]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_eap.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: hostapd eapol_version configuration
[thirdparty/hostap.git] / tests / hwsim / test_ap_eap.py
CommitLineData
eac67440 1# -*- coding: utf-8 -*-
9626962d 2# WPA2-Enterprise tests
3b51cc63 3# Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
9626962d
JM		 4#
5# This software may be distributed under the terms of the BSD license.
6# See README for more details.
7
6ea231e6 8import base64
5b3c40a6 9import binascii
9626962d
JM		 10import time
11import subprocess
12import logging
c9aa4308 13logger = logging.getLogger()
873e7c29 14import os
d4c3c055
JM		 15import socket
16import SocketServer
98d125ca
JM		 17import struct
18import tempfile
9626962d
JM		 19
20import hwsim_utils
21import hostapd
7c0d66cf 22from utils import HwsimSkip, alloc_fail, fail_test, skip_with_fips, wait_fail_trigger
52352802 23from wpasupplicant import WpaSupplicant
0ceff76e 24from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations, set_test_assoc_ie
9626962d 25
ca27ee09
JM		 26try:
27 import OpenSSL
28 openssl_imported = True
29except ImportError:
30 openssl_imported = False
31
81e787b7
JM		 32def check_hlr_auc_gw_support():
33 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
34 raise HwsimSkip("No hlr_auc_gw available")
35
3b51cc63
JM		 36def check_eap_capa(dev, method):
37 res = dev.get_capability("eap")
38 if method not in res:
39 raise HwsimSkip("EAP method %s not supported in the build" % method)
40
506b2f05
JM		 41def check_subject_match_support(dev):
42 tls = dev.request("GET tls_library")
43 if not tls.startswith("OpenSSL"):
44 raise HwsimSkip("subject_match not supported with this TLS library: " + tls)
45
46def check_altsubject_match_support(dev):
47 tls = dev.request("GET tls_library")
48 if not tls.startswith("OpenSSL"):
49 raise HwsimSkip("altsubject_match not supported with this TLS library: " + tls)
50
e78eb404
JM		 51def check_domain_match(dev):
52 tls = dev.request("GET tls_library")
53 if tls.startswith("internal"):
54 raise HwsimSkip("domain_match not supported with this TLS library: " + tls)
55
56def check_domain_suffix_match(dev):
57 tls = dev.request("GET tls_library")
58 if tls.startswith("internal"):
59 raise HwsimSkip("domain_suffix_match not supported with this TLS library: " + tls)
60
24579e70
JM		 61def check_domain_match_full(dev):
62 tls = dev.request("GET tls_library")
63 if not tls.startswith("OpenSSL"):
64 raise HwsimSkip("domain_suffix_match requires full match with this TLS library: " + tls)
65
4bf4e9db
JM		 66def check_cert_probe_support(dev):
67 tls = dev.request("GET tls_library")
0fc1b583 68 if not tls.startswith("OpenSSL") and not tls.startswith("internal"):
4bf4e9db
JM		 69 raise HwsimSkip("Certificate probing not supported with this TLS library: " + tls)
70
ca27ee09
JM		 71def check_ext_cert_check_support(dev):
72 tls = dev.request("GET tls_library")
73 if not tls.startswith("OpenSSL"):
74 raise HwsimSkip("ext_cert_check not supported with this TLS library: " + tls)
75
0dae8c99
JM		 76def check_ocsp_support(dev):
77 tls = dev.request("GET tls_library")
138903f9
JM		 78 #if tls.startswith("internal"):
79 # raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0c6185fc
JM		 80 #if "BoringSSL" in tls:
81 # raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0dae8c99 82
969e5250
JM		 83def check_pkcs5_v15_support(dev):
84 tls = dev.request("GET tls_library")
85 if "BoringSSL" in tls:
86 raise HwsimSkip("PKCS#5 v1.5 not supported with this TLS library: " + tls)
87
98d125ca
JM		 88def check_ocsp_multi_support(dev):
89 tls = dev.request("GET tls_library")
90 if not tls.startswith("internal"):
91 raise HwsimSkip("OCSP-multi not supported with this TLS library: " + tls)
92 as_hapd = hostapd.Hostapd("as")
93 res = as_hapd.request("GET tls_library")
94 del as_hapd
95 if not res.startswith("internal"):
96 raise HwsimSkip("Authentication server does not support ocsp_multi")
97
686eee77
JM		 98def check_pkcs12_support(dev):
99 tls = dev.request("GET tls_library")
16c43d2a
JM		 100 #if tls.startswith("internal"):
101 # raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
686eee77 102
404597e6
JM		 103def check_dh_dsa_support(dev):
104 tls = dev.request("GET tls_library")
105 if tls.startswith("internal"):
106 raise HwsimSkip("DH DSA not supported with this TLS library: " + tls)
107
6ea231e6
JM		 108def read_pem(fname):
109 with open(fname, "r") as f:
110 lines = f.readlines()
111 copy = False
112 cert = ""
113 for l in lines:
114 if "-----END" in l:
115 break
116 if copy:
117 cert = cert + l
118 if "-----BEGIN" in l:
119 copy = True
120 return base64.b64decode(cert)
121
3b3e2687 122def eap_connect(dev, hapd, method, identity,
6f939e59 123 sha256=False, expect_failure=False, local_error_report=False,
9dd21d51 124 maybe_local_error=False, **kwargs):
2bb9e283
JM		 125 id = dev.connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
126 eap=method, identity=identity,
6f939e59
JM		 127 wait_connect=False, scan_freq="2412", ieee80211w="1",
128 **kwargs)
f10ba3b2
JM		 129 eap_check_auth(dev, method, True, sha256=sha256,
130 expect_failure=expect_failure,
9dd21d51
JM		 131 local_error_report=local_error_report,
132 maybe_local_error=maybe_local_error)
f10ba3b2
JM		 133 if expect_failure:
134 return id
cb33ee14
JM		 135 ev = hapd.wait_event([ "AP-STA-CONNECTED" ], timeout=5)
136 if ev is None:
137 raise Exception("No connection event received from hostapd")
2bb9e283 138 return id
75b2b9cf 139
f10ba3b2 140def eap_check_auth(dev, method, initial, rsn=True, sha256=False,
9dd21d51
JM		 141 expect_failure=False, local_error_report=False,
142 maybe_local_error=False):
412c6030 143 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
9626962d
JM		 144 if ev is None:
145 raise Exception("Association and EAP start timed out")
06cdd1cd
JM		 146 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD",
147 "CTRL-EVENT-EAP-FAILURE"], timeout=10)
9626962d
JM		 148 if ev is None:
149 raise Exception("EAP method selection timed out")
06cdd1cd
JM		 150 if "CTRL-EVENT-EAP-FAILURE" in ev:
151 if maybe_local_error:
152 return
153 raise Exception("Could not select EAP method")
9626962d
JM		 154 if method not in ev:
155 raise Exception("Unexpected EAP method")
f10ba3b2
JM		 156 if expect_failure:
157 ev = dev.wait_event(["CTRL-EVENT-EAP-FAILURE"])
158 if ev is None:
159 raise Exception("EAP failure timed out")
5f35a5e2 160 ev = dev.wait_disconnected(timeout=10)
9dd21d51
JM		 161 if maybe_local_error and "locally_generated=1" in ev:
162 return
f10ba3b2
JM		 163 if not local_error_report:
164 if "reason=23" not in ev:
165 raise Exception("Proper reason code for disconnection not reported")
166 return
9626962d
JM		 167 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
168 if ev is None:
169 raise Exception("EAP success timed out")
9626962d 170
75b2b9cf
JM		 171 if initial:
172 ev = dev.wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
75b2b9cf 173 else:
bce774ad
JM		 174 ev = dev.wait_event(["WPA: Key negotiation completed"], timeout=10)
175 if ev is None:
176 raise Exception("Association with the AP timed out")
177 status = dev.get_status()
178 if status["wpa_state"] != "COMPLETED":
179 raise Exception("Connection not completed")
75b2b9cf 180
9626962d
JM		 181 if status["suppPortStatus"] != "Authorized":
182 raise Exception("Port not authorized")
447fb0b0
JM		 183 if "selectedMethod" not in status:
184 logger.info("Status: " + str(status))
185 raise Exception("No selectedMethod in status")
9626962d
JM		 186 if method not in status["selectedMethod"]:
187 raise Exception("Incorrect EAP method status")
2b005194
JM		 188 if sha256:
189 e = "WPA2-EAP-SHA256"
190 elif rsn:
71390dc8
JM		 191 e = "WPA2/IEEE 802.1X/EAP"
192 else:
193 e = "WPA/IEEE 802.1X/EAP"
194 if status["key_mgmt"] != e:
195 raise Exception("Unexpected key_mgmt status: " + status["key_mgmt"])
2fc4749c 196 return status
9626962d 197
5b1aaf6c 198def eap_reauth(dev, method, rsn=True, sha256=False, expect_failure=False):
75b2b9cf 199 dev.request("REAUTHENTICATE")
2fc4749c
JM		 200 return eap_check_auth(dev, method, False, rsn=rsn, sha256=sha256,
201 expect_failure=expect_failure)
75b2b9cf 202
9626962d
JM		 203def test_ap_wpa2_eap_sim(dev, apdev):
204 """WPA2-Enterprise connection using EAP-SIM"""
81e787b7 205 check_hlr_auc_gw_support()
9626962d 206 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 207 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 208 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
9626962d 209 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
a8375c94 210 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 211 eap_reauth(dev[0], "SIM")
9626962d 212
3b3e2687 213 eap_connect(dev[1], hapd, "SIM", "1232010000000001",
a0f350fd 214 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
3b3e2687 215 eap_connect(dev[2], hapd, "SIM", "1232010000000002",
a0f350fd
JM		 216 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
217 expect_failure=True)
218
f10ba3b2
JM		 219 logger.info("Negative test with incorrect key")
220 dev[0].request("REMOVE_NETWORK all")
3b3e2687 221 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
f10ba3b2
JM		 222 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
223 expect_failure=True)
224
32747a3e
JM		 225 logger.info("Invalid GSM-Milenage key")
226 dev[0].request("REMOVE_NETWORK all")
3b3e2687 227 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
32747a3e
JM		 228 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
229 expect_failure=True)
230
231 logger.info("Invalid GSM-Milenage key(2)")
232 dev[0].request("REMOVE_NETWORK all")
3b3e2687 233 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
32747a3e
JM		 234 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581",
235 expect_failure=True)
236
237 logger.info("Invalid GSM-Milenage key(3)")
238 dev[0].request("REMOVE_NETWORK all")
3b3e2687 239 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
32747a3e
JM		 240 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q",
241 expect_failure=True)
242
243 logger.info("Invalid GSM-Milenage key(4)")
244 dev[0].request("REMOVE_NETWORK all")
3b3e2687 245 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
32747a3e
JM		 246 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581",
247 expect_failure=True)
248
249 logger.info("Missing key configuration")
250 dev[0].request("REMOVE_NETWORK all")
3b3e2687 251 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
32747a3e
JM		 252 expect_failure=True)
253
5b1aaf6c
JM		 254def test_ap_wpa2_eap_sim_sql(dev, apdev, params):
255 """WPA2-Enterprise connection using EAP-SIM (SQL)"""
81e787b7 256 check_hlr_auc_gw_support()
5b1aaf6c
JM		 257 try:
258 import sqlite3
259 except ImportError:
81e787b7 260 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 261 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
262 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
263 params['auth_server_port'] = "1814"
3b3e2687
JD		 264 hapd = hostapd.add_ap(apdev[0], params)
265 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
5b1aaf6c
JM		 266 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
267
268 logger.info("SIM fast re-authentication")
269 eap_reauth(dev[0], "SIM")
270
271 logger.info("SIM full auth with pseudonym")
272 with con:
273 cur = con.cursor()
274 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
275 eap_reauth(dev[0], "SIM")
276
277 logger.info("SIM full auth with permanent identity")
278 with con:
279 cur = con.cursor()
280 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
281 cur.execute("DELETE FROM pseudonyms WHERE permanent='1232010000000000'")
282 eap_reauth(dev[0], "SIM")
283
284 logger.info("SIM reauth with mismatching MK")
285 with con:
286 cur = con.cursor()
287 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='1232010000000000'")
288 eap_reauth(dev[0], "SIM", expect_failure=True)
289 dev[0].request("REMOVE_NETWORK all")
290
3b3e2687 291 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
5b1aaf6c
JM		 292 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
293 with con:
294 cur = con.cursor()
295 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
296 eap_reauth(dev[0], "SIM")
297 with con:
298 cur = con.cursor()
299 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
300 logger.info("SIM reauth with mismatching counter")
301 eap_reauth(dev[0], "SIM")
302 dev[0].request("REMOVE_NETWORK all")
303
3b3e2687 304 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
5b1aaf6c
JM		 305 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
306 with con:
307 cur = con.cursor()
308 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='1232010000000000'")
309 logger.info("SIM reauth with max reauth count reached")
310 eap_reauth(dev[0], "SIM")
311
e2a90a4c
JM		 312def test_ap_wpa2_eap_sim_config(dev, apdev):
313 """EAP-SIM configuration options"""
314 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 315 hapd = hostapd.add_ap(apdev[0], params)
e2a90a4c
JM		 316 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
317 identity="1232010000000000",
318 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
319 phase1="sim_min_num_chal=1",
320 wait_connect=False, scan_freq="2412")
321 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
322 if ev is None:
323 raise Exception("No EAP error message seen")
324 dev[0].request("REMOVE_NETWORK all")
325
326 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
327 identity="1232010000000000",
328 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
329 phase1="sim_min_num_chal=4",
330 wait_connect=False, scan_freq="2412")
331 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
332 if ev is None:
333 raise Exception("No EAP error message seen (2)")
334 dev[0].request("REMOVE_NETWORK all")
335
3b3e2687 336 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
e2a90a4c
JM		 337 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
338 phase1="sim_min_num_chal=2")
3b3e2687 339 eap_connect(dev[1], hapd, "SIM", "1232010000000000",
e2a90a4c
JM		 340 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
341 anonymous_identity="345678")
342
72cbc684
JM		 343def test_ap_wpa2_eap_sim_ext(dev, apdev):
344 """WPA2-Enterprise connection using EAP-SIM and external GSM auth"""
47dcb118 345 try:
81e787b7 346 _test_ap_wpa2_eap_sim_ext(dev, apdev)
47dcb118
JM		 347 finally:
348 dev[0].request("SET external_sim 0")
349
350def _test_ap_wpa2_eap_sim_ext(dev, apdev):
81e787b7 351 check_hlr_auc_gw_support()
72cbc684 352 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 353 hostapd.add_ap(apdev[0], params)
72cbc684
JM		 354 dev[0].request("SET external_sim 1")
355 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
356 identity="1232010000000000",
357 wait_connect=False, scan_freq="2412")
358 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
359 if ev is None:
360 raise Exception("Network connected timed out")
361
362 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
363 if ev is None:
364 raise Exception("Wait for external SIM processing request timed out")
365 p = ev.split(':', 2)
366 if p[1] != "GSM-AUTH":
367 raise Exception("Unexpected CTRL-REQ-SIM type")
368 rid = p[0].split('-')[3]
369
370 # IK:CK:RES
371 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
372 # This will fail during processing, but the ctrl_iface command succeeds
373 dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTH:" + resp)
374 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
375 if ev is None:
376 raise Exception("EAP failure not reported")
377 dev[0].request("DISCONNECT")
90ad11e6
JM		 378 dev[0].wait_disconnected()
379 time.sleep(0.1)
72cbc684
JM		 380
381 dev[0].select_network(id, freq="2412")
382 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
383 if ev is None:
384 raise Exception("Wait for external SIM processing request timed out")
385 p = ev.split(':', 2)
386 if p[1] != "GSM-AUTH":
387 raise Exception("Unexpected CTRL-REQ-SIM type")
388 rid = p[0].split('-')[3]
389 # This will fail during GSM auth validation
390 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:q"):
391 raise Exception("CTRL-RSP-SIM failed")
392 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
393 if ev is None:
394 raise Exception("EAP failure not reported")
395 dev[0].request("DISCONNECT")
90ad11e6
JM		 396 dev[0].wait_disconnected()
397 time.sleep(0.1)
72cbc684
JM		 398
399 dev[0].select_network(id, freq="2412")
400 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
401 if ev is None:
402 raise Exception("Wait for external SIM processing request timed out")
403 p = ev.split(':', 2)
404 if p[1] != "GSM-AUTH":
405 raise Exception("Unexpected CTRL-REQ-SIM type")
406 rid = p[0].split('-')[3]
407 # This will fail during GSM auth validation
408 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:34"):
409 raise Exception("CTRL-RSP-SIM failed")
410 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
411 if ev is None:
412 raise Exception("EAP failure not reported")
413 dev[0].request("DISCONNECT")
90ad11e6
JM		 414 dev[0].wait_disconnected()
415 time.sleep(0.1)
72cbc684
JM		 416
417 dev[0].select_network(id, freq="2412")
418 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
419 if ev is None:
420 raise Exception("Wait for external SIM processing request timed out")
421 p = ev.split(':', 2)
422 if p[1] != "GSM-AUTH":
423 raise Exception("Unexpected CTRL-REQ-SIM type")
424 rid = p[0].split('-')[3]
425 # This will fail during GSM auth validation
426 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677"):
427 raise Exception("CTRL-RSP-SIM failed")
428 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
429 if ev is None:
430 raise Exception("EAP failure not reported")
431 dev[0].request("DISCONNECT")
90ad11e6
JM		 432 dev[0].wait_disconnected()
433 time.sleep(0.1)
72cbc684
JM		 434
435 dev[0].select_network(id, freq="2412")
436 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
437 if ev is None:
438 raise Exception("Wait for external SIM processing request timed out")
439 p = ev.split(':', 2)
440 if p[1] != "GSM-AUTH":
441 raise Exception("Unexpected CTRL-REQ-SIM type")
442 rid = p[0].split('-')[3]
443 # This will fail during GSM auth validation
444 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:q"):
445 raise Exception("CTRL-RSP-SIM failed")
446 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
447 if ev is None:
448 raise Exception("EAP failure not reported")
449 dev[0].request("DISCONNECT")
90ad11e6
JM		 450 dev[0].wait_disconnected()
451 time.sleep(0.1)
72cbc684
JM		 452
453 dev[0].select_network(id, freq="2412")
454 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
455 if ev is None:
456 raise Exception("Wait for external SIM processing request timed out")
457 p = ev.split(':', 2)
458 if p[1] != "GSM-AUTH":
459 raise Exception("Unexpected CTRL-REQ-SIM type")
460 rid = p[0].split('-')[3]
461 # This will fail during GSM auth validation
462 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233"):
463 raise Exception("CTRL-RSP-SIM failed")
464 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
465 if ev is None:
466 raise Exception("EAP failure not reported")
467 dev[0].request("DISCONNECT")
90ad11e6
JM		 468 dev[0].wait_disconnected()
469 time.sleep(0.1)
72cbc684
JM		 470
471 dev[0].select_network(id, freq="2412")
472 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
473 if ev is None:
474 raise Exception("Wait for external SIM processing request timed out")
475 p = ev.split(':', 2)
476 if p[1] != "GSM-AUTH":
477 raise Exception("Unexpected CTRL-REQ-SIM type")
478 rid = p[0].split('-')[3]
479 # This will fail during GSM auth validation
480 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233:q"):
481 raise Exception("CTRL-RSP-SIM failed")
482 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
483 if ev is None:
484 raise Exception("EAP failure not reported")
485
40c654cc
JM		 486def test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev):
487 """EAP-SIM with external GSM auth and replacing SIM without clearing pseudonym id"""
488 try:
489 _test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev)
490 finally:
491 dev[0].request("SET external_sim 0")
492
493def _test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev):
494 check_hlr_auc_gw_support()
495 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 496 hostapd.add_ap(apdev[0], params)
40c654cc
JM		 497 dev[0].request("SET external_sim 1")
498 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
499 identity="1232010000000000",
500 wait_connect=False, scan_freq="2412")
501
502 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
503 if ev is None:
504 raise Exception("Wait for external SIM processing request timed out")
505 p = ev.split(':', 2)
506 if p[1] != "GSM-AUTH":
507 raise Exception("Unexpected CTRL-REQ-SIM type")
508 rid = p[0].split('-')[3]
509 rand = p[2].split(' ')[0]
510
511 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
512 "-m",
513 "auth_serv/hlr_auc_gw.milenage_db",
514 "GSM-AUTH-REQ 232010000000000 " + rand])
515 if "GSM-AUTH-RESP" not in res:
516 raise Exception("Unexpected hlr_auc_gw response")
517 resp = res.split(' ')[2].rstrip()
518
519 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
520 dev[0].wait_connected(timeout=15)
521 dev[0].request("DISCONNECT")
522 dev[0].wait_disconnected()
523
524 # Replace SIM, but forget to drop the previous pseudonym identity
525 dev[0].set_network_quoted(id, "identity", "1232010000000009")
526 dev[0].select_network(id, freq="2412")
527
528 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
529 if ev is None:
530 raise Exception("Wait for external SIM processing request timed out")
531 p = ev.split(':', 2)
532 if p[1] != "GSM-AUTH":
533 raise Exception("Unexpected CTRL-REQ-SIM type")
534 rid = p[0].split('-')[3]
535 rand = p[2].split(' ')[0]
536
537 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
538 "-m",
539 "auth_serv/hlr_auc_gw.milenage_db",
540 "GSM-AUTH-REQ 232010000000009 " + rand])
541 if "GSM-AUTH-RESP" not in res:
542 raise Exception("Unexpected hlr_auc_gw response")
543 resp = res.split(' ')[2].rstrip()
544
545 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
546 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
547 if ev is None:
548 raise Exception("EAP-Failure not reported")
549 dev[0].request("DISCONNECT")
550 dev[0].wait_disconnected()
551
552def test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev):
553 """EAP-SIM with external GSM auth and replacing SIM and clearing pseudonym identity"""
554 try:
555 _test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev)
556 finally:
557 dev[0].request("SET external_sim 0")
558
559def _test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev):
560 check_hlr_auc_gw_support()
561 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 562 hostapd.add_ap(apdev[0], params)
40c654cc
JM		 563 dev[0].request("SET external_sim 1")
564 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
565 identity="1232010000000000",
566 wait_connect=False, scan_freq="2412")
567
568 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
