_support()
5b1aaf6c
JM		 737 try:
738 import sqlite3
739 except ImportError:
81e787b7 740 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 741 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
742 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
743 params['auth_server_port'] = "1814"
744 hostapd.add_ap(apdev[0]['ifname'], params)
745 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
746 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
747
748 logger.info("AKA' fast re-authentication")
749 eap_reauth(dev[0], "AKA'")
750
751 logger.info("AKA' full auth with pseudonym")
752 with con:
753 cur = con.cursor()
754 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
755 eap_reauth(dev[0], "AKA'")
756
757 logger.info("AKA' full auth with permanent identity")
758 with con:
759 cur = con.cursor()
760 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
761 cur.execute("DELETE FROM pseudonyms WHERE permanent='6555444333222111'")
762 eap_reauth(dev[0], "AKA'")
763
764 logger.info("AKA' reauth with mismatching k_aut")
765 with con:
766 cur = con.cursor()
767 cur.execute("UPDATE reauth SET k_aut='0000000000000000000000000000000000000000000000000000000000000000' WHERE permanent='6555444333222111'")
768 eap_reauth(dev[0], "AKA'", expect_failure=True)
769 dev[0].request("REMOVE_NETWORK all")
770
771 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
772 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
773 with con:
774 cur = con.cursor()
775 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
776 eap_reauth(dev[0], "AKA'")
777 with con:
778 cur = con.cursor()
779 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
780 logger.info("AKA' reauth with mismatching counter")
781 eap_reauth(dev[0], "AKA'")
782 dev[0].request("REMOVE_NETWORK all")
783
784 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
785 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
786 with con:
787 cur = con.cursor()
788 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='6555444333222111'")
789 logger.info("AKA' reauth with max reauth count reached")
790 eap_reauth(dev[0], "AKA'")
791
9626962d
JM		 792def test_ap_wpa2_eap_ttls_pap(dev, apdev):
793 """WPA2-Enterprise connection using EAP-TTLS/PAP"""
794 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
65038313
JM		 795 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
796 key_mgmt = hapd.get_config()['key_mgmt']
797 if key_mgmt.split(' ')[0] != "WPA-EAP":
798 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cb33ee14 799 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
9626962d 800 anonymous_identity="ttls", password="password",
506b2f05 801 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
a8375c94 802 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 803 eap_reauth(dev[0], "TTLS")
eaf3f9b1
JM		 804 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-1"),
805 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-1") ])
9626962d 806
506b2f05
JM		 807def test_ap_wpa2_eap_ttls_pap_subject_match(dev, apdev):
808 """WPA2-Enterprise connection using EAP-TTLS/PAP and (alt)subject_match"""
809 check_subject_match_support(dev[0])
810 check_altsubject_match_support(dev[0])
811 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
812 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
813 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
814 anonymous_identity="ttls", password="password",
815 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
816 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
817 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
818 eap_reauth(dev[0], "TTLS")
819
82a8f5b5
JM		 820def test_ap_wpa2_eap_ttls_pap_incorrect_password(dev, apdev):
821 """WPA2-Enterprise connection using EAP-TTLS/PAP - incorrect password"""
822 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
823 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
824 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
825 anonymous_identity="ttls", password="wrong",
826 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
827 expect_failure=True)
828 eap_connect(dev[1], apdev[0], "TTLS", "user",
829 anonymous_identity="ttls", password="password",
830 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
831 expect_failure=True)
832
9626962d
JM		 833def test_ap_wpa2_eap_ttls_chap(dev, apdev):
834 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 835 skip_with_fips(dev[0])
9626962d 836 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 837 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
506b2f05
JM		 838 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
839 anonymous_identity="ttls", password="password",
840 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
841 hwsim_utils.test_connectivity(dev[0], hapd)
842 eap_reauth(dev[0], "TTLS")
843
844def test_ap_wpa2_eap_ttls_chap_altsubject_match(dev, apdev):
845 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 846 skip_with_fips(dev[0])
506b2f05
JM		 847 check_altsubject_match_support(dev[0])
848 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
849 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 850 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
9626962d 851 anonymous_identity="ttls", password="password",
5c65e277
JM		 852 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
853 altsubject_match="EMAIL:noone@example.com;URI:http://example.com/;DNS:server.w1.fi")
75b2b9cf 854 eap_reauth(dev[0], "TTLS")
9626962d 855
82a8f5b5
JM		 856def test_ap_wpa2_eap_ttls_chap_incorrect_password(dev, apdev):
857 """WPA2-Enterprise connection using EAP-TTLS/CHAP - incorrect password"""
ca158ea6 858 skip_with_fips(dev[0])
82a8f5b5
JM		 859 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
860 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
861 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
862 anonymous_identity="ttls", password="wrong",
863 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
864 expect_failure=True)
865 eap_connect(dev[1], apdev[0], "TTLS", "user",
866 anonymous_identity="ttls", password="password",
867 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
868 expect_failure=True)
869
9626962d
JM		 870def test_ap_wpa2_eap_ttls_mschap(dev, apdev):
871 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP"""
ca158ea6 872 skip_with_fips(dev[0])
e78eb404 873 check_domain_suffix_match(dev[0])
9626962d 874 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 875 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 876 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
9626962d 877 anonymous_identity="ttls", password="password",
72c052d5
JM		 878 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
879 domain_suffix_match="server.w1.fi")
a8375c94 880 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 881 eap_reauth(dev[0], "TTLS")
6daf5b9c
JM		 882 dev[0].request("REMOVE_NETWORK all")
883 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
884 anonymous_identity="ttls", password="password",
885 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
886 fragment_size="200")
bfdb90d4
JM		 887 dev[0].request("REMOVE_NETWORK all")
888 dev[0].wait_disconnected()
889 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
890 anonymous_identity="ttls",
891 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
892 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP")
9626962d 893
82a8f5b5 894def test_ap_wpa2_eap_ttls_mschap_incorrect_password(dev, apdev):
ca158ea6
JM		 895 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP - incorrect password"""
896 skip_with_fips(dev[0])
82a8f5b5
JM		 897 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
898 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
899 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
900 anonymous_identity="ttls", password="wrong",
901 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
902 expect_failure=True)
903 eap_connect(dev[1], apdev[0], "TTLS", "user",
904 anonymous_identity="ttls", password="password",
905 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
906 expect_failure=True)
907 eap_connect(dev[2], apdev[0], "TTLS", "no such user",
908 anonymous_identity="ttls", password="password",
909 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
910 expect_failure=True)
911
9626962d
JM		 912def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev):
913 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
e78eb404 914 check_domain_suffix_match(dev[0])
ca158ea6 915 check_eap_capa(dev[0], "MSCHAPV2")
9626962d
JM		 916 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
917 hostapd.add_ap(apdev[0]['ifname'], params)
5dec879d 918 hapd = hostapd.Hostapd(apdev[0]['ifname'])
cb33ee14 919 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
9626962d 920 anonymous_identity="ttls", password="password",
72c052d5 921 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
24579e70 922 domain_suffix_match="server.w1.fi")
a8375c94 923 hwsim_utils.test_connectivity(dev[0], hapd)
5dec879d
JM		 924 sta1 = hapd.get_sta(dev[0].p2p_interface_addr())
925 eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
75b2b9cf 926 eap_reauth(dev[0], "TTLS")
5dec879d
JM		 927 sta2 = hapd.get_sta(dev[0].p2p_interface_addr())
928 eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
929 if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']):
930 raise Exception("dot1xAuthEapolFramesRx did not increase")
931 if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1:
932 raise Exception("authAuthEapStartsWhileAuthenticated did not increase")
933 if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']):
934 raise Exception("backendAuthSuccesses did not increase")
9626962d 935
fa0ddb14
JM		 936 logger.info("Password as hash value")
937 dev[0].request("REMOVE_NETWORK all")
938 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
939 anonymous_identity="ttls",
940 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
941 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
942
c4e06b9b
JM		 943def test_ap_wpa2_eap_ttls_invalid_phase2(dev, apdev):
944 """EAP-TTLS with invalid phase2 parameter values"""
945 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
946 hostapd.add_ap(apdev[0]['ifname'], params)
947 tests = [ "auth=MSCHAPv2", "auth=MSCHAPV2 autheap=MD5",
53827125
JM		 948 "autheap=MD5 auth=MSCHAPV2", "auth=PAP auth=CHAP",
949 "autheap=MD5 autheap=FOO autheap=MSCHAPV2" ]
c4e06b9b
JM		 950 for t in tests:
951 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
952 identity="DOMAIN\mschapv2 user",
953 anonymous_identity="ttls", password="password",
954 ca_cert="auth_serv/ca.pem", phase2=t,
955 wait_connect=False, scan_freq="2412")
956 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"], timeout=10)
957 if ev is None or "method=21" not in ev:
958 raise Exception("EAP-TTLS not started")
959 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method",
960 "CTRL-EVENT-CONNECTED"], timeout=5)
961 if ev is None or "CTRL-EVENT-CONNECTED" in ev:
962 raise Exception("No EAP-TTLS failure reported for phase2=" + t)
963 dev[0].request("REMOVE_NETWORK all")
964 dev[0].wait_disconnected()
965 dev[0].dump_monitor()
966
24579e70
JM		 967def test_ap_wpa2_eap_ttls_mschapv2_suffix_match(dev, apdev):
968 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
969 check_domain_match_full(dev[0])
ca158ea6 970 skip_with_fips(dev[0])
24579e70
JM		 971 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
972 hostapd.add_ap(apdev[0]['ifname'], params)
973 hapd = hostapd.Hostapd(apdev[0]['ifname'])
974 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
975 anonymous_identity="ttls", password="password",
976 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
977 domain_suffix_match="w1.fi")
978 hwsim_utils.test_connectivity(dev[0], hapd)
979 eap_reauth(dev[0], "TTLS")
980
061cbb25
JM		 981def test_ap_wpa2_eap_ttls_mschapv2_domain_match(dev, apdev):
982 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 (domain_match)"""
e78eb404 983 check_domain_match(dev[0])
ca158ea6 984 skip_with_fips(dev[0])
061cbb25
JM		 985 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
986 hostapd.add_ap(apdev[0]['ifname'], params)
987 hapd = hostapd.Hostapd(apdev[0]['ifname'])
988 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
989 anonymous_identity="ttls", password="password",
990 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
991 domain_match="Server.w1.fi")
992 hwsim_utils.test_connectivity(dev[0], hapd)
993 eap_reauth(dev[0], "TTLS")
994
82a8f5b5
JM		 995def test_ap_wpa2_eap_ttls_mschapv2_incorrect_password(dev, apdev):
996 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 - incorrect password"""
ca158ea6 997 skip_with_fips(dev[0])
82a8f5b5
JM		 998 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
999 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
f10ba3b2
JM		 1000 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
1001 anonymous_identity="ttls", password="password1",
1002 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1003 expect_failure=True)
82a8f5b5
JM		 1004 eap_connect(dev[1], apdev[0], "TTLS", "user",
1005 anonymous_identity="ttls", password="password",
1006 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1007 expect_failure=True)
f10ba3b2 1008
eac67440
JM		 1009def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev):
1010 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 and UTF-8 password"""
ca158ea6 1011 skip_with_fips(dev[0])
eac67440
JM		 1012 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1013 hostapd.add_ap(apdev[0]['ifname'], params)
1014 hapd = hostapd.Hostapd(apdev[0]['ifname'])
1015 eap_connect(dev[0], apdev[0], "TTLS", "utf8-user-hash",
1016 anonymous_identity="ttls", password="secret-åäö-€-password",
1017 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1018 eap_connect(dev[1], apdev[0], "TTLS", "utf8-user",
1019 anonymous_identity="ttls",
1020 password_hex="hash:bd5844fad2489992da7fe8c5a01559cf",
1021 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
0d2a7bad
JM		 1022 for p in [ "80", "41c041e04141e041", 257*"41" ]:
1023 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
1024 eap="TTLS", identity="utf8-user-hash",
1025 anonymous_identity="ttls", password_hex=p,
1026 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1027 wait_connect=False, scan_freq="2412")
1028 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=1)
1029 if ev is None:
1030 raise Exception("No failure reported")
1031 dev[2].request("REMOVE_NETWORK all")
1032 dev[2].wait_disconnected()
eac67440 1033
9626962d
JM		 1034def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev):
1035 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC"""
1036 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1037 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1038 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 1039 anonymous_identity="ttls", password="password",
1040 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
a8375c94 1041 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1042 eap_reauth(dev[0], "TTLS")
9626962d 1043
95a15d79
JM		 1044def test_ap_wpa2_eap_ttls_eap_gtc_incorrect_password(dev, apdev):
1045 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - incorrect password"""
1046 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1047 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1048 eap_connect(dev[0], apdev[0], "TTLS", "user",
1049 anonymous_identity="ttls", password="wrong",
1050 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1051 expect_failure=True)
1052
1053def test_ap_wpa2_eap_ttls_eap_gtc_no_password(dev, apdev):
1054 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - no password"""
1055 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1056 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1057 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1058 anonymous_identity="ttls", password="password",
1059 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1060 expect_failure=True)
1061
1062def test_ap_wpa2_eap_ttls_eap_gtc_server_oom(dev, apdev):
1063 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - server OOM"""
1064 params = int_eap_server_params()
1065 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1066 with alloc_fail(hapd, 1, "eap_gtc_init"):
1067 eap_connect(dev[0], apdev[0], "TTLS", "user",
1068 anonymous_identity="ttls", password="password",
1069 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1070 expect_failure=True)
1071 dev[0].request("REMOVE_NETWORK all")
1072
1073 with alloc_fail(hapd, 1, "eap_gtc_buildReq"):
1074 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1075 eap="TTLS", identity="user",
1076 anonymous_identity="ttls", password="password",
1077 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1078 wait_connect=False, scan_freq="2412")
1079 # This would eventually time out, but we can stop after having reached
1080 # the allocation failure.
1081 for i in range(20):
1082 time.sleep(0.1)
1083 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1084 break
1085
9626962d
JM		 1086def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev):
1087 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5"""
e7ac04ce 1088 check_eap_capa(dev[0], "MD5")
9626962d 1089 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1090 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1091 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 1092 anonymous_identity="ttls", password="password",
1093 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5")
a8375c94 1094 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1095 eap_reauth(dev[0], "TTLS")
9626962d 1096
ee9533eb
JM		 1097def test_ap_wpa2_eap_ttls_eap_md5_incorrect_password(dev, apdev):
1098 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - incorrect password"""
e7ac04ce 1099 check_eap_capa(dev[0], "MD5")
ee9533eb
JM		 1100 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1101 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1102 eap_connect(dev[0], apdev[0], "TTLS", "user",
1103 anonymous_identity="ttls", password="wrong",
1104 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1105 expect_failure=True)
1106
95a15d79
JM		 1107def test_ap_wpa2_eap_ttls_eap_md5_no_password(dev, apdev):
1108 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - no password"""
e7ac04ce 1109 check_eap_capa(dev[0], "MD5")
95a15d79
JM		 1110 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1111 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1112 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1113 anonymous_identity="ttls", password="password",
1114 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1115 expect_failure=True)
1116
ee9533eb
JM		 1117def test_ap_wpa2_eap_ttls_eap_md5_server_oom(dev, apdev):
1118 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - server OOM"""
e7ac04ce 1119 check_eap_capa(dev[0], "MD5")
ee9533eb
JM		 1120 params = int_eap_server_params()
1121 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1122 with alloc_fail(hapd, 1, "eap_md5_init"):
1123 eap_connect(dev[0], apdev[0], "TTLS", "user",
1124 anonymous_identity="ttls", password="password",
1125 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1126 expect_failure=True)
1127 dev[0].request("REMOVE_NETWORK all")
1128
1129 with alloc_fail(hapd, 1, "eap_md5_buildReq"):
1130 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1131 eap="TTLS", identity="user",
1132 anonymous_identity="ttls", password="password",
1133 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1134 wait_connect=False, scan_freq="2412")
1135 # This would eventually time out, but we can stop after having reached
1136 # the allocation failure.
1137 for i in range(20):
1138 time.sleep(0.1)
1139 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1140 break
1141
9626962d
JM		 1142def test_ap_wpa2_eap_ttls_eap_mschapv2(dev, apdev):
1143 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2"""
e7ac04ce 1144 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1145 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1146 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1147 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 1148 anonymous_identity="ttls", password="password",
1149 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2")
a8375c94 1150 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1151 eap_reauth(dev[0], "TTLS")
9626962d 1152
f10ba3b2
JM		 1153 logger.info("Negative test with incorrect password")
1154 dev[0].request("REMOVE_NETWORK all")
1155 eap_connect(dev[0], apdev[0], "TTLS", "user",
1156 anonymous_identity="ttls", password="password1",
1157 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1158 expect_failure=True)
1159
95a15d79
JM		 1160def test_ap_wpa2_eap_ttls_eap_mschapv2_no_password(dev, apdev):
1161 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - no password"""
e7ac04ce 1162 check_eap_capa(dev[0], "MSCHAPV2")
95a15d79
JM		 1163 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1164 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1165 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1166 anonymous_identity="ttls", password="password",
1167 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1168 expect_failure=True)
1169
ef318402
JM		 1170def test_ap_wpa2_eap_ttls_eap_mschapv2_server_oom(dev, apdev):
1171 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - server OOM"""
e7ac04ce 1172 check_eap_capa(dev[0], "MSCHAPV2")
ef318402
JM		 1173 params = int_eap_server_params()
1174 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1175 with alloc_fail(hapd, 1, "eap_mschapv2_init"):
1176 eap_connect(dev[0], apdev[0], "TTLS", "user",
1177 anonymous_identity="ttls", password="password",
1178 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1179 expect_failure=True)
1180 dev[0].request("REMOVE_NETWORK all")
1181
1182 with alloc_fail(hapd, 1, "eap_mschapv2_build_challenge"):
1183 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1184 eap="TTLS", identity="user",
1185 anonymous_identity="ttls", password="password",
1186 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1187 wait_connect=False, scan_freq="2412")
1188 # This would eventually time out, but we can stop after having reached
1189 # the allocation failure.
1190 for i in range(20):
1191 time.sleep(0.1)
1192 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1193 break
1194 dev[0].request("REMOVE_NETWORK all")
1195
1196 with alloc_fail(hapd, 1, "eap_mschapv2_build_success_req"):
1197 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1198 eap="TTLS", identity="user",
1199 anonymous_identity="ttls", password="password",
1200 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1201 wait_connect=False, scan_freq="2412")
1202 # This would eventually time out, but we can stop after having reached
1203 # the allocation failure.
1204 for i in range(20):
1205 time.sleep(0.1)
1206 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1207 break
1208 dev[0].request("REMOVE_NETWORK all")
1209
1210 with alloc_fail(hapd, 1, "eap_mschapv2_build_failure_req"):
1211 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1212 eap="TTLS", identity="user",
1213 anonymous_identity="ttls", password="wrong",
1214 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1215 wait_connect=False, scan_freq="2412")
1216 # This would eventually time out, but we can stop after having reached
1217 # the allocation failure.