569 if ev is None:
570 raise Exception("Wait for external SIM processing request timed out")
571 p = ev.split(':', 2)
572 if p[1] != "GSM-AUTH":
573 raise Exception("Unexpected CTRL-REQ-SIM type")
574 rid = p[0].split('-')[3]
575 rand = p[2].split(' ')[0]
576
577 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
578 "-m",
579 "auth_serv/hlr_auc_gw.milenage_db",
580 "GSM-AUTH-REQ 232010000000000 " + rand])
581 if "GSM-AUTH-RESP" not in res:
582 raise Exception("Unexpected hlr_auc_gw response")
583 resp = res.split(' ')[2].rstrip()
584
585 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
586 dev[0].wait_connected(timeout=15)
587 dev[0].request("DISCONNECT")
588 dev[0].wait_disconnected()
589
590 # Replace SIM and drop the previous pseudonym identity
591 dev[0].set_network_quoted(id, "identity", "1232010000000009")
592 dev[0].set_network(id, "anonymous_identity", "NULL")
593 dev[0].select_network(id, freq="2412")
594
595 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
596 if ev is None:
597 raise Exception("Wait for external SIM processing request timed out")
598 p = ev.split(':', 2)
599 if p[1] != "GSM-AUTH":
600 raise Exception("Unexpected CTRL-REQ-SIM type")
601 rid = p[0].split('-')[3]
602 rand = p[2].split(' ')[0]
603
604 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
605 "-m",
606 "auth_serv/hlr_auc_gw.milenage_db",
607 "GSM-AUTH-REQ 232010000000009 " + rand])
608 if "GSM-AUTH-RESP" not in res:
609 raise Exception("Unexpected hlr_auc_gw response")
610 resp = res.split(' ')[2].rstrip()
611
612 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
613 dev[0].wait_connected()
614 dev[0].request("DISCONNECT")
615 dev[0].wait_disconnected()
616
617def test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev):
618 """EAP-SIM with external GSM auth, replacing SIM, and no identity in config"""
619 try:
620 _test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev)
621 finally:
622 dev[0].request("SET external_sim 0")
623
624def _test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev):
625 check_hlr_auc_gw_support()
626 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 627 hostapd.add_ap(apdev[0], params)
40c654cc
JM		 628 dev[0].request("SET external_sim 1")
629 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
630 wait_connect=False, scan_freq="2412")
631
632 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
633 if ev is None:
634 raise Exception("Request for identity timed out")
635 rid = ev.split(':')[0].split('-')[-1]
636 dev[0].request("CTRL-RSP-IDENTITY-" + rid + ":1232010000000000")
637
638 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
639 if ev is None:
640 raise Exception("Wait for external SIM processing request timed out")
641 p = ev.split(':', 2)
642 if p[1] != "GSM-AUTH":
643 raise Exception("Unexpected CTRL-REQ-SIM type")
644 rid = p[0].split('-')[3]
645 rand = p[2].split(' ')[0]
646
647 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
648 "-m",
649 "auth_serv/hlr_auc_gw.milenage_db",
650 "GSM-AUTH-REQ 232010000000000 " + rand])
651 if "GSM-AUTH-RESP" not in res:
652 raise Exception("Unexpected hlr_auc_gw response")
653 resp = res.split(' ')[2].rstrip()
654
655 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
656 dev[0].wait_connected(timeout=15)
657 dev[0].request("DISCONNECT")
658 dev[0].wait_disconnected()
659
660 # Replace SIM and drop the previous permanent and pseudonym identities
661 dev[0].set_network(id, "identity", "NULL")
662 dev[0].set_network(id, "anonymous_identity", "NULL")
663 dev[0].select_network(id, freq="2412")
664
665 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
666 if ev is None:
667 raise Exception("Request for identity timed out")
668 rid = ev.split(':')[0].split('-')[-1]
669 dev[0].request("CTRL-RSP-IDENTITY-" + rid + ":1232010000000009")
670
671 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
672 if ev is None:
673 raise Exception("Wait for external SIM processing request timed out")
674 p = ev.split(':', 2)
675 if p[1] != "GSM-AUTH":
676 raise Exception("Unexpected CTRL-REQ-SIM type")
677 rid = p[0].split('-')[3]
678 rand = p[2].split(' ')[0]
679
680 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
681 "-m",
682 "auth_serv/hlr_auc_gw.milenage_db",
683 "GSM-AUTH-REQ 232010000000009 " + rand])
684 if "GSM-AUTH-RESP" not in res:
685 raise Exception("Unexpected hlr_auc_gw response")
686 resp = res.split(' ')[2].rstrip()
687
688 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
689 dev[0].wait_connected()
690 dev[0].request("DISCONNECT")
691 dev[0].wait_disconnected()
692
c397edf2
JM		 693def test_ap_wpa2_eap_sim_ext_auth_fail(dev, apdev):
694 """EAP-SIM with external GSM auth and auth failing"""
695 try:
696 _test_ap_wpa2_eap_sim_ext_auth_fail(dev, apdev)
697 finally:
698 dev[0].request("SET external_sim 0")
699
700def _test_ap_wpa2_eap_sim_ext_auth_fail(dev, apdev):
701 check_hlr_auc_gw_support()
702 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 703 hostapd.add_ap(apdev[0], params)
c397edf2
JM		 704 dev[0].request("SET external_sim 1")
705 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
706 identity="1232010000000000",
707 wait_connect=False, scan_freq="2412")
708
709 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
710 if ev is None:
711 raise Exception("Wait for external SIM processing request timed out")
712 p = ev.split(':', 2)
713 rid = p[0].split('-')[3]
714 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-FAIL")
715 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
716 if ev is None:
717 raise Exception("EAP failure not reported")
718 dev[0].request("REMOVE_NETWORK all")
719 dev[0].wait_disconnected()
720
6c7fed46
JM		 721def test_ap_wpa2_eap_sim_change_bssid(dev, apdev):
722 """EAP-SIM and external GSM auth to check fast reauth with bssid change"""
723 try:
724 _test_ap_wpa2_eap_sim_change_bssid(dev, apdev)
725 finally:
726 dev[0].request("SET external_sim 0")
727
728def _test_ap_wpa2_eap_sim_change_bssid(dev, apdev):
729 check_hlr_auc_gw_support()
730 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 731 hostapd.add_ap(apdev[0], params)
6c7fed46
JM		 732 dev[0].request("SET external_sim 1")
733 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
734 identity="1232010000000000",
735 wait_connect=False, scan_freq="2412")
736
737 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
738 if ev is None:
739 raise Exception("Wait for external SIM processing request timed out")
740 p = ev.split(':', 2)
741 if p[1] != "GSM-AUTH":
742 raise Exception("Unexpected CTRL-REQ-SIM type")
743 rid = p[0].split('-')[3]
744 rand = p[2].split(' ')[0]
745
746 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
747 "-m",
748 "auth_serv/hlr_auc_gw.milenage_db",
749 "GSM-AUTH-REQ 232010000000000 " + rand])
750 if "GSM-AUTH-RESP" not in res:
751 raise Exception("Unexpected hlr_auc_gw response")
752 resp = res.split(' ')[2].rstrip()
753
754 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
755 dev[0].wait_connected(timeout=15)
756
757 # Verify that EAP-SIM Reauthentication can be used after a profile change
758 # that does not affect EAP parameters.
759 dev[0].set_network(id, "bssid", "any")
760 eap_reauth(dev[0], "SIM")
761
07f0da30
JM		 762def test_ap_wpa2_eap_sim_no_change_set(dev, apdev):
763 """EAP-SIM and external GSM auth to check fast reauth with no-change SET_NETWORK"""
764 try:
765 _test_ap_wpa2_eap_sim_no_change_set(dev, apdev)
766 finally:
767 dev[0].request("SET external_sim 0")
768
769def _test_ap_wpa2_eap_sim_no_change_set(dev, apdev):
770 check_hlr_auc_gw_support()
771 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 772 hostapd.add_ap(apdev[0], params)
07f0da30
JM		 773 dev[0].request("SET external_sim 1")
774 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
775 identity="1232010000000000",
776 wait_connect=False, scan_freq="2412")
777
778 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
779 if ev is None:
780 raise Exception("Wait for external SIM processing request timed out")
781 p = ev.split(':', 2)
782 if p[1] != "GSM-AUTH":
783 raise Exception("Unexpected CTRL-REQ-SIM type")
784 rid = p[0].split('-')[3]
785 rand = p[2].split(' ')[0]
786
787 res = subprocess.check_output(["../../hostapd/hlr_auc_gw",
788 "-m",
789 "auth_serv/hlr_auc_gw.milenage_db",
790 "GSM-AUTH-REQ 232010000000000 " + rand])
791 if "GSM-AUTH-RESP" not in res:
792 raise Exception("Unexpected hlr_auc_gw response")
793 resp = res.split(' ')[2].rstrip()
794
795 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
796 dev[0].wait_connected(timeout=15)
797
798 # Verify that EAP-SIM Reauthentication can be used after network profile
799 # SET_NETWORK commands that do not actually change previously set
800 # parameter values.
801 dev[0].set_network(id, "key_mgmt", "WPA-EAP")
802 dev[0].set_network(id, "eap", "SIM")
803 dev[0].set_network_quoted(id, "identity", "1232010000000000")
804 dev[0].set_network_quoted(id, "ssid", "test-wpa2-eap")
805 eap_reauth(dev[0], "SIM")
806
486f4e3c
JM		 807def test_ap_wpa2_eap_sim_oom(dev, apdev):
808 """EAP-SIM and OOM"""
809 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 810 hostapd.add_ap(apdev[0], params)
486f4e3c
JM		 811 tests = [ (1, "milenage_f2345"),
812 (2, "milenage_f2345"),
813 (3, "milenage_f2345"),
814 (4, "milenage_f2345"),
815 (5, "milenage_f2345"),
816 (6, "milenage_f2345"),
817 (7, "milenage_f2345"),
818 (8, "milenage_f2345"),
819 (9, "milenage_f2345"),
820 (10, "milenage_f2345"),
821 (11, "milenage_f2345"),
822 (12, "milenage_f2345") ]
823 for count, func in tests:
7cbc8e67 824 with fail_test(dev[0], count, func):
486f4e3c
JM		 825 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
826 identity="1232010000000000",
827 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
828 wait_connect=False, scan_freq="2412")
829 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
830 if ev is None:
831 raise Exception("EAP method not selected")
832 dev[0].wait_disconnected()
833 dev[0].request("REMOVE_NETWORK all")
834
9626962d
JM		 835def test_ap_wpa2_eap_aka(dev, apdev):
836 """WPA2-Enterprise connection using EAP-AKA"""
81e787b7 837 check_hlr_auc_gw_support()
9626962d 838 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 839 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 840 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
9626962d 841 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
a8375c94 842 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 843 eap_reauth(dev[0], "AKA")
9626962d 844
f10ba3b2
JM		 845 logger.info("Negative test with incorrect key")
846 dev[0].request("REMOVE_NETWORK all")
3b3e2687 847 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
f10ba3b2
JM		 848 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
849 expect_failure=True)
850
32747a3e
JM		 851 logger.info("Invalid Milenage key")
852 dev[0].request("REMOVE_NETWORK all")
3b3e2687 853 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 854 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
855 expect_failure=True)
856
857 logger.info("Invalid Milenage key(2)")
3b3e2687 858 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 859 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581:000000000123",
860 expect_failure=True)
861
862 logger.info("Invalid Milenage key(3)")
3b3e2687 863 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 864 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q:000000000123",
865 expect_failure=True)
866
867 logger.info("Invalid Milenage key(4)")
3b3e2687 868 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 869 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:00000000012q",
870 expect_failure=True)
871
872 logger.info("Invalid Milenage key(5)")
873 dev[0].request("REMOVE_NETWORK all")
3b3e2687 874 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 875 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581q000000000123",
876 expect_failure=True)
877
878 logger.info("Invalid Milenage key(6)")
879 dev[0].request("REMOVE_NETWORK all")
3b3e2687 880 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 881 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581q000000000123",
882 expect_failure=True)
883
884 logger.info("Missing key configuration")
885 dev[0].request("REMOVE_NETWORK all")
3b3e2687 886 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
32747a3e
JM		 887 expect_failure=True)
888
5b1aaf6c
JM		 889def test_ap_wpa2_eap_aka_sql(dev, apdev, params):
890 """WPA2-Enterprise connection using EAP-AKA (SQL)"""
81e787b7 891 check_hlr_auc_gw_support()
5b1aaf6c
JM		 892 try:
893 import sqlite3
894 except ImportError:
81e787b7 895 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 896 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
897 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
898 params['auth_server_port'] = "1814"
3b3e2687
JD		 899 hapd = hostapd.add_ap(apdev[0], params)
900 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
5b1aaf6c
JM		 901 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
902
903 logger.info("AKA fast re-authentication")
904 eap_reauth(dev[0], "AKA")
905
906 logger.info("AKA full auth with pseudonym")
907 with con:
908 cur = con.cursor()
909 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
910 eap_reauth(dev[0], "AKA")
911
912 logger.info("AKA full auth with permanent identity")
913 with con:
914 cur = con.cursor()
915 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
916 cur.execute("DELETE FROM pseudonyms WHERE permanent='0232010000000000'")
917 eap_reauth(dev[0], "AKA")
918
919 logger.info("AKA reauth with mismatching MK")
920 with con:
921 cur = con.cursor()
922 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='0232010000000000'")
923 eap_reauth(dev[0], "AKA", expect_failure=True)
924 dev[0].request("REMOVE_NETWORK all")
925
3b3e2687 926 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
5b1aaf6c
JM		 927 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
928 with con:
929 cur = con.cursor()
930 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
931 eap_reauth(dev[0], "AKA")
932 with con:
933 cur = con.cursor()
934 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
935 logger.info("AKA reauth with mismatching counter")
936 eap_reauth(dev[0], "AKA")
937 dev[0].request("REMOVE_NETWORK all")
938
3b3e2687 939 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
5b1aaf6c
JM		 940 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
941 with con:
942 cur = con.cursor()
943 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='0232010000000000'")
944 logger.info("AKA reauth with max reauth count reached")
945 eap_reauth(dev[0], "AKA")
946
e2a90a4c
JM		 947def test_ap_wpa2_eap_aka_config(dev, apdev):
948 """EAP-AKA configuration options"""
949 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 950 hapd = hostapd.add_ap(apdev[0], params)
951 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
e2a90a4c
JM		 952 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
953 anonymous_identity="2345678")
954
d314bedf
JM		 955def test_ap_wpa2_eap_aka_ext(dev, apdev):
956 """WPA2-Enterprise connection using EAP-AKA and external UMTS auth"""
47dcb118 957 try:
81e787b7 958 _test_ap_wpa2_eap_aka_ext(dev, apdev)
47dcb118
JM		 959 finally:
960 dev[0].request("SET external_sim 0")
961
962def _test_ap_wpa2_eap_aka_ext(dev, apdev):
81e787b7 963 check_hlr_auc_gw_support()
d314bedf 964 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 965 hostapd.add_ap(apdev[0], params)
d314bedf
JM		 966 dev[0].request("SET external_sim 1")
967 id = dev[0].connect("test-wpa2-eap", eap="AKA", key_mgmt="WPA-EAP",
968 identity="0232010000000000",
969 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
970 wait_connect=False, scan_freq="2412")
971 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
972 if ev is None:
973 raise Exception("Network connected timed out")
974
975 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
976 if ev is None:
977 raise Exception("Wait for external SIM processing request timed out")
978 p = ev.split(':', 2)
979 if p[1] != "UMTS-AUTH":
980 raise Exception("Unexpected CTRL-REQ-SIM type")
981 rid = p[0].split('-')[3]
982
983 # IK:CK:RES
984 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
985 # This will fail during processing, but the ctrl_iface command succeeds
986 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
987 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
988 if ev is None:
989 raise Exception("EAP failure not reported")
990 dev[0].request("DISCONNECT")
584e4197 991 dev[0].wait_disconnected()
90ad11e6 992 time.sleep(0.1)
a359c7bb 993 dev[0].dump_monitor()
d314bedf 994
d8e02214
JM		 995 dev[0].select_network(id, freq="2412")
996 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
997 if ev is None:
998 raise Exception("Wait for external SIM processing request timed out")
999 p = ev.split(':', 2)
1000 if p[1] != "UMTS-AUTH":
1001 raise Exception("Unexpected CTRL-REQ-SIM type")
1002 rid = p[0].split('-')[3]
1003 # This will fail during UMTS auth validation
1004 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:112233445566778899aabbccddee"):
1005 raise Exception("CTRL-RSP-SIM failed")
1006 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
1007 if ev is None:
1008 raise Exception("Wait for external SIM processing request timed out")
1009 p = ev.split(':', 2)
1010 if p[1] != "UMTS-AUTH":
1011 raise Exception("Unexpected CTRL-REQ-SIM type")
1012 rid = p[0].split('-')[3]
1013 # This will fail during UMTS auth validation
1014 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:12"):
1015 raise Exception("CTRL-RSP-SIM failed")
1016 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
1017 if ev is None:
1018 raise Exception("EAP failure not reported")
1019 dev[0].request("DISCONNECT")
584e4197 1020 dev[0].wait_disconnected()
90ad11e6 1021 time.sleep(0.1)
a359c7bb 1022 dev[0].dump_monitor()
d8e02214 1023
0258cf10
JM		 1024 tests = [ ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344",
1025 ":UMTS-AUTH:34",
1026 ":UMTS-AUTH:00112233445566778899aabbccddeeff.00112233445566778899aabbccddeeff:0011223344",
1027 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddee:0011223344",
1028 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff.0011223344",
1029 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff0011223344",
1030 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:001122334q" ]
1031 for t in tests:
1032 dev[0].select_network(id, freq="2412")
1033 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
1034 if ev is None:
1035 raise Exception("Wait for external SIM processing request timed out")
1036 p = ev.split(':', 2)
1037 if p[1] != "UMTS-AUTH":
1038 raise Exception("Unexpected CTRL-REQ-SIM type")
1039 rid = p[0].split('-')[3]
1040 # This will fail during UMTS auth validation
1041 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + t):
1042 raise Exception("CTRL-RSP-SIM failed")
1043 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
1044 if ev is None:
1045 raise Exception("EAP failure not reported")
1046 dev[0].request("DISCONNECT")
1047 dev[0].wait_disconnected()
90ad11e6 1048 time.sleep(0.1)
a359c7bb 1049 dev[0].dump_monitor()
d314bedf 1050
c397edf2
JM		 1051def test_ap_wpa2_eap_aka_ext_auth_fail(dev, apdev):
1052 """EAP-AKA with external UMTS auth and auth failing"""
1053 try:
1054 _test_ap_wpa2_eap_aka_ext_auth_fail(dev, apdev)
1055 finally:
1056 dev[0].request("SET external_sim 0")
1057
1058def _test_ap_wpa2_eap_aka_ext_auth_fail(dev, apdev):
1059 check_hlr_auc_gw_support()
1060 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1061 hostapd.add_ap(apdev[0], params)
c397edf2
JM		 1062 dev[0].request("SET external_sim 1")
1063 id = dev[0].connect("test-wpa2-eap", eap="AKA", key_mgmt="WPA-EAP",
1064 identity="0232010000000000",
1065 wait_connect=False, scan_freq="2412")
1066
1067 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
1068 if ev is None:
1069 raise Exception("Wait for external SIM processing request timed out")
1070 p = ev.split(':', 2)
1071 rid = p[0].split('-')[3]
1072 dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-FAIL")
1073 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
1074 if ev is None:
1075 raise Exception("EAP failure not reported")
1076 dev[0].request("REMOVE_NETWORK all")
1077 dev[0].wait_disconnected()
1078
9626962d
JM		 1079def test_ap_wpa2_eap_aka_prime(dev, apdev):
1080 """WPA2-Enterprise connection using EAP-AKA'"""
81e787b7 1081 check_hlr_auc_gw_support()
9626962d 1082 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1083 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1084 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
9626962d 1085 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
a8375c94 1086 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1087 eap_reauth(dev[0], "AKA'")
9626962d 1088
8583d664
JM		 1089 logger.info("EAP-AKA' bidding protection when EAP-AKA enabled as well")
1090 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="AKA' AKA",
1091 identity="6555444333222111@both",
1092 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
1093 wait_connect=False, scan_freq="2412")
5f35a5e2 1094 dev[1].wait_connected(timeout=15)
8583d664 1095
f10ba3b2
JM		 1096 logger.info("Negative test with incorrect key")
1097 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1098 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
f10ba3b2
JM		 1099 password="ff22250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
1100 expect_failure=True)
1101
5b1aaf6c
JM		 1102def test_ap_wpa2_eap_aka_prime_sql(dev, apdev, params):
1103 """WPA2-Enterprise connection using EAP-AKA' (SQL)"""
81e787b7 1104 check_hlr_auc_gw_support()
5b1aaf6c
JM		 1105 try:
1106 import sqlite3
1107 except ImportError:
81e787b7 1108 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 1109 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
1110 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1111 params['auth_server_port'] = "1814"
3b3e2687
JD		 1112 hapd = hostapd.add_ap(apdev[0], params)
1113 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
5b1aaf6c
JM		 1114 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
1115
1116 logger.info("AKA' fast re-authentication")
1117 eap_reauth(dev[0], "AKA'")
1118
1119 logger.info("AKA' full auth with pseudonym")
1120 with con:
1121 cur = con.cursor()
1122 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
1123 eap_reauth(dev[0], "AKA'")
1124
1125 logger.info("AKA' full auth with permanent identity")
1126 with con:
1127 cur = con.cursor()
1128 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
1129 cur.execute("DELETE FROM pseudonyms WHERE permanent='6555444333222111'")
1130 eap_reauth(dev[0], "AKA'")
1131
1132 logger.info("AKA' reauth with mismatching k_aut")
1133 with con:
1134 cur = con.cursor()
1135 cur.execute("UPDATE reauth SET k_aut='0000000000000000000000000000000000000000000000000000000000000000' WHERE permanent='6555444333222111'")
1136 eap_reauth(dev[0], "AKA'", expect_failure=True)
1137 dev[0].request("REMOVE_NETWORK all")
1138
3b3e2687 1139 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
5b1aaf6c
JM		 1140 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
1141 with con:
1142 cur = con.cursor()
1143 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
1144 eap_reauth(dev[0], "AKA'")
1145 with con:
1146 cur = con.cursor()
1147 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
1148 logger.info("AKA' reauth with mismatching counter")
1149 eap_reauth(dev[0], "AKA'")
1150 dev[0].request("REMOVE_NETWORK all")
1151
3b3e2687 1152 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
5b1aaf6c
JM		 1153 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
1154 with con:
1155 cur = con.cursor()
1156 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='6555444333222111'")
1157 logger.info("AKA' reauth with max reauth count reached")
1158 eap_reauth(dev[0], "AKA'")
1159
c397edf2
JM		 1160def test_ap_wpa2_eap_aka_prime_ext_auth_fail(dev, apdev):
1161 """EAP-AKA' with external UMTS auth and auth failing"""
1162 try:
1163 _test_ap_wpa2_eap_aka_prime_ext_auth_fail(dev, apdev)
1164 finally:
1165 dev[0].request("SET external_sim 0")
1166
1167def _test_ap_wpa2_eap_aka_prime_ext_auth_fail(dev, apdev):
1168 check_hlr_auc_gw_support()
1169 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1170 hostapd.add_ap(apdev[0], params)
c397edf2
JM		 1171 dev[0].request("SET external_sim 1")
1172 id = dev[0].connect("test-wpa2-eap", eap="AKA'", key_mgmt="WPA-EAP",
1173 identity="6555444333222111",
1174 wait_connect=False, scan_freq="2412")
1175
1176 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
1177 if ev is None:
1178 raise Exception("Wait for external SIM processing request timed out")
1179 p = ev.split(':', 2)
1180 rid = p[0].split('-')[3]
1181 dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-FAIL")
1182 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
1183 if ev is None:
1184 raise Exception("EAP failure not reported")
1185 dev[0].request("REMOVE_NETWORK all")
1186 dev[0].wait_disconnected()
1187
9626962d
JM		 1188def test_ap_wpa2_eap_ttls_pap(dev, apdev):
1189 """WPA2-Enterprise connection using EAP-TTLS/PAP"""
1190 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1191 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 1192 key_mgmt = hapd.get_config()['key_mgmt']
1193 if key_mgmt.split(' ')[0] != "WPA-EAP":
1194 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3b3e2687 1195 eap_connect(dev[0], hapd, "TTLS", "pap user",
9626962d 1196 anonymous_identity="ttls", password="password",
506b2f05 1197 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
a8375c94 1198 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1199 eap_reauth(dev[0], "TTLS")
eaf3f9b1
JM		 1200 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-1"),
1201 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-1") ])
9626962d 1202
506b2f05
JM		 1203def test_ap_wpa2_eap_ttls_pap_subject_match(dev, apdev):
1204 """WPA2-Enterprise connection using EAP-TTLS/PAP and (alt)subject_match"""
1205 check_subject_match_support(dev[0])
1206 check_altsubject_match_support(dev[0])
1207 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1208 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1209 eap_connect(dev[0], hapd, "TTLS", "pap user",
506b2f05
JM		 1210 anonymous_identity="ttls", password="password",
1211 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
1212 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
1213 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
1214 eap_reauth(dev[0], "TTLS")
1215
82a8f5b5
JM		 1216def test_ap_wpa2_eap_ttls_pap_incorrect_password(dev, apdev):
1217 """WPA2-Enterprise connection using EAP-TTLS/PAP - incorrect password"""
1218 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1219 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1220 eap_connect(dev[0], hapd, "TTLS", "pap user",
82a8f5b5
JM		 1221 anonymous_identity="ttls", password="wrong",
1222 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
1223 expect_failure=True)
3b3e2687 1224 eap_connect(dev[1], hapd, "TTLS", "user",
82a8f5b5
JM		 1225 anonymous_identity="ttls", password="password",
1226 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
1227 expect_failure=True)
1228
9626962d
JM		 1229def test_ap_wpa2_eap_ttls_chap(dev, apdev):
1230 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 1231 skip_with_fips(dev[0])
9626962d 1232 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1233 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1234 eap_connect(dev[0], hapd, "TTLS", "chap user",
506b2f05
JM		 1235 anonymous_identity="ttls", password="password",
1236 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
1237 hwsim_utils.test_connectivity(dev[0], hapd)
1238 eap_reauth(dev[0], "TTLS")
1239
1240def test_ap_wpa2_eap_ttls_chap_altsubject_match(dev, apdev):
1241 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 1242 skip_with_fips(dev[0])
506b2f05
JM		 1243 check_altsubject_match_support(dev[0])
1244 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1245 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1246 eap_connect(dev[0], hapd, "TTLS", "chap user",
9626962d 1247 anonymous_identity="ttls", password="password",
5c65e277
JM		 1248 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
1249 altsubject_match="EMAIL:noone@example.com;URI:http://example.com/;DNS:server.w1.fi")
75b2b9cf 1250 eap_reauth(dev[0], "TTLS")
9626962d 1251
82a8f5b5
JM		 1252def test_ap_wpa2_eap_ttls_chap_incorrect_password(dev, apdev):
1253 """WPA2-Enterprise connection using EAP-TTLS/CHAP - incorrect password"""
ca158ea6 1254 skip_with_fips(dev[0])
82a8f5b5 1255 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1256 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1257 eap_connect(dev[0], hapd, "TTLS", "chap user",
82a8f5b5
JM		 1258 anonymous_identity="ttls", password="wrong",
1259 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
1260 expect_failure=True)
3b3e2687 1261 eap_connect(dev[1], hapd, "TTLS", "user",
82a8f5b5
JM		 1262 anonymous_identity="ttls", password="password",
1263 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
1264 expect_failure=True)
1265
9626962d
JM		 1266def test_ap_wpa2_eap_ttls_mschap(dev, apdev):
1267 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP"""
ca158ea6 1268 skip_with_fips(dev[0])
e78eb404 1269 check_domain_suffix_match(dev[0])
9626962d 1270 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1271 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1272 eap_connect(dev[0], hapd, "TTLS", "mschap user",
9626962d 1273 anonymous_identity="ttls", password="password",
72c052d5
JM		 1274 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1275 domain_suffix_match="server.w1.fi")
a8375c94 1276 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1277 eap_reauth(dev[0], "TTLS")
6daf5b9c 1278 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1279 eap_connect(dev[0], hapd, "TTLS", "mschap user",
6daf5b9c
JM		 1280 anonymous_identity="ttls", password="password",
1281 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1282 fragment_size="200")
bfdb90d4
JM		 1283 dev[0].request("REMOVE_NETWORK all")
1284 dev[0].wait_disconnected()
3b3e2687 1285 eap_connect(dev[0], hapd, "TTLS", "mschap user",
bfdb90d4
JM		 1286 anonymous_identity="ttls",
1287 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
1288 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP")
9626962d 1289
82a8f5b5 1290def test_ap_wpa2_eap_ttls_mschap_incorrect_password(dev, apdev):
ca158ea6
JM		 1291 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP - incorrect password"""
1292 skip_with_fips(dev[0])
82a8f5b5 1293 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1294 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1295 eap_connect(dev[0], hapd, "TTLS", "mschap user",
82a8f5b5
JM		 1296 anonymous_identity="ttls", password="wrong",
1297 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1298 expect_failure=True)
3b3e2687 1299 eap_connect(dev[1], hapd, "TTLS", "user",
82a8f5b5
JM		 1300 anonymous_identity="ttls", password="password",
1301 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1302 expect_failure=True)
3b3e2687 1303 eap_connect(dev[2], hapd, "TTLS", "no such user",
82a8f5b5
JM		 1304 anonymous_identity="ttls", password="password",
1305 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1306 expect_failure=True)
1307
9626962d
JM		 1308def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev):
1309 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
e78eb404 1310 check_domain_suffix_match(dev[0])
ca158ea6 1311 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1312 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1313 hapd = hostapd.add_ap(apdev[0], params)
1314 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
9626962d 1315 anonymous_identity="ttls", password="password",
72c052d5 1316 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
24579e70 1317 domain_suffix_match="server.w1.fi")
a8375c94 1318 hwsim_utils.test_connectivity(dev[0], hapd)
5dec879d
JM		 1319 sta1 = hapd.get_sta(dev[0].p2p_interface_addr())
1320 eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
75b2b9cf 1321 eap_reauth(dev[0], "TTLS")
5dec879d
JM		 1322 sta2 = hapd.get_sta(dev[0].p2p_interface_addr())
1323 eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
1324 if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']):
1325 raise Exception("dot1xAuthEapolFramesRx did not increase")
1326 if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1:
1327 raise Exception("authAuthEapStartsWhileAuthenticated did not increase")
1328 if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']):
1329 raise Exception("backendAuthSuccesses did not increase")
9626962d 1330
fa0ddb14
JM		 1331 logger.info("Password as hash value")
1332 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1333 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
fa0ddb14
JM		 1334 anonymous_identity="ttls",
1335 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
1336 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1337
c4e06b9b
JM		 1338def test_ap_wpa2_eap_ttls_invalid_phase2(dev, apdev):
1339 """EAP-TTLS with invalid phase2 parameter values"""
1340 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1341 hostapd.add_ap(apdev[0], params)
c4e06b9b 1342 tests = [ "auth=MSCHAPv2", "auth=MSCHAPV2 autheap=MD5",
53827125
JM		 1343 "autheap=MD5 auth=MSCHAPV2", "auth=PAP auth=CHAP",
1344 "autheap=MD5 autheap=FOO autheap=MSCHAPV2" ]
c4e06b9b
JM		 1345 for t in tests:
1346 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1347 identity="DOMAIN\mschapv2 user",
1348 anonymous_identity="ttls", password="password",
1349 ca_cert="auth_serv/ca.pem", phase2=t,
1350 wait_connect=False, scan_freq="2412")
1351 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"], timeout=10)
1352 if ev is None or "method=21" not in ev:
1353 raise Exception("EAP-TTLS not started")
1354 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method",
1355 "CTRL-EVENT-CONNECTED"], timeout=5)
1356 if ev is None or "CTRL-EVENT-CONNECTED" in ev:
1357 raise Exception("No EAP-TTLS failure reported for phase2=" + t)
1358 dev[0].request("REMOVE_NETWORK all")
1359 dev[0].wait_disconnected()
1360 dev[0].dump_monitor()
1361
24579e70
JM		 1362def test_ap_wpa2_eap_ttls_mschapv2_suffix_match(dev, apdev):
1363 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
1364 check_domain_match_full(dev[0])
ca158ea6 1365 skip_with_fips(dev[0])
24579e70 1366 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1367 hapd = hostapd.add_ap(apdev[0], params)
1368 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
24579e70
JM		 1369 anonymous_identity="ttls", password="password",
1370 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1371 domain_suffix_match="w1.fi")
1372 hwsim_utils.test_connectivity(dev[0], hapd)
1373 eap_reauth(dev[0], "TTLS")
1374
061cbb25
JM		 1375def test_ap_wpa2_eap_ttls_mschapv2_domain_match(dev, apdev):
1376 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 (domain_match)"""
e78eb404 1377 check_domain_match(dev[0])
ca158ea6 1378 skip_with_fips(dev[0])
061cbb25 1379 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1380 hapd = hostapd.add_ap(apdev[0], params)
1381 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
061cbb25
JM		 1382 anonymous_identity="ttls", password="password",
1383 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1384 domain_match="Server.w1.fi")
1385 hwsim_utils.test_connectivity(dev[0], hapd)
1386 eap_reauth(dev[0], "TTLS")
1387
82a8f5b5
JM		 1388def test_ap_wpa2_eap_ttls_mschapv2_incorrect_password(dev, apdev):
1389 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 - incorrect password"""
ca158ea6 1390 skip_with_fips(dev[0])
82a8f5b5 1391 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1392 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1393 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
f10ba3b2
JM		 1394 anonymous_identity="ttls", password="password1",
1395 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1396 expect_failure=True)
3b3e2687 1397 eap_connect(dev[1], hapd, "TTLS", "user",
82a8f5b5
JM		 1398 anonymous_identity="ttls", password="password",
1399 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1400 expect_failure=True)
f10ba3b2 1401
eac67440
JM		 1402def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev):
1403 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 and UTF-8 password"""
ca158ea6 1404 skip_with_fips(dev[0])
eac67440 1405 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1406 hapd = hostapd.add_ap(apdev[0], params)
1407 eap_connect(dev[0], hapd, "TTLS", "utf8-user-hash",
eac67440
JM		 1408 anonymous_identity="ttls", password="secret-åäö-€-password",
1409 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3b3e2687 1410 eap_connect(dev[1], hapd, "TTLS", "utf8-user",
eac67440
JM		 1411 anonymous_identity="ttls",
1412 password_hex="hash:bd5844fad2489992da7fe8c5a01559cf",
1413 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
0d2a7bad
JM		 1414 for p in [ "80", "41c041e04141e041", 257*"41" ]:
1415 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
1416 eap="TTLS", identity="utf8-user-hash",
1417 anonymous_identity="ttls", password_hex=p,
1418 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1419 wait_connect=False, scan_freq="2412")
1420 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=1)
1421 if ev is None:
1422 raise Exception("No failure reported")
1423 dev[2].request("REMOVE_NETWORK all")
1424 dev[2].wait_disconnected()
eac67440 1425
9626962d
JM		 1426def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev):
1427 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC"""
1428 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1429 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1430 eap_connect(dev[0], hapd, "TTLS", "user",
9626962d
JM		 1431 anonymous_identity="ttls", password="password",
1432 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
a8375c94 1433 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1434 eap_reauth(dev[0], "TTLS")
9626962d 1435
95a15d79
JM		 1436def test_ap_wpa2_eap_ttls_eap_gtc_incorrect_password(dev, apdev):
1437 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - incorrect password"""
1438 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1439 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1440 eap_connect(dev[0], hapd, "TTLS", "user",
95a15d79
JM		 1441 anonymous_identity="ttls", password="wrong",
1442 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1443 expect_failure=True)
1444
1445def test_ap_wpa2_eap_ttls_eap_gtc_no_password(dev, apdev):
1446 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - no password"""
1447 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1448 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1449 eap_connect(dev[0], hapd, "TTLS", "user-no-passwd",
95a15d79
JM		 1450 anonymous_identity="ttls", password="password",
1451 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1452 expect_failure=True)
1453
1454def test_ap_wpa2_eap_ttls_eap_gtc_server_oom(dev, apdev):
1455 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - server OOM"""
1456 params = int_eap_server_params()
8b8a1864 1457 hapd = hostapd.add_ap(apdev[0], params)
95a15d79 1458 with alloc_fail(hapd, 1, "eap_gtc_init"):
3b3e2687 1459 eap_connect(dev[0], hapd, "TTLS", "user",
95a15d79
JM		 1460 anonymous_identity="ttls", password="password",
1461 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1462 expect_failure=True)
1463 dev[0].request("REMOVE_NETWORK all")
1464
1465 with alloc_fail(hapd, 1, "eap_gtc_buildReq"):
1466 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1467 eap="TTLS", identity="user",
1468 anonymous_identity="ttls", password="password",
1469 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1470 wait_connect=False, scan_freq="2412")
1471 # This would eventually time out, but we can stop after having reached
1472 # the allocation failure.
1473 for i in range(20):
1474 time.sleep(0.1)
1475 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1476 break
1477
ac713c09
JM		 1478def test_ap_wpa2_eap_ttls_eap_gtc_oom(dev, apdev):
1479 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC (OOM)"""
1480 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1481 hapd = hostapd.add_ap(apdev[0], params)
ac713c09
JM		 1482
1483 tests = [ "eap_gtc_init",
1484 "eap_msg_alloc;eap_gtc_process" ]
1485 for func in tests:
1486 with alloc_fail(dev[0], 1, func):
1487 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
1488 scan_freq="2412",
1489 eap="TTLS", identity="user",
1490 anonymous_identity="ttls", password="password",
1491 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1492 wait_connect=False)
1493 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
1494 dev[0].request("REMOVE_NETWORK all")
1495 dev[0].wait_disconnected()
1496
9626962d
JM		 1497def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev):
1498 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5"""
e7ac04ce 1499 check_eap_capa(dev[0], "MD5")
9626962d 1500 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1501 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1502 eap_connect(dev[0], hapd, "TTLS", "user",
9626962d
JM		 1503 anonymous_identity="ttls", password="password",
1504 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5")
a8375c94 1505 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1506 eap_reauth(dev[0], "TTLS")
9626962d 1507
ee9533eb
JM		 1508def test_ap_wpa2_eap_ttls_eap_md5_incorrect_password(dev, apdev):
1509 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - incorrect password"""
e7ac04ce 1510 check_eap_capa(dev[0], "MD5")
ee9533eb 1511 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1512 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1513 eap_connect(dev[0], hapd, "TTLS", "user",
ee9533eb
JM		 1514 anonymous_identity="ttls", password="wrong",
1515 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1516 expect_failure=True)
1517
95a15d79
JM		 1518def test_ap_wpa2_eap_ttls_eap_md5_no_password(dev, apdev):
1519 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - no password"""
e7ac04ce 1520 check_eap_capa(dev[0], "MD5")
95a15d79 1521 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1522 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1523 eap_connect(dev[0], hapd, "TTLS", "user-no-passwd",
95a15d79
JM		 1524 anonymous_identity="ttls", password="password",
1525 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1526 expect_failure=True)
1527
ee9533eb
JM		 1528def test_ap_wpa2_eap_ttls_eap_md5_server_oom(dev, apdev):
1529 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - server OOM"""
e7ac04ce 1530 check_eap_capa(dev[0], "MD5")
ee9533eb 1531 params = int_eap_server_params()
8b8a1864 1532 hapd = hostapd.add_ap(apdev[0], params)
ee9533eb 1533 with alloc_fail(hapd, 1, "eap_md5_init"):
3b3e2687 1534 eap_connect(dev[0], hapd, "TTLS", "user",
ee9533eb
JM		 1535 anonymous_identity="ttls", password="password",
1536 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1537 expect_failure=True)
1538 dev[0].request("REMOVE_NETWORK all")
1539
1540 with alloc_fail(hapd, 1, "eap_md5_buildReq"):
1541 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1542 eap="TTLS", identity="user",
1543 anonymous_identity="ttls", password="password",
1544 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1545 wait_connect=False, scan_freq="2412")
1546 # This would eventually time out, but we can stop after having reached
1547 # the allocation failure.
1548 for i in range(20):
1549 time.sleep(0.1)
1550 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1551 break
1552
9626962d
JM		 1553def test_ap_wpa2_eap_ttls_eap_mschapv2(dev, apdev):
1554 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2"""
e7ac04ce 1555 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1556 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1557 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1558 eap_connect(dev[0], hapd, "TTLS", "user",
9626962d
JM		 1559 anonymous_identity="ttls", password="password",
1560 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2")
a8375c94 1561 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1562 eap_reauth(dev[0], "TTLS")
9626962d 1563
f10ba3b2
JM		 1564 logger.info("Negative test with incorrect password")
1565 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1566 eap_connect(dev[0], hapd, "TTLS", "user",
f10ba3b2
JM		 1567 anonymous_identity="ttls", password="password1",
1568 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1569 expect_failure=True)
1570
95a15d79
JM		 1571def test_ap_wpa2_eap_ttls_eap_mschapv2_no_password(dev, apdev):
1572 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - no password"""
e7ac04ce 1573 check_eap_capa(dev[0], "MSCHAPV2")
95a15d79 1574 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1575 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1576 eap_connect(dev[0], hapd, "TTLS", "user-no-passwd",
95a15d79
JM		 1577 anonymous_identity="ttls", password="password",
1578 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1579 expect_failure=True)
1580
ef318402
JM		 1581def test_ap_wpa2_eap_ttls_eap_mschapv2_server_oom(dev, apdev):
1582 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - server OOM"""
e7ac04ce 1583 check_eap_capa(dev[0], "MSCHAPV2")
ef318402 1584 params = int_eap_server_params()
8b8a1864 1585 hapd = hostapd.add_ap(apdev[0], params)
ef318402 1586 with alloc_fail(hapd, 1, "eap_mschapv2_init"):
3b3e2687 1587 eap_connect(dev[0], hapd, "TTLS", "user",
ef318402
JM		 1588 anonymous_identity="ttls", password="password",
1589 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1590 expect_failure=True)
1591 dev[0].request("REMOVE_NETWORK all")
1592
1593 with alloc_fail(hapd, 1, "eap_mschapv2_build_challenge"):
1594 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1595 eap="TTLS", identity="user",
1596 anonymous_identity="ttls", password="password",
1597 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1598 wait_connect=False, scan_freq="2412")
1599 # This would eventually time out, but we can stop after having reached
1600 # the allocation failure.