1218 for i in range(20):
1219 time.sleep(0.1)
1220 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1221 break
1222 dev[0].request("REMOVE_NETWORK all")
1223
95fb531c
JM		 1224def test_ap_wpa2_eap_ttls_eap_aka(dev, apdev):
1225 """WPA2-Enterprise connection using EAP-TTLS/EAP-AKA"""
1226 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1227 hostapd.add_ap(apdev[0]['ifname'], params)
1228 eap_connect(dev[0], apdev[0], "TTLS", "0232010000000000",
1229 anonymous_identity="0232010000000000@ttls",
1230 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1231 ca_cert="auth_serv/ca.pem", phase2="autheap=AKA")
1232
1233def test_ap_wpa2_eap_peap_eap_aka(dev, apdev):
1234 """WPA2-Enterprise connection using EAP-PEAP/EAP-AKA"""
1235 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1236 hostapd.add_ap(apdev[0]['ifname'], params)
1237 eap_connect(dev[0], apdev[0], "PEAP", "0232010000000000",
1238 anonymous_identity="0232010000000000@peap",
1239 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1240 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1241
1242def test_ap_wpa2_eap_fast_eap_aka(dev, apdev):
1243 """WPA2-Enterprise connection using EAP-FAST/EAP-AKA"""
3b51cc63 1244 check_eap_capa(dev[0], "FAST")
95fb531c
JM		 1245 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1246 hostapd.add_ap(apdev[0]['ifname'], params)
1247 eap_connect(dev[0], apdev[0], "FAST", "0232010000000000",
1248 anonymous_identity="0232010000000000@fast",
1249 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1250 phase1="fast_provisioning=2",
1251 pac_file="blob://fast_pac_auth_aka",
1252 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1253
9626962d
JM		 1254def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev):
1255 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 1256 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1257 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1258 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1259 eap_connect(dev[0], apdev[0], "PEAP", "user",
698f8324 1260 anonymous_identity="peap", password="password",
9626962d 1261 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
a8375c94 1262 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1263 eap_reauth(dev[0], "PEAP")
6daf5b9c
JM		 1264 dev[0].request("REMOVE_NETWORK all")
1265 eap_connect(dev[0], apdev[0], "PEAP", "user",
1266 anonymous_identity="peap", password="password",
1267 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1268 fragment_size="200")
c7afc078 1269
fa0ddb14
JM		 1270 logger.info("Password as hash value")
1271 dev[0].request("REMOVE_NETWORK all")
1272 eap_connect(dev[0], apdev[0], "PEAP", "user",
1273 anonymous_identity="peap",
1274 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
1275 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1276
f10ba3b2
JM		 1277 logger.info("Negative test with incorrect password")
1278 dev[0].request("REMOVE_NETWORK all")
1279 eap_connect(dev[0], apdev[0], "PEAP", "user",
1280 anonymous_identity="peap", password="password1",
1281 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1282 expect_failure=True)
1283
0d33f504
JM		 1284def test_ap_wpa2_eap_peap_eap_mschapv2_domain(dev, apdev):
1285 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 with domain"""
e7ac04ce 1286 check_eap_capa(dev[0], "MSCHAPV2")
0d33f504
JM		 1287 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1288 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1289 eap_connect(dev[0], apdev[0], "PEAP", "DOMAIN\user3",
1290 anonymous_identity="peap", password="password",
1291 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1292 hwsim_utils.test_connectivity(dev[0], hapd)
1293 eap_reauth(dev[0], "PEAP")
1294
f4cd0f64
JM		 1295def test_ap_wpa2_eap_peap_eap_mschapv2_incorrect_password(dev, apdev):
1296 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 - incorrect password"""
e7ac04ce 1297 check_eap_capa(dev[0], "MSCHAPV2")
f4cd0f64
JM		 1298 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1299 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1300 eap_connect(dev[0], apdev[0], "PEAP", "user",
1301 anonymous_identity="peap", password="wrong",
1302 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1303 expect_failure=True)
1304
698f8324
JM		 1305def test_ap_wpa2_eap_peap_crypto_binding(dev, apdev):
1306 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding"""
e7ac04ce 1307 check_eap_capa(dev[0], "MSCHAPV2")
698f8324 1308 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1309 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1310 eap_connect(dev[0], apdev[0], "PEAP", "user", password="password",
698f8324
JM		 1311 ca_cert="auth_serv/ca.pem",
1312 phase1="peapver=0 crypto_binding=2",
1313 phase2="auth=MSCHAPV2")
a8375c94 1314 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1315 eap_reauth(dev[0], "PEAP")
698f8324 1316
ea6464b0
JM		 1317 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
1318 ca_cert="auth_serv/ca.pem",
1319 phase1="peapver=0 crypto_binding=1",
1320 phase2="auth=MSCHAPV2")
1321 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
1322 ca_cert="auth_serv/ca.pem",
1323 phase1="peapver=0 crypto_binding=0",
1324 phase2="auth=MSCHAPV2")
1325
ef318402
JM		 1326def test_ap_wpa2_eap_peap_crypto_binding_server_oom(dev, apdev):
1327 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding with server OOM"""
e7ac04ce 1328 check_eap_capa(dev[0], "MSCHAPV2")
ef318402
JM		 1329 params = int_eap_server_params()
1330 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1331 with alloc_fail(hapd, 1, "eap_mschapv2_getKey"):
1332 eap_connect(dev[0], apdev[0], "PEAP", "user", password="password",
1333 ca_cert="auth_serv/ca.pem",
1334 phase1="peapver=0 crypto_binding=2",
1335 phase2="auth=MSCHAPV2",
1336 expect_failure=True, local_error_report=True)
1337
c4d37011
JM		 1338def test_ap_wpa2_eap_peap_params(dev, apdev):
1339 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and various parameters"""
e7ac04ce 1340 check_eap_capa(dev[0], "MSCHAPV2")
c4d37011
JM		 1341 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1342 hostapd.add_ap(apdev[0]['ifname'], params)
1343 eap_connect(dev[0], apdev[0], "PEAP", "user",
1344 anonymous_identity="peap", password="password",
1345 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1346 phase1="peapver=0 peaplabel=1",
1347 expect_failure=True)
1348 dev[0].request("REMOVE_NETWORK all")
09ad98c5
JM		 1349 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1350 identity="user",
1351 anonymous_identity="peap", password="password",
1352 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1353 phase1="peap_outer_success=0",
1354 wait_connect=False, scan_freq="2412")
1355 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
1356 if ev is None:
1357 raise Exception("No EAP success seen")
1358 # This won't succeed to connect with peap_outer_success=0, so stop here.
1359 dev[0].request("REMOVE_NETWORK all")
1360 dev[0].wait_disconnected()
c4d37011
JM		 1361 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
1362 ca_cert="auth_serv/ca.pem",
1363 phase1="peap_outer_success=1",
1364 phase2="auth=MSCHAPV2")
1365 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
1366 ca_cert="auth_serv/ca.pem",
1367 phase1="peap_outer_success=2",
1368 phase2="auth=MSCHAPV2")
1369 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1370 identity="user",
1371 anonymous_identity="peap", password="password",
1372 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1373 phase1="peapver=1 peaplabel=1",
1374 wait_connect=False, scan_freq="2412")
1375 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
1376 if ev is None:
1377 raise Exception("No EAP success seen")
1378 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
1379 if ev is not None:
1380 raise Exception("Unexpected connection")
1381
09a4404a
JM		 1382 tests = [ ("peap-ver0", ""),
1383 ("peap-ver1", ""),
1384 ("peap-ver0", "peapver=0"),
1385 ("peap-ver1", "peapver=1") ]
1386 for anon,phase1 in tests:
1387 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1388 identity="user", anonymous_identity=anon,
1389 password="password", phase1=phase1,
1390 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1391 scan_freq="2412")
1392 dev[0].request("REMOVE_NETWORK all")
1393 dev[0].wait_disconnected()
1394
1395 tests = [ ("peap-ver0", "peapver=1"),
1396 ("peap-ver1", "peapver=0") ]
1397 for anon,phase1 in tests:
1398 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1399 identity="user", anonymous_identity=anon,
1400 password="password", phase1=phase1,
1401 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1402 wait_connect=False, scan_freq="2412")
1403 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
1404 if ev is None:
1405 raise Exception("No EAP-Failure seen")
1406 dev[0].request("REMOVE_NETWORK all")
1407 dev[0].wait_disconnected()
1408
d0ce1050
JM		 1409def test_ap_wpa2_eap_peap_eap_tls(dev, apdev):
1410 """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS"""
1411 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1412 hostapd.add_ap(apdev[0]['ifname'], params)
1413 eap_connect(dev[0], apdev[0], "PEAP", "cert user",
1414 ca_cert="auth_serv/ca.pem", phase2="auth=TLS",
1415 ca_cert2="auth_serv/ca.pem",
1416 client_cert2="auth_serv/user.pem",
1417 private_key2="auth_serv/user.key")
1418 eap_reauth(dev[0], "PEAP")
1419
e114c49c
JM		 1420def test_ap_wpa2_eap_tls(dev, apdev):
1421 """WPA2-Enterprise connection using EAP-TLS"""
1422 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1423 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1424 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
e114c49c
JM		 1425 client_cert="auth_serv/user.pem",
1426 private_key="auth_serv/user.key")
75b2b9cf 1427 eap_reauth(dev[0], "TLS")
e114c49c 1428
96bf8fe1
JM		 1429def test_eap_tls_pkcs8_pkcs5_v2_des3(dev, apdev):
1430 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v2 DES3 key"""
1431 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1432 hostapd.add_ap(apdev[0]['ifname'], params)
1433 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1434 client_cert="auth_serv/user.pem",
1435 private_key="auth_serv/user.key.pkcs8",
1436 private_key_passwd="whatever")
1437
1438def test_eap_tls_pkcs8_pkcs5_v15(dev, apdev):
1439 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v1.5 key"""
1440 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1441 hostapd.add_ap(apdev[0]['ifname'], params)
1442 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1443 client_cert="auth_serv/user.pem",
1444 private_key="auth_serv/user.key.pkcs8.pkcs5v15",
1445 private_key_passwd="whatever")
1446
6ea231e6
JM		 1447def test_ap_wpa2_eap_tls_blob(dev, apdev):
1448 """WPA2-Enterprise connection using EAP-TLS and config blobs"""
1449 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1450 hostapd.add_ap(apdev[0]['ifname'], params)
1451 cert = read_pem("auth_serv/ca.pem")
1452 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1453 raise Exception("Could not set cacert blob")
1454 cert = read_pem("auth_serv/user.pem")
1455 if "OK" not in dev[0].request("SET blob usercert " + cert.encode("hex")):
1456 raise Exception("Could not set usercert blob")
62750c3e 1457 key = read_pem("auth_serv/user.rsa-key")
6ea231e6
JM		 1458 if "OK" not in dev[0].request("SET blob userkey " + key.encode("hex")):
1459 raise Exception("Could not set cacert blob")
1460 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
1461 client_cert="blob://usercert",
1462 private_key="blob://userkey")
1463
cef42a44
JM		 1464def test_ap_wpa2_eap_tls_blob_missing(dev, apdev):
1465 """EAP-TLS and config blob missing"""
1466 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1467 hostapd.add_ap(apdev[0]['ifname'], params)
1468 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1469 identity="tls user",
1470 ca_cert="blob://testing-blob-does-not-exist",
1471 client_cert="blob://testing-blob-does-not-exist",
1472 private_key="blob://testing-blob-does-not-exist",
1473 wait_connect=False, scan_freq="2412")
1474 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], timeout=10)
1475 if ev is None:
1476 raise Exception("EAP failure not reported")
1477 dev[0].request("REMOVE_NETWORK all")
1478 dev[0].wait_disconnected()
1479
7cb27f89
JM		 1480def test_ap_wpa2_eap_tls_with_tls_len(dev, apdev):
1481 """EAP-TLS and TLS Message Length in unfragmented packets"""
1482 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1483 hostapd.add_ap(apdev[0]['ifname'], params)
1484 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1485 phase1="include_tls_length=1",
1486 client_cert="auth_serv/user.pem",
1487 private_key="auth_serv/user.key")
1488
2d10eb0e
JM		 1489def test_ap_wpa2_eap_tls_pkcs12(dev, apdev):
1490 """WPA2-Enterprise connection using EAP-TLS and PKCS#12"""
686eee77 1491 check_pkcs12_support(dev[0])
2d10eb0e
JM		 1492 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1493 hostapd.add_ap(apdev[0]['ifname'], params)
1494 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1495 private_key="auth_serv/user.pkcs12",
1496 private_key_passwd="whatever")
1497 dev[0].request("REMOVE_NETWORK all")
0c83ae04
JM		 1498 dev[0].wait_disconnected()
1499
2d10eb0e
JM		 1500 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1501 identity="tls user",
1502 ca_cert="auth_serv/ca.pem",
1503 private_key="auth_serv/user.pkcs12",
1504 wait_connect=False, scan_freq="2412")
1505 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"])
1506 if ev is None:
1507 raise Exception("Request for private key passphrase timed out")
1508 id = ev.split(':')[0].split('-')[-1]
1509 dev[0].request("CTRL-RSP-PASSPHRASE-" + id + ":whatever")
5f35a5e2 1510 dev[0].wait_connected(timeout=10)
0c83ae04
JM		 1511 dev[0].request("REMOVE_NETWORK all")
1512 dev[0].wait_disconnected()
1513
6da3b745
JM		 1514 # Run this twice to verify certificate chain handling with OpenSSL. Use two
1515 # different files to cover both cases of the extra certificate being the
1516 # one that signed the client certificate and it being unrelated to the
1517 # client certificate.
1518 for pkcs12 in "auth_serv/user2.pkcs12", "auth_serv/user3.pkcs12":
1519 for i in range(2):
1520 eap_connect(dev[0], apdev[0], "TLS", "tls user",
1521 ca_cert="auth_serv/ca.pem",
1522 private_key=pkcs12,
1523 private_key_passwd="whatever")
1524 dev[0].request("REMOVE_NETWORK all")
1525 dev[0].wait_disconnected()
2d10eb0e 1526
6ea231e6
JM		 1527def test_ap_wpa2_eap_tls_pkcs12_blob(dev, apdev):
1528 """WPA2-Enterprise connection using EAP-TLS and PKCS#12 from configuration blob"""
686eee77 1529 check_pkcs12_support(dev[0])
6ea231e6
JM		 1530 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1531 hostapd.add_ap(apdev[0]['ifname'], params)
1532 cert = read_pem("auth_serv/ca.pem")
1533 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1534 raise Exception("Could not set cacert blob")
1535 with open("auth_serv/user.pkcs12", "rb") as f:
1536 if "OK" not in dev[0].request("SET blob pkcs12 " + f.read().encode("hex")):
1537 raise Exception("Could not set pkcs12 blob")
1538 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
1539 private_key="blob://pkcs12",
1540 private_key_passwd="whatever")
1541
c7afc078
JM		 1542def test_ap_wpa2_eap_tls_neg_incorrect_trust_root(dev, apdev):
1543 """WPA2-Enterprise negative test - incorrect trust root"""
e7ac04ce 1544 check_eap_capa(dev[0], "MSCHAPV2")
c7afc078
JM		 1545 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1546 hostapd.add_ap(apdev[0]['ifname'], params)
6ea231e6
JM		 1547 cert = read_pem("auth_serv/ca-incorrect.pem")
1548 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1549 raise Exception("Could not set cacert blob")
c7afc078 1550 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
6ea231e6
JM		 1551 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1552 password="password", phase2="auth=MSCHAPV2",
1553 ca_cert="blob://cacert",
1554 wait_connect=False, scan_freq="2412")
1555 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
c7afc078
JM		 1556 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1557 password="password", phase2="auth=MSCHAPV2",
1558 ca_cert="auth_serv/ca-incorrect.pem",
c65f23ab 1559 wait_connect=False, scan_freq="2412")
c7afc078 1560
6ea231e6
JM		 1561 for dev in (dev[0], dev[1]):
1562 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1563 if ev is None:
1564 raise Exception("Association and EAP start timed out")
c7afc078 1565
6ea231e6
JM		 1566 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1567 if ev is None:
1568 raise Exception("EAP method selection timed out")
1569 if "TTLS" not in ev:
1570 raise Exception("Unexpected EAP method")
1571
1572 ev = dev.wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1573 "CTRL-EVENT-EAP-SUCCESS",
1574 "CTRL-EVENT-EAP-FAILURE",
1575 "CTRL-EVENT-CONNECTED",
1576 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1577 if ev is None:
1578 raise Exception("EAP result timed out")
1579 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1580 raise Exception("TLS certificate error not reported")
1581
1582 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS",
1583 "CTRL-EVENT-EAP-FAILURE",
1584 "CTRL-EVENT-CONNECTED",
1585 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1586 if ev is None:
1587 raise Exception("EAP result(2) timed out")
1588 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1589 raise Exception("EAP failure not reported")
c7afc078 1590
6ea231e6
JM		 1591 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
1592 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1593 if ev is None:
1594 raise Exception("EAP result(3) timed out")
1595 if "CTRL-EVENT-DISCONNECTED" not in ev:
1596 raise Exception("Disconnection not reported")
c7afc078 1597
6ea231e6
JM		 1598 ev = dev.wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1599 if ev is None:
1600 raise Exception("Network block disabling not reported")
72c052d5 1601
9a5cfd70
JM		 1602def test_ap_wpa2_eap_tls_diff_ca_trust(dev, apdev):
1603 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1604 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1605 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1606 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1607 identity="pap user", anonymous_identity="ttls",
1608 password="password", phase2="auth=PAP",
1609 ca_cert="auth_serv/ca.pem",
1610 wait_connect=True, scan_freq="2412")
1611 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1612 identity="pap user", anonymous_identity="ttls",
1613 password="password", phase2="auth=PAP",
1614 ca_cert="auth_serv/ca-incorrect.pem",
1615 only_add_network=True, scan_freq="2412")
1616
1617 dev[0].request("DISCONNECT")
90ad11e6 1618 dev[0].wait_disconnected()
9a5cfd70
JM		 1619 dev[0].dump_monitor()
1620 dev[0].select_network(id, freq="2412")
1621
1622 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1623 if ev is None:
1624 raise Exception("EAP-TTLS not re-started")
1625
5f35a5e2 1626 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1627 if "reason=23" not in ev:
1628 raise Exception("Proper reason code for disconnection not reported")
1629
1630def test_ap_wpa2_eap_tls_diff_ca_trust2(dev, apdev):
1631 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1632 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1633 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1634 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1635 identity="pap user", anonymous_identity="ttls",
1636 password="password", phase2="auth=PAP",
1637 wait_connect=True, scan_freq="2412")
1638 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1639 identity="pap user", anonymous_identity="ttls",
1640 password="password", phase2="auth=PAP",
1641 ca_cert="auth_serv/ca-incorrect.pem",
1642 only_add_network=True, scan_freq="2412")
1643
1644 dev[0].request("DISCONNECT")
90ad11e6 1645 dev[0].wait_disconnected()
9a5cfd70
JM		 1646 dev[0].dump_monitor()
1647 dev[0].select_network(id, freq="2412")
1648
1649 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1650 if ev is None:
1651 raise Exception("EAP-TTLS not re-started")
1652
5f35a5e2 1653 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1654 if "reason=23" not in ev:
1655 raise Exception("Proper reason code for disconnection not reported")
1656
1657def test_ap_wpa2_eap_tls_diff_ca_trust3(dev, apdev):
1658 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1659 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1660 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1661 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1662 identity="pap user", anonymous_identity="ttls",
1663 password="password", phase2="auth=PAP",
1664 ca_cert="auth_serv/ca.pem",
1665 wait_connect=True, scan_freq="2412")
1666 dev[0].request("DISCONNECT")
90ad11e6 1667 dev[0].wait_disconnected()
9a5cfd70
JM		 1668 dev[0].dump_monitor()
1669 dev[0].set_network_quoted(id, "ca_cert", "auth_serv/ca-incorrect.pem")
1670 dev[0].select_network(id, freq="2412")
1671
1672 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1673 if ev is None:
1674 raise Exception("EAP-TTLS not re-started")
1675
5f35a5e2 1676 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1677 if "reason=23" not in ev:
1678 raise Exception("Proper reason code for disconnection not reported")
1679
72c052d5
JM		 1680def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev):
1681 """WPA2-Enterprise negative test - domain suffix mismatch"""
e78eb404 1682 check_domain_suffix_match(dev[0])
72c052d5
JM		 1683 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1684 hostapd.add_ap(apdev[0]['ifname'], params)
1685 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1686 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1687 password="password", phase2="auth=MSCHAPV2",
1688 ca_cert="auth_serv/ca.pem",
1689 domain_suffix_match="incorrect.example.com",
c65f23ab 1690 wait_connect=False, scan_freq="2412")
72c052d5
JM		 1691
1692 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1693 if ev is None:
1694 raise Exception("Association and EAP start timed out")
1695
1696 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1697 if ev is None:
1698 raise Exception("EAP method selection timed out")
1699 if "TTLS" not in ev:
1700 raise Exception("Unexpected EAP method")
1701
1702 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1703 "CTRL-EVENT-EAP-SUCCESS",
1704 "CTRL-EVENT-EAP-FAILURE",
1705 "CTRL-EVENT-CONNECTED",
1706 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1707 if ev is None:
1708 raise Exception("EAP result timed out")
1709 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1710 raise Exception("TLS certificate error not reported")
1711 if "Domain suffix mismatch" not in ev:
1712 raise Exception("Domain suffix mismatch not reported")