1601 for i in range(20):
1602 time.sleep(0.1)
1603 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1604 break
1605 dev[0].request("REMOVE_NETWORK all")
1606
1607 with alloc_fail(hapd, 1, "eap_mschapv2_build_success_req"):
1608 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1609 eap="TTLS", identity="user",
1610 anonymous_identity="ttls", password="password",
1611 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1612 wait_connect=False, scan_freq="2412")
1613 # This would eventually time out, but we can stop after having reached
1614 # the allocation failure.
1615 for i in range(20):
1616 time.sleep(0.1)
1617 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1618 break
1619 dev[0].request("REMOVE_NETWORK all")
1620
1621 with alloc_fail(hapd, 1, "eap_mschapv2_build_failure_req"):
1622 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1623 eap="TTLS", identity="user",
1624 anonymous_identity="ttls", password="wrong",
1625 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1626 wait_connect=False, scan_freq="2412")
1627 # This would eventually time out, but we can stop after having reached
1628 # the allocation failure.
1629 for i in range(20):
1630 time.sleep(0.1)
1631 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1632 break
1633 dev[0].request("REMOVE_NETWORK all")
1634
95fb531c
JM		 1635def test_ap_wpa2_eap_ttls_eap_aka(dev, apdev):
1636 """WPA2-Enterprise connection using EAP-TTLS/EAP-AKA"""
1637 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1638 hapd = hostapd.add_ap(apdev[0], params)
1639 eap_connect(dev[0], hapd, "TTLS", "0232010000000000",
95fb531c
JM		 1640 anonymous_identity="0232010000000000@ttls",
1641 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1642 ca_cert="auth_serv/ca.pem", phase2="autheap=AKA")
1643
1644def test_ap_wpa2_eap_peap_eap_aka(dev, apdev):
1645 """WPA2-Enterprise connection using EAP-PEAP/EAP-AKA"""
1646 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1647 hapd = hostapd.add_ap(apdev[0], params)
1648 eap_connect(dev[0], hapd, "PEAP", "0232010000000000",
95fb531c
JM		 1649 anonymous_identity="0232010000000000@peap",
1650 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1651 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1652
1653def test_ap_wpa2_eap_fast_eap_aka(dev, apdev):
1654 """WPA2-Enterprise connection using EAP-FAST/EAP-AKA"""
3b51cc63 1655 check_eap_capa(dev[0], "FAST")
95fb531c 1656 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1657 hapd = hostapd.add_ap(apdev[0], params)
1658 eap_connect(dev[0], hapd, "FAST", "0232010000000000",
95fb531c
JM		 1659 anonymous_identity="0232010000000000@fast",
1660 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1661 phase1="fast_provisioning=2",
1662 pac_file="blob://fast_pac_auth_aka",
1663 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1664
9626962d
JM		 1665def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev):
1666 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 1667 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1668 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1669 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1670 eap_connect(dev[0], hapd, "PEAP", "user",
698f8324 1671 anonymous_identity="peap", password="password",
9626962d 1672 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
a8375c94 1673 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1674 eap_reauth(dev[0], "PEAP")
6daf5b9c 1675 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1676 eap_connect(dev[0], hapd, "PEAP", "user",
6daf5b9c
JM		 1677 anonymous_identity="peap", password="password",
1678 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1679 fragment_size="200")
c7afc078 1680
fa0ddb14
JM		 1681 logger.info("Password as hash value")
1682 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1683 eap_connect(dev[0], hapd, "PEAP", "user",
fa0ddb14
JM		 1684 anonymous_identity="peap",
1685 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
1686 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1687
f10ba3b2
JM		 1688 logger.info("Negative test with incorrect password")
1689 dev[0].request("REMOVE_NETWORK all")
3b3e2687 1690 eap_connect(dev[0], hapd, "PEAP", "user",
f10ba3b2
JM		 1691 anonymous_identity="peap", password="password1",
1692 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1693 expect_failure=True)
1694
0d33f504
JM		 1695def test_ap_wpa2_eap_peap_eap_mschapv2_domain(dev, apdev):
1696 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 with domain"""
e7ac04ce 1697 check_eap_capa(dev[0], "MSCHAPV2")
0d33f504 1698 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1699 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1700 eap_connect(dev[0], hapd, "PEAP", "DOMAIN\user3",
0d33f504
JM		 1701 anonymous_identity="peap", password="password",
1702 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1703 hwsim_utils.test_connectivity(dev[0], hapd)
1704 eap_reauth(dev[0], "PEAP")
1705
f4cd0f64
JM		 1706def test_ap_wpa2_eap_peap_eap_mschapv2_incorrect_password(dev, apdev):
1707 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 - incorrect password"""
e7ac04ce 1708 check_eap_capa(dev[0], "MSCHAPV2")
f4cd0f64 1709 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1710 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1711 eap_connect(dev[0], hapd, "PEAP", "user",
f4cd0f64
JM		 1712 anonymous_identity="peap", password="wrong",
1713 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1714 expect_failure=True)
1715
698f8324
JM		 1716def test_ap_wpa2_eap_peap_crypto_binding(dev, apdev):
1717 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding"""
e7ac04ce 1718 check_eap_capa(dev[0], "MSCHAPV2")
698f8324 1719 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1720 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 1721 eap_connect(dev[0], hapd, "PEAP", "user", password="password",
698f8324
JM		 1722 ca_cert="auth_serv/ca.pem",
1723 phase1="peapver=0 crypto_binding=2",
1724 phase2="auth=MSCHAPV2")
a8375c94 1725 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1726 eap_reauth(dev[0], "PEAP")
698f8324 1727
3b3e2687 1728 eap_connect(dev[1], hapd, "PEAP", "user", password="password",
ea6464b0
JM		 1729 ca_cert="auth_serv/ca.pem",
1730 phase1="peapver=0 crypto_binding=1",
1731 phase2="auth=MSCHAPV2")
3b3e2687 1732 eap_connect(dev[2], hapd, "PEAP", "user", password="password",
ea6464b0
JM		 1733 ca_cert="auth_serv/ca.pem",
1734 phase1="peapver=0 crypto_binding=0",
1735 phase2="auth=MSCHAPV2")
1736
ef318402
JM		 1737def test_ap_wpa2_eap_peap_crypto_binding_server_oom(dev, apdev):
1738 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding with server OOM"""
e7ac04ce 1739 check_eap_capa(dev[0], "MSCHAPV2")
ef318402 1740 params = int_eap_server_params()
8b8a1864 1741 hapd = hostapd.add_ap(apdev[0], params)
ef318402 1742 with alloc_fail(hapd, 1, "eap_mschapv2_getKey"):
3b3e2687 1743 eap_connect(dev[0], hapd, "PEAP", "user", password="password",
ef318402
JM		 1744 ca_cert="auth_serv/ca.pem",
1745 phase1="peapver=0 crypto_binding=2",
1746 phase2="auth=MSCHAPV2",
1747 expect_failure=True, local_error_report=True)
1748
c4d37011
JM		 1749def test_ap_wpa2_eap_peap_params(dev, apdev):
1750 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and various parameters"""
e7ac04ce 1751 check_eap_capa(dev[0], "MSCHAPV2")
c4d37011 1752 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1753 hapd = hostapd.add_ap(apdev[0], params)
1754 eap_connect(dev[0], hapd, "PEAP", "user",
c4d37011
JM		 1755 anonymous_identity="peap", password="password",
1756 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1757 phase1="peapver=0 peaplabel=1",
1758 expect_failure=True)
1759 dev[0].request("REMOVE_NETWORK all")
09ad98c5
JM		 1760 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1761 identity="user",
1762 anonymous_identity="peap", password="password",
1763 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1764 phase1="peap_outer_success=0",
1765 wait_connect=False, scan_freq="2412")
1766 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
1767 if ev is None:
1768 raise Exception("No EAP success seen")
1769 # This won't succeed to connect with peap_outer_success=0, so stop here.
1770 dev[0].request("REMOVE_NETWORK all")
1771 dev[0].wait_disconnected()
3b3e2687 1772 eap_connect(dev[1], hapd, "PEAP", "user", password="password",
c4d37011
JM		 1773 ca_cert="auth_serv/ca.pem",
1774 phase1="peap_outer_success=1",
1775 phase2="auth=MSCHAPV2")
3b3e2687 1776 eap_connect(dev[2], hapd, "PEAP", "user", password="password",
c4d37011
JM		 1777 ca_cert="auth_serv/ca.pem",
1778 phase1="peap_outer_success=2",
1779 phase2="auth=MSCHAPV2")
1780 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1781 identity="user",
1782 anonymous_identity="peap", password="password",
1783 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1784 phase1="peapver=1 peaplabel=1",
1785 wait_connect=False, scan_freq="2412")
1786 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
1787 if ev is None:
1788 raise Exception("No EAP success seen")
1789 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
1790 if ev is not None:
1791 raise Exception("Unexpected connection")
1792
09a4404a
JM		 1793 tests = [ ("peap-ver0", ""),
1794 ("peap-ver1", ""),
1795 ("peap-ver0", "peapver=0"),
1796 ("peap-ver1", "peapver=1") ]
1797 for anon,phase1 in tests:
1798 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1799 identity="user", anonymous_identity=anon,
1800 password="password", phase1=phase1,
1801 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1802 scan_freq="2412")
1803 dev[0].request("REMOVE_NETWORK all")
1804 dev[0].wait_disconnected()
1805
1806 tests = [ ("peap-ver0", "peapver=1"),
1807 ("peap-ver1", "peapver=0") ]
1808 for anon,phase1 in tests:
1809 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1810 identity="user", anonymous_identity=anon,
1811 password="password", phase1=phase1,
1812 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1813 wait_connect=False, scan_freq="2412")
1814 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
1815 if ev is None:
1816 raise Exception("No EAP-Failure seen")
1817 dev[0].request("REMOVE_NETWORK all")
1818 dev[0].wait_disconnected()
1819
3b3e2687 1820 eap_connect(dev[0], hapd, "PEAP", "user", password="password",
d5f5d260
JM		 1821 ca_cert="auth_serv/ca.pem",
1822 phase1="tls_allow_md5=1 tls_disable_session_ticket=1 tls_disable_tlsv1_0=0 tls_disable_tlsv1_1=0 tls_disable_tlsv1_2=0 tls_ext_cert_check=0",
1823 phase2="auth=MSCHAPV2")
1824
d0ce1050
JM		 1825def test_ap_wpa2_eap_peap_eap_tls(dev, apdev):
1826 """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS"""
1827 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1828 hapd = hostapd.add_ap(apdev[0], params)
1829 eap_connect(dev[0], hapd, "PEAP", "cert user",
d0ce1050
JM		 1830 ca_cert="auth_serv/ca.pem", phase2="auth=TLS",
1831 ca_cert2="auth_serv/ca.pem",
1832 client_cert2="auth_serv/user.pem",
1833 private_key2="auth_serv/user.key")
1834 eap_reauth(dev[0], "PEAP")
1835
e114c49c
JM		 1836def test_ap_wpa2_eap_tls(dev, apdev):
1837 """WPA2-Enterprise connection using EAP-TLS"""
1838 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1839 hapd = hostapd.add_ap(apdev[0], params)
1840 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
e114c49c
JM		 1841 client_cert="auth_serv/user.pem",
1842 private_key="auth_serv/user.key")
75b2b9cf 1843 eap_reauth(dev[0], "TLS")
e114c49c 1844
96bf8fe1
JM		 1845def test_eap_tls_pkcs8_pkcs5_v2_des3(dev, apdev):
1846 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v2 DES3 key"""
1847 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1848 hapd = hostapd.add_ap(apdev[0], params)
1849 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
96bf8fe1
JM		 1850 client_cert="auth_serv/user.pem",
1851 private_key="auth_serv/user.key.pkcs8",
1852 private_key_passwd="whatever")
1853
1854def test_eap_tls_pkcs8_pkcs5_v15(dev, apdev):
1855 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v1.5 key"""
969e5250 1856 check_pkcs5_v15_support(dev[0])
96bf8fe1 1857 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1858 hapd = hostapd.add_ap(apdev[0], params)
1859 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
96bf8fe1
JM		 1860 client_cert="auth_serv/user.pem",
1861 private_key="auth_serv/user.key.pkcs8.pkcs5v15",
1862 private_key_passwd="whatever")
1863
6ea231e6
JM		 1864def test_ap_wpa2_eap_tls_blob(dev, apdev):
1865 """WPA2-Enterprise connection using EAP-TLS and config blobs"""
1866 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 1867 hapd = hostapd.add_ap(apdev[0], params)
6ea231e6
JM		 1868 cert = read_pem("auth_serv/ca.pem")
1869 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1870 raise Exception("Could not set cacert blob")
1871 cert = read_pem("auth_serv/user.pem")
1872 if "OK" not in dev[0].request("SET blob usercert " + cert.encode("hex")):
1873 raise Exception("Could not set usercert blob")
62750c3e 1874 key = read_pem("auth_serv/user.rsa-key")
6ea231e6
JM		 1875 if "OK" not in dev[0].request("SET blob userkey " + key.encode("hex")):
1876 raise Exception("Could not set cacert blob")
3b3e2687 1877 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="blob://cacert",
6ea231e6
JM		 1878 client_cert="blob://usercert",
1879 private_key="blob://userkey")
1880
cef42a44
JM		 1881def test_ap_wpa2_eap_tls_blob_missing(dev, apdev):
1882 """EAP-TLS and config blob missing"""
1883 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1884 hostapd.add_ap(apdev[0], params)
cef42a44
JM		 1885 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1886 identity="tls user",
1887 ca_cert="blob://testing-blob-does-not-exist",
1888 client_cert="blob://testing-blob-does-not-exist",
1889 private_key="blob://testing-blob-does-not-exist",
1890 wait_connect=False, scan_freq="2412")
1891 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], timeout=10)
1892 if ev is None:
1893 raise Exception("EAP failure not reported")
1894 dev[0].request("REMOVE_NETWORK all")
1895 dev[0].wait_disconnected()
1896
7cb27f89
JM		 1897def test_ap_wpa2_eap_tls_with_tls_len(dev, apdev):
1898 """EAP-TLS and TLS Message Length in unfragmented packets"""
1899 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1900 hapd = hostapd.add_ap(apdev[0], params)
1901 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
7cb27f89
JM		 1902 phase1="include_tls_length=1",
1903 client_cert="auth_serv/user.pem",
1904 private_key="auth_serv/user.key")
1905
2d10eb0e
JM		 1906def test_ap_wpa2_eap_tls_pkcs12(dev, apdev):
1907 """WPA2-Enterprise connection using EAP-TLS and PKCS#12"""
686eee77 1908 check_pkcs12_support(dev[0])
2d10eb0e 1909 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 1910 hapd = hostapd.add_ap(apdev[0], params)
1911 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
2d10eb0e
JM		 1912 private_key="auth_serv/user.pkcs12",
1913 private_key_passwd="whatever")
1914 dev[0].request("REMOVE_NETWORK all")
0c83ae04
JM		 1915 dev[0].wait_disconnected()
1916
2d10eb0e
JM		 1917 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1918 identity="tls user",
1919 ca_cert="auth_serv/ca.pem",
1920 private_key="auth_serv/user.pkcs12",
1921 wait_connect=False, scan_freq="2412")
1922 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"])
1923 if ev is None:
1924 raise Exception("Request for private key passphrase timed out")
1925 id = ev.split(':')[0].split('-')[-1]
1926 dev[0].request("CTRL-RSP-PASSPHRASE-" + id + ":whatever")
5f35a5e2 1927 dev[0].wait_connected(timeout=10)
0c83ae04
JM		 1928 dev[0].request("REMOVE_NETWORK all")
1929 dev[0].wait_disconnected()
1930
6da3b745
JM		 1931 # Run this twice to verify certificate chain handling with OpenSSL. Use two
1932 # different files to cover both cases of the extra certificate being the
1933 # one that signed the client certificate and it being unrelated to the
1934 # client certificate.
1935 for pkcs12 in "auth_serv/user2.pkcs12", "auth_serv/user3.pkcs12":
1936 for i in range(2):
3b3e2687 1937 eap_connect(dev[0], hapd, "TLS", "tls user",
6da3b745
JM		 1938 ca_cert="auth_serv/ca.pem",
1939 private_key=pkcs12,
1940 private_key_passwd="whatever")
1941 dev[0].request("REMOVE_NETWORK all")
1942 dev[0].wait_disconnected()
2d10eb0e 1943
6ea231e6
JM		 1944def test_ap_wpa2_eap_tls_pkcs12_blob(dev, apdev):
1945 """WPA2-Enterprise connection using EAP-TLS and PKCS#12 from configuration blob"""
686eee77 1946 check_pkcs12_support(dev[0])
6ea231e6 1947 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 1948 hapd = hostapd.add_ap(apdev[0], params)
6ea231e6
JM		 1949 cert = read_pem("auth_serv/ca.pem")
1950 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1951 raise Exception("Could not set cacert blob")
1952 with open("auth_serv/user.pkcs12", "rb") as f:
1953 if "OK" not in dev[0].request("SET blob pkcs12 " + f.read().encode("hex")):
1954 raise Exception("Could not set pkcs12 blob")
3b3e2687 1955 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="blob://cacert",
6ea231e6
JM		 1956 private_key="blob://pkcs12",
1957 private_key_passwd="whatever")
1958
c7afc078
JM		 1959def test_ap_wpa2_eap_tls_neg_incorrect_trust_root(dev, apdev):
1960 """WPA2-Enterprise negative test - incorrect trust root"""
e7ac04ce 1961 check_eap_capa(dev[0], "MSCHAPV2")
c7afc078 1962 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 1963 hostapd.add_ap(apdev[0], params)
6ea231e6
JM		 1964 cert = read_pem("auth_serv/ca-incorrect.pem")
1965 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1966 raise Exception("Could not set cacert blob")
c7afc078 1967 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
6ea231e6
JM		 1968 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1969 password="password", phase2="auth=MSCHAPV2",
1970 ca_cert="blob://cacert",
1971 wait_connect=False, scan_freq="2412")
1972 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
c7afc078
JM		 1973 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1974 password="password", phase2="auth=MSCHAPV2",
1975 ca_cert="auth_serv/ca-incorrect.pem",
c65f23ab 1976 wait_connect=False, scan_freq="2412")
c7afc078 1977
6ea231e6 1978 for dev in (dev[0], dev[1]):
412c6030 1979 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
6ea231e6
JM		 1980 if ev is None:
1981 raise Exception("Association and EAP start timed out")
c7afc078 1982
6ea231e6
JM		 1983 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1984 if ev is None:
1985 raise Exception("EAP method selection timed out")
1986 if "TTLS" not in ev:
1987 raise Exception("Unexpected EAP method")
1988
1989 ev = dev.wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1990 "CTRL-EVENT-EAP-SUCCESS",
1991 "CTRL-EVENT-EAP-FAILURE",
1992 "CTRL-EVENT-CONNECTED",
1993 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1994 if ev is None:
1995 raise Exception("EAP result timed out")
1996 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1997 raise Exception("TLS certificate error not reported")
1998
1999 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS",
2000 "CTRL-EVENT-EAP-FAILURE",
2001 "CTRL-EVENT-CONNECTED",
2002 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2003 if ev is None:
2004 raise Exception("EAP result(2) timed out")
2005 if "CTRL-EVENT-EAP-FAILURE" not in ev:
2006 raise Exception("EAP failure not reported")
c7afc078 2007
6ea231e6
JM		 2008 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
2009 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2010 if ev is None:
2011 raise Exception("EAP result(3) timed out")
2012 if "CTRL-EVENT-DISCONNECTED" not in ev:
2013 raise Exception("Disconnection not reported")
c7afc078 2014
6ea231e6
JM		 2015 ev = dev.wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
2016 if ev is None:
2017 raise Exception("Network block disabling not reported")
72c052d5 2018
9a5cfd70
JM		 2019def test_ap_wpa2_eap_tls_diff_ca_trust(dev, apdev):
2020 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
2021 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2022 hapd = hostapd.add_ap(apdev[0], params)
9a5cfd70
JM		 2023 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2024 identity="pap user", anonymous_identity="ttls",
2025 password="password", phase2="auth=PAP",
2026 ca_cert="auth_serv/ca.pem",
2027 wait_connect=True, scan_freq="2412")
2028 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2029 identity="pap user", anonymous_identity="ttls",
2030 password="password", phase2="auth=PAP",
2031 ca_cert="auth_serv/ca-incorrect.pem",
2032 only_add_network=True, scan_freq="2412")
2033
2034 dev[0].request("DISCONNECT")
90ad11e6 2035 dev[0].wait_disconnected()
9a5cfd70
JM		 2036 dev[0].dump_monitor()
2037 dev[0].select_network(id, freq="2412")
2038
2039 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
2040 if ev is None:
2041 raise Exception("EAP-TTLS not re-started")
db98b587 2042
5f35a5e2 2043 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 2044 if "reason=23" not in ev:
2045 raise Exception("Proper reason code for disconnection not reported")
2046
2047def test_ap_wpa2_eap_tls_diff_ca_trust2(dev, apdev):
2048 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
2049 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2050 hapd = hostapd.add_ap(apdev[0], params)
9a5cfd70
JM		 2051 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2052 identity="pap user", anonymous_identity="ttls",
2053 password="password", phase2="auth=PAP",
2054 wait_connect=True, scan_freq="2412")
2055 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2056 identity="pap user", anonymous_identity="ttls",
2057 password="password", phase2="auth=PAP",
2058 ca_cert="auth_serv/ca-incorrect.pem",
2059 only_add_network=True, scan_freq="2412")
2060
2061 dev[0].request("DISCONNECT")
90ad11e6 2062 dev[0].wait_disconnected()
9a5cfd70
JM		 2063 dev[0].dump_monitor()
2064 dev[0].select_network(id, freq="2412")
2065
2066 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
2067 if ev is None:
2068 raise Exception("EAP-TTLS not re-started")
db98b587 2069
5f35a5e2 2070 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 2071 if "reason=23" not in ev:
2072 raise Exception("Proper reason code for disconnection not reported")
2073
2074def test_ap_wpa2_eap_tls_diff_ca_trust3(dev, apdev):
2075 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
2076 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2077 hapd = hostapd.add_ap(apdev[0], params)
9a5cfd70
JM		 2078 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2079 identity="pap user", anonymous_identity="ttls",
2080 password="password", phase2="auth=PAP",
2081 ca_cert="auth_serv/ca.pem",
2082 wait_connect=True, scan_freq="2412")
2083 dev[0].request("DISCONNECT")
90ad11e6 2084 dev[0].wait_disconnected()
9a5cfd70
JM		 2085 dev[0].dump_monitor()
2086 dev[0].set_network_quoted(id, "ca_cert", "auth_serv/ca-incorrect.pem")
2087 dev[0].select_network(id, freq="2412")
2088
2089 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
2090 if ev is None:
2091 raise Exception("EAP-TTLS not re-started")
db98b587 2092
5f35a5e2 2093 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 2094 if "reason=23" not in ev:
2095 raise Exception("Proper reason code for disconnection not reported")
2096
72c052d5
JM		 2097def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev):
2098 """WPA2-Enterprise negative test - domain suffix mismatch"""
e78eb404 2099 check_domain_suffix_match(dev[0])
72c052d5 2100 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2101 hostapd.add_ap(apdev[0], params)
72c052d5
JM		 2102 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2103 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2104 password="password", phase2="auth=MSCHAPV2",
2105 ca_cert="auth_serv/ca.pem",
2106 domain_suffix_match="incorrect.example.com",
c65f23ab 2107 wait_connect=False, scan_freq="2412")
72c052d5 2108
412c6030 2109 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
72c052d5
JM		 2110 if ev is None:
2111 raise Exception("Association and EAP start timed out")
2112
2113 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
2114 if ev is None:
2115 raise Exception("EAP method selection timed out")
2116 if "TTLS" not in ev:
2117 raise Exception("Unexpected EAP method")
2118
2119 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
2120 "CTRL-EVENT-EAP-SUCCESS",
2121 "CTRL-EVENT-EAP-FAILURE",
2122 "CTRL-EVENT-CONNECTED",
2123 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2124 if ev is None:
2125 raise Exception("EAP result timed out")
2126 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
2127 raise Exception("TLS certificate error not reported")
2128 if "Domain suffix mismatch" not in ev:
2129 raise Exception("Domain suffix mismatch not reported")
2130
2131 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
2132 "CTRL-EVENT-EAP-FAILURE",
2133 "CTRL-EVENT-CONNECTED",
2134 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2135 if ev is None:
2136 raise Exception("EAP result(2) timed out")
2137 if "CTRL-EVENT-EAP-FAILURE" not in ev:
2138 raise Exception("EAP failure not reported")
2139
2140 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2141 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2142 if ev is None:
2143 raise Exception("EAP result(3) timed out")
2144 if "CTRL-EVENT-DISCONNECTED" not in ev:
2145 raise Exception("Disconnection not reported")
2146
2147 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
2148 if ev is None:
2149 raise Exception("Network block disabling not reported")
22b99086 2150
061cbb25
JM		 2151def test_ap_wpa2_eap_tls_neg_domain_match(dev, apdev):
2152 """WPA2-Enterprise negative test - domain mismatch"""
e78eb404 2153 check_domain_match(dev[0])
061cbb25 2154 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2155 hostapd.add_ap(apdev[0], params)
061cbb25
JM		 2156 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2157 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2158 password="password", phase2="auth=MSCHAPV2",
2159 ca_cert="auth_serv/ca.pem",
2160 domain_match="w1.fi",
2161 wait_connect=False, scan_freq="2412")
2162
412c6030 2163 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
061cbb25
JM		 2164 if ev is None:
2165 raise Exception("Association and EAP start timed out")
2166
2167 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
2168 if ev is None:
2169 raise Exception("EAP method selection timed out")
2170 if "TTLS" not in ev:
2171 raise Exception("Unexpected EAP method")
2172
2173 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
2174 "CTRL-EVENT-EAP-SUCCESS",
2175 "CTRL-EVENT-EAP-FAILURE",
2176 "CTRL-EVENT-CONNECTED",
2177 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2178 if ev is None:
2179 raise Exception("EAP result timed out")
2180 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
2181 raise Exception("TLS certificate error not reported")
2182 if "Domain mismatch" not in ev:
2183 raise Exception("Domain mismatch not reported")
2184
2185 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
2186 "CTRL-EVENT-EAP-FAILURE",
2187 "CTRL-EVENT-CONNECTED",
2188 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2189 if ev is None:
2190 raise Exception("EAP result(2) timed out")
2191 if "CTRL-EVENT-EAP-FAILURE" not in ev:
2192 raise Exception("EAP failure not reported")
2193
2194 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2195 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2196 if ev is None:
2197 raise Exception("EAP result(3) timed out")
2198 if "CTRL-EVENT-DISCONNECTED" not in ev:
2199 raise Exception("Disconnection not reported")
2200
2201 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
2202 if ev is None:
2203 raise Exception("Network block disabling not reported")
2204
3b74982f
JM		 2205def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
2206 """WPA2-Enterprise negative test - subject mismatch"""
2207 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2208 hostapd.add_ap(apdev[0], params)
3b74982f
JM		 2209 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2210 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2211 password="password", phase2="auth=MSCHAPV2",
2212 ca_cert="auth_serv/ca.pem",
2213 subject_match="/C=FI/O=w1.fi/CN=example.com",
2214 wait_connect=False, scan_freq="2412")
2215
412c6030 2216 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
3b74982f
JM		 2217 if ev is None:
2218 raise Exception("Association and EAP start timed out")
2219
506b2f05
JM		 2220 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
2221 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 2222 if ev is None:
2223 raise Exception("EAP method selection timed out")
506b2f05
JM		 2224 if "EAP: Failed to initialize EAP method" in ev:
2225 tls = dev[0].request("GET tls_library")
2226 if tls.startswith("OpenSSL"):
2227 raise Exception("Failed to select EAP method")
2228 logger.info("subject_match not supported - connection failed, so test succeeded")
2229 return
3b74982f
JM		 2230 if "TTLS" not in ev:
2231 raise Exception("Unexpected EAP method")
2232
2233 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
2234 "CTRL-EVENT-EAP-SUCCESS",
2235 "CTRL-EVENT-EAP-FAILURE",
2236 "CTRL-EVENT-CONNECTED",
2237 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2238 if ev is None:
2239 raise Exception("EAP result timed out")
2240 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
2241 raise Exception("TLS certificate error not reported")
2242 if "Subject mismatch" not in ev:
2243 raise Exception("Subject mismatch not reported")
2244
2245 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
2246 "CTRL-EVENT-EAP-FAILURE",
2247 "CTRL-EVENT-CONNECTED",
2248 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2249 if ev is None:
2250 raise Exception("EAP result(2) timed out")
2251 if "CTRL-EVENT-EAP-FAILURE" not in ev:
2252 raise Exception("EAP failure not reported")
2253
2254 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2255 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2256 if ev is None:
2257 raise Exception("EAP result(3) timed out")
2258 if "CTRL-EVENT-DISCONNECTED" not in ev:
2259 raise Exception("Disconnection not reported")
2260
2261 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
2262 if ev is None:
2263 raise Exception("Network block disabling not reported")
2264
2265def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
2266 """WPA2-Enterprise negative test - altsubject mismatch"""
2267 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2268 hostapd.add_ap(apdev[0], params)
37d61355
JM		 2269
2270 tests = [ "incorrect.example.com",
2271 "DNS:incorrect.example.com",
2272 "DNS:w1.fi",
2273 "DNS:erver.w1.fi" ]
2274 for match in tests:
2275 _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match)
2276
2277def _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match):
3b74982f
JM		 2278 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2279 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2280 password="password", phase2="auth=MSCHAPV2",
2281 ca_cert="auth_serv/ca.pem",
37d61355 2282 altsubject_match=match,
3b74982f
JM		 2283 wait_connect=False, scan_freq="2412")
2284
412c6030 2285 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
3b74982f
JM		 2286 if ev is None:
2287 raise Exception("Association and EAP start timed out")
2288
506b2f05
JM		 2289 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
2290 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 2291 if ev is None:
2292 raise Exception("EAP method selection timed out")
506b2f05
JM		 2293 if "EAP: Failed to initialize EAP method" in ev:
2294 tls = dev[0].request("GET tls_library")
2295 if tls.startswith("OpenSSL"):
2296 raise Exception("Failed to select EAP method")
2297 logger.info("altsubject_match not supported - connection failed, so test succeeded")
2298 return
3b74982f
JM		 2299 if "TTLS" not in ev:
2300 raise Exception("Unexpected EAP method")
2301
2302 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
2303 "CTRL-EVENT-EAP-SUCCESS",
2304 "CTRL-EVENT-EAP-FAILURE",
2305 "CTRL-EVENT-CONNECTED",
2306 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2307 if ev is None:
2308 raise Exception("EAP result timed out")
2309 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
2310 raise Exception("TLS certificate error not reported")
2311 if "AltSubject mismatch" not in ev:
2312 raise Exception("altsubject mismatch not reported")
2313
2314 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
2315 "CTRL-EVENT-EAP-FAILURE",
2316 "CTRL-EVENT-CONNECTED",
2317 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2318 if ev is None:
2319 raise Exception("EAP result(2) timed out")
2320 if "CTRL-EVENT-EAP-FAILURE" not in ev:
2321 raise Exception("EAP failure not reported")
2322
2323 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2324 "CTRL-EVENT-DISCONNECTED"], timeout=10)
2325 if ev is None:
2326 raise Exception("EAP result(3) timed out")
2327 if "CTRL-EVENT-DISCONNECTED" not in ev:
2328 raise Exception("Disconnection not reported")
2329
2330 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
2331 if ev is None:
2332 raise Exception("Network block disabling not reported")
2333
37d61355
JM		 2334 dev[0].request("REMOVE_NETWORK all")
2335
5a0c1517
JM		 2336def test_ap_wpa2_eap_unauth_tls(dev, apdev):
2337 """WPA2-Enterprise connection using UNAUTH-TLS"""
2338 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2339 hapd = hostapd.add_ap(apdev[0], params)
2340 eap_connect(dev[0], hapd, "UNAUTH-TLS", "unauth-tls",
5a0c1517
JM		 2341 ca_cert="auth_serv/ca.pem")
2342 eap_reauth(dev[0], "UNAUTH-TLS")
2343
57be05e1
JM		 2344def test_ap_wpa2_eap_ttls_server_cert_hash(dev, apdev):
2345 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash"""
4bf4e9db 2346 check_cert_probe_support(dev[0])
ca158ea6 2347 skip_with_fips(dev[0])
5b71cb55 2348 srv_cert_hash = "bdb9cb55d3df278e52a071abf58e7f0238fbec3ad8fb2c254742f63562628272"
57be05e1 2349 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 2350 hapd = hostapd.add_ap(apdev[0], params)
57be05e1
JM		 2351 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2352 identity="probe", ca_cert="probe://",
2353 wait_connect=False, scan_freq="2412")
412c6030 2354 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
57be05e1
JM		 2355 if ev is None:
2356 raise Exception("Association and EAP start timed out")
2357 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT depth=0"], timeout=10)
2358 if ev is None:
2359 raise Exception("No peer server certificate event seen")
2360 if "hash=" + srv_cert_hash not in ev:
2361 raise Exception("Expected server certificate hash not reported")
2362 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
2363 if ev is None:
2364 raise Exception("EAP result timed out")
2365 if "Server certificate chain probe" not in ev:
2366 raise Exception("Server certificate probe not reported")
5f35a5e2 2367 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 2368 dev[0].request("REMOVE_NETWORK all")
2369
2370 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2371 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2372 password="password", phase2="auth=MSCHAPV2",
2373 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
2374 wait_connect=False, scan_freq="2412")
412c6030 2375 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
57be05e1
JM		 2376 if ev is None:
2377 raise Exception("Association and EAP start timed out")
2378 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
2379 if ev is None:
2380 raise Exception("EAP result timed out")
2381 if "Server certificate mismatch" not in ev:
2382 raise Exception("Server certificate mismatch not reported")
5f35a5e2 2383 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 2384 dev[0].request("REMOVE_NETWORK all")
2385
3b3e2687 2386 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
57be05e1
JM		 2387 anonymous_identity="ttls", password="password",
2388 ca_cert="hash://server/sha256/" + srv_cert_hash,
2389 phase2="auth=MSCHAPV2")
2390
2a6a2192
JM		 2391def test_ap_wpa2_eap_ttls_server_cert_hash_invalid(dev, apdev):
2392 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash (invalid config)"""
2393 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2394 hostapd.add_ap(apdev[0], params)
2a6a2192
JM		 2395 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2396 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2397 password="password", phase2="auth=MSCHAPV2",
2398 ca_cert="hash://server/md5/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
2399 wait_connect=False, scan_freq="2412")
2400 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2401 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2402 password="password", phase2="auth=MSCHAPV2",
2403 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca",
2404 wait_connect=False, scan_freq="2412")
2405 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2406 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
2407 password="password", phase2="auth=MSCHAPV2",
2408 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6Q",
2409 wait_connect=False, scan_freq="2412")
2410 for i in range(0, 3):
412c6030 2411 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
2a6a2192
JM		 2412 if ev is None:
2413 raise Exception("Association and EAP start timed out")
cbb85a03
JM		 2414 ev = dev[i].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 21 (TTLS)"], timeout=5)
2415 if ev is None:
2416 raise Exception("Did not report EAP method initialization failure")
2a6a2192 2417
22b99086
JM		 2418def test_ap_wpa2_eap_pwd(dev, apdev):
2419 """WPA2-Enterprise connection using EAP-pwd"""
3b51cc63 2420 check_eap_capa(dev[0], "PWD")
22b99086 2421 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2422 hapd = hostapd.add_ap(apdev[0], params)
2423 eap_connect(dev[0], hapd, "PWD", "pwd user", password="secret password")
75b2b9cf 2424 eap_reauth(dev[0], "PWD")
6daf5b9c 2425 dev[0].request("REMOVE_NETWORK all")
0403fa0a 2426
3b3e2687 2427 eap_connect(dev[1], hapd, "PWD",
0403fa0a
JM		 2428 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
2429 password="secret password",
6daf5b9c
JM		 2430 fragment_size="90")
2431
f10ba3b2 2432 logger.info("Negative test with incorrect password")
3b3e2687 2433 eap_connect(dev[2], hapd, "PWD", "pwd user", password="secret-password",
f10ba3b2
JM		 2434 expect_failure=True, local_error_report=True)
2435
3b3e2687 2436 eap_connect(dev[0], hapd, "PWD",
0403fa0a
JM		 2437 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
2438 password="secret password",
2439 fragment_size="31")
2440
b898a6ee
JM		 2441def test_ap_wpa2_eap_pwd_nthash(dev, apdev):
2442 """WPA2-Enterprise connection using EAP-pwd and NTHash"""
2443 check_eap_capa(dev[0], "PWD")
0392867b 2444 skip_with_fips(dev[0])
b898a6ee 2445 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2446 hapd = hostapd.add_ap(apdev[0], params)
2447 eap_connect(dev[0], hapd, "PWD", "pwd-hash", password="secret password")
2448 eap_connect(dev[1], hapd, "PWD", "pwd-hash",
b898a6ee 2449 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a")
3b3e2687 2450 eap_connect(dev[2], hapd, "PWD", "pwd user",
b898a6ee
JM		 2451 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a",
2452 expect_failure=True, local_error_report=True)
2453
c075f040
JM		 2454def test_ap_wpa2_eap_pwd_groups(dev, apdev):
2455 """WPA2-Enterprise connection using various EAP-pwd groups"""
3b51cc63 2456 check_eap_capa(dev[0], "PWD")
5f2e4547 2457 tls = dev[0].request("GET tls_library")
c075f040
JM		 2458 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2459 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2460 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
f2d789f2
JM		 2461 groups = [ 19, 20, 21, 25, 26 ]
2462 if tls.startswith("OpenSSL") and "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
2463 logger.info("Add Brainpool EC groups since OpenSSL is new enough")
2464 groups += [ 27, 28, 29, 30 ]
2465 for i in groups:
2466 logger.info("Group %d" % i)
c075f040 2467 params['pwd_group'] = str(i)
3b3e2687 2468 hapd = hostapd.add_ap(apdev[0], params)
5f2e4547 2469 try:
3b3e2687 2470 eap_connect(dev[0], hapd, "PWD", "pwd user",
5f2e4547 2471 password="secret password")
f2d789f2
JM		 2472 dev[0].request("REMOVE_NETWORK all")
2473 dev[0].wait_disconnected()
2474 dev[0].dump_monitor()
5f2e4547
JM		 2475 except:
2476 if "BoringSSL" in tls and i in [ 25 ]:
2477 logger.info("Ignore connection failure with group %d with BoringSSL" % i)
2478 dev[0].request("DISCONNECT")
2479 time.sleep(0.1)
f2d789f2
JM		 2480 dev[0].request("REMOVE_NETWORK all")
2481 dev[0].dump_monitor()
5f2e4547
JM		 2482 continue
2483 raise
c075f040 2484
4b2d2098
JM		 2485def test_ap_wpa2_eap_pwd_invalid_group(dev, apdev):
2486 """WPA2-Enterprise connection using invalid EAP-pwd group"""
3b51cc63 2487 check_eap_capa(dev[0], "PWD")
4b2d2098
JM		 2488 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2489 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2490 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
2491 params['pwd_group'] = "0"
8b8a1864 2492 hostapd.add_ap(apdev[0], params)
4b2d2098
JM		 2493 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PWD",
2494 identity="pwd user", password="secret password",
2495 scan_freq="2412", wait_connect=False)
2496 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2497 if ev is None:
2498 raise Exception("Timeout on EAP failure report")
2499
8ba89e0a
JM		 2500def test_ap_wpa2_eap_pwd_as_frag(dev, apdev):
2501 """WPA2-Enterprise connection using EAP-pwd with server fragmentation"""
3b51cc63 2502 check_eap_capa(dev[0], "PWD")
8ba89e0a
JM		 2503 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2504 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2505 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2506 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2507 "pwd_group": "19", "fragment_size": "40" }
3b3e2687
JD		 2508 hapd = hostapd.add_ap(apdev[0], params)
2509 eap_connect(dev[0], hapd, "PWD", "pwd user", password="secret password")
8ba89e0a 2510
22b99086
JM		 2511def test_ap_wpa2_eap_gpsk(dev, apdev):
2512 """WPA2-Enterprise connection using EAP-GPSK"""
2513 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2514 hapd = hostapd.add_ap(apdev[0], params)
2515 id = eap_connect(dev[0], hapd, "GPSK", "gpsk user",
369f9c20 2516 password="abcdefghijklmnop0123456789abcdef")
75b2b9cf 2517 eap_reauth(dev[0], "GPSK")
22b99086 2518
369f9c20
JM		 2519 logger.info("Test forced algorithm selection")
2520 for phase1 in [ "cipher=1", "cipher=2" ]:
2521 dev[0].set_network_quoted(id, "phase1", phase1)
2522 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2523 if ev is None:
2524 raise Exception("EAP success timed out")
5f35a5e2 2525 dev[0].wait_connected(timeout=10)
369f9c20
JM		 2526
2527 logger.info("Test failed algorithm negotiation")
2528 dev[0].set_network_quoted(id, "phase1", "cipher=9")
2529 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2530 if ev is None:
2531 raise Exception("EAP failure timed out")
2532
f10ba3b2
JM		 2533 logger.info("Negative test with incorrect password")
2534 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2535 eap_connect(dev[0], hapd, "GPSK", "gpsk user",
f10ba3b2
JM		 2536 password="ffcdefghijklmnop0123456789abcdef",
2537 expect_failure=True)
2538
22b99086
JM		 2539def test_ap_wpa2_eap_sake(dev, apdev):
2540 """WPA2-Enterprise connection using EAP-SAKE"""
2541 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2542 hapd = hostapd.add_ap(apdev[0], params)
2543 eap_connect(dev[0], hapd, "SAKE", "sake user",
22b99086 2544 password_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
75b2b9cf 2545 eap_reauth(dev[0], "SAKE")
22b99086 2546
f10ba3b2
JM		 2547 logger.info("Negative test with incorrect password")
2548 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2549 eap_connect(dev[0], hapd, "SAKE", "sake user",
f10ba3b2
JM		 2550 password_hex="ff23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
2551 expect_failure=True)
2552
22b99086
JM		 2553def test_ap_wpa2_eap_eke(dev, apdev):
2554 """WPA2-Enterprise connection using EAP-EKE"""
2555 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2556 hapd = hostapd.add_ap(apdev[0], params)
2557 id = eap_connect(dev[0], hapd, "EKE", "eke user", password="hello")
75b2b9cf 2558 eap_reauth(dev[0], "EKE")
22b99086 2559
2bb9e283
JM		 2560 logger.info("Test forced algorithm selection")
2561 for phase1 in [ "dhgroup=5 encr=1 prf=2 mac=2",
2562 "dhgroup=4 encr=1 prf=2 mac=2",
2563 "dhgroup=3 encr=1 prf=2 mac=2",
2564 "dhgroup=3 encr=1 prf=1 mac=1" ]:
2565 dev[0].set_network_quoted(id, "phase1", phase1)
2566 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2567 if ev is None:
2568 raise Exception("EAP success timed out")
5f35a5e2 2569 dev[0].wait_connected(timeout=10)
2bb9e283
JM		 2570
2571 logger.info("Test failed algorithm negotiation")
2572 dev[0].set_network_quoted(id, "phase1", "dhgroup=9 encr=9 prf=9 mac=9")
2573 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2574 if ev is None:
2575 raise Exception("EAP failure timed out")
2576
f10ba3b2
JM		 2577 logger.info("Negative test with incorrect password")
2578 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2579 eap_connect(dev[0], hapd, "EKE", "eke user", password="hello1",
f10ba3b2
JM		 2580 expect_failure=True)
2581
3b6f3b37
JM		 2582def test_ap_wpa2_eap_eke_many(dev, apdev, params):
2583 """WPA2-Enterprise connection using EAP-EKE (many connections) [long]"""
2584 if not params['long']:
2585 raise HwsimSkip("Skip test case with long duration due to --long not specified")
2586 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2587 hostapd.add_ap(apdev[0], params)
3b6f3b37
JM		 2588 success = 0
2589 fail = 0
2590 for i in range(100):
2591 for j in range(3):
2592 dev[j].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="EKE",
2593 identity="eke user", password="hello",
2594 phase1="dhgroup=3 encr=1 prf=1 mac=1",
2595 scan_freq="2412", wait_connect=False)
2596 for j in range(3):
2597 ev = dev[j].wait_event(["CTRL-EVENT-CONNECTED",
2598 "CTRL-EVENT-DISCONNECTED"], timeout=15)
2599 if ev is None:
2600 raise Exception("No connected/disconnected event")
2601 if "CTRL-EVENT-DISCONNECTED" in ev:
2602 fail += 1
2603 # The RADIUS server limits on active sessions can be hit when
2604 # going through this test case, so try to give some more time
2605 # for the server to remove sessions.