1713
1714 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1715 "CTRL-EVENT-EAP-FAILURE",
1716 "CTRL-EVENT-CONNECTED",
1717 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1718 if ev is None:
1719 raise Exception("EAP result(2) timed out")
1720 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1721 raise Exception("EAP failure not reported")
1722
1723 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1724 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1725 if ev is None:
1726 raise Exception("EAP result(3) timed out")
1727 if "CTRL-EVENT-DISCONNECTED" not in ev:
1728 raise Exception("Disconnection not reported")
1729
1730 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1731 if ev is None:
1732 raise Exception("Network block disabling not reported")
22b99086 1733
061cbb25
JM		 1734def test_ap_wpa2_eap_tls_neg_domain_match(dev, apdev):
1735 """WPA2-Enterprise negative test - domain mismatch"""
e78eb404 1736 check_domain_match(dev[0])
061cbb25
JM		 1737 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1738 hostapd.add_ap(apdev[0]['ifname'], params)
1739 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1740 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1741 password="password", phase2="auth=MSCHAPV2",
1742 ca_cert="auth_serv/ca.pem",
1743 domain_match="w1.fi",
1744 wait_connect=False, scan_freq="2412")
1745
1746 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1747 if ev is None:
1748 raise Exception("Association and EAP start timed out")
1749
1750 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1751 if ev is None:
1752 raise Exception("EAP method selection timed out")
1753 if "TTLS" not in ev:
1754 raise Exception("Unexpected EAP method")
1755
1756 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1757 "CTRL-EVENT-EAP-SUCCESS",
1758 "CTRL-EVENT-EAP-FAILURE",
1759 "CTRL-EVENT-CONNECTED",
1760 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1761 if ev is None:
1762 raise Exception("EAP result timed out")
1763 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1764 raise Exception("TLS certificate error not reported")
1765 if "Domain mismatch" not in ev:
1766 raise Exception("Domain mismatch not reported")
1767
1768 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1769 "CTRL-EVENT-EAP-FAILURE",
1770 "CTRL-EVENT-CONNECTED",
1771 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1772 if ev is None:
1773 raise Exception("EAP result(2) timed out")
1774 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1775 raise Exception("EAP failure not reported")
1776
1777 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1778 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1779 if ev is None:
1780 raise Exception("EAP result(3) timed out")
1781 if "CTRL-EVENT-DISCONNECTED" not in ev:
1782 raise Exception("Disconnection not reported")
1783
1784 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1785 if ev is None:
1786 raise Exception("Network block disabling not reported")
1787
3b74982f
JM		 1788def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
1789 """WPA2-Enterprise negative test - subject mismatch"""
1790 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1791 hostapd.add_ap(apdev[0]['ifname'], params)
1792 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1793 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1794 password="password", phase2="auth=MSCHAPV2",
1795 ca_cert="auth_serv/ca.pem",
1796 subject_match="/C=FI/O=w1.fi/CN=example.com",
1797 wait_connect=False, scan_freq="2412")
1798
1799 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1800 if ev is None:
1801 raise Exception("Association and EAP start timed out")
1802
506b2f05
JM		 1803 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
1804 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 1805 if ev is None:
1806 raise Exception("EAP method selection timed out")
506b2f05
JM		 1807 if "EAP: Failed to initialize EAP method" in ev:
1808 tls = dev[0].request("GET tls_library")
1809 if tls.startswith("OpenSSL"):
1810 raise Exception("Failed to select EAP method")
1811 logger.info("subject_match not supported - connection failed, so test succeeded")
1812 return
3b74982f
JM		 1813 if "TTLS" not in ev:
1814 raise Exception("Unexpected EAP method")
1815
1816 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1817 "CTRL-EVENT-EAP-SUCCESS",
1818 "CTRL-EVENT-EAP-FAILURE",
1819 "CTRL-EVENT-CONNECTED",
1820 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1821 if ev is None:
1822 raise Exception("EAP result timed out")
1823 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1824 raise Exception("TLS certificate error not reported")
1825 if "Subject mismatch" not in ev:
1826 raise Exception("Subject mismatch not reported")
1827
1828 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1829 "CTRL-EVENT-EAP-FAILURE",
1830 "CTRL-EVENT-CONNECTED",
1831 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1832 if ev is None:
1833 raise Exception("EAP result(2) timed out")
1834 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1835 raise Exception("EAP failure not reported")
1836
1837 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1838 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1839 if ev is None:
1840 raise Exception("EAP result(3) timed out")
1841 if "CTRL-EVENT-DISCONNECTED" not in ev:
1842 raise Exception("Disconnection not reported")
1843
1844 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1845 if ev is None:
1846 raise Exception("Network block disabling not reported")
1847
1848def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
1849 """WPA2-Enterprise negative test - altsubject mismatch"""
1850 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1851 hostapd.add_ap(apdev[0]['ifname'], params)
37d61355
JM		 1852
1853 tests = [ "incorrect.example.com",
1854 "DNS:incorrect.example.com",
1855 "DNS:w1.fi",
1856 "DNS:erver.w1.fi" ]
1857 for match in tests:
1858 _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match)
1859
1860def _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match):
3b74982f
JM		 1861 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1862 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1863 password="password", phase2="auth=MSCHAPV2",
1864 ca_cert="auth_serv/ca.pem",
37d61355 1865 altsubject_match=match,
3b74982f
JM		 1866 wait_connect=False, scan_freq="2412")
1867
1868 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1869 if ev is None:
1870 raise Exception("Association and EAP start timed out")
1871
506b2f05
JM		 1872 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
1873 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 1874 if ev is None:
1875 raise Exception("EAP method selection timed out")
506b2f05
JM		 1876 if "EAP: Failed to initialize EAP method" in ev:
1877 tls = dev[0].request("GET tls_library")
1878 if tls.startswith("OpenSSL"):
1879 raise Exception("Failed to select EAP method")
1880 logger.info("altsubject_match not supported - connection failed, so test succeeded")
1881 return
3b74982f
JM		 1882 if "TTLS" not in ev:
1883 raise Exception("Unexpected EAP method")
1884
1885 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1886 "CTRL-EVENT-EAP-SUCCESS",
1887 "CTRL-EVENT-EAP-FAILURE",
1888 "CTRL-EVENT-CONNECTED",
1889 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1890 if ev is None:
1891 raise Exception("EAP result timed out")
1892 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1893 raise Exception("TLS certificate error not reported")
1894 if "AltSubject mismatch" not in ev:
1895 raise Exception("altsubject mismatch not reported")
1896
1897 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1898 "CTRL-EVENT-EAP-FAILURE",
1899 "CTRL-EVENT-CONNECTED",
1900 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1901 if ev is None:
1902 raise Exception("EAP result(2) timed out")
1903 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1904 raise Exception("EAP failure not reported")
1905
1906 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1907 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1908 if ev is None:
1909 raise Exception("EAP result(3) timed out")
1910 if "CTRL-EVENT-DISCONNECTED" not in ev:
1911 raise Exception("Disconnection not reported")
1912
1913 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1914 if ev is None:
1915 raise Exception("Network block disabling not reported")
1916
37d61355
JM		 1917 dev[0].request("REMOVE_NETWORK all")
1918
5a0c1517
JM		 1919def test_ap_wpa2_eap_unauth_tls(dev, apdev):
1920 """WPA2-Enterprise connection using UNAUTH-TLS"""
1921 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1922 hostapd.add_ap(apdev[0]['ifname'], params)
1923 eap_connect(dev[0], apdev[0], "UNAUTH-TLS", "unauth-tls",
1924 ca_cert="auth_serv/ca.pem")
1925 eap_reauth(dev[0], "UNAUTH-TLS")
1926
57be05e1
JM		 1927def test_ap_wpa2_eap_ttls_server_cert_hash(dev, apdev):
1928 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash"""
4bf4e9db 1929 check_cert_probe_support(dev[0])
ca158ea6 1930 skip_with_fips(dev[0])
403610d3 1931 srv_cert_hash = "e75bd454c7b02d312e5006d75067c28ffa5baea422effeb2bbd572179cd000ca"
57be05e1
JM		 1932 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1933 hostapd.add_ap(apdev[0]['ifname'], params)
1934 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1935 identity="probe", ca_cert="probe://",
1936 wait_connect=False, scan_freq="2412")
1937 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1938 if ev is None:
1939 raise Exception("Association and EAP start timed out")
1940 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT depth=0"], timeout=10)
1941 if ev is None:
1942 raise Exception("No peer server certificate event seen")
1943 if "hash=" + srv_cert_hash not in ev:
1944 raise Exception("Expected server certificate hash not reported")
1945 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1946 if ev is None:
1947 raise Exception("EAP result timed out")
1948 if "Server certificate chain probe" not in ev:
1949 raise Exception("Server certificate probe not reported")
5f35a5e2 1950 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 1951 dev[0].request("REMOVE_NETWORK all")
1952
1953 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1954 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1955 password="password", phase2="auth=MSCHAPV2",
1956 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1957 wait_connect=False, scan_freq="2412")
1958 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1959 if ev is None:
1960 raise Exception("Association and EAP start timed out")
1961 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1962 if ev is None:
1963 raise Exception("EAP result timed out")
1964 if "Server certificate mismatch" not in ev:
1965 raise Exception("Server certificate mismatch not reported")
5f35a5e2 1966 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 1967 dev[0].request("REMOVE_NETWORK all")
1968
1969 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
1970 anonymous_identity="ttls", password="password",
1971 ca_cert="hash://server/sha256/" + srv_cert_hash,
1972 phase2="auth=MSCHAPV2")
1973
2a6a2192
JM		 1974def test_ap_wpa2_eap_ttls_server_cert_hash_invalid(dev, apdev):
1975 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash (invalid config)"""
1976 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1977 hostapd.add_ap(apdev[0]['ifname'], params)
1978 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1979 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1980 password="password", phase2="auth=MSCHAPV2",
1981 ca_cert="hash://server/md5/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1982 wait_connect=False, scan_freq="2412")
1983 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1984 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1985 password="password", phase2="auth=MSCHAPV2",
1986 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca",
1987 wait_connect=False, scan_freq="2412")
1988 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1989 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1990 password="password", phase2="auth=MSCHAPV2",
1991 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6Q",
1992 wait_connect=False, scan_freq="2412")
1993 for i in range(0, 3):
1994 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1995 if ev is None:
1996 raise Exception("Association and EAP start timed out")
cbb85a03
JM		 1997 ev = dev[i].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 21 (TTLS)"], timeout=5)
1998 if ev is None:
1999 raise Exception("Did not report EAP method initialization failure")
2a6a2192 2000
22b99086
JM		 2001def test_ap_wpa2_eap_pwd(dev, apdev):
2002 """WPA2-Enterprise connection using EAP-pwd"""
3b51cc63 2003 check_eap_capa(dev[0], "PWD")
22b99086
JM		 2004 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2005 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2006 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
75b2b9cf 2007 eap_reauth(dev[0], "PWD")
6daf5b9c 2008 dev[0].request("REMOVE_NETWORK all")
0403fa0a
JM		 2009
2010 eap_connect(dev[1], apdev[0], "PWD",
2011 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
2012 password="secret password",
6daf5b9c
JM		 2013 fragment_size="90")
2014
f10ba3b2 2015 logger.info("Negative test with incorrect password")
0403fa0a 2016 eap_connect(dev[2], apdev[0], "PWD", "pwd user", password="secret-password",
f10ba3b2
JM		 2017 expect_failure=True, local_error_report=True)
2018
0403fa0a
JM		 2019 eap_connect(dev[0], apdev[0], "PWD",
2020 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
2021 password="secret password",
2022 fragment_size="31")
2023
b898a6ee
JM		 2024def test_ap_wpa2_eap_pwd_nthash(dev, apdev):
2025 """WPA2-Enterprise connection using EAP-pwd and NTHash"""
2026 check_eap_capa(dev[0], "PWD")
0392867b 2027 skip_with_fips(dev[0])
b898a6ee
JM		 2028 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2029 hostapd.add_ap(apdev[0]['ifname'], params)
2030 eap_connect(dev[0], apdev[0], "PWD", "pwd-hash", password="secret password")
2031 eap_connect(dev[1], apdev[0], "PWD", "pwd-hash",
2032 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a")
2033 eap_connect(dev[2], apdev[0], "PWD", "pwd user",
2034 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a",
2035 expect_failure=True, local_error_report=True)
2036
c075f040
JM		 2037def test_ap_wpa2_eap_pwd_groups(dev, apdev):
2038 """WPA2-Enterprise connection using various EAP-pwd groups"""
3b51cc63 2039 check_eap_capa(dev[0], "PWD")
5f2e4547 2040 tls = dev[0].request("GET tls_library")
c075f040
JM		 2041 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2042 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2043 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
f2d789f2
JM		 2044 groups = [ 19, 20, 21, 25, 26 ]
2045 if tls.startswith("OpenSSL") and "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
2046 logger.info("Add Brainpool EC groups since OpenSSL is new enough")
2047 groups += [ 27, 28, 29, 30 ]
2048 for i in groups:
2049 logger.info("Group %d" % i)
c075f040
JM		 2050 params['pwd_group'] = str(i)
2051 hostapd.add_ap(apdev[0]['ifname'], params)
5f2e4547
JM		 2052 try:
2053 eap_connect(dev[0], apdev[0], "PWD", "pwd user",
2054 password="secret password")
f2d789f2
JM		 2055 dev[0].request("REMOVE_NETWORK all")
2056 dev[0].wait_disconnected()
2057 dev[0].dump_monitor()
5f2e4547
JM		 2058 except:
2059 if "BoringSSL" in tls and i in [ 25 ]:
2060 logger.info("Ignore connection failure with group %d with BoringSSL" % i)
2061 dev[0].request("DISCONNECT")
2062 time.sleep(0.1)
f2d789f2
JM		 2063 dev[0].request("REMOVE_NETWORK all")
2064 dev[0].dump_monitor()
5f2e4547
JM		 2065 continue
2066 raise
c075f040 2067
4b2d2098
JM		 2068def test_ap_wpa2_eap_pwd_invalid_group(dev, apdev):
2069 """WPA2-Enterprise connection using invalid EAP-pwd group"""
3b51cc63 2070 check_eap_capa(dev[0], "PWD")
4b2d2098
JM		 2071 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2072 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2073 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
2074 params['pwd_group'] = "0"
2075 hostapd.add_ap(apdev[0]['ifname'], params)
2076 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PWD",
2077 identity="pwd user", password="secret password",
2078 scan_freq="2412", wait_connect=False)
2079 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2080 if ev is None:
2081 raise Exception("Timeout on EAP failure report")
2082
8ba89e0a
JM		 2083def test_ap_wpa2_eap_pwd_as_frag(dev, apdev):
2084 """WPA2-Enterprise connection using EAP-pwd with server fragmentation"""
3b51cc63 2085 check_eap_capa(dev[0], "PWD")
8ba89e0a
JM		 2086 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2087 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2088 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2089 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2090 "pwd_group": "19", "fragment_size": "40" }
2091 hostapd.add_ap(apdev[0]['ifname'], params)
2092 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
2093
22b99086
JM		 2094def test_ap_wpa2_eap_gpsk(dev, apdev):
2095 """WPA2-Enterprise connection using EAP-GPSK"""
2096 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2097 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2098 id = eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
369f9c20 2099 password="abcdefghijklmnop0123456789abcdef")
75b2b9cf 2100 eap_reauth(dev[0], "GPSK")
22b99086 2101
369f9c20
JM		 2102 logger.info("Test forced algorithm selection")
2103 for phase1 in [ "cipher=1", "cipher=2" ]:
2104 dev[0].set_network_quoted(id, "phase1", phase1)
2105 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2106 if ev is None:
2107 raise Exception("EAP success timed out")
5f35a5e2 2108 dev[0].wait_connected(timeout=10)
369f9c20
JM		 2109
2110 logger.info("Test failed algorithm negotiation")
2111 dev[0].set_network_quoted(id, "phase1", "cipher=9")
2112 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2113 if ev is None:
2114 raise Exception("EAP failure timed out")
2115
f10ba3b2
JM		 2116 logger.info("Negative test with incorrect password")
2117 dev[0].request("REMOVE_NETWORK all")
2118 eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
2119 password="ffcdefghijklmnop0123456789abcdef",
2120 expect_failure=True)
2121
22b99086
JM		 2122def test_ap_wpa2_eap_sake(dev, apdev):
2123 """WPA2-Enterprise connection using EAP-SAKE"""
2124 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2125 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2126 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
22b99086 2127 password_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
75b2b9cf 2128 eap_reauth(dev[0], "SAKE")
22b99086 2129
f10ba3b2
JM		 2130 logger.info("Negative test with incorrect password")
2131 dev[0].request("REMOVE_NETWORK all")
2132 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
2133 password_hex="ff23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
2134 expect_failure=True)
2135
22b99086
JM		 2136def test_ap_wpa2_eap_eke(dev, apdev):
2137 """WPA2-Enterprise connection using EAP-EKE"""
2138 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2139 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2140 id = eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello")
75b2b9cf 2141 eap_reauth(dev[0], "EKE")
22b99086 2142
2bb9e283
JM		 2143 logger.info("Test forced algorithm selection")
2144 for phase1 in [ "dhgroup=5 encr=1 prf=2 mac=2",
2145 "dhgroup=4 encr=1 prf=2 mac=2",
2146 "dhgroup=3 encr=1 prf=2 mac=2",
2147 "dhgroup=3 encr=1 prf=1 mac=1" ]:
2148 dev[0].set_network_quoted(id, "phase1", phase1)
2149 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2150 if ev is None:
2151 raise Exception("EAP success timed out")
5f35a5e2 2152 dev[0].wait_connected(timeout=10)
2bb9e283
JM		 2153
2154 logger.info("Test failed algorithm negotiation")
2155 dev[0].set_network_quoted(id, "phase1", "dhgroup=9 encr=9 prf=9 mac=9")
2156 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2157 if ev is None:
2158 raise Exception("EAP failure timed out")
2159
f10ba3b2
JM		 2160 logger.info("Negative test with incorrect password")
2161 dev[0].request("REMOVE_NETWORK all")
2162 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello1",
2163 expect_failure=True)
2164
f7e3c17b
JM		 2165def test_ap_wpa2_eap_eke_serverid_nai(dev, apdev):
2166 """WPA2-Enterprise connection using EAP-EKE with serverid NAI"""
2167 params = int_eap_server_params()
2168 params['server_id'] = 'example.server@w1.fi'
2169 hostapd.add_ap(apdev[0]['ifname'], params)
2170 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello")
2171
5e0bedc6
JM		 2172def test_ap_wpa2_eap_eke_server_oom(dev, apdev):
2173 """WPA2-Enterprise connection using EAP-EKE with server OOM"""
2174 params = int_eap_server_params()
2175 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2176 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
2177
2178 for count,func in [ (1, "eap_eke_build_commit"),
2179 (2, "eap_eke_build_commit"),
2180 (3, "eap_eke_build_commit"),
2181 (1, "eap_eke_build_confirm"),
2182 (2, "eap_eke_build_confirm"),
2183 (1, "eap_eke_process_commit"),
2184 (2, "eap_eke_process_commit"),
2185 (1, "eap_eke_process_confirm"),
2186 (1, "eap_eke_process_identity"),
2187 (2, "eap_eke_process_identity"),
2188 (3, "eap_eke_process_identity"),
2189 (4, "eap_eke_process_identity") ]:
2190 with alloc_fail(hapd, count, func):
2191 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello",
2192 expect_failure=True)
2193 dev[0].request("REMOVE_NETWORK all")
2194
2195 for count,func,pw in [ (1, "eap_eke_init", "hello"),
2196 (1, "eap_eke_get_session_id", "hello"),
2197 (1, "eap_eke_getKey", "hello"),
2198 (1, "eap_eke_build_msg", "hello"),
2199 (1, "eap_eke_build_failure", "wrong"),
2200 (1, "eap_eke_build_identity", "hello"),
2201 (2, "eap_eke_build_identity", "hello") ]:
2202 with alloc_fail(hapd, count, func):
2203 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
2204 eap="EKE", identity="eke user", password=pw,
2205 wait_connect=False, scan_freq="2412")
2206 # This would eventually time out, but we can stop after having
2207 # reached the allocation failure.
2208 for i in range(20):
2209 time.sleep(0.1)
2210 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2211 break
2212 dev[0].request("REMOVE_NETWORK all")
2213
2214 for count in range(1, 1000):
2215 try:
2216 with alloc_fail(hapd, count, "eap_server_sm_step"):
2217 dev[0].connect("test-wpa2-eap",
2218 key_mgmt="WPA-EAP WPA-EAP-SHA256",
2219 eap="EKE", identity="eke user", password=pw,
2220 wait_connect=False, scan_freq="2412")
2221 # This would eventually time out, but we can stop after having
2222 # reached the allocation failure.