2606 logger.info("Failed to connect i=%d j=%d" % (i, j))
2607 dev[j].request("REMOVE_NETWORK all")
2608 time.sleep(1)
2609 else:
2610 success += 1
2611 dev[j].request("REMOVE_NETWORK all")
2612 dev[j].wait_disconnected()
2613 dev[j].dump_monitor()
2614 logger.info("Total success=%d failure=%d" % (success, fail))
2615
f7e3c17b
JM		 2616def test_ap_wpa2_eap_eke_serverid_nai(dev, apdev):
2617 """WPA2-Enterprise connection using EAP-EKE with serverid NAI"""
2618 params = int_eap_server_params()
2619 params['server_id'] = 'example.server@w1.fi'
3b3e2687
JD		 2620 hapd = hostapd.add_ap(apdev[0], params)
2621 eap_connect(dev[0], hapd, "EKE", "eke user", password="hello")
f7e3c17b 2622
5e0bedc6
JM		 2623def test_ap_wpa2_eap_eke_server_oom(dev, apdev):
2624 """WPA2-Enterprise connection using EAP-EKE with server OOM"""
2625 params = int_eap_server_params()
8b8a1864 2626 hapd = hostapd.add_ap(apdev[0], params)
5e0bedc6
JM		 2627 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
2628
2629 for count,func in [ (1, "eap_eke_build_commit"),
2630 (2, "eap_eke_build_commit"),
2631 (3, "eap_eke_build_commit"),
2632 (1, "eap_eke_build_confirm"),
2633 (2, "eap_eke_build_confirm"),
2634 (1, "eap_eke_process_commit"),
2635 (2, "eap_eke_process_commit"),
2636 (1, "eap_eke_process_confirm"),
2637 (1, "eap_eke_process_identity"),
2638 (2, "eap_eke_process_identity"),
2639 (3, "eap_eke_process_identity"),
2640 (4, "eap_eke_process_identity") ]:
2641 with alloc_fail(hapd, count, func):
3b3e2687 2642 eap_connect(dev[0], hapd, "EKE", "eke user", password="hello",
5e0bedc6
JM		 2643 expect_failure=True)
2644 dev[0].request("REMOVE_NETWORK all")
2645
2646 for count,func,pw in [ (1, "eap_eke_init", "hello"),
2647 (1, "eap_eke_get_session_id", "hello"),
2648 (1, "eap_eke_getKey", "hello"),
2649 (1, "eap_eke_build_msg", "hello"),
2650 (1, "eap_eke_build_failure", "wrong"),
2651 (1, "eap_eke_build_identity", "hello"),
2652 (2, "eap_eke_build_identity", "hello") ]:
2653 with alloc_fail(hapd, count, func):
2654 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
2655 eap="EKE", identity="eke user", password=pw,
2656 wait_connect=False, scan_freq="2412")
2657 # This would eventually time out, but we can stop after having
2658 # reached the allocation failure.
2659 for i in range(20):
2660 time.sleep(0.1)
2661 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2662 break
2663 dev[0].request("REMOVE_NETWORK all")
2664
2665 for count in range(1, 1000):
2666 try:
2667 with alloc_fail(hapd, count, "eap_server_sm_step"):
2668 dev[0].connect("test-wpa2-eap",
2669 key_mgmt="WPA-EAP WPA-EAP-SHA256",
2670 eap="EKE", identity="eke user", password=pw,
2671 wait_connect=False, scan_freq="2412")
2672 # This would eventually time out, but we can stop after having
2673 # reached the allocation failure.
2674 for i in range(10):
2675 time.sleep(0.1)
2676 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2677 break
2678 dev[0].request("REMOVE_NETWORK all")
2679 except Exception, e:
2680 if str(e) == "Allocation failure did not trigger":
2681 if count < 30:
2682 raise Exception("Too few allocation failures")
2683 logger.info("%d allocation failures tested" % (count - 1))
2684 break
2685 raise e
2686
22b99086
JM		 2687def test_ap_wpa2_eap_ikev2(dev, apdev):
2688 """WPA2-Enterprise connection using EAP-IKEv2"""
c8e82c94 2689 check_eap_capa(dev[0], "IKEV2")
22b99086 2690 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2691 hapd = hostapd.add_ap(apdev[0], params)
2692 eap_connect(dev[0], hapd, "IKEV2", "ikev2 user",
cb33ee14 2693 password="ike password")
75b2b9cf 2694 eap_reauth(dev[0], "IKEV2")
6daf5b9c 2695 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2696 eap_connect(dev[0], hapd, "IKEV2", "ikev2 user",
47a74ad8 2697 password="ike password", fragment_size="50")
22b99086 2698
f10ba3b2
JM		 2699 logger.info("Negative test with incorrect password")
2700 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2701 eap_connect(dev[0], hapd, "IKEV2", "ikev2 user",
f10ba3b2 2702 password="ike-password", expect_failure=True)
35372f6c
JM		 2703 dev[0].request("REMOVE_NETWORK all")
2704
3b3e2687 2705 eap_connect(dev[0], hapd, "IKEV2", "ikev2 user",
35372f6c
JM		 2706 password="ike password", fragment_size="0")
2707 dev[0].request("REMOVE_NETWORK all")
2708 dev[0].wait_disconnected()
f10ba3b2 2709
47a74ad8
JM		 2710def test_ap_wpa2_eap_ikev2_as_frag(dev, apdev):
2711 """WPA2-Enterprise connection using EAP-IKEv2 with server fragmentation"""
c8e82c94 2712 check_eap_capa(dev[0], "IKEV2")
47a74ad8
JM		 2713 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2714 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2715 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2716 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2717 "fragment_size": "50" }
3b3e2687
JD		 2718 hapd = hostapd.add_ap(apdev[0], params)
2719 eap_connect(dev[0], hapd, "IKEV2", "ikev2 user",
47a74ad8
JM		 2720 password="ike password")
2721 eap_reauth(dev[0], "IKEV2")
2722
f1ab79c3
JM		 2723def test_ap_wpa2_eap_ikev2_oom(dev, apdev):
2724 """WPA2-Enterprise connection using EAP-IKEv2 and OOM"""
c8e82c94 2725 check_eap_capa(dev[0], "IKEV2")
f1ab79c3 2726 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2727 hostapd.add_ap(apdev[0], params)
f1ab79c3
JM		 2728
2729 tests = [ (1, "dh_init"),
2730 (2, "dh_init"),
2731 (1, "dh_derive_shared") ]
2732 for count, func in tests:
2733 with alloc_fail(dev[0], count, func):
2734 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2735 identity="ikev2 user", password="ike password",
2736 wait_connect=False, scan_freq="2412")
2737 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2738 if ev is None:
2739 raise Exception("EAP method not selected")
2740 for i in range(10):
2741 if "0:" in dev[0].request("GET_ALLOC_FAIL"):
2742 break
2743 time.sleep(0.02)
2744 dev[0].request("REMOVE_NETWORK all")
2745
2746 tests = [ (1, "os_get_random;dh_init") ]
2747 for count, func in tests:
2748 with fail_test(dev[0], count, func):
2749 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2750 identity="ikev2 user", password="ike password",
2751 wait_connect=False, scan_freq="2412")
2752 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2753 if ev is None:
2754 raise Exception("EAP method not selected")
2755 for i in range(10):
2756 if "0:" in dev[0].request("GET_FAIL"):
2757 break
2758 time.sleep(0.02)
2759 dev[0].request("REMOVE_NETWORK all")
2760
22b99086
JM		 2761def test_ap_wpa2_eap_pax(dev, apdev):
2762 """WPA2-Enterprise connection using EAP-PAX"""
2763 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2764 hapd = hostapd.add_ap(apdev[0], params)
2765 eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
22b99086 2766 password_hex="0123456789abcdef0123456789abcdef")
75b2b9cf 2767 eap_reauth(dev[0], "PAX")
22b99086 2768
f10ba3b2
JM		 2769 logger.info("Negative test with incorrect password")
2770 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2771 eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
f10ba3b2
JM		 2772 password_hex="ff23456789abcdef0123456789abcdef",
2773 expect_failure=True)
2774
22b99086
JM		 2775def test_ap_wpa2_eap_psk(dev, apdev):
2776 """WPA2-Enterprise connection using EAP-PSK"""
2777 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2b005194
JM		 2778 params["wpa_key_mgmt"] = "WPA-EAP-SHA256"
2779 params["ieee80211w"] = "2"
3b3e2687
JD		 2780 hapd = hostapd.add_ap(apdev[0], params)
2781 eap_connect(dev[0], hapd, "PSK", "psk.user@example.com",
2b005194
JM		 2782 password_hex="0123456789abcdef0123456789abcdef", sha256=True)
2783 eap_reauth(dev[0], "PSK", sha256=True)
eaf3f9b1
JM		 2784 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-5"),
2785 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-5") ])
71390dc8 2786
d463c556
JM		 2787 bss = dev[0].get_bss(apdev[0]['bssid'])
2788 if 'flags' not in bss:
2789 raise Exception("Could not get BSS flags from BSS table")
2790 if "[WPA2-EAP-SHA256-CCMP]" not in bss['flags']:
2791 raise Exception("Unexpected BSS flags: " + bss['flags'])
2792
f10ba3b2
JM		 2793 logger.info("Negative test with incorrect password")
2794 dev[0].request("REMOVE_NETWORK all")
3b3e2687 2795 eap_connect(dev[0], hapd, "PSK", "psk.user@example.com",
f10ba3b2
JM		 2796 password_hex="ff23456789abcdef0123456789abcdef", sha256=True,
2797 expect_failure=True)
2798
8c4e4c01
JM		 2799def test_ap_wpa2_eap_psk_oom(dev, apdev):
2800 """WPA2-Enterprise connection using EAP-PSK and OOM"""
38934ed1 2801 skip_with_fips(dev[0])
8c4e4c01 2802 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2803 hostapd.add_ap(apdev[0], params)
7cbc8e67
JM		 2804 tests = [ (1, "=aes_128_eax_encrypt"),
2805 (1, "=aes_128_eax_decrypt") ]
2806 for count, func in tests:
2807 with alloc_fail(dev[0], count, func):
2808 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2809 identity="psk.user@example.com",
2810 password_hex="0123456789abcdef0123456789abcdef",
2811 wait_connect=False, scan_freq="2412")
2812 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2813 if ev is None:
2814 raise Exception("EAP method not selected")
2815 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL",
2816 note="Failure not triggered: %d:%s" % (count, func))
2817 dev[0].request("REMOVE_NETWORK all")
2818 dev[0].wait_disconnected()
2819
677c2283 2820 tests = [ (1, "aes_ctr_encrypt;aes_128_eax_encrypt"),
8c4e4c01
JM		 2821 (1, "omac1_aes_128;aes_128_eax_encrypt"),
2822 (2, "omac1_aes_128;aes_128_eax_encrypt"),
2823 (3, "omac1_aes_128;aes_128_eax_encrypt"),
8c4e4c01 2824 (1, "omac1_aes_vector"),
8c4e4c01
JM		 2825 (1, "omac1_aes_128;aes_128_eax_decrypt"),
2826 (2, "omac1_aes_128;aes_128_eax_decrypt"),
2827 (3, "omac1_aes_128;aes_128_eax_decrypt"),
677c2283 2828 (1, "aes_ctr_encrypt;aes_128_eax_decrypt") ]
8c4e4c01 2829 for count, func in tests:
7cbc8e67 2830 with fail_test(dev[0], count, func):
8c4e4c01
JM		 2831 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2832 identity="psk.user@example.com",
2833 password_hex="0123456789abcdef0123456789abcdef",
2834 wait_connect=False, scan_freq="2412")
2835 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2836 if ev is None:
2837 raise Exception("EAP method not selected")
7cbc8e67
JM		 2838 wait_fail_trigger(dev[0], "GET_FAIL",
2839 note="Failure not triggered: %d:%s" % (count, func))
8c4e4c01 2840 dev[0].request("REMOVE_NETWORK all")
7cbc8e67 2841 dev[0].wait_disconnected()
8c4e4c01 2842
7cbc8e67 2843 with fail_test(dev[0], 1, "aes_128_encrypt_block"):
8c4e4c01
JM		 2844 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2845 identity="psk.user@example.com",
2846 password_hex="0123456789abcdef0123456789abcdef",
2847 wait_connect=False, scan_freq="2412")
2848 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2849 if ev is None:
2850 raise Exception("EAP method failure not reported")
2851 dev[0].request("REMOVE_NETWORK all")
7cbc8e67 2852 dev[0].wait_disconnected()
8c4e4c01 2853
71390dc8
JM		 2854def test_ap_wpa_eap_peap_eap_mschapv2(dev, apdev):
2855 """WPA-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 2856 check_eap_capa(dev[0], "MSCHAPV2")
71390dc8 2857 params = hostapd.wpa_eap_params(ssid="test-wpa-eap")
8b8a1864 2858 hapd = hostapd.add_ap(apdev[0], params)
71390dc8
JM		 2859 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="PEAP",
2860 identity="user", password="password", phase2="auth=MSCHAPV2",
2861 ca_cert="auth_serv/ca.pem", wait_connect=False,
2862 scan_freq="2412")
2863 eap_check_auth(dev[0], "PEAP", True, rsn=False)
a8375c94 2864 hwsim_utils.test_connectivity(dev[0], hapd)
71390dc8 2865 eap_reauth(dev[0], "PEAP", rsn=False)
eaf3f9b1
JM		 2866 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-50-f2-1"),
2867 ("dot11RSNAAuthenticationSuiteSelected", "00-50-f2-1") ])
48bb2e68
JM		 2868 status = dev[0].get_status(extra="VERBOSE")
2869 if 'portControl' not in status:
2870 raise Exception("portControl missing from STATUS-VERBOSE")
2871 if status['portControl'] != 'Auto':
2872 raise Exception("Unexpected portControl value: " + status['portControl'])
2873 if 'eap_session_id' not in status:
2874 raise Exception("eap_session_id missing from STATUS-VERBOSE")
2875 if not status['eap_session_id'].startswith("19"):
2876 raise Exception("Unexpected eap_session_id value: " + status['eap_session_id'])
40759604
JM		 2877
2878def test_ap_wpa2_eap_interactive(dev, apdev):
2879 """WPA2-Enterprise connection using interactive identity/password entry"""
e7ac04ce 2880 check_eap_capa(dev[0], "MSCHAPV2")
40759604 2881 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
6f334bf7 2882 hapd = hostapd.add_ap(apdev[0], params)
40759604
JM		 2883
2884 tests = [ ("Connection with dynamic TTLS/MSCHAPv2 password entry",
2885 "TTLS", "ttls", "DOMAIN\mschapv2 user", "auth=MSCHAPV2",
2886 None, "password"),
2887 ("Connection with dynamic TTLS/MSCHAPv2 identity and password entry",
2888 "TTLS", "ttls", None, "auth=MSCHAPV2",
2889 "DOMAIN\mschapv2 user", "password"),
2890 ("Connection with dynamic TTLS/EAP-MSCHAPv2 password entry",
2891 "TTLS", "ttls", "user", "autheap=MSCHAPV2", None, "password"),
2892 ("Connection with dynamic TTLS/EAP-MD5 password entry",
2893 "TTLS", "ttls", "user", "autheap=MD5", None, "password"),
2894 ("Connection with dynamic PEAP/EAP-MSCHAPv2 password entry",
2895 "PEAP", None, "user", "auth=MSCHAPV2", None, "password"),
2896 ("Connection with dynamic PEAP/EAP-GTC password entry",
2897 "PEAP", None, "user", "auth=GTC", None, "password") ]
2898 for [desc,eap,anon,identity,phase2,req_id,req_pw] in tests:
2899 logger.info(desc)
2900 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap=eap,
2901 anonymous_identity=anon, identity=identity,
2902 ca_cert="auth_serv/ca.pem", phase2=phase2,
2903 wait_connect=False, scan_freq="2412")
2904 if req_id:
2905 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2906 if ev is None:
2907 raise Exception("Request for identity timed out")
2908 id = ev.split(':')[0].split('-')[-1]
2909 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2910 ev = dev[0].wait_event(["CTRL-REQ-PASSWORD","CTRL-REQ-OTP"])
2911 if ev is None:
2912 raise Exception("Request for password timed out")
2913 id = ev.split(':')[0].split('-')[-1]
2914 type = "OTP" if "CTRL-REQ-OTP" in ev else "PASSWORD"
2915 dev[0].request("CTRL-RSP-" + type + "-" + id + ":" + req_pw)
5f35a5e2 2916 dev[0].wait_connected(timeout=10)
40759604 2917 dev[0].request("REMOVE_NETWORK all")
e745c811 2918
f455998a
JM		 2919def test_ap_wpa2_eap_ext_enable_network_while_connected(dev, apdev):
2920 """WPA2-Enterprise interactive identity entry and ENABLE_NETWORK"""
2921 check_eap_capa(dev[0], "MSCHAPV2")
2922 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
6f334bf7 2923 hapd = hostapd.add_ap(apdev[0], params)
f455998a
JM		 2924
2925 id_other = dev[0].connect("other", key_mgmt="NONE", scan_freq="2412",
2926 only_add_network=True)
2927
2928 req_id = "DOMAIN\mschapv2 user"
2929 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2930 anonymous_identity="ttls", identity=None,
2931 password="password",
2932 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2933 wait_connect=False, scan_freq="2412")
2934 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2935 if ev is None:
2936 raise Exception("Request for identity timed out")
2937 id = ev.split(':')[0].split('-')[-1]
2938 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2939 dev[0].wait_connected(timeout=10)
2940
2941 if "OK" not in dev[0].request("ENABLE_NETWORK " + str(id_other)):
2942 raise Exception("Failed to enable network")
2943 ev = dev[0].wait_event(["SME: Trying to authenticate"], timeout=1)
2944 if ev is not None:
2945 raise Exception("Unexpected reconnection attempt on ENABLE_NETWORK")
2946 dev[0].request("REMOVE_NETWORK all")
2947
e745c811
JM		 2948def test_ap_wpa2_eap_vendor_test(dev, apdev):
2949 """WPA2-Enterprise connection using EAP vendor test"""
2950 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 2951 hapd = hostapd.add_ap(apdev[0], params)
2952 eap_connect(dev[0], hapd, "VENDOR-TEST", "vendor-test")
e745c811 2953 eap_reauth(dev[0], "VENDOR-TEST")
3b3e2687 2954 eap_connect(dev[1], hapd, "VENDOR-TEST", "vendor-test",
467775c5 2955 password="pending")
53a6f06a 2956
79a3973c
JM		 2957def test_ap_wpa2_eap_vendor_test_oom(dev, apdev):
2958 """WPA2-Enterprise connection using EAP vendor test (OOM)"""
2959 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2960 hostapd.add_ap(apdev[0], params)
79a3973c
JM		 2961
2962 tests = [ "eap_vendor_test_init",
2963 "eap_msg_alloc;eap_vendor_test_process",
2964 "eap_vendor_test_getKey" ]
2965 for func in tests:
2966 with alloc_fail(dev[0], 1, func):
2967 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
2968 scan_freq="2412",
2969 eap="VENDOR-TEST", identity="vendor-test",
2970 wait_connect=False)
2971 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
2972 dev[0].request("REMOVE_NETWORK all")
2973 dev[0].wait_disconnected()
2974
53a6f06a
JM		 2975def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev):
2976 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning"""
3b51cc63 2977 check_eap_capa(dev[0], "FAST")
53a6f06a 2978 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 2979 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 2980 eap_connect(dev[0], hapd, "FAST", "user",
53a6f06a
JM		 2981 anonymous_identity="FAST", password="password",
2982 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2983 phase1="fast_provisioning=1", pac_file="blob://fast_pac")
a8375c94 2984 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 2985 res = eap_reauth(dev[0], "FAST")
2986 if res['tls_session_reused'] != '1':
2987 raise Exception("EAP-FAST could not use PAC session ticket")
53a6f06a 2988
873e7c29
JM		 2989def test_ap_wpa2_eap_fast_pac_file(dev, apdev, params):
2990 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and PAC file"""
3b51cc63 2991 check_eap_capa(dev[0], "FAST")
873e7c29
JM		 2992 pac_file = os.path.join(params['logdir'], "fast.pac")
2993 pac_file2 = os.path.join(params['logdir'], "fast-bin.pac")
2994 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 2995 hapd = hostapd.add_ap(apdev[0], params)
873e7c29
JM		 2996
2997 try:
3b3e2687 2998 eap_connect(dev[0], hapd, "FAST", "user",
873e7c29
JM		 2999 anonymous_identity="FAST", password="password",
3000 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3001 phase1="fast_provisioning=1", pac_file=pac_file)
3002 with open(pac_file, "r") as f:
3003 data = f.read()
3004 if "wpa_supplicant EAP-FAST PAC file - version 1" not in data:
3005 raise Exception("PAC file header missing")
3006 if "PAC-Key=" not in data:
3007 raise Exception("PAC-Key missing from PAC file")
3008 dev[0].request("REMOVE_NETWORK all")
3b3e2687 3009 eap_connect(dev[0], hapd, "FAST", "user",
873e7c29
JM		 3010 anonymous_identity="FAST", password="password",
3011 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3012 pac_file=pac_file)
3013
3b3e2687 3014 eap_connect(dev[1], hapd, "FAST", "user",
873e7c29
JM		 3015 anonymous_identity="FAST", password="password",
3016 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3017 phase1="fast_provisioning=1 fast_pac_format=binary",
3018 pac_file=pac_file2)
3019 dev[1].request("REMOVE_NETWORK all")
3b3e2687 3020 eap_connect(dev[1], hapd, "FAST", "user",
873e7c29
JM		 3021 anonymous_identity="FAST", password="password",
3022 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3023 phase1="fast_pac_format=binary",
3024 pac_file=pac_file2)
3025 finally:
b638f703
JM		 3026 try:
3027 os.remove(pac_file)
3028 except:
3029 pass
3030 try:
3031 os.remove(pac_file2)
3032 except:
3033 pass
873e7c29 3034
c6ab1cdb