2223 for i in range(10):
2224 time.sleep(0.1)
2225 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2226 break
2227 dev[0].request("REMOVE_NETWORK all")
2228 except Exception, e:
2229 if str(e) == "Allocation failure did not trigger":
2230 if count < 30:
2231 raise Exception("Too few allocation failures")
2232 logger.info("%d allocation failures tested" % (count - 1))
2233 break
2234 raise e
2235
22b99086
JM		 2236def test_ap_wpa2_eap_ikev2(dev, apdev):
2237 """WPA2-Enterprise connection using EAP-IKEv2"""
c8e82c94 2238 check_eap_capa(dev[0], "IKEV2")
22b99086
JM		 2239 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2240 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14
JM		 2241 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2242 password="ike password")
75b2b9cf 2243 eap_reauth(dev[0], "IKEV2")
6daf5b9c
JM		 2244 dev[0].request("REMOVE_NETWORK all")
2245 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
47a74ad8 2246 password="ike password", fragment_size="50")
22b99086 2247
f10ba3b2
JM		 2248 logger.info("Negative test with incorrect password")
2249 dev[0].request("REMOVE_NETWORK all")
2250 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2251 password="ike-password", expect_failure=True)
2252
47a74ad8
JM		 2253def test_ap_wpa2_eap_ikev2_as_frag(dev, apdev):
2254 """WPA2-Enterprise connection using EAP-IKEv2 with server fragmentation"""
c8e82c94 2255 check_eap_capa(dev[0], "IKEV2")
47a74ad8
JM		 2256 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2257 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2258 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2259 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2260 "fragment_size": "50" }
2261 hostapd.add_ap(apdev[0]['ifname'], params)
2262 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2263 password="ike password")
2264 eap_reauth(dev[0], "IKEV2")
2265
f1ab79c3
JM		 2266def test_ap_wpa2_eap_ikev2_oom(dev, apdev):
2267 """WPA2-Enterprise connection using EAP-IKEv2 and OOM"""
c8e82c94 2268 check_eap_capa(dev[0], "IKEV2")
f1ab79c3
JM		 2269 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2270 hostapd.add_ap(apdev[0]['ifname'], params)
2271
2272 tests = [ (1, "dh_init"),
2273 (2, "dh_init"),
2274 (1, "dh_derive_shared") ]
2275 for count, func in tests:
2276 with alloc_fail(dev[0], count, func):
2277 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2278 identity="ikev2 user", password="ike password",
2279 wait_connect=False, scan_freq="2412")
2280 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2281 if ev is None:
2282 raise Exception("EAP method not selected")
2283 for i in range(10):
2284 if "0:" in dev[0].request("GET_ALLOC_FAIL"):
2285 break
2286 time.sleep(0.02)
2287 dev[0].request("REMOVE_NETWORK all")
2288
2289 tests = [ (1, "os_get_random;dh_init") ]
2290 for count, func in tests:
2291 with fail_test(dev[0], count, func):
2292 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2293 identity="ikev2 user", password="ike password",
2294 wait_connect=False, scan_freq="2412")
2295 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2296 if ev is None:
2297 raise Exception("EAP method not selected")
2298 for i in range(10):
2299 if "0:" in dev[0].request("GET_FAIL"):
2300 break
2301 time.sleep(0.02)
2302 dev[0].request("REMOVE_NETWORK all")
2303
22b99086
JM		 2304def test_ap_wpa2_eap_pax(dev, apdev):
2305 """WPA2-Enterprise connection using EAP-PAX"""
2306 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2307 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2308 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
22b99086 2309 password_hex="0123456789abcdef0123456789abcdef")
75b2b9cf 2310 eap_reauth(dev[0], "PAX")
22b99086 2311
f10ba3b2
JM		 2312 logger.info("Negative test with incorrect password")
2313 dev[0].request("REMOVE_NETWORK all")
2314 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
2315 password_hex="ff23456789abcdef0123456789abcdef",
2316 expect_failure=True)
2317
22b99086
JM		 2318def test_ap_wpa2_eap_psk(dev, apdev):
2319 """WPA2-Enterprise connection using EAP-PSK"""
2320 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2b005194
JM		 2321 params["wpa_key_mgmt"] = "WPA-EAP-SHA256"
2322 params["ieee80211w"] = "2"
22b99086 2323 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2324 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
2b005194
JM		 2325 password_hex="0123456789abcdef0123456789abcdef", sha256=True)
2326 eap_reauth(dev[0], "PSK", sha256=True)
eaf3f9b1
JM		 2327 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-5"),
2328 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-5") ])
71390dc8 2329
d463c556
JM		 2330 bss = dev[0].get_bss(apdev[0]['bssid'])
2331 if 'flags' not in bss:
2332 raise Exception("Could not get BSS flags from BSS table")
2333 if "[WPA2-EAP-SHA256-CCMP]" not in bss['flags']:
2334 raise Exception("Unexpected BSS flags: " + bss['flags'])
2335
f10ba3b2
JM		 2336 logger.info("Negative test with incorrect password")
2337 dev[0].request("REMOVE_NETWORK all")
2338 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
2339 password_hex="ff23456789abcdef0123456789abcdef", sha256=True,
2340 expect_failure=True)
2341
8c4e4c01
JM		 2342def test_ap_wpa2_eap_psk_oom(dev, apdev):
2343 """WPA2-Enterprise connection using EAP-PSK and OOM"""
38934ed1 2344 skip_with_fips(dev[0])
8c4e4c01
JM		 2345 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2346 hostapd.add_ap(apdev[0]['ifname'], params)
2347 tests = [ (1, "aes_128_ctr_encrypt;aes_128_eax_encrypt"),
2348 (1, "omac1_aes_128;aes_128_eax_encrypt"),
2349 (2, "omac1_aes_128;aes_128_eax_encrypt"),
2350 (3, "omac1_aes_128;aes_128_eax_encrypt"),
2351 (1, "=aes_128_eax_encrypt"),
2352 (1, "omac1_aes_vector"),
2353 (1, "aes_128_ctr_encrypt;aes_128_eax_decrypt"),
2354 (1, "omac1_aes_128;aes_128_eax_decrypt"),
2355 (2, "omac1_aes_128;aes_128_eax_decrypt"),
2356 (3, "omac1_aes_128;aes_128_eax_decrypt"),
2357 (1, "=aes_128_eax_decrypt") ]
2358 for count, func in tests:
2359 with alloc_fail(dev[0], count, func):
2360 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2361 identity="psk.user@example.com",
2362 password_hex="0123456789abcdef0123456789abcdef",
2363 wait_connect=False, scan_freq="2412")
2364 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2365 if ev is None:
2366 raise Exception("EAP method not selected")
2367 for i in range(10):
2368 if "0:" in dev[0].request("GET_ALLOC_FAIL"):
2369 break
2370 time.sleep(0.02)
2371 dev[0].request("REMOVE_NETWORK all")
2372
2373 with alloc_fail(dev[0], 1, "aes_128_encrypt_block"):
2374 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2375 identity="psk.user@example.com",
2376 password_hex="0123456789abcdef0123456789abcdef",
2377 wait_connect=False, scan_freq="2412")
2378 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2379 if ev is None:
2380 raise Exception("EAP method failure not reported")
2381 dev[0].request("REMOVE_NETWORK all")
2382
71390dc8
JM		 2383def test_ap_wpa_eap_peap_eap_mschapv2(dev, apdev):
2384 """WPA-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 2385 check_eap_capa(dev[0], "MSCHAPV2")
71390dc8 2386 params = hostapd.wpa_eap_params(ssid="test-wpa-eap")
a8375c94 2387 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
71390dc8
JM		 2388 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="PEAP",
2389 identity="user", password="password", phase2="auth=MSCHAPV2",
2390 ca_cert="auth_serv/ca.pem", wait_connect=False,
2391 scan_freq="2412")
2392 eap_check_auth(dev[0], "PEAP", True, rsn=False)
a8375c94 2393 hwsim_utils.test_connectivity(dev[0], hapd)
71390dc8 2394 eap_reauth(dev[0], "PEAP", rsn=False)
eaf3f9b1
JM		 2395 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-50-f2-1"),
2396 ("dot11RSNAAuthenticationSuiteSelected", "00-50-f2-1") ])
48bb2e68
JM		 2397 status = dev[0].get_status(extra="VERBOSE")
2398 if 'portControl' not in status:
2399 raise Exception("portControl missing from STATUS-VERBOSE")
2400 if status['portControl'] != 'Auto':
2401 raise Exception("Unexpected portControl value: " + status['portControl'])
2402 if 'eap_session_id' not in status:
2403 raise Exception("eap_session_id missing from STATUS-VERBOSE")
2404 if not status['eap_session_id'].startswith("19"):
2405 raise Exception("Unexpected eap_session_id value: " + status['eap_session_id'])
40759604
JM		 2406
2407def test_ap_wpa2_eap_interactive(dev, apdev):
2408 """WPA2-Enterprise connection using interactive identity/password entry"""
e7ac04ce 2409 check_eap_capa(dev[0], "MSCHAPV2")
40759604
JM		 2410 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2411 hostapd.add_ap(apdev[0]['ifname'], params)
2412 hapd = hostapd.Hostapd(apdev[0]['ifname'])
2413
2414 tests = [ ("Connection with dynamic TTLS/MSCHAPv2 password entry",
2415 "TTLS", "ttls", "DOMAIN\mschapv2 user", "auth=MSCHAPV2",
2416 None, "password"),
2417 ("Connection with dynamic TTLS/MSCHAPv2 identity and password entry",
2418 "TTLS", "ttls", None, "auth=MSCHAPV2",
2419 "DOMAIN\mschapv2 user", "password"),
2420 ("Connection with dynamic TTLS/EAP-MSCHAPv2 password entry",
2421 "TTLS", "ttls", "user", "autheap=MSCHAPV2", None, "password"),
2422 ("Connection with dynamic TTLS/EAP-MD5 password entry",
2423 "TTLS", "ttls", "user", "autheap=MD5", None, "password"),
2424 ("Connection with dynamic PEAP/EAP-MSCHAPv2 password entry",
2425 "PEAP", None, "user", "auth=MSCHAPV2", None, "password"),
2426 ("Connection with dynamic PEAP/EAP-GTC password entry",
2427 "PEAP", None, "user", "auth=GTC", None, "password") ]
2428 for [desc,eap,anon,identity,phase2,req_id,req_pw] in tests:
2429 logger.info(desc)
2430 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap=eap,
2431 anonymous_identity=anon, identity=identity,
2432 ca_cert="auth_serv/ca.pem", phase2=phase2,
2433 wait_connect=False, scan_freq="2412")
2434 if req_id:
2435 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2436 if ev is None:
2437 raise Exception("Request for identity timed out")
2438 id = ev.split(':')[0].split('-')[-1]
2439 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2440 ev = dev[0].wait_event(["CTRL-REQ-PASSWORD","CTRL-REQ-OTP"])
2441 if ev is None:
2442 raise Exception("Request for password timed out")
2443 id = ev.split(':')[0].split('-')[-1]
2444 type = "OTP" if "CTRL-REQ-OTP" in ev else "PASSWORD"
2445 dev[0].request("CTRL-RSP-" + type + "-" + id + ":" + req_pw)
5f35a5e2 2446 dev[0].wait_connected(timeout=10)
40759604 2447 dev[0].request("REMOVE_NETWORK all")
e745c811 2448
f455998a
JM		 2449def test_ap_wpa2_eap_ext_enable_network_while_connected(dev, apdev):
2450 """WPA2-Enterprise interactive identity entry and ENABLE_NETWORK"""
2451 check_eap_capa(dev[0], "MSCHAPV2")
2452 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2453 hostapd.add_ap(apdev[0]['ifname'], params)
2454 hapd = hostapd.Hostapd(apdev[0]['ifname'])
2455
2456 id_other = dev[0].connect("other", key_mgmt="NONE", scan_freq="2412",
2457 only_add_network=True)
2458
2459 req_id = "DOMAIN\mschapv2 user"
2460 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2461 anonymous_identity="ttls", identity=None,
2462 password="password",
2463 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2464 wait_connect=False, scan_freq="2412")
2465 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2466 if ev is None:
2467 raise Exception("Request for identity timed out")
2468 id = ev.split(':')[0].split('-')[-1]
2469 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2470 dev[0].wait_connected(timeout=10)
2471
2472 if "OK" not in dev[0].request("ENABLE_NETWORK " + str(id_other)):
2473 raise Exception("Failed to enable network")
2474 ev = dev[0].wait_event(["SME: Trying to authenticate"], timeout=1)
2475 if ev is not None:
2476 raise Exception("Unexpected reconnection attempt on ENABLE_NETWORK")
2477 dev[0].request("REMOVE_NETWORK all")
2478
e745c811
JM		 2479def test_ap_wpa2_eap_vendor_test(dev, apdev):
2480 """WPA2-Enterprise connection using EAP vendor test"""
2481 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2482 hostapd.add_ap(apdev[0]['ifname'], params)
2483 eap_connect(dev[0], apdev[0], "VENDOR-TEST", "vendor-test")
2484 eap_reauth(dev[0], "VENDOR-TEST")
467775c5
JM		 2485 eap_connect(dev[1], apdev[0], "VENDOR-TEST", "vendor-test",
2486 password="pending")
53a6f06a
JM		 2487
2488def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev):
2489 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning"""
3b51cc63 2490 check_eap_capa(dev[0], "FAST")
53a6f06a 2491 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 2492 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
53a6f06a
JM		 2493 eap_connect(dev[0], apdev[0], "FAST", "user",
2494 anonymous_identity="FAST", password="password",
2495 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2496 phase1="fast_provisioning=1", pac_file="blob://fast_pac")
a8375c94 2497 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 2498 res = eap_reauth(dev[0], "FAST")
2499 if res['tls_session_reused'] != '1':
2500 raise Exception("EAP-FAST could not use PAC session ticket")
53a6f06a 2501
873e7c29
JM		 2502def test_ap_wpa2_eap_fast_pac_file(dev, apdev, params):
2503 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and PAC file"""
3b51cc63 2504 check_eap_capa(dev[0], "FAST")
873e7c29
JM		 2505 pac_file = os.path.join(params['logdir'], "fast.pac")
2506 pac_file2 = os.path.join(params['logdir'], "fast-bin.pac")
2507 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2508 hostapd.add_ap(apdev[0]['ifname'], params)
2509
2510 try:
2511 eap_connect(dev[0], apdev[0], "FAST", "user",
2512 anonymous_identity="FAST", password="password",
2513 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2514 phase1="fast_provisioning=1", pac_file=pac_file)
2515 with open(pac_file, "r") as f:
2516 data = f.read()
2517 if "wpa_supplicant EAP-FAST PAC file - version 1" not in data:
2518 raise Exception("PAC file header missing")
2519 if "PAC-Key=" not in data:
2520 raise Exception("PAC-Key missing from PAC file")
2521 dev[0].request("REMOVE_NETWORK all")
2522 eap_connect(dev[0], apdev[0], "FAST", "user",
2523 anonymous_identity="FAST", password="password",
2524 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2525 pac_file=pac_file)
2526
2527 eap_connect(dev[1], apdev[0], "FAST", "user",
2528 anonymous_identity="FAST", password="password",
2529 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2530 phase1="fast_provisioning=1 fast_pac_format=binary",
2531 pac_file=pac_file2)
2532 dev[1].request("REMOVE_NETWORK all")
2533 eap_connect(dev[1], apdev[0], "FAST", "user",
2534 anonymous_identity="FAST", password="password",
2535 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2536 phase1="fast_pac_format=binary",
2537 pac_file=pac_file2)
2538 finally:
b638f703
JM		 2539 try:
2540 os.remove(pac_file)
2541 except:
2542 pass
2543 try:
2544 os.remove(pac_file2)
2545 except:
2546 pass
873e7c29 2547
c6ab1cdb
JM		 2548def test_ap_wpa2_eap_fast_binary_pac(dev, apdev):
2549 """WPA2-Enterprise connection using EAP-FAST and binary PAC format"""
3b51cc63 2550 check_eap_capa(dev[0], "FAST")
c6ab1cdb
JM		 2551 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2552 hostapd.add_ap(apdev[0]['ifname'], params)
2553 eap_connect(dev[0], apdev[0], "FAST", "user",
2554 anonymous_identity="FAST", password="password",
2555 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2556 phase1="fast_provisioning=1 fast_max_pac_list_len=1 fast_pac_format=binary",
2557 pac_file="blob://fast_pac_bin")
2fc4749c
JM		 2558 res = eap_reauth(dev[0], "FAST")
2559 if res['tls_session_reused'] != '1':
2560 raise Exception("EAP-FAST could not use PAC session ticket")
c6ab1cdb 2561
46e094bd
JM		 2562def test_ap_wpa2_eap_fast_missing_pac_config(dev, apdev):
2563 """WPA2-Enterprise connection using EAP-FAST and missing PAC config"""
3b51cc63 2564 check_eap_capa(dev[0], "FAST")
46e094bd
JM		 2565 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2566 hostapd.add_ap(apdev[0]['ifname'], params)
2567
2568 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2569 identity="user", anonymous_identity="FAST",
2570 password="password",
2571 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2572 pac_file="blob://fast_pac_not_in_use",
2573 wait_connect=False, scan_freq="2412")
2574 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2575 if ev is None:
2576 raise Exception("Timeout on EAP failure report")
2577 dev[0].request("REMOVE_NETWORK all")
2578
2579 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2580 identity="user", anonymous_identity="FAST",
2581 password="password",
2582 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2583 wait_connect=False, scan_freq="2412")
2584 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2585 if ev is None:
2586 raise Exception("Timeout on EAP failure report")
2587
53a6f06a
JM		 2588def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev):
2589 """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning"""
3b51cc63 2590 check_eap_capa(dev[0], "FAST")
53a6f06a 2591 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 2592 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
53a6f06a
JM		 2593 eap_connect(dev[0], apdev[0], "FAST", "user",
2594 anonymous_identity="FAST", password="password",
2595 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
2596 phase1="fast_provisioning=2", pac_file="blob://fast_pac_auth")
a8375c94 2597 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 2598 res = eap_reauth(dev[0], "FAST")
2599 if res['tls_session_reused'] != '1':
2600 raise Exception("EAP-FAST could not use PAC session ticket")
d4c7a2b9 2601
95a15d79
JM		 2602def test_ap_wpa2_eap_fast_gtc_identity_change(dev, apdev):
2603 """WPA2-Enterprise connection using EAP-FAST/GTC and identity changing"""
2604 check_eap_capa(dev[0], "FAST")
2605 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2606 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2607 id = eap_connect(dev[0], apdev[0], "FAST", "user",
2608 anonymous_identity="FAST", password="password",
2609 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
2610 phase1="fast_provisioning=2",
2611 pac_file="blob://fast_pac_auth")
2612 dev[0].set_network_quoted(id, "identity", "user2")
2613 dev[0].wait_disconnected()
2614 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
2615 if ev is None:
2616 raise Exception("EAP-FAST not started")
2617 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
2618 if ev is None:
2619 raise Exception("EAP failure not reported")
2620 dev[0].wait_disconnected()
2621
27f2fab0
JM		 2622def test_ap_wpa2_eap_fast_prf_oom(dev, apdev):
2623 """WPA2-Enterprise connection using EAP-FAST and OOM in PRF"""
2624 check_eap_capa(dev[0], "FAST")
cc71035f
JM		 2625 tls = dev[0].request("GET tls_library")
2626 if tls.startswith("OpenSSL"):
2627 func = "openssl_tls_prf"
2628 count = 2
2629 elif tls.startswith("internal"):
2630 func = "tls_connection_prf"
2631 count = 1
2632 else:
2633 raise HwsimSkip("Unsupported TLS library")
27f2fab0
JM		 2634 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2635 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cc71035f 2636 with alloc_fail(dev[0], count, func):
27f2fab0
JM		 2637 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2638 identity="user", anonymous_identity="FAST",
2639 password="password", ca_cert="auth_serv/ca.pem",
2640 phase2="auth=GTC",
2641 phase1="fast_provisioning=2",
2642 pac_file="blob://fast_pac_auth",
2643 wait_connect=False, scan_freq="2412")
2644 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
2645 if ev is None:
2646 raise Exception("EAP failure not reported")
2647 dev[0].request("DISCONNECT")
2648
6eddd530
JM		 2649def test_ap_wpa2_eap_fast_server_oom(dev, apdev):
2650 """EAP-FAST/MSCHAPv2 and server OOM"""
2651 check_eap_capa(dev[0], "FAST")
2652
2653 params = int_eap_server_params()
2654 params['dh_file'] = 'auth_serv/dh.conf'
2655 params['pac_opaque_encr_key'] = '000102030405060708090a0b0c0d0e0f'
2656 params['eap_fast_a_id'] = '1011'
2657 params['eap_fast_a_id_info'] = 'another test server'
2658 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2659
2660 with alloc_fail(hapd, 1, "tls_session_ticket_ext_cb"):
2661 id = eap_connect(dev[0], apdev[0], "FAST", "user",
2662 anonymous_identity="FAST", password="password",
2663 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2664 phase1="fast_provisioning=1",
2665 pac_file="blob://fast_pac",
2666 expect_failure=True)
2667 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2668 if ev is None:
2669 raise Exception("No EAP failure reported")
2670 dev[0].wait_disconnected()
2671 dev[0].request("DISCONNECT")
2672
2673 dev[0].select_network(id, freq="2412")
2674
d4c7a2b9
JM		 2675def test_ap_wpa2_eap_tls_ocsp(dev, apdev):
2676 """WPA2-Enterprise connection using EAP-TLS and verifying OCSP"""
0dae8c99 2677 check_ocsp_support(dev[0])
16c43d2a 2678 check_pkcs12_support(dev[0])
d4c7a2b9
JM		 2679 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2680 hostapd.add_ap(apdev[0]['ifname'], params)
2681 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
2682 private_key="auth_serv/user.pkcs12",
2683 private_key_passwd="whatever", ocsp=2)
2684
64e05f96 2685def int_eap_server_params():
d4c7a2b9
JM		 2686 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2687 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2688 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2689 "ca_cert": "auth_serv/ca.pem",
2690 "server_cert": "auth_serv/server.pem",
64e05f96
JM		 2691 "private_key": "auth_serv/server.key" }
2692 return params
d2a1047e 2693
58a40620
JM		 2694def test_ap_wpa2_eap_tls_ocsp_key_id(dev, apdev, params):
2695 """EAP-TLS and OCSP certificate signed OCSP response using key ID"""
2696 check_ocsp_support(dev[0])
2697 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-key-id.der")
2698 if not os.path.exists(ocsp):
2699 raise HwsimSkip("No OCSP response available")
2700 params = int_eap_server_params()
2701 params["ocsp_stapling_response"] = ocsp
2702 hostapd.add_ap(apdev[0]['ifname'], params)
2703 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2704 identity="tls user", ca_cert="auth_serv/ca.pem",
2705 private_key="auth_serv/user.pkcs12",
2706 private_key_passwd="whatever", ocsp=2,
2707 scan_freq="2412")
2708
d79ce4a6
JM		 2709def test_ap_wpa2_eap_tls_ocsp_ca_signed_good(dev, apdev, params):
2710 """EAP-TLS and CA signed OCSP response (good)"""
2711 check_ocsp_support(dev[0])
2712 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed.der")
2713 if not os.path.exists(ocsp):
2714 raise HwsimSkip("No OCSP response available")
2715 params = int_eap_server_params()
2716 params["ocsp_stapling_response"] = ocsp
2717 hostapd.add_ap(apdev[0]['ifname'], params)
2718 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2719 identity="tls user", ca_cert="auth_serv/ca.pem",
2720 private_key="auth_serv/user.pkcs12",
2721 private_key_passwd="whatever", ocsp=2,
2722 scan_freq="2412")
2723
2724def test_ap_wpa2_eap_tls_ocsp_ca_signed_revoked(dev, apdev, params):
2725 """EAP-TLS and CA signed OCSP response (revoked)"""
2726 check_ocsp_support(dev[0])
2727 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-revoked.der")
2728 if not os.path.exists(ocsp):
2729 raise HwsimSkip("No OCSP response available")
2730 params = int_eap_server_params()
2731 params["ocsp_stapling_response"] = ocsp
2732 hostapd.add_ap(apdev[0]['ifname'], params)
2733 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2734 identity="tls user", ca_cert="auth_serv/ca.pem",
2735 private_key="auth_serv/user.pkcs12",
2736 private_key_passwd="whatever", ocsp=2,
2737 wait_connect=False, scan_freq="2412")
2738 count = 0
2739 while True:
2740 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2741 if ev is None:
2742 raise Exception("Timeout on EAP status")
2743 if 'bad certificate status response' in ev:
2744 break
2745 if 'certificate revoked' in ev:
2746 break
2747 count = count + 1
2748 if count > 10:
2749 raise Exception("Unexpected number of EAP status messages")
2750
2751 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2752 if ev is None:
2753 raise Exception("Timeout on EAP failure report")
2754
2755def test_ap_wpa2_eap_tls_ocsp_ca_signed_unknown(dev, apdev, params):
2756 """EAP-TLS and CA signed OCSP response (unknown)"""
2757 check_ocsp_support(dev[0])
2758 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-unknown.der")
2759 if not os.path.exists(ocsp):
2760 raise HwsimSkip("No OCSP response available")
2761 params = int_eap_server_params()
2762 params["ocsp_stapling_response"] = ocsp
2763 hostapd.add_ap(apdev[0]['ifname'], params)
2764 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2765 identity="tls user", ca_cert="auth_serv/ca.pem",
2766 private_key="auth_serv/user.pkcs12",
2767 private_key_passwd="whatever", ocsp=2,
2768 wait_connect=False, scan_freq="2412")
2769 count = 0
2770 while True:
2771 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2772 if ev is None:
2773 raise Exception("Timeout on EAP status")
2774 if 'bad certificate status response' in ev:
2775 break
2776 count = count + 1
2777 if count > 10:
2778 raise Exception("Unexpected number of EAP status messages")
2779
2780 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2781 if ev is None:
2782 raise Exception("Timeout on EAP failure report")
2783
2784def test_ap_wpa2_eap_tls_ocsp_server_signed(dev, apdev, params):
2785 """EAP-TLS and server signed OCSP response"""
2786 check_ocsp_support(dev[0])
2787 ocsp = os.path.join(params['logdir'], "ocsp-resp-server-signed.der")
2788 if not os.path.exists(ocsp):
2789 raise HwsimSkip("No OCSP response available")
2790 params = int_eap_server_params()
2791 params["ocsp_stapling_response"] = ocsp
2792 hostapd.add_ap(apdev[0]['ifname'], params)
2793 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2794 identity="tls user", ca_cert="auth_serv/ca.pem",
2795 private_key="auth_serv/user.pkcs12",
2796 private_key_passwd="whatever", ocsp=2,
2797 wait_connect=False, scan_freq="2412")
2798 count = 0
2799 while True:
2800 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2801 if ev is None:
2802 raise Exception("Timeout on EAP status")
2803 if 'bad certificate status response' in ev:
2804 break
2805 count = count + 1
2806 if count > 10:
2807 raise Exception("Unexpected number of EAP status messages")
2808
2809 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2810 if ev is None:
2811 raise Exception("Timeout on EAP failure report")
2812
d2a1047e
JM		 2813def test_ap_wpa2_eap_tls_ocsp_invalid_data(dev, apdev):
2814 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP data"""
0dae8c99 2815 check_ocsp_support(dev[0])
d2a1047e
JM		 2816 params = int_eap_server_params()
2817 params["ocsp_stapling_response"] = "auth_serv/ocsp-req.der"
2818 hostapd.add_ap(apdev[0]['ifname'], params)
2819 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2820 identity="tls user", ca_cert="auth_serv/ca.pem",
2821 private_key="auth_serv/user.pkcs12",
2822 private_key_passwd="whatever", ocsp=2,
2823 wait_connect=False, scan_freq="2412")
2824 count = 0
2825 while True:
2826 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2827 if ev is None:
2828 raise Exception("Timeout on EAP status")
2829 if 'bad certificate status response' in ev:
2830 break
2831 count = count + 1
2832 if count > 10:
2833 raise Exception("Unexpected number of EAP status messages")
2834
2835 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2836 if ev is None:
2837 raise Exception("Timeout on EAP failure report")
2838
64e05f96
JM		 2839def test_ap_wpa2_eap_tls_ocsp_invalid(dev, apdev):
2840 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP response"""
0dae8c99 2841 check_ocsp_support(dev[0])
64e05f96
JM		 2842 params = int_eap_server_params()
2843 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-invalid"
d4c7a2b9 2844 hostapd.add_ap(apdev[0]['ifname'], params)
df7ad0fa
JM		 2845 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2846 identity="tls user", ca_cert="auth_serv/ca.pem",
2847 private_key="auth_serv/user.pkcs12",
2848 private_key_passwd="whatever", ocsp=2,
2849 wait_connect=False, scan_freq="2412")
2850 count = 0
2851 while True:
2852 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2853 if ev is None:
2854 raise Exception("Timeout on EAP status")
2855 if 'bad certificate status response' in ev:
2856 break
2857 count = count + 1
2858 if count > 10:
2859 raise Exception("Unexpected number of EAP status messages")
2860
2861 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2862 if ev is None:
2863 raise Exception("Timeout on EAP failure report")
2864
2865def test_ap_wpa2_eap_tls_ocsp_unknown_sign(dev, apdev):
2866 """WPA2-Enterprise connection using EAP-TLS and unknown OCSP signer"""
0dae8c99 2867 check_ocsp_support(dev[0])
df7ad0fa
JM		 2868 params = int_eap_server_params()
2869 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-unknown-sign"
2870 hostapd.add_ap(apdev[0]['ifname'], params)
d4c7a2b9
JM		 2871 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2872 identity="tls user", ca_cert="auth_serv/ca.pem",
2873 private_key="auth_serv/user.pkcs12",
2874 private_key_passwd="whatever", ocsp=2,
2875 wait_connect=False, scan_freq="2412")
2876 count = 0
2877 while True:
2878 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2879 if ev is None:
2880 raise Exception("Timeout on EAP status")
2881 if 'bad certificate status response' in ev:
2882 break
2883 count = count + 1
2884 if count > 10:
2885 raise Exception("Unexpected number of EAP status messages")
2886
2887 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2888 if ev is None:
2889 raise Exception("Timeout on EAP failure report")
64e05f96 2890
37b4a66c
JM		 2891def test_ap_wpa2_eap_ttls_ocsp_revoked(dev, apdev, params):
2892 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 2893 check_ocsp_support(dev[0])
37b4a66c
JM		 2894 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-revoked.der")
2895 if not os.path.exists(ocsp):
2896 raise HwsimSkip("No OCSP response available")
2897 params = int_eap_server_params()
2898 params["ocsp_stapling_response"] = ocsp
2899 hostapd.add_ap(apdev[0]['ifname'], params)
2900 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2901 identity="pap user", ca_cert="auth_serv/ca.pem",
2902 anonymous_identity="ttls", password="password",
2903 phase2="auth=PAP", ocsp=2,
2904 wait_connect=False, scan_freq="2412")
2905 count = 0
2906 while True:
2907 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2908 if ev is None:
2909 raise Exception("Timeout on EAP status")
2910 if 'bad certificate status response' in ev:
2911 break
2912 if 'certificate revoked' in ev:
2913 break
2914 count = count + 1
2915 if count > 10:
2916 raise Exception("Unexpected number of EAP status messages")
2917
2918 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2919 if ev is None:
2920 raise Exception("Timeout on EAP failure report")
2921
2922def test_ap_wpa2_eap_ttls_ocsp_unknown(dev, apdev, params):
2923 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 2924 check_ocsp_support(dev[0])
37b4a66c
JM		 2925 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
2926 if not os.path.exists(ocsp):
2927 raise HwsimSkip("No OCSP response available")
2928 params = int_eap_server_params()
2929 params["ocsp_stapling_response"] = ocsp
2930 hostapd.add_ap(apdev[0]['ifname'], params)
2931 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2932 identity="pap user", ca_cert="auth_serv/ca.pem",
2933 anonymous_identity="ttls", password="password",
2934 phase2="auth=PAP", ocsp=2,
2935 wait_connect=False, scan_freq="2412")
2936 count = 0
2937 while True:
2938 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2939 if ev is None:
2940 raise Exception("Timeout on EAP status")
2941 if 'bad certificate status response' in ev:
2942 break
2943 count = count + 1
2944 if count > 10:
2945 raise Exception("Unexpected number of EAP status messages")
2946
2947 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2948 if ev is None:
2949 raise Exception("Timeout on EAP failure report")
2950
2951def test_ap_wpa2_eap_ttls_optional_ocsp_unknown(dev, apdev, params):
2952 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
2953 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
2954 if not os.path.exists(ocsp):
2955 raise HwsimSkip("No OCSP response available")
2956 params = int_eap_server_params()
2957 params["ocsp_stapling_response"] = ocsp
2958 hostapd.add_ap(apdev[0]['ifname'], params)
2959 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2960 identity="pap user", ca_cert="auth_serv/ca.pem",
2961 anonymous_identity="ttls", password="password",
2962 phase2="auth=PAP", ocsp=1, scan_freq="2412")
2963
24579e70 2964def test_ap_wpa2_eap_tls_domain_suffix_match_cn_full(dev, apdev):
64e05f96 2965 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
e78eb404 2966 check_domain_match_full(dev[0])
64e05f96
JM		 2967 params = int_eap_server_params()
2968 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2969 params["private_key"] = "auth_serv/server-no-dnsname.key"
2970 hostapd.add_ap(apdev[0]['ifname'], params)
2971 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2972 identity="tls user", ca_cert="auth_serv/ca.pem",
2973 private_key="auth_serv/user.pkcs12",
2974 private_key_passwd="whatever",
2975 domain_suffix_match="server3.w1.fi",
2976 scan_freq="2412")
24579e70 2977
061cbb25
JM		 2978def test_ap_wpa2_eap_tls_domain_match_cn(dev, apdev):
2979 """WPA2-Enterprise using EAP-TLS and domainmatch (CN)"""
e78eb404 2980 check_domain_match(dev[0])
061cbb25
JM		 2981 params = int_eap_server_params()
2982 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2983 params["private_key"] = "auth_serv/server-no-dnsname.key"
2984 hostapd.add_ap(apdev[0]['ifname'], params)
2985 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2986 identity="tls user", ca_cert="auth_serv/ca.pem",
2987 private_key="auth_serv/user.pkcs12",
2988 private_key_passwd="whatever",
2989 domain_match="server3.w1.fi",
2990 scan_freq="2412")
2991
24579e70
JM		 2992def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev):
2993 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
2994 check_domain_match_full(dev[0])
2995 params = int_eap_server_params()
2996 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2997 params["private_key"] = "auth_serv/server-no-dnsname.key"
2998 hostapd.add_ap(apdev[0]['ifname'], params)
64e05f96
JM		 2999 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3000 identity="tls user", ca_cert="auth_serv/ca.pem",
3001 private_key="auth_serv/user.pkcs12",
3002 private_key_passwd="whatever",
3003 domain_suffix_match="w1.fi",
3004 scan_freq="2412")
3005
3006def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev):
3007 """WPA2-Enterprise using EAP-TLS and domain suffix mismatch (CN)"""
e78eb404 3008 check_domain_suffix_match(dev[0])
64e05f96
JM		 3009 params = int_eap_server_params()
3010 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
3011 params["private_key"] = "auth_serv/server-no-dnsname.key"
3012 hostapd.add_ap(apdev[0]['ifname'], params)
3013 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3014 identity="tls user", ca_cert="auth_serv/ca.pem",
3015 private_key="auth_serv/user.pkcs12",
3016 private_key_passwd="whatever",
3017 domain_suffix_match="example.com",
3018 wait_connect=False,
3019 scan_freq="2412")
c61dca40
JM		 3020 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3021 identity="tls user", ca_cert="auth_serv/ca.pem",
3022 private_key="auth_serv/user.pkcs12",
3023 private_key_passwd="whatever",
3024 domain_suffix_match="erver3.w1.fi",
3025 wait_connect=False,
3026 scan_freq="2412")
64e05f96
JM		 3027 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3028 if ev is None:
3029 raise Exception("Timeout on EAP failure report")
c61dca40
JM		 3030 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3031 if ev is None:
3032 raise Exception("Timeout on EAP failure report (2)")
6a4d0dbe 3033
061cbb25
JM		 3034def test_ap_wpa2_eap_tls_domain_mismatch_cn(dev, apdev):
3035 """WPA2-Enterprise using EAP-TLS and domain mismatch (CN)"""
e78eb404 3036 check_domain_match(dev[0])
061cbb25
JM		 3037 params = int_eap_server_params()
3038 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
3039 params["private_key"] = "auth_serv/server-no-dnsname.key"
3040 hostapd.add_ap(apdev[0]['ifname'], params)
3041 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3042 identity="tls user", ca_cert="auth_serv/ca.pem",
3043 private_key="auth_serv/user.pkcs12",
3044 private_key_passwd="whatever",
3045 domain_match="example.com",
3046 wait_connect=False,
3047 scan_freq="2412")
3048 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3049 identity="tls user", ca_cert="auth_serv/ca.pem",
3050 private_key="auth_serv/user.pkcs12",
3051 private_key_passwd="whatever",
3052 domain_match="w1.fi",
3053 wait_connect=False,
3054 scan_freq="2412")
3055 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3056 if ev is None:
3057 raise Exception("Timeout on EAP failure report")
3058 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3059 if ev is None:
3060 raise Exception("Timeout on EAP failure report (2)")
3061
6a4d0dbe
JM		 3062def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev):
3063 """WPA2-Enterprise using EAP-TTLS and expired certificate"""
ca158ea6 3064 skip_with_fips(dev[0])
6a4d0dbe
JM		 3065 params = int_eap_server_params()
3066 params["server_cert"] = "auth_serv/server-expired.pem"
3067 params["private_key"] = "auth_serv/server-expired.key"
3068 hostapd.add_ap(apdev[0]['ifname'], params)
3069 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3070 identity="mschap user", password="password",
3071 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3072 wait_connect=False,
3073 scan_freq="2412")
3074 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"])
3075 if ev is None:
3076 raise Exception("Timeout on EAP certificate error report")
3077 if "reason=4" not in ev or "certificate has expired" not in ev:
3078 raise Exception("Unexpected failure reason: " + ev)
3079 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3080 if ev is None:
3081 raise Exception("Timeout on EAP failure report")
3082
3083def test_ap_wpa2_eap_ttls_ignore_expired_cert(dev, apdev):
3084 """WPA2-Enterprise using EAP-TTLS and ignore certificate expiration"""
ca158ea6 3085 skip_with_fips(dev[0])
6a4d0dbe
JM		 3086 params = int_eap_server_params()
3087 params["server_cert"] = "auth_serv/server-expired.pem"
3088 params["private_key"] = "auth_serv/server-expired.key"
3089 hostapd.add_ap(apdev[0]['ifname'], params)
3090 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3091 identity="mschap user", password="password",
3092 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3093 phase1="tls_disable_time_checks=1",
3094 scan_freq="2412")
6ab4a7aa 3095
5748d1e5
JM		 3096def test_ap_wpa2_eap_ttls_long_duration(dev, apdev):
3097 """WPA2-Enterprise using EAP-TTLS and long certificate duration"""
ca158ea6 3098 skip_with_fips(dev[0])
5748d1e5
JM		 3099 params = int_eap_server_params()
3100 params["server_cert"] = "auth_serv/server-long-duration.pem"
3101 params["private_key"] = "auth_serv/server-long-duration.key"
3102 hostapd.add_ap(apdev[0]['ifname'], params)
3103 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3104 identity="mschap user", password="password",
3105 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3106 scan_freq="2412")
3107
6ab4a7aa
JM		 3108def test_ap_wpa2_eap_ttls_server_cert_eku_client(dev, apdev):
3109 """WPA2-Enterprise using EAP-TTLS and server cert with client EKU"""
ca158ea6 3110 skip_with_fips(dev[0])
6ab4a7aa
JM		 3111 params = int_eap_server_params()
3112 params["server_cert"] = "auth_serv/server-eku-client.pem"
3113 params["private_key"] = "auth_serv/server-eku-client.key"
3114 hostapd.add_ap(apdev[0]['ifname'], params)
3115 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3116 identity="mschap user", password="password",
3117 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3118 wait_connect=False,
3119 scan_freq="2412")
3120 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3121 if ev is None:
3122 raise Exception("Timeout on EAP failure report")
242219c5 3123
14bef66d
JM		 3124def test_ap_wpa2_eap_ttls_server_cert_eku_client_server(dev, apdev):
3125 """WPA2-Enterprise using EAP-TTLS and server cert with client and server EKU"""
ca158ea6 3126 skip_with_fips(dev[0])
14bef66d
JM		 3127 params = int_eap_server_params()
3128 params["server_cert"] = "auth_serv/server-eku-client-server.pem"
3129 params["private_key"] = "auth_serv/server-eku-client-server.key"
3130 hostapd.add_ap(apdev[0]['ifname'], params)
3131 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3132 identity="mschap user", password="password",
3133 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3134 scan_freq="2412")
3135
c37b02fc
JM		 3136def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
3137 """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
ca158ea6 3138 skip_with_fips(dev[0])
c37b02fc
JM		 3139 params = int_eap_server_params()
3140 del params["server_cert"]
3141 params["private_key"] = "auth_serv/server.pkcs12"
3142 hostapd.add_ap(apdev[0]['ifname'], params)
3143 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3144 identity="mschap user", password="password",
3145 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3146 scan_freq="2412")
3147
242219c5
JM		 3148def test_ap_wpa2_eap_ttls_dh_params(dev, apdev):
3149 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params"""
3150 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3151 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3152 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
242219c5 3153 anonymous_identity="ttls", password="password",
ca158ea6 3154 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
242219c5 3155 dh_file="auth_serv/dh.conf")
7c50093f 3156
b3ff3dec
JM		 3157def test_ap_wpa2_eap_ttls_dh_params_dsa(dev, apdev):
3158 """WPA2-Enterprise connection using EAP-TTLS and setting DH params (DSA)"""
404597e6 3159 check_dh_dsa_support(dev[0])
b3ff3dec
JM		 3160 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3161 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3162 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
b3ff3dec 3163 anonymous_identity="ttls", password="password",
ca158ea6 3164 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
b3ff3dec
JM		 3165 dh_file="auth_serv/dsaparam.pem")
3166
3167def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
3168 """EAP-TTLS and DH params file not found"""
ca158ea6 3169 skip_with_fips(dev[0])
b3ff3dec
JM		 3170 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3171 hostapd.add_ap(apdev[0]['ifname'], params)
3172 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3173 identity="mschap user", password="password",
3174 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3175 dh_file="auth_serv/dh-no-such-file.conf",
3176 scan_freq="2412", wait_connect=False)
3177 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3178 if ev is None:
3179 raise Exception("EAP failure timed out")
3180 dev[0].request("REMOVE_NETWORK all")
3181 dev[0].wait_disconnected()
3182
3183def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
3184 """EAP-TTLS and invalid DH params file"""
ca158ea6 3185 skip_with_fips(dev[0])
b3ff3dec
JM		 3186 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3187 hostapd.add_ap(apdev[0]['ifname'], params)
3188 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3189 identity="mschap user", password="password",
3190 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3191 dh_file="auth_serv/ca.pem",
3192 scan_freq="2412", wait_connect=False)
3193 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3194 if ev is None:
3195 raise Exception("EAP failure timed out")
3196 dev[0].request("REMOVE_NETWORK all")
3197 dev[0].wait_disconnected()
3198
6ea231e6
JM		 3199def test_ap_wpa2_eap_ttls_dh_params_blob(dev, apdev):
3200 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params from blob"""
3201 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3202 hostapd.add_ap(apdev[0]['ifname'], params)
768ea0bc 3203 dh = read_pem("auth_serv/dh2.conf")
6ea231e6
JM		 3204 if "OK" not in dev[0].request("SET blob dhparams " + dh.encode("hex")):
3205 raise Exception("Could not set dhparams blob")
ca158ea6 3206 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
6ea231e6 3207 anonymous_identity="ttls", password="password",
ca158ea6 3208 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
6ea231e6
JM		 3209 dh_file="blob://dhparams")
3210
768ea0bc
JM		 3211def test_ap_wpa2_eap_ttls_dh_params_server(dev, apdev):
3212 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams"""
3213 params = int_eap_server_params()
3214 params["dh_file"] = "auth_serv/dh2.conf"
3215 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3216 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
768ea0bc 3217 anonymous_identity="ttls", password="password",
ca158ea6 3218 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
768ea0bc 3219
b3ff3dec
JM		 3220def test_ap_wpa2_eap_ttls_dh_params_dsa_server(dev, apdev):
3221 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams (DSA)"""
3222 params = int_eap_server_params()
3223 params["dh_file"] = "auth_serv/dsaparam.pem"
3224 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3225 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
b3ff3dec 3226 anonymous_identity="ttls", password="password",
ca158ea6 3227 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
b3ff3dec
JM		 3228
3229def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
3230 """EAP-TLS server and dhparams file not found"""
3231 params = int_eap_server_params()
3232 params["dh_file"] = "auth_serv/dh-no-such-file.conf"
3233 hapd = hostapd.add_ap(apdev[0]['ifname'], params, no_enable=True)
3234 if "FAIL" not in hapd.request("ENABLE"):
3235 raise Exception("Invalid configuration accepted")
3236
3237def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
3238 """EAP-TLS server and invalid dhparams file"""
3239 params = int_eap_server_params()
3240 params["dh_file"] = "auth_serv/ca.pem"
3241 hapd = hostapd.add_ap(apdev[0]['ifname'], params, no_enable=True)
3242 if "FAIL" not in hapd.request("ENABLE"):
3243 raise Exception("Invalid configuration accepted")
3244