JM		 3035def test_ap_wpa2_eap_fast_binary_pac(dev, apdev):
3036 """WPA2-Enterprise connection using EAP-FAST and binary PAC format"""
3b51cc63 3037 check_eap_capa(dev[0], "FAST")
c6ab1cdb 3038 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 3039 hapd = hostapd.add_ap(apdev[0], params)
3040 eap_connect(dev[0], hapd, "FAST", "user",
c6ab1cdb
JM		 3041 anonymous_identity="FAST", password="password",
3042 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3043 phase1="fast_provisioning=1 fast_max_pac_list_len=1 fast_pac_format=binary",
3044 pac_file="blob://fast_pac_bin")
2fc4749c
JM		 3045 res = eap_reauth(dev[0], "FAST")
3046 if res['tls_session_reused'] != '1':
3047 raise Exception("EAP-FAST could not use PAC session ticket")
c6ab1cdb 3048
d7ef6e63
JM		 3049 # Verify fast_max_pac_list_len=0 special case
3050 dev[0].request("REMOVE_NETWORK all")
3051 dev[0].wait_disconnected()
3b3e2687 3052 eap_connect(dev[0], hapd, "FAST", "user",
d7ef6e63
JM		 3053 anonymous_identity="FAST", password="password",
3054 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3055 phase1="fast_provisioning=1 fast_max_pac_list_len=0 fast_pac_format=binary",
3056 pac_file="blob://fast_pac_bin")
3057
46e094bd
JM		 3058def test_ap_wpa2_eap_fast_missing_pac_config(dev, apdev):
3059 """WPA2-Enterprise connection using EAP-FAST and missing PAC config"""
3b51cc63 3060 check_eap_capa(dev[0], "FAST")
46e094bd 3061 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3062 hostapd.add_ap(apdev[0], params)
46e094bd
JM		 3063
3064 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3065 identity="user", anonymous_identity="FAST",
3066 password="password",
3067 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3068 pac_file="blob://fast_pac_not_in_use",
3069 wait_connect=False, scan_freq="2412")
3070 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3071 if ev is None:
3072 raise Exception("Timeout on EAP failure report")
3073 dev[0].request("REMOVE_NETWORK all")
3074
3075 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3076 identity="user", anonymous_identity="FAST",
3077 password="password",
3078 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3079 wait_connect=False, scan_freq="2412")
3080 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3081 if ev is None:
3082 raise Exception("Timeout on EAP failure report")
3083
93aa1e16
JM		 3084def test_ap_wpa2_eap_fast_binary_pac_errors(dev, apdev):
3085 """EAP-FAST and binary PAC errors"""
3086 check_eap_capa(dev[0], "FAST")
3087 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 3088 hapd = hostapd.add_ap(apdev[0], params)
93aa1e16
JM		 3089
3090 tests = [ (1, "=eap_fast_save_pac_bin"),
3091 (1, "eap_fast_write_pac"),
3092 (2, "eap_fast_write_pac"), ]
3093 for count, func in tests:
3094 if "OK" not in dev[0].request("SET blob fast_pac_bin_errors "):
3095 raise Exception("Could not set blob")
3096
3097 with alloc_fail(dev[0], count, func):
3b3e2687 3098 eap_connect(dev[0], hapd, "FAST", "user",
93aa1e16
JM		 3099 anonymous_identity="FAST", password="password",
3100 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3101 phase1="fast_provisioning=1 fast_pac_format=binary",
3102 pac_file="blob://fast_pac_bin_errors")
3103 dev[0].request("REMOVE_NETWORK all")
3104 dev[0].wait_disconnected()
3105
3106 tests = [ "00", "000000000000", "6ae4920c0001",
3107 "6ae4920c000000",
3108 "6ae4920c0000" + "0000" + 32*"00" + "ffff" + "0000",
3109 "6ae4920c0000" + "0000" + 32*"00" + "0001" + "0000",
3110 "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0001",
3111 "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0008" + "00040000" + "0007000100"]
3112 for t in tests:
3113 if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + t):
3114 raise Exception("Could not set blob")
3115
3116 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3117 identity="user", anonymous_identity="FAST",
3118 password="password",
3119 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3120 phase1="fast_provisioning=1 fast_pac_format=binary",
3121 pac_file="blob://fast_pac_bin_errors",
3122 scan_freq="2412", wait_connect=False)
3123 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"],
3124 timeout=5)
3125 if ev is None:
3126 raise Exception("Failure not reported")
3127 dev[0].request("REMOVE_NETWORK all")
3128 dev[0].wait_disconnected()
3129
3130 pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0000"
3131 tests = [ (1, "eap_fast_load_pac_bin"),
3132 (2, "eap_fast_load_pac_bin"),
3133 (3, "eap_fast_load_pac_bin") ]
3134 for count, func in tests:
3135 if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac):
3136 raise Exception("Could not set blob")
3137
3138 with alloc_fail(dev[0], count, func):
3139 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3140 identity="user", anonymous_identity="FAST",
3141 password="password",
3142 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3143 phase1="fast_provisioning=1 fast_pac_format=binary",
3144 pac_file="blob://fast_pac_bin_errors",
3145 scan_freq="2412", wait_connect=False)
3146 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"],
3147 timeout=5)
3148 if ev is None:
3149 raise Exception("Failure not reported")
3150 dev[0].request("REMOVE_NETWORK all")
3151 dev[0].wait_disconnected()
3152
3153 pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0005" + "0011223344"
3154 if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac):
3155 raise Exception("Could not set blob")
3156
3b3e2687 3157 eap_connect(dev[0], hapd, "FAST", "user",
93aa1e16
JM		 3158 anonymous_identity="FAST", password="password",
3159 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3160 phase1="fast_provisioning=1 fast_pac_format=binary",
3161 pac_file="blob://fast_pac_bin_errors")
3162 dev[0].request("REMOVE_NETWORK all")
3163 dev[0].wait_disconnected()
3164
3165 pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0009" + "00040000" + "0007000100"
3166 tests = [ (1, "eap_fast_pac_get_a_id"),
3167 (2, "eap_fast_pac_get_a_id") ]
3168 for count, func in tests:
3169 if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac):
3170 raise Exception("Could not set blob")
3171 with alloc_fail(dev[0], count, func):
3b3e2687 3172 eap_connect(dev[0], hapd, "FAST", "user",
93aa1e16
JM		 3173 anonymous_identity="FAST", password="password",
3174 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3175 phase1="fast_provisioning=1 fast_pac_format=binary",
3176 pac_file="blob://fast_pac_bin_errors")
3177 dev[0].request("REMOVE_NETWORK all")
3178 dev[0].wait_disconnected()
3179
592790bf
JM		 3180def test_ap_wpa2_eap_fast_text_pac_errors(dev, apdev):
3181 """EAP-FAST and text PAC errors"""
3182 check_eap_capa(dev[0], "FAST")
3183 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3184 hostapd.add_ap(apdev[0], params)
592790bf
JM		 3185
3186 tests = [ (1, "eap_fast_parse_hex;eap_fast_parse_pac_key"),
3187 (1, "eap_fast_parse_hex;eap_fast_parse_pac_opaque"),
3188 (1, "eap_fast_parse_hex;eap_fast_parse_a_id"),
3189 (1, "eap_fast_parse_start"),
3190 (1, "eap_fast_save_pac") ]
3191 for count, func in tests:
3192 dev[0].request("FLUSH")
3193 if "OK" not in dev[0].request("SET blob fast_pac_text_errors "):
3194 raise Exception("Could not set blob")
3195
3196 with alloc_fail(dev[0], count, func):
3197 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3198 identity="user", anonymous_identity="FAST",
3199 password="password",
3200 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3201 phase1="fast_provisioning=1",
3202 pac_file="blob://fast_pac_text_errors",
3203 scan_freq="2412", wait_connect=False)
3204 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
3205 dev[0].request("REMOVE_NETWORK all")
3206 dev[0].wait_disconnected()
3207
3208 pac = "wpa_supplicant EAP-FAST PAC file - version 1\n"
3209 pac += "START\n"
3210 pac += "PAC-Type\n"
3211 pac += "END\n"
3212 if "OK" not in dev[0].request("SET blob fast_pac_text_errors " + pac.encode("hex")):
3213 raise Exception("Could not set blob")
3214
3215 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3216 identity="user", anonymous_identity="FAST",
3217 password="password",
3218 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3219 phase1="fast_provisioning=1",
3220 pac_file="blob://fast_pac_text_errors",
3221 scan_freq="2412", wait_connect=False)
3222 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], timeout=5)
3223 if ev is None:
3224 raise Exception("Failure not reported")
3225 dev[0].request("REMOVE_NETWORK all")
3226 dev[0].wait_disconnected()
3227
3228 dev[0].request("FLUSH")
3229 if "OK" not in dev[0].request("SET blob fast_pac_text_errors "):
3230 raise Exception("Could not set blob")
3231
3232 with alloc_fail(dev[0], 1, "eap_fast_add_pac_data"):
3233 for i in range(3):
3234 params = int_eap_server_params()
3235 params['ssid'] = "test-wpa2-eap-2"
3236 params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i
3237 params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i
3238 params['eap_fast_a_id_info'] = "test server %d" % i
3239
8b8a1864 3240 hapd2 = hostapd.add_ap(apdev[1], params)
592790bf
JM		 3241
3242 dev[0].connect("test-wpa2-eap-2", key_mgmt="WPA-EAP", eap="FAST",
3243 identity="user", anonymous_identity="FAST",
3244 password="password",
3245 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3246 phase1="fast_provisioning=1",
3247 pac_file="blob://fast_pac_text_errors",
3248 scan_freq="2412", wait_connect=False)
3249 dev[0].wait_connected()
3250 dev[0].request("REMOVE_NETWORK all")
3251 dev[0].wait_disconnected()
3252
3253 hapd2.disable()
3254
3255def test_ap_wpa2_eap_fast_pac_truncate(dev, apdev):
3256 """EAP-FAST and PAC list truncation"""
3257 check_eap_capa(dev[0], "FAST")
3258 if "OK" not in dev[0].request("SET blob fast_pac_truncate "):
3259 raise Exception("Could not set blob")
3260 for i in range(5):
3261 params = int_eap_server_params()
3262 params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i
3263 params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i
3264 params['eap_fast_a_id_info'] = "test server %d" % i
8b8a1864 3265 hapd = hostapd.add_ap(apdev[0], params)
592790bf
JM		 3266
3267 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3268 identity="user", anonymous_identity="FAST",
3269 password="password",
3270 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3271 phase1="fast_provisioning=1 fast_max_pac_list_len=2",
3272 pac_file="blob://fast_pac_truncate",
3273 scan_freq="2412", wait_connect=False)
3274 dev[0].wait_connected()
3275 dev[0].request("REMOVE_NETWORK all")
3276 dev[0].wait_disconnected()
3277
3278 hapd.disable()
3279
3280def test_ap_wpa2_eap_fast_pac_refresh(dev, apdev):
3281 """EAP-FAST and PAC refresh"""
3282 check_eap_capa(dev[0], "FAST")
3283 if "OK" not in dev[0].request("SET blob fast_pac_refresh "):
3284 raise Exception("Could not set blob")
3285 for i in range(2):
3286 params = int_eap_server_params()
3287 params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i
3288 params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i
3289 params['eap_fast_a_id_info'] = "test server %d" % i
3290 params['pac_key_refresh_time'] = "1"
3291 params['pac_key_lifetime'] = "10"
8b8a1864 3292 hapd = hostapd.add_ap(apdev[0], params)
592790bf
JM		 3293
3294 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3295 identity="user", anonymous_identity="FAST",
3296 password="password",
3297 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3298 phase1="fast_provisioning=1",
3299 pac_file="blob://fast_pac_refresh",
3300 scan_freq="2412", wait_connect=False)
3301 dev[0].wait_connected()
3302 dev[0].request("REMOVE_NETWORK all")
3303 dev[0].wait_disconnected()
3304
3305 hapd.disable()
3306
3307 for i in range(2):
3308 params = int_eap_server_params()
3309 params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i
3310 params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i
3311 params['eap_fast_a_id_info'] = "test server %d" % i
3312 params['pac_key_refresh_time'] = "10"
3313 params['pac_key_lifetime'] = "10"
8b8a1864 3314 hapd = hostapd.add_ap(apdev[0], params)
592790bf
JM		 3315
3316 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3317 identity="user", anonymous_identity="FAST",
3318 password="password",
3319 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3320 phase1="fast_provisioning=1",
3321 pac_file="blob://fast_pac_refresh",
3322 scan_freq="2412", wait_connect=False)
3323 dev[0].wait_connected()
3324 dev[0].request("REMOVE_NETWORK all")
3325 dev[0].wait_disconnected()
3326
3327 hapd.disable()
3328
3329def test_ap_wpa2_eap_fast_pac_lifetime(dev, apdev):
3330 """EAP-FAST and PAC lifetime"""
3331 check_eap_capa(dev[0], "FAST")
3332 if "OK" not in dev[0].request("SET blob fast_pac_refresh "):
3333 raise Exception("Could not set blob")
3334
3335 i = 0
3336 params = int_eap_server_params()
3337 params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i
3338 params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i
3339 params['eap_fast_a_id_info'] = "test server %d" % i
3340 params['pac_key_refresh_time'] = "0"
3341 params['pac_key_lifetime'] = "2"
8b8a1864 3342 hapd = hostapd.add_ap(apdev[0], params)
592790bf
JM		 3343
3344 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3345 identity="user", anonymous_identity="FAST",
3346 password="password",
3347 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3348 phase1="fast_provisioning=2",
3349 pac_file="blob://fast_pac_refresh",
3350 scan_freq="2412", wait_connect=False)
3351 dev[0].wait_connected()
3352 dev[0].request("DISCONNECT")
3353 dev[0].wait_disconnected()
3354
3355 time.sleep(3)
3356 dev[0].request("PMKSA_FLUSH")
3357 dev[0].request("RECONNECT")
3358 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
3359 if ev is None:
3360 raise Exception("No EAP-Failure seen after expired PAC")
3361 dev[0].request("DISCONNECT")
3362 dev[0].wait_disconnected()
3363
3364 dev[0].select_network(id)
3365 dev[0].wait_connected()
3366 dev[0].request("REMOVE_NETWORK all")
3367 dev[0].wait_disconnected()
3368
53a6f06a
JM		 3369def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev):
3370 """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning"""
3b51cc63 3371 check_eap_capa(dev[0], "FAST")
53a6f06a 3372 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3373 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 3374 eap_connect(dev[0], hapd, "FAST", "user",
53a6f06a
JM		 3375 anonymous_identity="FAST", password="password",
3376 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
3377 phase1="fast_provisioning=2", pac_file="blob://fast_pac_auth")
a8375c94 3378 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 3379 res = eap_reauth(dev[0], "FAST")
3380 if res['tls_session_reused'] != '1':
3381 raise Exception("EAP-FAST could not use PAC session ticket")
d4c7a2b9 3382
95a15d79
JM		 3383def test_ap_wpa2_eap_fast_gtc_identity_change(dev, apdev):
3384 """WPA2-Enterprise connection using EAP-FAST/GTC and identity changing"""
3385 check_eap_capa(dev[0], "FAST")
3386 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3387 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 3388 id = eap_connect(dev[0], hapd, "FAST", "user",
95a15d79
JM		 3389 anonymous_identity="FAST", password="password",
3390 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
3391 phase1="fast_provisioning=2",
3392 pac_file="blob://fast_pac_auth")
3393 dev[0].set_network_quoted(id, "identity", "user2")
3394 dev[0].wait_disconnected()
3395 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
3396 if ev is None:
3397 raise Exception("EAP-FAST not started")
3398 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
3399 if ev is None:
3400 raise Exception("EAP failure not reported")
3401 dev[0].wait_disconnected()
3402
27f2fab0
JM		 3403def test_ap_wpa2_eap_fast_prf_oom(dev, apdev):
3404 """WPA2-Enterprise connection using EAP-FAST and OOM in PRF"""
3405 check_eap_capa(dev[0], "FAST")
cc71035f
JM		 3406 tls = dev[0].request("GET tls_library")
3407 if tls.startswith("OpenSSL"):
90b4c73f 3408 func = "tls_connection_get_eap_fast_key"
cc71035f
JM		 3409 count = 2
3410 elif tls.startswith("internal"):
3411 func = "tls_connection_prf"
3412 count = 1
3413 else:
3414 raise HwsimSkip("Unsupported TLS library")
27f2fab0 3415 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3416 hapd = hostapd.add_ap(apdev[0], params)
cc71035f 3417 with alloc_fail(dev[0], count, func):
27f2fab0
JM		 3418 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
3419 identity="user", anonymous_identity="FAST",
3420 password="password", ca_cert="auth_serv/ca.pem",
3421 phase2="auth=GTC",
3422 phase1="fast_provisioning=2",
3423 pac_file="blob://fast_pac_auth",
3424 wait_connect=False, scan_freq="2412")
3425 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
3426 if ev is None:
3427 raise Exception("EAP failure not reported")
3428 dev[0].request("DISCONNECT")
3429
6eddd530
JM		 3430def test_ap_wpa2_eap_fast_server_oom(dev, apdev):
3431 """EAP-FAST/MSCHAPv2 and server OOM"""
3432 check_eap_capa(dev[0], "FAST")
3433
3434 params = int_eap_server_params()
3435 params['dh_file'] = 'auth_serv/dh.conf'
3436 params['pac_opaque_encr_key'] = '000102030405060708090a0b0c0d0e0f'
3437 params['eap_fast_a_id'] = '1011'
3438 params['eap_fast_a_id_info'] = 'another test server'
8b8a1864 3439 hapd = hostapd.add_ap(apdev[0], params)
6eddd530
JM		 3440
3441 with alloc_fail(hapd, 1, "tls_session_ticket_ext_cb"):
3b3e2687 3442 id = eap_connect(dev[0], hapd, "FAST", "user",
6eddd530
JM		 3443 anonymous_identity="FAST", password="password",
3444 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3445 phase1="fast_provisioning=1",
3446 pac_file="blob://fast_pac",
3447 expect_failure=True)
3448 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
3449 if ev is None:
3450 raise Exception("No EAP failure reported")
3451 dev[0].wait_disconnected()
3452 dev[0].request("DISCONNECT")
3453
3454 dev[0].select_network(id, freq="2412")
3455
ecd07de4
JM		 3456def test_ap_wpa2_eap_fast_cipher_suites(dev, apdev):
3457 """EAP-FAST and different TLS cipher suites"""
3458 check_eap_capa(dev[0], "FAST")
3459 tls = dev[0].request("GET tls_library")
3460 if not tls.startswith("OpenSSL"):
3461 raise HwsimSkip("TLS library is not OpenSSL: " + tls)
3462
3463 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 3464 hapd = hostapd.add_ap(apdev[0], params)
ecd07de4
JM		 3465
3466 dev[0].request("SET blob fast_pac_ciphers ")
3b3e2687 3467 eap_connect(dev[0], hapd, "FAST", "user",
ecd07de4
JM		 3468 anonymous_identity="FAST", password="password",
3469 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
3470 phase1="fast_provisioning=2",
3471 pac_file="blob://fast_pac_ciphers")
3472 res = dev[0].get_status_field('EAP TLS cipher')
3473 dev[0].request("REMOVE_NETWORK all")
3474 dev[0].wait_disconnected()
3475 if res != "DHE-RSA-AES256-SHA":
3476 raise Exception("Unexpected cipher suite for provisioning: " + res)
3477
3478 tests = [ "DHE-RSA-AES128-SHA",
3479 "RC4-SHA",
3480 "AES128-SHA",
3481 "AES256-SHA",
3482 "DHE-RSA-AES256-SHA" ]
3483 for cipher in tests:
71666dc3
JM		 3484 dev[0].dump_monitor()
3485 logger.info("Testing " + cipher)
3486 try:
3b3e2687 3487 eap_connect(dev[0], hapd, "FAST", "user",
71666dc3
JM		 3488 openssl_ciphers=cipher,
3489 anonymous_identity="FAST", password="password",
3490 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
3491 pac_file="blob://fast_pac_ciphers")
3492 except Exception, e:
3493 if "Could not select EAP method" in str(e) and cipher == "RC4-SHA":
3494 tls = dev[0].request("GET tls_library")
3495 if "run=OpenSSL 1.1" in tls:
3496 logger.info("Allow failure due to missing TLS library support")