7c50093f
JM		 3245def test_ap_wpa2_eap_reauth(dev, apdev):
3246 """WPA2-Enterprise and Authenticator forcing reauthentication"""
3247 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3248 params['eap_reauth_period'] = '2'
3249 hostapd.add_ap(apdev[0]['ifname'], params)
3250 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
3251 password_hex="0123456789abcdef0123456789abcdef")
3252 logger.info("Wait for reauthentication")
3253 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3254 if ev is None:
3255 raise Exception("Timeout on reauthentication")
3256 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3257 if ev is None:
3258 raise Exception("Timeout on reauthentication")
3259 for i in range(0, 20):
3260 state = dev[0].get_status_field("wpa_state")
3261 if state == "COMPLETED":
3262 break
3263 time.sleep(0.1)
3264 if state != "COMPLETED":
3265 raise Exception("Reauthentication did not complete")
8b56743e
JM		 3266
3267def test_ap_wpa2_eap_request_identity_message(dev, apdev):
3268 """Optional displayable message in EAP Request-Identity"""
3269 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3270 params['eap_message'] = 'hello\\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com'
3271 hostapd.add_ap(apdev[0]['ifname'], params)
3272 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
3273 password_hex="0123456789abcdef0123456789abcdef")
910f16ca
JM		 3274
3275def test_ap_wpa2_eap_sim_aka_result_ind(dev, apdev):
3276 """WPA2-Enterprise using EAP-SIM/AKA and protected result indication"""
81e787b7 3277 check_hlr_auc_gw_support()
910f16ca
JM		 3278 params = int_eap_server_params()
3279 params['eap_sim_db'] = "unix:/tmp/hlr_auc_gw.sock"
3280 params['eap_sim_aka_result_ind'] = "1"
3281 hostapd.add_ap(apdev[0]['ifname'], params)
3282
3283 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
3284 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
3285 phase1="result_ind=1")
3286 eap_reauth(dev[0], "SIM")
3287 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
3288 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
3289
3290 dev[0].request("REMOVE_NETWORK all")
3291 dev[1].request("REMOVE_NETWORK all")
3292
3293 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
3294 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
3295 phase1="result_ind=1")
3296 eap_reauth(dev[0], "AKA")
3297 eap_connect(dev[1], apdev[0], "AKA", "0232010000000000",
3298 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
3299
3300 dev[0].request("REMOVE_NETWORK all")
3301 dev[1].request("REMOVE_NETWORK all")
3302
3303 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
3304 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
3305 phase1="result_ind=1")
3306 eap_reauth(dev[0], "AKA'")
3307 eap_connect(dev[1], apdev[0], "AKA'", "6555444333222111",
3308 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
633e364b
JM		 3309
3310def test_ap_wpa2_eap_too_many_roundtrips(dev, apdev):
3311 """WPA2-Enterprise connection resulting in too many EAP roundtrips"""
ca158ea6 3312 skip_with_fips(dev[0])
633e364b
JM		 3313 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3314 hostapd.add_ap(apdev[0]['ifname'], params)
3315 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
3316 eap="TTLS", identity="mschap user",
3317 wait_connect=False, scan_freq="2412", ieee80211w="1",
3318 anonymous_identity="ttls", password="password",
3319 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3320 fragment_size="10")
3321 ev = dev[0].wait_event(["EAP: more than"], timeout=20)
3322 if ev is None:
3323 raise Exception("EAP roundtrip limit not reached")
32dca985
JM		 3324
3325def test_ap_wpa2_eap_expanded_nak(dev, apdev):
3326 """WPA2-Enterprise connection with EAP resulting in expanded NAK"""
3327 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3328 hostapd.add_ap(apdev[0]['ifname'], params)
3329 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
3330 eap="PSK", identity="vendor-test",
3331 password_hex="ff23456789abcdef0123456789abcdef",
3332 wait_connect=False)
3333
3334 found = False
3335 for i in range(0, 5):
3336 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"], timeout=10)
3337 if ev is None:
3338 raise Exception("Association and EAP start timed out")
3339 if "refuse proposed method" in ev:
3340 found = True
3341 break
3342 if not found:
3343 raise Exception("Unexpected EAP status: " + ev)
3344
3345 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3346 if ev is None:
3347 raise Exception("EAP failure timed out")
745f8771
JM		 3348
3349def test_ap_wpa2_eap_sql(dev, apdev, params):
3350 """WPA2-Enterprise connection using SQLite for user DB"""
ca158ea6 3351 skip_with_fips(dev[0])
745f8771
JM		 3352 try:
3353 import sqlite3
3354 except ImportError:
81e787b7 3355 raise HwsimSkip("No sqlite3 module available")
745f8771
JM		 3356 dbfile = os.path.join(params['logdir'], "eap-user.db")
3357 try:
3358 os.remove(dbfile)
3359 except:
3360 pass
3361 con = sqlite3.connect(dbfile)
3362 with con:
3363 cur = con.cursor()
3364 cur.execute("CREATE TABLE users(identity TEXT PRIMARY KEY, methods TEXT, password TEXT, remediation TEXT, phase2 INTEGER)")
3365 cur.execute("CREATE TABLE wildcards(identity TEXT PRIMARY KEY, methods TEXT)")
3366 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-pap','TTLS-PAP','password',1)")
3367 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-chap','TTLS-CHAP','password',1)")
3368 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschap','TTLS-MSCHAP','password',1)")
3369 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschapv2','TTLS-MSCHAPV2','password',1)")
3370 cur.execute("INSERT INTO wildcards(identity,methods) VALUES ('','TTLS,TLS')")
3371 cur.execute("CREATE TABLE authlog(timestamp TEXT, session TEXT, nas_ip TEXT, username TEXT, note TEXT)")
3372
3373 try:
3374 params = int_eap_server_params()
3375 params["eap_user_file"] = "sqlite:" + dbfile
3376 hostapd.add_ap(apdev[0]['ifname'], params)
3377 eap_connect(dev[0], apdev[0], "TTLS", "user-mschapv2",
3378 anonymous_identity="ttls", password="password",
3379 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3380 dev[0].request("REMOVE_NETWORK all")
3381 eap_connect(dev[1], apdev[0], "TTLS", "user-mschap",
3382 anonymous_identity="ttls", password="password",
3383 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP")
3384 dev[1].request("REMOVE_NETWORK all")
3385 eap_connect(dev[0], apdev[0], "TTLS", "user-chap",
3386 anonymous_identity="ttls", password="password",
3387 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP")
3388 eap_connect(dev[1], apdev[0], "TTLS", "user-pap",
3389 anonymous_identity="ttls", password="password",
3390 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3391 finally:
3392 os.remove(dbfile)
b246e2af
JM		 3393
3394def test_ap_wpa2_eap_non_ascii_identity(dev, apdev):
3395 """WPA2-Enterprise connection attempt using non-ASCII identity"""
3396 params = int_eap_server_params()
3397 hostapd.add_ap(apdev[0]['ifname'], params)
3398 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3399 identity="\x80", password="password", wait_connect=False)
3400 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3401 identity="a\x80", password="password", wait_connect=False)
3402 for i in range(0, 2):
3403 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3404 if ev is None:
3405 raise Exception("Association and EAP start timed out")
3406 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
3407 if ev is None:
3408 raise Exception("EAP method selection timed out")
3409
3410def test_ap_wpa2_eap_non_ascii_identity2(dev, apdev):
3411 """WPA2-Enterprise connection attempt using non-ASCII identity"""
3412 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3413 hostapd.add_ap(apdev[0]['ifname'], params)
3414 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3415 identity="\x80", password="password", wait_connect=False)
3416 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3417 identity="a\x80", password="password", wait_connect=False)
3418 for i in range(0, 2):
3419 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3420 if ev is None:
3421 raise Exception("Association and EAP start timed out")
3422 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
3423 if ev is None:
3424 raise Exception("EAP method selection timed out")
89f20842
JM		 3425
3426def test_openssl_cipher_suite_config_wpas(dev, apdev):
3427 """OpenSSL cipher suite configuration on wpa_supplicant"""
a783340d
JM		 3428 tls = dev[0].request("GET tls_library")
3429 if not tls.startswith("OpenSSL"):
3430 raise HwsimSkip("TLS library is not OpenSSL: " + tls)
89f20842
JM		 3431 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3432 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3433 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3434 anonymous_identity="ttls", password="password",
3435 openssl_ciphers="AES128",
3436 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3437 eap_connect(dev[1], apdev[0], "TTLS", "pap user",
3438 anonymous_identity="ttls", password="password",
3439 openssl_ciphers="EXPORT",
3440 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
9dd21d51 3441 expect_failure=True, maybe_local_error=True)
7be5ec99
JM		 3442 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3443 identity="pap user", anonymous_identity="ttls",
3444 password="password",
3445 openssl_ciphers="FOO",
3446 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
3447 wait_connect=False)
3448 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
3449 if ev is None:
3450 raise Exception("EAP failure after invalid openssl_ciphers not reported")
3451 dev[2].request("DISCONNECT")
89f20842
JM		 3452
3453def test_openssl_cipher_suite_config_hapd(dev, apdev):
3454 """OpenSSL cipher suite configuration on hostapd"""
a783340d
JM		 3455 tls = dev[0].request("GET tls_library")
3456 if not tls.startswith("OpenSSL"):
3457 raise HwsimSkip("wpa_supplicant TLS library is not OpenSSL: " + tls)
89f20842
JM		 3458 params = int_eap_server_params()
3459 params['openssl_ciphers'] = "AES256"
3460 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
a783340d
JM		 3461 tls = hapd.request("GET tls_library")
3462 if not tls.startswith("OpenSSL"):
3463 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
89f20842
JM		 3464 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3465 anonymous_identity="ttls", password="password",
3466 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3467 eap_connect(dev[1], apdev[0], "TTLS", "pap user",
3468 anonymous_identity="ttls", password="password",
3469 openssl_ciphers="AES128",
3470 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
3471 expect_failure=True)
3472 eap_connect(dev[2], apdev[0], "TTLS", "pap user",
3473 anonymous_identity="ttls", password="password",
3474 openssl_ciphers="HIGH:!ADH",
3475 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
5b3c40a6 3476
7be5ec99
JM		 3477 params['openssl_ciphers'] = "FOO"
3478 hapd2 = hostapd.add_ap(apdev[1]['ifname'], params, no_enable=True)
3479 if "FAIL" not in hapd2.request("ENABLE"):
3480 raise Exception("Invalid openssl_ciphers value accepted")
3481
5b3c40a6
JM		 3482def test_wpa2_eap_ttls_pap_key_lifetime_in_memory(dev, apdev, params):
3483 """Key lifetime in memory with WPA2-Enterprise using EAP-TTLS/PAP"""
3484 p = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3485 hapd = hostapd.add_ap(apdev[0]['ifname'], p)
3486 password = "63d2d21ac3c09ed567ee004a34490f1d16e7fa5835edf17ddba70a63f1a90a25"
3487 pid = find_wpas_process(dev[0])
3488 id = eap_connect(dev[0], apdev[0], "TTLS", "pap-secret",
3489 anonymous_identity="ttls", password=password,
3490 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
8e416cec
JM		 3491 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
3492 # event has been delivered, so verify that wpa_supplicant has returned to
3493 # eloop before reading process memory.
54f2cae2 3494 time.sleep(1)
8e416cec 3495 dev[0].ping()
5b3c40a6
JM		 3496 buf = read_process_memory(pid, password)
3497
3498 dev[0].request("DISCONNECT")
3499 dev[0].wait_disconnected()
3500
3501 dev[0].relog()
750904dd
JM		 3502 msk = None
3503 emsk = None
5b3c40a6
JM		 3504 pmk = None
3505 ptk = None
3506 gtk = None
3507 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
3508 for l in f.readlines():
750904dd
JM		 3509 if "EAP-TTLS: Derived key - hexdump" in l:
3510 val = l.strip().split(':')[3].replace(' ', '')
3511 msk = binascii.unhexlify(val)
3512 if "EAP-TTLS: Derived EMSK - hexdump" in l:
3513 val = l.strip().split(':')[3].replace(' ', '')
3514 emsk = binascii.unhexlify(val)
5b3c40a6
JM		 3515 if "WPA: PMK - hexdump" in l:
3516 val = l.strip().split(':')[3].replace(' ', '')
3517 pmk = binascii.unhexlify(val)
3518 if "WPA: PTK - hexdump" in l:
3519 val = l.strip().split(':')[3].replace(' ', '')
3520 ptk = binascii.unhexlify(val)
3521 if "WPA: Group Key - hexdump" in l:
3522 val = l.strip().split(':')[3].replace(' ', '')
3523 gtk = binascii.unhexlify(val)
750904dd 3524 if not msk or not emsk or not pmk or not ptk or not gtk:
5b3c40a6
JM		 3525 raise Exception("Could not find keys from debug log")
3526 if len(gtk) != 16:
3527 raise Exception("Unexpected GTK length")
3528
3529 kck = ptk[0:16]
3530 kek = ptk[16:32]
3531 tk = ptk[32:48]
3532
3533 fname = os.path.join(params['logdir'],
3534 'wpa2_eap_ttls_pap_key_lifetime_in_memory.memctx-')
3535
3536 logger.info("Checking keys in memory while associated")
3537 get_key_locations(buf, password, "Password")
3538 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3539 get_key_locations(buf, msk, "MSK")
3540 get_key_locations(buf, emsk, "EMSK")
5b3c40a6 3541 if password not in buf:
81e787b7 3542 raise HwsimSkip("Password not found while associated")
5b3c40a6 3543 if pmk not in buf:
81e787b7 3544 raise HwsimSkip("PMK not found while associated")
5b3c40a6
JM		 3545 if kck not in buf:
3546 raise Exception("KCK not found while associated")
3547 if kek not in buf:
3548 raise Exception("KEK not found while associated")
3549 if tk in buf:
3550 raise Exception("TK found from memory")
3551 if gtk in buf:
8eb45bde 3552 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 3553 raise Exception("GTK found from memory")
3554
3555 logger.info("Checking keys in memory after disassociation")
3556 buf = read_process_memory(pid, password)
3557
3558 # Note: Password is still present in network configuration
3559 # Note: PMK is in PMKSA cache and EAP fast re-auth data
3560
3561 get_key_locations(buf, password, "Password")
3562 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3563 get_key_locations(buf, msk, "MSK")
3564 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3565 verify_not_present(buf, kck, fname, "KCK")
3566 verify_not_present(buf, kek, fname, "KEK")
3567 verify_not_present(buf, tk, fname, "TK")
3568 verify_not_present(buf, gtk, fname, "GTK")
3569
3570 dev[0].request("PMKSA_FLUSH")
3571 dev[0].set_network_quoted(id, "identity", "foo")
3572 logger.info("Checking keys in memory after PMKSA cache and EAP fast reauth flush")
3573 buf = read_process_memory(pid, password)
3574 get_key_locations(buf, password, "Password")
3575 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3576 get_key_locations(buf, msk, "MSK")
3577 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3578 verify_not_present(buf, pmk, fname, "PMK")
3579
3580 dev[0].request("REMOVE_NETWORK all")
3581
3582 logger.info("Checking keys in memory after network profile removal")
3583 buf = read_process_memory(pid, password)
3584
3585 get_key_locations(buf, password, "Password")
3586 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3587 get_key_locations(buf, msk, "MSK")
3588 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3589 verify_not_present(buf, password, fname, "password")
3590 verify_not_present(buf, pmk, fname, "PMK")
3591 verify_not_present(buf, kck, fname, "KCK")
3592 verify_not_present(buf, kek, fname, "KEK")
3593 verify_not_present(buf, tk, fname, "TK")
3594 verify_not_present(buf, gtk, fname, "GTK")
750904dd
JM		 3595 verify_not_present(buf, msk, fname, "MSK")
3596 verify_not_present(buf, emsk, fname, "EMSK")
a08fdb17
JM		 3597
3598def test_ap_wpa2_eap_unexpected_wep_eapol_key(dev, apdev):
3599 """WPA2-Enterprise connection and unexpected WEP EAPOL-Key"""
3600 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3601 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3602 bssid = apdev[0]['bssid']
3603 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3604 anonymous_identity="ttls", password="password",
3605 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3606
3607 # Send unexpected WEP EAPOL-Key; this gets dropped
3608 res = dev[0].request("EAPOL_RX " + bssid + " 0203002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
3609 if "OK" not in res:
3610 raise Exception("EAPOL_RX to wpa_supplicant failed")
52352802
JM		 3611
3612def test_ap_wpa2_eap_in_bridge(dev, apdev):
3613 """WPA2-EAP and wpas interface in a bridge"""
3614 br_ifname='sta-br0'
3615 ifname='wlan5'
3616 try:
3617 _test_ap_wpa2_eap_in_bridge(dev, apdev)
3618 finally:
3619 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'down'])
3620 subprocess.call(['brctl', 'delif', br_ifname, ifname])
3621 subprocess.call(['brctl', 'delbr', br_ifname])
3622 subprocess.call(['iw', ifname, 'set', '4addr', 'off'])
3623
3624def _test_ap_wpa2_eap_in_bridge(dev, apdev):
3625 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3626 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3627
3628 br_ifname='sta-br0'
3629 ifname='wlan5'
3630 wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
3631 subprocess.call(['brctl', 'addbr', br_ifname])
3632 subprocess.call(['brctl', 'setfd', br_ifname, '0'])
3633 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
3634 subprocess.call(['iw', ifname, 'set', '4addr', 'on'])
3635 subprocess.check_call(['brctl', 'addif', br_ifname, ifname])
3636 wpas.interface_add(ifname, br_ifname=br_ifname)
4b9d79b6 3637 wpas.dump_monitor()
52352802
JM		 3638
3639 id = eap_connect(wpas, apdev[0], "PAX", "pax.user@example.com",
3640 password_hex="0123456789abcdef0123456789abcdef")
4b9d79b6 3641 wpas.dump_monitor()
52352802 3642 eap_reauth(wpas, "PAX")
4b9d79b6 3643 wpas.dump_monitor()
52352802
JM		 3644 # Try again as a regression test for packet socket workaround
3645 eap_reauth(wpas, "PAX")
4b9d79b6 3646 wpas.dump_monitor()
52352802
JM		 3647 wpas.request("DISCONNECT")
3648 wpas.wait_disconnected()
4b9d79b6 3649 wpas.dump_monitor()
52352802
JM		 3650 wpas.request("RECONNECT")
3651 wpas.wait_connected()
4b9d79b6 3652 wpas.dump_monitor()
febf5752
JM		 3653
3654def test_ap_wpa2_eap_session_ticket(dev, apdev):
3655 """WPA2-Enterprise connection using EAP-TTLS and TLS session ticket enabled"""
3656 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3657 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3658 key_mgmt = hapd.get_config()['key_mgmt']
3659 if key_mgmt.split(' ')[0] != "WPA-EAP":
3660 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3661 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3662 anonymous_identity="ttls", password="password",
3663 ca_cert="auth_serv/ca.pem",
3664 phase1="tls_disable_session_ticket=0", phase2="auth=PAP")
3665 eap_reauth(dev[0], "TTLS")
3666
3667def test_ap_wpa2_eap_no_workaround(dev, apdev):
3668 """WPA2-Enterprise connection using EAP-TTLS and eap_workaround=0"""
3669 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3670 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3671 key_mgmt = hapd.get_config()['key_mgmt']
3672 if key_mgmt.split(' ')[0] != "WPA-EAP":
3673 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3674 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3675 anonymous_identity="ttls", password="password",
3676 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3677 phase2="auth=PAP")
3678 eap_reauth(dev[0], "TTLS")
b197a819
JM		 3679
3680def test_ap_wpa2_eap_tls_check_crl(dev, apdev):
3681 """EAP-TLS and server checking CRL"""
3682 params = int_eap_server_params()
3683 params['check_crl'] = '1'
3684 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3685
3686 # check_crl=1 and no CRL available --> reject connection
3687 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3688 client_cert="auth_serv/user.pem",
3689 private_key="auth_serv/user.key", expect_failure=True)
3690 dev[0].request("REMOVE_NETWORK all")
3691
3692 hapd.disable()
3693 hapd.set("ca_cert", "auth_serv/ca-and-crl.pem")
3694 hapd.enable()
3695
3696 # check_crl=1 and valid CRL --> accept
3697 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3698 client_cert="auth_serv/user.pem",
3699 private_key="auth_serv/user.key")
3700 dev[0].request("REMOVE_NETWORK all")
3701
3702 hapd.disable()
3703 hapd.set("check_crl", "2")
3704 hapd.enable()
3705
3706 # check_crl=2 and valid CRL --> accept
3707 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3708 client_cert="auth_serv/user.pem",
3709 private_key="auth_serv/user.key")
3710 dev[0].request("REMOVE_NETWORK all")
b1fb4275
JM		 3711
3712def test_ap_wpa2_eap_tls_oom(dev, apdev):
3713 """EAP-TLS and OOM"""
3714 check_subject_match_support(dev[0])
3715 check_altsubject_match_support(dev[0])
e78eb404 3716 check_domain_match(dev[0])
b1fb4275
JM		 3717 check_domain_match_full(dev[0])
3718
3719 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3720 hostapd.add_ap(apdev[0]['ifname'], params)
3721
3722 tests = [ (1, "tls_connection_set_subject_match"),
3723 (2, "tls_connection_set_subject_match"),
3724 (3, "tls_connection_set_subject_match"),
3725 (4, "tls_connection_set_subject_match") ]
3726 for count, func in tests:
3727 with alloc_fail(dev[0], count, func):
3728 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3729 identity="tls user", ca_cert="auth_serv/ca.pem",
3730 client_cert="auth_serv/user.pem",
3731 private_key="auth_serv/user.key",
3732 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
3733 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/",
3734 domain_suffix_match="server.w1.fi",
3735 domain_match="server.w1.fi",
3736 wait_connect=False, scan_freq="2412")
3737 # TLS parameter configuration error results in CTRL-REQ-PASSPHRASE
3738 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"], timeout=5)
3739 if ev is None:
3740 raise Exception("No passphrase request")
3741 dev[0].request("REMOVE_NETWORK all")
3742 dev[0].wait_disconnected()
405c621c
JM		 3743
3744def test_ap_wpa2_eap_tls_macacl(dev, apdev):
3745 """WPA2-Enterprise connection using MAC ACL"""
3746 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3747 params["macaddr_acl"] = "2"
3748 hostapd.add_ap(apdev[0]['ifname'], params)
3749 eap_connect(dev[1], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3750 client_cert="auth_serv/user.pem",
3751 private_key="auth_serv/user.key")
85774b70
JM		 3752
3753def test_ap_wpa2_eap_oom(dev, apdev):
3754 """EAP server and OOM"""
3755 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3756 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3757 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
3758
3759 with alloc_fail(hapd, 1, "eapol_auth_alloc"):
3760 # The first attempt fails, but STA will send EAPOL-Start to retry and
3761 # that succeeds.
3762 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3763 identity="tls user", ca_cert="auth_serv/ca.pem",
3764 client_cert="auth_serv/user.pem",
3765 private_key="auth_serv/user.key",
3766 scan_freq="2412")
6c4b5da4
JM		 3767
3768def check_tls_ver(dev, ap, phase1, expected):
3769 eap_connect(dev, ap, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3770 client_cert="auth_serv/user.pem",
3771 private_key="auth_serv/user.key",
3772 phase1=phase1)
3773 ver = dev.get_status_field("eap_tls_version")
3774 if ver != expected:
3775 raise Exception("Unexpected TLS version (expected %s): %s" % (expected, ver))
3776
3777def test_ap_wpa2_eap_tls_versions(dev, apdev):
3778 """EAP-TLS and TLS version configuration"""
3779 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3780 hostapd.add_ap(apdev[0]['ifname'], params)
3781
3782 tls = dev[0].request("GET tls_library")
3783 if tls.startswith("OpenSSL"):
3784 if "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
3785 check_tls_ver(dev[0], apdev[0],
3786 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1",
3787 "TLSv1.2")
2286578f
JM		 3788 elif tls.startswith("internal"):
3789 check_tls_ver(dev[0], apdev[0],
3790 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1", "TLSv1.2")
6c4b5da4
JM		 3791 check_tls_ver(dev[1], apdev[0],
3792 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_2=1", "TLSv1.1")
3793 check_tls_ver(dev[2], apdev[0],
3794 "tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1")
ecafa0cf
JM		 3795
3796def test_rsn_ie_proto_eap_sta(dev, apdev):
3797 """RSN element protocol testing for EAP cases on STA side"""
3798 bssid = apdev[0]['bssid']
3799 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3800 # This is the RSN element used normally by hostapd
3801 params['own_ie_override'] = '30140100000fac040100000fac040100000fac010c00'
3802 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3803 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
3804 identity="gpsk user",
3805 password="abcdefghijklmnop0123456789abcdef",
3806 scan_freq="2412")
3807
3808 tests = [ ('No RSN Capabilities field',
3809 '30120100000fac040100000fac040100000fac01'),
3810 ('No AKM Suite fields',
3811 '300c0100000fac040100000fac04'),
3812 ('No Pairwise Cipher Suite fields',
3813 '30060100000fac04'),
3814 ('No Group Data Cipher Suite field',
3815 '30020100') ]
3816 for txt,ie in tests:
3817 dev[0].request("DISCONNECT")
3818 dev[0].wait_disconnected()
3819 logger.info(txt)
3820 hapd.disable()
3821 hapd.set('own_ie_override', ie)
3822 hapd.enable()
3823 dev[0].request("BSS_FLUSH 0")
3824 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
3825 dev[0].select_network(id, freq=2412)
3826 dev[0].wait_connected()
f9dd43ea
JM		 3827
3828def check_tls_session_resumption_capa(dev, hapd):
3829 tls = hapd.request("GET tls_library")
3830 if not tls.startswith("OpenSSL"):
3831 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
3832
3833 tls = dev.request("GET tls_library")
3834 if not tls.startswith("OpenSSL"):
3835 raise HwsimSkip("Session resumption not supported with this TLS library: " + tls)
3836
3837def test_eap_ttls_pap_session_resumption(dev, apdev):
3838 """EAP-TTLS/PAP session resumption"""
3839 params = int_eap_server_params()
3840 params['tls_session_lifetime'] = '60'
3841 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3842 check_tls_session_resumption_capa(dev[0], hapd)
3843 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3844 anonymous_identity="ttls", password="password",
3845 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3846 phase2="auth=PAP")
3847 if dev[0].get_status_field("tls_session_reused") != '0':
3848 raise Exception("Unexpected session resumption on the first connection")
3849
3850 dev[0].request("REAUTHENTICATE")
3851 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3852 if ev is None:
3853 raise Exception("EAP success timed out")
3854 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3855 if ev is None:
3856 raise Exception("Key handshake with the AP timed out")
3857 if dev[0].get_status_field("tls_session_reused") != '1':
3858 raise Exception("Session resumption not used on the second connection")
3859
3860def test_eap_ttls_chap_session_resumption(dev, apdev):
3861 """EAP-TTLS/CHAP session resumption"""
3862 params = int_eap_server_params()
3863 params['tls_session_lifetime'] = '60'
3864 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3865 check_tls_session_resumption_capa(dev[0], hapd)
3866 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
3867 anonymous_identity="ttls", password="password",
3868 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
3869 if dev[0].get_status_field("tls_session_reused") != '0':
3870 raise Exception("Unexpected session resumption on the first connection")
3871
3872 dev[0].request("REAUTHENTICATE")
3873 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3874 if ev is None:
3875 raise Exception("EAP success timed out")
3876 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3877 if ev is None:
3878 raise Exception("Key handshake with the AP timed out")
3879 if dev[0].get_status_field("tls_session_reused") != '1':
3880 raise Exception("Session resumption not used on the second connection")
3881
3882def test_eap_ttls_mschap_session_resumption(dev, apdev):
3883 """EAP-TTLS/MSCHAP session resumption"""
e78eb404 3884 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 3885 params = int_eap_server_params()
3886 params['tls_session_lifetime'] = '60'
3887 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3888 check_tls_session_resumption_capa(dev[0], hapd)
3889 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
3890 anonymous_identity="ttls", password="password",
3891 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3892 domain_suffix_match="server.w1.fi")
3893 if dev[0].get_status_field("tls_session_reused") != '0':
3894 raise Exception("Unexpected session resumption on the first connection")
3895
3896 dev[0].request("REAUTHENTICATE")
3897 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3898 if ev is None:
3899 raise Exception("EAP success timed out")
3900 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3901 if ev is None:
3902 raise Exception("Key handshake with the AP timed out")
3903 if dev[0].get_status_field("tls_session_reused") != '1':
3904 raise Exception("Session resumption not used on the second connection")
3905
3906def test_eap_ttls_mschapv2_session_resumption(dev, apdev):
3907 """EAP-TTLS/MSCHAPv2 session resumption"""
e78eb404 3908 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 3909 check_eap_capa(dev[0], "MSCHAPV2")
3910 params = int_eap_server_params()
3911 params['tls_session_lifetime'] = '60'
3912 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3913 check_tls_session_resumption_capa(dev[0], hapd)
3914 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
3915 anonymous_identity="ttls", password="password",
3916 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3917 domain_suffix_match="server.w1.fi")
3918 if dev[0].get_status_field("tls_session_reused") != '0':
3919 raise Exception("Unexpected session resumption on the first connection")
3920
3921 dev[0].request("REAUTHENTICATE")
3922 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3923 if ev is None:
3924 raise Exception("EAP success timed out")
3925 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3926 if ev is None:
3927 raise Exception("Key handshake with the AP timed out")
3928 if dev[0].get_status_field("tls_session_reused") != '1':
3929 raise Exception("Session resumption not used on the second connection")
3930
3931def test_eap_ttls_eap_gtc_session_resumption(dev, apdev):
3932 """EAP-TTLS/EAP-GTC session resumption"""
3933 params = int_eap_server_params()
3934 params['tls_session_lifetime'] = '60'
3935 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3936 check_tls_session_resumption_capa(dev[0], hapd)
3937 eap_connect(dev[0], apdev[0], "TTLS", "user",
3938 anonymous_identity="ttls", password="password",
3939 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
3940 if dev[0].get_status_field("tls_session_reused") != '0':
3941 raise Exception("Unexpected session resumption on the first connection")
3942
3943 dev[0].request("REAUTHENTICATE")
3944 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3945 if ev is None:
3946 raise Exception("EAP success timed out")
3947 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3948 if ev is None:
3949 raise Exception("Key handshake with the AP timed out")
3950 if dev[0].get_status_field("tls_session_reused") != '1':
3951 raise Exception("Session resumption not used on the second connection")
3952
3953def test_eap_ttls_no_session_resumption(dev, apdev):
3954 """EAP-TTLS session resumption disabled on server"""
3955 params = int_eap_server_params()
3956 params['tls_session_lifetime'] = '0'
3957 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3958 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3959 anonymous_identity="ttls", password="password",
3960 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3961 phase2="auth=PAP")
3962 if dev[0].get_status_field("tls_session_reused") != '0':
3963 raise Exception("Unexpected session resumption on the first connection")
3964
3965 dev[0].request("REAUTHENTICATE")
3966 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3967 if ev is None:
3968 raise Exception("EAP success timed out")
3969 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3970 if ev is None:
3971 raise Exception("Key handshake with the AP timed out")
3972 if dev[0].get_status_field("tls_session_reused") != '0':
3973 raise Exception("Unexpected session resumption on the second connection")
3974
3975def test_eap_peap_session_resumption(dev, apdev):
3976 """EAP-PEAP session resumption"""
3977 params = int_eap_server_params()
3978 params['tls_session_lifetime'] = '60'
3979 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3980 check_tls_session_resumption_capa(dev[0], hapd)
3981 eap_connect(dev[0], apdev[0], "PEAP", "user",
3982 anonymous_identity="peap", password="password",
3983 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3984 if dev[0].get_status_field("tls_session_reused") != '0':
3985 raise Exception("Unexpected session resumption on the first connection")
3986
3987 dev[0].request("REAUTHENTICATE")
3988 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3989 if ev is None:
3990 raise Exception("EAP success timed out")
3991 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3992 if ev is None:
3993 raise Exception("Key handshake with the AP timed out")
3994 if dev[0].get_status_field("tls_session_reused") != '1':
3995 raise Exception("Session resumption not used on the second connection")
3996
81e1ab85
JM		 3997def test_eap_peap_session_resumption_crypto_binding(dev, apdev):
3998 """EAP-PEAP session resumption with crypto binding"""
3999 params = int_eap_server_params()
4000 params['tls_session_lifetime'] = '60'
4001 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4002 check_tls_session_resumption_capa(dev[0], hapd)
4003 eap_connect(dev[0], apdev[0], "PEAP", "user",
4004 anonymous_identity="peap", password="password",
4005 phase1="peapver=0 crypto_binding=2",
4006 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
4007 if dev[0].get_status_field("tls_session_reused") != '0':
4008 raise Exception("Unexpected session resumption on the first connection")
4009
4010 dev[0].request("REAUTHENTICATE")
4011 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4012 if ev is None:
4013 raise Exception("EAP success timed out")
4014 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4015 if ev is None:
4016 raise Exception("Key handshake with the AP timed out")
4017 if dev[0].get_status_field("tls_session_reused") != '1':
4018 raise Exception("Session resumption not used on the second connection")
4019
f9dd43ea
JM		 4020def test_eap_peap_no_session_resumption(dev, apdev):
4021 """EAP-PEAP session resumption disabled on server"""
4022 params = int_eap_server_params()
4023 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4024 eap_connect(dev[0], apdev[0], "PEAP", "user",
4025 anonymous_identity="peap", password="password",
4026 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
4027 if dev[0].get_status_field("tls_session_reused") != '0':
4028 raise Exception("Unexpected session resumption on the first connection")
4029
4030 dev[0].request("REAUTHENTICATE")
4031 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4032 if ev is None:
4033 raise Exception("EAP success timed out")
4034 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4035 if ev is None:
4036 raise Exception("Key handshake with the AP timed out")
4037 if dev[0].get_status_field("tls_session_reused") != '0':
4038 raise Exception("Unexpected session resumption on the second connection")
4039
4040def test_eap_tls_session_resumption(dev, apdev):
4041 """EAP-TLS session resumption"""
4042 params = int_eap_server_params()
4043 params['tls_session_lifetime'] = '60'
4044 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4045 check_tls_session_resumption_capa(dev[0], hapd)
4046 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4047 client_cert="auth_serv/user.pem",
4048 private_key="auth_serv/user.key")
4049 if dev[0].get_status_field("tls_session_reused") != '0':
4050 raise Exception("Unexpected session resumption on the first connection")
4051
4052 dev[0].request("REAUTHENTICATE")
4053 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4054 if ev is None:
4055 raise Exception("EAP success timed out")
4056 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4057 if ev is None:
4058 raise Exception("Key handshake with the AP timed out")
4059 if dev[0].get_status_field("tls_session_reused") != '1':
4060 raise Exception("Session resumption not used on the second connection")
4061
4062 dev[0].request("REAUTHENTICATE")
4063 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4064 if ev is None:
4065 raise Exception("EAP success timed out")
4066 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4067 if ev is None:
4068 raise Exception("Key handshake with the AP timed out")
4069 if dev[0].get_status_field("tls_session_reused") != '1':
4070 raise Exception("Session resumption not used on the third connection")
4071
4072def test_eap_tls_session_resumption_expiration(dev, apdev):
4073 """EAP-TLS session resumption"""
4074 params = int_eap_server_params()
4075 params['tls_session_lifetime'] = '1'
4076 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4077 check_tls_session_resumption_capa(dev[0], hapd)
4078 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4079 client_cert="auth_serv/user.pem",
4080 private_key="auth_serv/user.key")
4081 if dev[0].get_status_field("tls_session_reused") != '0':
4082 raise Exception("Unexpected session resumption on the first connection")
4083
4084 # Allow multiple attempts since OpenSSL may not expire the cached entry
4085 # immediately.
4086 for i in range(10):
4087 time.sleep(1.2)
4088
4089 dev[0].request("REAUTHENTICATE")
4090 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4091 if ev is None:
4092 raise Exception("EAP success timed out")
4093 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4094 if ev is None:
4095 raise Exception("Key handshake with the AP timed out")
4096 if dev[0].get_status_field("tls_session_reused") == '0':
4097 break
4098 if dev[0].get_status_field("tls_session_reused") != '0':
4099 raise Exception("Session resumption used after lifetime expiration")
4100
4101def test_eap_tls_no_session_resumption(dev, apdev):
4102 """EAP-TLS session resumption disabled on server"""
4103 params = int_eap_server_params()
4104 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4105 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4106 client_cert="auth_serv/user.pem",
4107 private_key="auth_serv/user.key")
4108 if dev[0].get_status_field("tls_session_reused") != '0':
4109 raise Exception("Unexpected session resumption on the first connection")
4110
4111 dev[0].request("REAUTHENTICATE")
4112 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4113 if ev is None:
4114 raise Exception("EAP success timed out")
4115 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4116 if ev is None:
4117 raise Exception("Key handshake with the AP timed out")
4118 if dev[0].get_status_field("tls_session_reused") != '0':
4119 raise Exception("Unexpected session resumption on the second connection")
4120
4121def test_eap_tls_session_resumption_radius(dev, apdev):
4122 """EAP-TLS session resumption (RADIUS)"""
4123 params = { "ssid": "as", "beacon_int": "2000",
4124 "radius_server_clients": "auth_serv/radius_clients.conf",
4125 "radius_server_auth_port": '18128',
4126 "eap_server": "1",
4127 "eap_user_file": "auth_serv/eap_user.conf",
4128 "ca_cert": "auth_serv/ca.pem",
4129 "server_cert": "auth_serv/server.pem",
4130 "private_key": "auth_serv/server.key",
4131 "tls_session_lifetime": "60" }
4132 authsrv = hostapd.add_ap(apdev[1]['ifname'], params)
4133 check_tls_session_resumption_capa(dev[0], authsrv)
4134
4135 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4136 params['auth_server_port'] = "18128"
4137 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4138 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4139 client_cert="auth_serv/user.pem",
4140 private_key="auth_serv/user.key")
4141 if dev[0].get_status_field("tls_session_reused") != '0':
4142 raise Exception("Unexpected session resumption on the first connection")
4143
4144 dev[0].request("REAUTHENTICATE")
4145 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4146 if ev is None:
4147 raise Exception("EAP success timed out")
4148 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4149 if ev is None:
4150 raise Exception("Key handshake with the AP timed out")
4151 if dev[0].get_status_field("tls_session_reused") != '1':
4152 raise Exception("Session resumption not used on the second connection")
4153
4154def test_eap_tls_no_session_resumption_radius(dev, apdev):
4155 """EAP-TLS session resumption disabled (RADIUS)"""
4156 params = { "ssid": "as", "beacon_int": "2000",
4157 "radius_server_clients": "auth_serv/radius_clients.conf",
4158 "radius_server_auth_port": '18128',
4159 "eap_server": "1",
4160 "eap_user_file": "auth_serv/eap_user.conf",
4161 "ca_cert": "auth_serv/ca.pem",
4162 "server_cert": "auth_serv/server.pem",
4163 "private_key": "auth_serv/server.key",
4164 "tls_session_lifetime": "0" }
4165 hostapd.add_ap(apdev[1]['ifname'], params)
4166
4167 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4168 params['auth_server_port'] = "18128"
4169 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4170 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4171 client_cert="auth_serv/user.pem",
4172 private_key="auth_serv/user.key")
4173 if dev[0].get_status_field("tls_session_reused") != '0':
4174 raise Exception("Unexpected session resumption on the first connection")
4175
4176 dev[0].request("REAUTHENTICATE")
4177 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4178 if ev is None:
4179 raise Exception("EAP success timed out")
4180 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4181 if ev is None:
4182 raise Exception("Key handshake with the AP timed out")
4183 if dev[0].get_status_field("tls_session_reused") != '0':
4184 raise Exception("Unexpected session resumption on the second connection")
7c0d66cf
JM		 4185
4186def test_eap_mschapv2_errors(dev, apdev):
4187 """EAP-MSCHAPv2 error cases"""
4188 check_eap_capa(dev[0], "MSCHAPV2")
4189 check_eap_capa(dev[0], "FAST")
4190
4191 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
4192 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4193 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4194 identity="phase1-user", password="password",
4195 scan_freq="2412")
4196 dev[0].request("REMOVE_NETWORK all")
4197 dev[0].wait_disconnected()
4198
4199 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
4200 (1, "nt_password_hash;mschapv2_derive_response"),
4201 (1, "nt_password_hash;=mschapv2_derive_response"),
4202 (1, "generate_nt_response;mschapv2_derive_response"),
4203 (1, "generate_authenticator_response;mschapv2_derive_response"),
4204 (1, "nt_password_hash;=mschapv2_derive_response"),
4205 (1, "get_master_key;mschapv2_derive_response"),
4206 (1, "os_get_random;eap_mschapv2_challenge_reply") ]
4207 for count, func in tests:
4208 with fail_test(dev[0], count, func):
4209 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4210 identity="phase1-user", password="password",
4211 wait_connect=False, scan_freq="2412")
4212 wait_fail_trigger(dev[0], "GET_FAIL")
4213 dev[0].request("REMOVE_NETWORK all")
4214 dev[0].wait_disconnected()
4215
4216 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
4217 (1, "hash_nt_password_hash;=mschapv2_derive_response"),
4218 (1, "generate_nt_response_pwhash;mschapv2_derive_response"),
4219 (1, "generate_authenticator_response_pwhash;mschapv2_derive_response") ]
4220 for count, func in tests:
4221 with fail_test(dev[0], count, func):
4222 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4223 identity="phase1-user",
4224 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
4225 wait_connect=False, scan_freq="2412")
4226 wait_fail_trigger(dev[0], "GET_FAIL")
4227 dev[0].request("REMOVE_NETWORK all")
4228 dev[0].wait_disconnected()
4229
4230 tests = [ (1, "eap_mschapv2_init"),
4231 (1, "eap_msg_alloc;eap_mschapv2_challenge_reply"),
4232 (1, "eap_msg_alloc;eap_mschapv2_success"),
4233 (1, "eap_mschapv2_getKey") ]
4234 for count, func in tests:
4235 with alloc_fail(dev[0], count, func):
4236 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4237 identity="phase1-user", password="password",
4238 wait_connect=False, scan_freq="2412")
4239 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4240 dev[0].request("REMOVE_NETWORK all")
4241 dev[0].wait_disconnected()
4242
4243 tests = [ (1, "eap_msg_alloc;eap_mschapv2_failure") ]
4244 for count, func in tests:
4245 with alloc_fail(dev[0], count, func):
4246 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4247 identity="phase1-user", password="wrong password",
4248 wait_connect=False, scan_freq="2412")
4249 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4250 dev[0].request("REMOVE_NETWORK all")
4251 dev[0].wait_disconnected()
4252
4253 tests = [ (2, "eap_mschapv2_init"),
4254 (3, "eap_mschapv2_init") ]
4255 for count, func in tests:
4256 with alloc_fail(dev[0], count, func):
4257 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="FAST",
4258 anonymous_identity="FAST", identity="user",
4259 password="password",
4260 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
4261 phase1="fast_provisioning=1",
4262 pac_file="blob://fast_pac",
4263 wait_connect=False, scan_freq="2412")
4264 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4265 dev[0].request("REMOVE_NETWORK all")
4266 dev[0].wait_disconnected()
bf0ec17a
JM		 4267
4268def test_eap_gpsk_errors(dev, apdev):
4269 """EAP-GPSK error cases"""
4270 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
4271 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4272 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4273 identity="gpsk user",
4274 password="abcdefghijklmnop0123456789abcdef",
4275 scan_freq="2412")
4276 dev[0].request("REMOVE_NETWORK all")
4277 dev[0].wait_disconnected()
4278
4279 tests = [ (1, "os_get_random;eap_gpsk_send_gpsk_2", None),
4280 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
4281 "cipher=1"),
4282 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
4283 "cipher=2"),
4284 (1, "eap_gpsk_derive_keys_helper", None),
4285 (2, "eap_gpsk_derive_keys_helper", None),
4286 (1, "eap_gpsk_compute_mic_aes;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
4287 "cipher=1"),
4288 (1, "hmac_sha256;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
4289 "cipher=2"),
4290 (1, "eap_gpsk_compute_mic;eap_gpsk_validate_gpsk_3_mic", None),
4291 (1, "eap_gpsk_compute_mic;eap_gpsk_send_gpsk_4", None),
4292 (1, "eap_gpsk_derive_mid_helper", None) ]
4293 for count, func, phase1 in tests:
4294 with fail_test(dev[0], count, func):
4295 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4296 identity="gpsk user",
4297 password="abcdefghijklmnop0123456789abcdef",
4298 phase1=phase1,
4299 wait_connect=False, scan_freq="2412")
4300 wait_fail_trigger(dev[0], "GET_FAIL")
4301 dev[0].request("REMOVE_NETWORK all")
4302 dev[0].wait_disconnected()
4303
4304 tests = [ (1, "eap_gpsk_init"),
4305 (2, "eap_gpsk_init"),
4306 (3, "eap_gpsk_init"),
4307 (1, "eap_gpsk_process_id_server"),
4308 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_2"),
4309 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
4310 (1, "eap_gpsk_derive_mid_helper;eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
4311 (1, "eap_gpsk_derive_keys"),
4312 (1, "eap_gpsk_derive_keys_helper"),
4313 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_4"),
4314 (1, "eap_gpsk_getKey"),
4315 (1, "eap_gpsk_get_emsk"),
4316 (1, "eap_gpsk_get_session_id") ]
4317 for count, func in tests:
4318 with alloc_fail(dev[0], count, func):
4319 dev[0].request("ERP_FLUSH")
4320 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4321 identity="gpsk user", erp="1",
4322 password="abcdefghijklmnop0123456789abcdef",
4323 wait_connect=False, scan_freq="2412")
4324 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4325 dev[0].request("REMOVE_NETWORK all")
4326 dev[0].wait_disconnected()
d4c3c055
JM		 4327
4328def test_ap_wpa2_eap_sim_db(dev, apdev, params):
4329 """EAP-SIM DB error cases"""
4330 sockpath = '/tmp/hlr_auc_gw.sock-test'
4331 try:
4332 os.remove(sockpath)
4333 except:
4334 pass
4335 hparams = int_eap_server_params()
4336 hparams['eap_sim_db'] = 'unix:' + sockpath
4337 hapd = hostapd.add_ap(apdev[0]['ifname'], hparams)
4338
4339 # Initial test with hlr_auc_gw socket not available
4340 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
4341 eap="SIM", identity="1232010000000000",
4342 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
4343 scan_freq="2412", wait_connect=False)
4344 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
4345 if ev is None:
4346 raise Exception("EAP-Failure not reported")
4347 dev[0].wait_disconnected()
4348 dev[0].request("DISCONNECT")
4349
4350 # Test with invalid responses and response timeout
4351
4352 class test_handler(SocketServer.DatagramRequestHandler):
4353 def handle(self):
4354 data = self.request[0].strip()
4355 socket = self.request[1]
4356 logger.debug("Received hlr_auc_gw request: " + data)
4357 # EAP-SIM DB: Failed to parse response string
4358 socket.sendto("FOO", self.client_address)
4359 # EAP-SIM DB: Failed to parse response string
4360 socket.sendto("FOO 1", self.client_address)
4361 # EAP-SIM DB: Unknown external response
4362 socket.sendto("FOO 1 2", self.client_address)
4363 logger.info("No proper response - wait for pending eap_sim_db request timeout")
4364
4365 server = SocketServer.UnixDatagramServer(sockpath, test_handler)
4366 server.timeout = 1
4367
4368 dev[0].select_network(id)
4369 server.handle_request()
4370 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
4371 if ev is None:
4372 raise Exception("EAP-Failure not reported")
4373 dev[0].wait_disconnected()
4374 dev[0].request("DISCONNECT")
4375
4376 # Test with a valid response
4377
4378 class test_handler2(SocketServer.DatagramRequestHandler):
4379 def handle(self):
4380 data = self.request[0].strip()
4381 socket = self.request[1]
4382 logger.debug("Received hlr_auc_gw request: " + data)
4383 fname = os.path.join(params['logdir'],
4384 'hlr_auc_gw.milenage_db')
4385 cmd = subprocess.Popen(['../../hostapd/hlr_auc_gw',
4386 '-m', fname, data],
4387 stdout=subprocess.PIPE)
4388 res = cmd.stdout.read().strip()
4389 cmd.stdout.close()
4390 logger.debug("hlr_auc_gw response: " + res)
4391 socket.sendto(res, self.client_address)
4392
4393 server.RequestHandlerClass = test_handler2
4394
4395 dev[0].select_network(id)
4396 server.handle_request()
4397 dev[0].wait_connected()
4398 dev[0].request("DISCONNECT")
4399 dev[0].wait_disconnected()
d6ba709a
JM		 4400
4401def test_eap_tls_sha512(dev, apdev, params):
4402 """EAP-TLS with SHA512 signature"""
4403 params = int_eap_server_params()
4404 params["ca_cert"] = "auth_serv/sha512-ca.pem"
4405 params["server_cert"] = "auth_serv/sha512-server.pem"
4406 params["private_key"] = "auth_serv/sha512-server.key"
4407 hostapd.add_ap(apdev[0]['ifname'], params)
4408
4409 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4410 identity="tls user sha512",
4411 ca_cert="auth_serv/sha512-ca.pem",
4412 client_cert="auth_serv/sha512-user.pem",
4413 private_key="auth_serv/sha512-user.key",
4414 scan_freq="2412")
4415 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4416 identity="tls user sha512",
4417 ca_cert="auth_serv/sha512-ca.pem",
4418 client_cert="auth_serv/sha384-user.pem",
4419 private_key="auth_serv/sha384-user.key",
4420 scan_freq="2412")
4421
4422def test_eap_tls_sha384(dev, apdev, params):
4423 """EAP-TLS with SHA384 signature"""
4424 params = int_eap_server_params()
4425 params["ca_cert"] = "auth_serv/sha512-ca.pem"
4426 params["server_cert"] = "auth_serv/sha384-server.pem"
4427 params["private_key"] = "auth_serv/sha384-server.key"
4428 hostapd.add_ap(apdev[0]['ifname'], params)
4429
4430 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4431 identity="tls user sha512",
4432 ca_cert="auth_serv/sha512-ca.pem",
4433 client_cert="auth_serv/sha512-user.pem",
4434 private_key="auth_serv/sha512-user.key",
4435 scan_freq="2412")
4436 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4437 identity="tls user sha512",
4438 ca_cert="auth_serv/sha512-ca.pem",
4439 client_cert="auth_serv/sha384-user.pem",
4440 private_key="auth_serv/sha384-user.key",
4441 scan_freq="2412")
0ceff76e
JM		 4442
4443def test_ap_wpa2_eap_assoc_rsn(dev, apdev):
4444 """WPA2-Enterprise AP and association request RSN IE differences"""
4445 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4446 hostapd.add_ap(apdev[0]['ifname'], params)
4447
4448 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap-11w")
4449 params["ieee80211w"] = "2"
4450 hostapd.add_ap(apdev[1]['ifname'], params)
4451
4452 # Success cases with optional RSN IE fields removed one by one
4453 tests = [ ("Normal wpa_supplicant assoc req RSN IE",
4454 "30140100000fac040100000fac040100000fac010000"),
4455 ("Extra PMKIDCount field in RSN IE",
4456 "30160100000fac040100000fac040100000fac0100000000"),
4457 ("Extra Group Management Cipher Suite in RSN IE",
4458 "301a0100000fac040100000fac040100000fac0100000000000fac06"),
4459 ("Extra undefined extension field in RSN IE",
4460 "301c0100000fac040100000fac040100000fac0100000000000fac061122"),
4461 ("RSN IE without RSN Capabilities",
4462 "30120100000fac040100000fac040100000fac01"),
4463 ("RSN IE without AKM", "300c0100000fac040100000fac04"),
4464 ("RSN IE without pairwise", "30060100000fac04"),
4465 ("RSN IE without group", "30020100") ]
4466 for title, ie in tests:
4467 logger.info(title)
4468 set_test_assoc_ie(dev[0], ie)
4469 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
4470 identity="gpsk user",
4471 password="abcdefghijklmnop0123456789abcdef",
4472 scan_freq="2412")
4473 dev[0].request("REMOVE_NETWORK all")
4474 dev[0].wait_disconnected()
4475
4476 tests = [ ("Normal wpa_supplicant assoc req RSN IE",
4477 "30140100000fac040100000fac040100000fac01cc00"),
4478 ("Group management cipher included in assoc req RSN IE",
4479 "301a0100000fac040100000fac040100000fac01cc000000000fac06") ]
4480 for title, ie in tests:
4481 logger.info(title)
4482 set_test_assoc_ie(dev[0], ie)
4483 dev[0].connect("test-wpa2-eap-11w", key_mgmt="WPA-EAP", ieee80211w="1",
4484 eap="GPSK", identity="gpsk user",
4485 password="abcdefghijklmnop0123456789abcdef",
4486 scan_freq="2412")
4487 dev[0].request("REMOVE_NETWORK all")
4488 dev[0].wait_disconnected()
4489
4490 tests = [ ("Invalid group cipher", "30060100000fac02", 41),
4491 ("Invalid pairwise cipher", "300c0100000fac040100000fac02", 42) ]
4492 for title, ie, status in tests:
4493 logger.info(title)
4494 set_test_assoc_ie(dev[0], ie)
4495 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
4496 identity="gpsk user",
4497 password="abcdefghijklmnop0123456789abcdef",
4498 scan_freq="2412", wait_connect=False)
4499 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"])
4500 if ev is None:
4501 raise Exception("Association rejection not reported")
4502 if "status_code=" + str(status) not in ev:
4503 raise Exception("Unexpected status code: " + ev)
4504 dev[0].request("REMOVE_NETWORK all")
4505 dev[0].dump_monitor()
4506
4507 tests = [ ("Management frame protection not enabled",
4508 "30140100000fac040100000fac040100000fac010000", 31),
4509 ("Unsupported management group cipher",
4510 "301a0100000fac040100000fac040100000fac01cc000000000fac0b", 31) ]
4511 for title, ie, status in tests:
4512 logger.info(title)
4513 set_test_assoc_ie(dev[0], ie)
4514 dev[0].connect("test-wpa2-eap-11w", key_mgmt="WPA-EAP", ieee80211w="1",
4515 eap="GPSK", identity="gpsk user",
4516 password="abcdefghijklmnop0123456789abcdef",
4517 scan_freq="2412", wait_connect=False)
4518 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"])
4519 if ev is None:
4520 raise Exception("Association rejection not reported")
4521 if "status_code=" + str(status) not in ev:
4522 raise Exception("Unexpected status code: " + ev)
4523 dev[0].request("REMOVE_NETWORK all")
4524 dev[0].dump_monitor()
ca27ee09
JM		 4525
4526def test_eap_tls_ext_cert_check(dev, apdev):
4527 """EAP-TLS and external server certification validation"""
4528 # With internal server certificate chain validation
4529 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4530 identity="tls user",
4531 ca_cert="auth_serv/ca.pem",
4532 client_cert="auth_serv/user.pem",
4533 private_key="auth_serv/user.key",
4534 phase1="tls_ext_cert_check=1", scan_freq="2412",
4535 only_add_network=True)
4536 run_ext_cert_check(dev, apdev, id)
4537
4538def test_eap_ttls_ext_cert_check(dev, apdev):
4539 """EAP-TTLS and external server certification validation"""
4540 # Without internal server certificate chain validation
4541 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4542 identity="pap user", anonymous_identity="ttls",
4543 password="password", phase2="auth=PAP",
4544 phase1="tls_ext_cert_check=1", scan_freq="2412",
4545 only_add_network=True)
4546 run_ext_cert_check(dev, apdev, id)
4547
4548def test_eap_peap_ext_cert_check(dev, apdev):
4549 """EAP-PEAP and external server certification validation"""
4550 # With internal server certificate chain validation
4551 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
4552 identity="user", anonymous_identity="peap",
4553 ca_cert="auth_serv/ca.pem",
4554 password="password", phase2="auth=MSCHAPV2",
4555 phase1="tls_ext_cert_check=1", scan_freq="2412",
4556 only_add_network=True)
4557 run_ext_cert_check(dev, apdev, id)
4558
4559def test_eap_fast_ext_cert_check(dev, apdev):
4560 """EAP-FAST and external server certification validation"""
4561 check_eap_capa(dev[0], "FAST")
4562 # With internal server certificate chain validation
4563 dev[0].request("SET blob fast_pac_auth_ext ")
4564 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
4565 identity="user", anonymous_identity="FAST",
4566 ca_cert="auth_serv/ca.pem",
4567 password="password", phase2="auth=GTC",
4568 phase1="tls_ext_cert_check=1 fast_provisioning=2",
4569 pac_file="blob://fast_pac_auth_ext",
4570 scan_freq="2412",
4571 only_add_network=True)
4572 run_ext_cert_check(dev, apdev, id)
4573
4574def run_ext_cert_check(dev, apdev, net_id):
4575 check_ext_cert_check_support(dev[0])
4576 if not openssl_imported:
4577 raise HwsimSkip("OpenSSL python method not available")
4578
4579 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4580 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4581
4582 dev[0].select_network(net_id)
4583 certs = {}
4584 while True:
4585 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT",
4586 "CTRL-REQ-EXT_CERT_CHECK",
4587 "CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4588 if ev is None:
4589 raise Exception("No peer server certificate event seen")
4590 if "CTRL-EVENT-EAP-PEER-CERT" in ev:
4591 depth = None
4592 cert = None
4593 vals = ev.split(' ')
4594 for v in vals:
4595 if v.startswith("depth="):
4596 depth = int(v.split('=')[1])
4597 elif v.startswith("cert="):
4598 cert = v.split('=')[1]
4599 if depth is not None and cert:
4600 certs[depth] = binascii.unhexlify(cert)
4601 elif "CTRL-EVENT-EAP-SUCCESS" in ev:
4602 raise Exception("Unexpected EAP-Success")
4603 elif "CTRL-REQ-EXT_CERT_CHECK" in ev:
4604 id = ev.split(':')[0].split('-')[-1]
4605 break
4606 if 0 not in certs:
4607 raise Exception("Server certificate not received")
4608 if 1 not in certs:
4609 raise Exception("Server certificate issuer not received")
4610
4611 cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1,
4612 certs[0])
4613 cn = cert.get_subject().commonName
4614 logger.info("Server certificate CN=" + cn)
4615
4616 issuer = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1,
4617 certs[1])
4618 icn = issuer.get_subject().commonName
4619 logger.info("Issuer certificate CN=" + icn)
4620
4621 if cn != "server.w1.fi":
4622 raise Exception("Unexpected server certificate CN: " + cn)
4623 if icn != "Root CA":
4624 raise Exception("Unexpected server certificate issuer CN: " + icn)
4625
4626 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=0.1)
4627 if ev:
4628 raise Exception("Unexpected EAP-Success before external check result indication")
4629
4630 dev[0].request("CTRL-RSP-EXT_CERT_CHECK-" + id + ":good")
4631 dev[0].wait_connected()
4632
4633 dev[0].request("DISCONNECT")
4634 dev[0].wait_disconnected()
4635 if "FAIL" in dev[0].request("PMKSA_FLUSH"):
4636 raise Exception("PMKSA_FLUSH failed")
4637 dev[0].request("SET blob fast_pac_auth_ext ")
4638 dev[0].request("RECONNECT")
4639
4640 ev = dev[0].wait_event(["CTRL-REQ-EXT_CERT_CHECK"], timeout=10)
4641 if ev is None:
4642 raise Exception("No peer server certificate event seen (2)")
4643 id = ev.split(':')[0].split('-')[-1]
4644 dev[0].request("CTRL-RSP-EXT_CERT_CHECK-" + id + ":bad")
4645 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
4646 if ev is None:
4647 raise Exception("EAP-Failure not reported")
4648 dev[0].request("REMOVE_NETWORK all")
4649 dev[0].wait_disconnected()
Unnamed repository; edit this file 'description' to name the repository.