3497 dev[0].request("REMOVE_NETWORK all")
3498 dev[0].wait_disconnected()
3499 continue
3500 raise
ecd07de4
JM		 3501 res = dev[0].get_status_field('EAP TLS cipher')
3502 dev[0].request("REMOVE_NETWORK all")
3503 dev[0].wait_disconnected()
3504 if res != cipher:
3505 raise Exception("Unexpected TLS cipher info (configured %s): %s" % (cipher, res))
3506
d4c7a2b9
JM		 3507def test_ap_wpa2_eap_tls_ocsp(dev, apdev):
3508 """WPA2-Enterprise connection using EAP-TLS and verifying OCSP"""
0dae8c99 3509 check_ocsp_support(dev[0])
16c43d2a 3510 check_pkcs12_support(dev[0])
d4c7a2b9 3511 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 3512 hapd = hostapd.add_ap(apdev[0], params)
3513 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
d4c7a2b9
JM		 3514 private_key="auth_serv/user.pkcs12",
3515 private_key_passwd="whatever", ocsp=2)
3516
98d125ca
JM		 3517def test_ap_wpa2_eap_tls_ocsp_multi(dev, apdev):
3518 """WPA2-Enterprise connection using EAP-TLS and verifying OCSP-multi"""
3519 check_ocsp_multi_support(dev[0])
3520 check_pkcs12_support(dev[0])
3521
3522 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 3523 hapd = hostapd.add_ap(apdev[0], params)
3524 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
98d125ca
JM		 3525 private_key="auth_serv/user.pkcs12",
3526 private_key_passwd="whatever", ocsp=2)
3527
64e05f96 3528def int_eap_server_params():
d4c7a2b9
JM		 3529 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
3530 "rsn_pairwise": "CCMP", "ieee8021x": "1",
3531 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
3532 "ca_cert": "auth_serv/ca.pem",
3533 "server_cert": "auth_serv/server.pem",
8adce07a
JM		 3534 "private_key": "auth_serv/server.key",
3535 "dh_file": "auth_serv/dh.conf" }
64e05f96 3536 return params
d2a1047e 3537
58a40620
JM		 3538def test_ap_wpa2_eap_tls_ocsp_key_id(dev, apdev, params):
3539 """EAP-TLS and OCSP certificate signed OCSP response using key ID"""
3540 check_ocsp_support(dev[0])
3541 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-key-id.der")
3542 if not os.path.exists(ocsp):
3543 raise HwsimSkip("No OCSP response available")
3544 params = int_eap_server_params()
3545 params["ocsp_stapling_response"] = ocsp
8b8a1864 3546 hostapd.add_ap(apdev[0], params)
58a40620
JM		 3547 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3548 identity="tls user", ca_cert="auth_serv/ca.pem",
3549 private_key="auth_serv/user.pkcs12",
3550 private_key_passwd="whatever", ocsp=2,
3551 scan_freq="2412")
3552
d79ce4a6
JM		 3553def test_ap_wpa2_eap_tls_ocsp_ca_signed_good(dev, apdev, params):
3554 """EAP-TLS and CA signed OCSP response (good)"""
3555 check_ocsp_support(dev[0])
3556 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed.der")
3557 if not os.path.exists(ocsp):
3558 raise HwsimSkip("No OCSP response available")
3559 params = int_eap_server_params()
3560 params["ocsp_stapling_response"] = ocsp
8b8a1864 3561 hostapd.add_ap(apdev[0], params)
d79ce4a6
JM		 3562 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3563 identity="tls user", ca_cert="auth_serv/ca.pem",
3564 private_key="auth_serv/user.pkcs12",
3565 private_key_passwd="whatever", ocsp=2,
3566 scan_freq="2412")
3567
3568def test_ap_wpa2_eap_tls_ocsp_ca_signed_revoked(dev, apdev, params):
3569 """EAP-TLS and CA signed OCSP response (revoked)"""
3570 check_ocsp_support(dev[0])
3571 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-revoked.der")
3572 if not os.path.exists(ocsp):
3573 raise HwsimSkip("No OCSP response available")
3574 params = int_eap_server_params()
3575 params["ocsp_stapling_response"] = ocsp
8b8a1864 3576 hostapd.add_ap(apdev[0], params)
d79ce4a6
JM		 3577 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3578 identity="tls user", ca_cert="auth_serv/ca.pem",
3579 private_key="auth_serv/user.pkcs12",
3580 private_key_passwd="whatever", ocsp=2,
3581 wait_connect=False, scan_freq="2412")
3582 count = 0
3583 while True:
3584 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3585 if ev is None:
3586 raise Exception("Timeout on EAP status")
3587 if 'bad certificate status response' in ev:
3588 break
3589 if 'certificate revoked' in ev:
3590 break
3591 count = count + 1
3592 if count > 10:
3593 raise Exception("Unexpected number of EAP status messages")
3594
3595 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3596 if ev is None:
3597 raise Exception("Timeout on EAP failure report")
3598
3599def test_ap_wpa2_eap_tls_ocsp_ca_signed_unknown(dev, apdev, params):
3600 """EAP-TLS and CA signed OCSP response (unknown)"""
3601 check_ocsp_support(dev[0])
3602 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-unknown.der")
3603 if not os.path.exists(ocsp):
3604 raise HwsimSkip("No OCSP response available")
3605 params = int_eap_server_params()
3606 params["ocsp_stapling_response"] = ocsp
8b8a1864 3607 hostapd.add_ap(apdev[0], params)
d79ce4a6
JM		 3608 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3609 identity="tls user", ca_cert="auth_serv/ca.pem",
3610 private_key="auth_serv/user.pkcs12",
3611 private_key_passwd="whatever", ocsp=2,
3612 wait_connect=False, scan_freq="2412")
3613 count = 0
3614 while True:
3615 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3616 if ev is None:
3617 raise Exception("Timeout on EAP status")
3618 if 'bad certificate status response' in ev:
3619 break
3620 count = count + 1
3621 if count > 10:
3622 raise Exception("Unexpected number of EAP status messages")
3623
3624 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3625 if ev is None:
3626 raise Exception("Timeout on EAP failure report")
3627
3628def test_ap_wpa2_eap_tls_ocsp_server_signed(dev, apdev, params):
3629 """EAP-TLS and server signed OCSP response"""
3630 check_ocsp_support(dev[0])
3631 ocsp = os.path.join(params['logdir'], "ocsp-resp-server-signed.der")
3632 if not os.path.exists(ocsp):
3633 raise HwsimSkip("No OCSP response available")
3634 params = int_eap_server_params()
3635 params["ocsp_stapling_response"] = ocsp
8b8a1864 3636 hostapd.add_ap(apdev[0], params)
d79ce4a6
JM		 3637 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3638 identity="tls user", ca_cert="auth_serv/ca.pem",
3639 private_key="auth_serv/user.pkcs12",
3640 private_key_passwd="whatever", ocsp=2,
3641 wait_connect=False, scan_freq="2412")
3642 count = 0
3643 while True:
3644 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3645 if ev is None:
3646 raise Exception("Timeout on EAP status")
3647 if 'bad certificate status response' in ev:
3648 break
3649 count = count + 1
3650 if count > 10:
3651 raise Exception("Unexpected number of EAP status messages")
3652
3653 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3654 if ev is None:
3655 raise Exception("Timeout on EAP failure report")
3656
d2a1047e
JM		 3657def test_ap_wpa2_eap_tls_ocsp_invalid_data(dev, apdev):
3658 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP data"""
0dae8c99 3659 check_ocsp_support(dev[0])
d2a1047e
JM		 3660 params = int_eap_server_params()
3661 params["ocsp_stapling_response"] = "auth_serv/ocsp-req.der"
8b8a1864 3662 hostapd.add_ap(apdev[0], params)
d2a1047e
JM		 3663 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3664 identity="tls user", ca_cert="auth_serv/ca.pem",
3665 private_key="auth_serv/user.pkcs12",
3666 private_key_passwd="whatever", ocsp=2,
3667 wait_connect=False, scan_freq="2412")
3668 count = 0
3669 while True:
3670 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3671 if ev is None:
3672 raise Exception("Timeout on EAP status")
3673 if 'bad certificate status response' in ev:
3674 break
3675 count = count + 1
3676 if count > 10:
3677 raise Exception("Unexpected number of EAP status messages")
3678
3679 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3680 if ev is None:
3681 raise Exception("Timeout on EAP failure report")
3682
64e05f96
JM		 3683def test_ap_wpa2_eap_tls_ocsp_invalid(dev, apdev):
3684 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP response"""
0dae8c99 3685 check_ocsp_support(dev[0])
64e05f96
JM		 3686 params = int_eap_server_params()
3687 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-invalid"
8b8a1864 3688 hostapd.add_ap(apdev[0], params)
df7ad0fa
JM		 3689 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3690 identity="tls user", ca_cert="auth_serv/ca.pem",
3691 private_key="auth_serv/user.pkcs12",
3692 private_key_passwd="whatever", ocsp=2,
3693 wait_connect=False, scan_freq="2412")
3694 count = 0
3695 while True:
3696 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3697 if ev is None:
3698 raise Exception("Timeout on EAP status")
3699 if 'bad certificate status response' in ev:
3700 break
3701 count = count + 1
3702 if count > 10:
3703 raise Exception("Unexpected number of EAP status messages")
3704
3705 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3706 if ev is None:
3707 raise Exception("Timeout on EAP failure report")
3708
3709def test_ap_wpa2_eap_tls_ocsp_unknown_sign(dev, apdev):
3710 """WPA2-Enterprise connection using EAP-TLS and unknown OCSP signer"""
0dae8c99 3711 check_ocsp_support(dev[0])
df7ad0fa
JM		 3712 params = int_eap_server_params()
3713 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-unknown-sign"
8b8a1864 3714 hostapd.add_ap(apdev[0], params)
d4c7a2b9
JM		 3715 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3716 identity="tls user", ca_cert="auth_serv/ca.pem",
3717 private_key="auth_serv/user.pkcs12",
3718 private_key_passwd="whatever", ocsp=2,
3719 wait_connect=False, scan_freq="2412")
3720 count = 0
3721 while True:
3722 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3723 if ev is None:
3724 raise Exception("Timeout on EAP status")
3725 if 'bad certificate status response' in ev:
3726 break
3727 count = count + 1
3728 if count > 10:
3729 raise Exception("Unexpected number of EAP status messages")
3730
3731 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3732 if ev is None:
3733 raise Exception("Timeout on EAP failure report")
64e05f96 3734
37b4a66c
JM		 3735def test_ap_wpa2_eap_ttls_ocsp_revoked(dev, apdev, params):
3736 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 3737 check_ocsp_support(dev[0])
37b4a66c
JM		 3738 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-revoked.der")
3739 if not os.path.exists(ocsp):
3740 raise HwsimSkip("No OCSP response available")
3741 params = int_eap_server_params()
3742 params["ocsp_stapling_response"] = ocsp
8b8a1864 3743 hostapd.add_ap(apdev[0], params)
37b4a66c
JM		 3744 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3745 identity="pap user", ca_cert="auth_serv/ca.pem",
3746 anonymous_identity="ttls", password="password",
3747 phase2="auth=PAP", ocsp=2,
3748 wait_connect=False, scan_freq="2412")
3749 count = 0
3750 while True:
3751 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3752 if ev is None:
3753 raise Exception("Timeout on EAP status")
3754 if 'bad certificate status response' in ev:
3755 break
3756 if 'certificate revoked' in ev:
3757 break
3758 count = count + 1
3759 if count > 10:
3760 raise Exception("Unexpected number of EAP status messages")
3761
3762 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3763 if ev is None:
3764 raise Exception("Timeout on EAP failure report")
3765
3766def test_ap_wpa2_eap_ttls_ocsp_unknown(dev, apdev, params):
3767 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 3768 check_ocsp_support(dev[0])
37b4a66c
JM		 3769 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
3770 if not os.path.exists(ocsp):
3771 raise HwsimSkip("No OCSP response available")
3772 params = int_eap_server_params()
3773 params["ocsp_stapling_response"] = ocsp
8b8a1864 3774 hostapd.add_ap(apdev[0], params)
37b4a66c
JM		 3775 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3776 identity="pap user", ca_cert="auth_serv/ca.pem",
3777 anonymous_identity="ttls", password="password",
3778 phase2="auth=PAP", ocsp=2,
3779 wait_connect=False, scan_freq="2412")
3780 count = 0
3781 while True:
3782 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
3783 if ev is None:
3784 raise Exception("Timeout on EAP status")
3785 if 'bad certificate status response' in ev:
3786 break
3787 count = count + 1
3788 if count > 10:
3789 raise Exception("Unexpected number of EAP status messages")
3790
3791 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3792 if ev is None:
3793 raise Exception("Timeout on EAP failure report")
3794
3795def test_ap_wpa2_eap_ttls_optional_ocsp_unknown(dev, apdev, params):
3796 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
3797 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
3798 if not os.path.exists(ocsp):
3799 raise HwsimSkip("No OCSP response available")
3800 params = int_eap_server_params()
3801 params["ocsp_stapling_response"] = ocsp
8b8a1864 3802 hostapd.add_ap(apdev[0], params)
37b4a66c
JM		 3803 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3804 identity="pap user", ca_cert="auth_serv/ca.pem",
3805 anonymous_identity="ttls", password="password",
3806 phase2="auth=PAP", ocsp=1, scan_freq="2412")
3807
52811b8c
JM		 3808def test_ap_wpa2_eap_tls_intermediate_ca(dev, apdev, params):
3809 """EAP-TLS with intermediate server/user CA"""
3810 params = int_eap_server_params()
3811 params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
3812 params["server_cert"] = "auth_serv/iCA-server/server.pem"
3813 params["private_key"] = "auth_serv/iCA-server/server.key"
8b8a1864 3814 hostapd.add_ap(apdev[0], params)
52811b8c
JM		 3815 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3816 identity="tls user",
3817 ca_cert="auth_serv/iCA-user/ca-and-root.pem",
3818 client_cert="auth_serv/iCA-user/user.pem",
3819 private_key="auth_serv/iCA-user/user.key",
3820 scan_freq="2412")
3821
3822def root_ocsp(cert):
3823 ca = "auth_serv/ca.pem"
3824
3825 fd2, fn2 = tempfile.mkstemp()
3826 os.close(fd2)
3827
3828 arg = [ "openssl", "ocsp", "-reqout", fn2, "-issuer", ca, "-cert", cert,
3829 "-no_nonce", "-sha256", "-text" ]
3830 cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
3831 stderr=subprocess.PIPE)
3832 res = cmd.stdout.read() + "\n" + cmd.stderr.read()
3833 cmd.stdout.close()
3834 cmd.stderr.close()
3835 logger.info("OCSP request:\n" + res)
3836
3837 fd, fn = tempfile.mkstemp()
3838 os.close(fd)
40ae4a2f
JM		 3839 arg = [ "openssl", "ocsp", "-index", "auth_serv/rootCA/index.txt",
3840 "-rsigner", ca, "-rkey", "auth_serv/ca-key.pem",
52811b8c
JM		 3841 "-CA", ca, "-issuer", ca, "-verify_other", ca, "-trust_other",
3842 "-ndays", "7", "-reqin", fn2, "-resp_no_certs", "-respout", fn,
3843 "-text" ]
3844 cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
3845 stderr=subprocess.PIPE)
3846 res = cmd.stdout.read() + "\n" + cmd.stderr.read()
3847 cmd.stdout.close()
3848 cmd.stderr.close()
3849 logger.info("OCSP response:\n" + res)
3850 os.unlink(fn2)
3851 return fn
3852
3853def ica_ocsp(cert):
3854 prefix = "auth_serv/iCA-server/"
3855 ca = prefix + "cacert.pem"
3856 cert = prefix + cert
3857
3858 fd2, fn2 = tempfile.mkstemp()
3859 os.close(fd2)
3860
3861 arg = [ "openssl", "ocsp", "-reqout", fn2, "-issuer", ca, "-cert", cert,
3862 "-no_nonce", "-sha256", "-text" ]
3863 cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
3864 stderr=subprocess.PIPE)
3865 res = cmd.stdout.read() + "\n" + cmd.stderr.read()
3866 cmd.stdout.close()
3867 cmd.stderr.close()
3868 logger.info("OCSP request:\n" + res)
3869
3870 fd, fn = tempfile.mkstemp()
3871 os.close(fd)
3872 arg = [ "openssl", "ocsp", "-index", prefix + "index.txt",
3873 "-rsigner", ca, "-rkey", prefix + "private/cakey.pem",
3874 "-CA", ca, "-issuer", ca, "-verify_other", ca, "-trust_other",
3875 "-ndays", "7", "-reqin", fn2, "-resp_no_certs", "-respout", fn,
3876 "-text" ]
3877 cmd = subprocess.Popen(arg, stdout=subprocess.PIPE,
3878 stderr=subprocess.PIPE)
3879 res = cmd.stdout.read() + "\n" + cmd.stderr.read()
3880 cmd.stdout.close()
3881 cmd.stderr.close()
3882 logger.info("OCSP response:\n" + res)
3883 os.unlink(fn2)
3884 return fn
3885
3886def test_ap_wpa2_eap_tls_intermediate_ca_ocsp(dev, apdev, params):
3887 """EAP-TLS with intermediate server/user CA and OCSP on server certificate"""
3888 params = int_eap_server_params()
3889 params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
3890 params["server_cert"] = "auth_serv/iCA-server/server.pem"
3891 params["private_key"] = "auth_serv/iCA-server/server.key"
3892 fn = ica_ocsp("server.pem")
3893 params["ocsp_stapling_response"] = fn
3894 try:
8b8a1864 3895 hostapd.add_ap(apdev[0], params)
52811b8c
JM		 3896 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3897 identity="tls user",
3898 ca_cert="auth_serv/iCA-user/ca-and-root.pem",
3899 client_cert="auth_serv/iCA-user/user.pem",
3900 private_key="auth_serv/iCA-user/user.key",
3901 scan_freq="2412", ocsp=2)
3902 finally:
3903 os.unlink(fn)
3904
3905def test_ap_wpa2_eap_tls_intermediate_ca_ocsp_revoked(dev, apdev, params):
3906 """EAP-TLS with intermediate server/user CA and OCSP on revoked server certificate"""
3907 params = int_eap_server_params()
3908 params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
3909 params["server_cert"] = "auth_serv/iCA-server/server-revoked.pem"
3910 params["private_key"] = "auth_serv/iCA-server/server-revoked.key"
3911 fn = ica_ocsp("server-revoked.pem")
3912 params["ocsp_stapling_response"] = fn
3913 try:
8b8a1864 3914 hostapd.add_ap(apdev[0], params)
52811b8c
JM		 3915 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3916 identity="tls user",
3917 ca_cert="auth_serv/iCA-user/ca-and-root.pem",
3918 client_cert="auth_serv/iCA-user/user.pem",
3919 private_key="auth_serv/iCA-user/user.key",
3920 scan_freq="2412", ocsp=1, wait_connect=False)
3921 count = 0
3922 while True:
3923 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS",
3924 "CTRL-EVENT-EAP-SUCCESS"])
3925 if ev is None:
3926 raise Exception("Timeout on EAP status")
3927 if "CTRL-EVENT-EAP-SUCCESS" in ev:
3928 raise Exception("Unexpected EAP-Success")
3929 if 'bad certificate status response' in ev:
3930 break
3931 if 'certificate revoked' in ev:
3932 break
3933 count = count + 1
3934 if count > 10:
3935 raise Exception("Unexpected number of EAP status messages")
3936
3937 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3938 if ev is None:
3939 raise Exception("Timeout on EAP failure report")
3940 dev[0].request("REMOVE_NETWORK all")
3941 dev[0].wait_disconnected()
3942 finally:
3943 os.unlink(fn)
3944
3945def test_ap_wpa2_eap_tls_intermediate_ca_ocsp_multi_missing_resp(dev, apdev, params):
3946 """EAP-TLS with intermediate server/user CA and OCSP multi missing response"""
3947 check_ocsp_support(dev[0])
3948 check_ocsp_multi_support(dev[0])
3949
3950 params = int_eap_server_params()
3951 params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
3952 params["server_cert"] = "auth_serv/iCA-server/server.pem"
3953 params["private_key"] = "auth_serv/iCA-server/server.key"
3954 fn = ica_ocsp("server.pem")
3955 params["ocsp_stapling_response"] = fn
3956 try:
8b8a1864 3957 hostapd.add_ap(apdev[0], params)
52811b8c
JM		 3958 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3959 identity="tls user",
3960 ca_cert="auth_serv/iCA-user/ca-and-root.pem",
3961 client_cert="auth_serv/iCA-user/user.pem",
3962 private_key="auth_serv/iCA-user/user.key",
3963 scan_freq="2412", ocsp=3, wait_connect=False)
3964 count = 0
3965 while True:
3966 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS",
3967 "CTRL-EVENT-EAP-SUCCESS"])
3968 if ev is None:
3969 raise Exception("Timeout on EAP status")
3970 if "CTRL-EVENT-EAP-SUCCESS" in ev:
3971 raise Exception("Unexpected EAP-Success")
3972 if 'bad certificate status response' in ev:
3973 break
3974 if 'certificate revoked' in ev:
3975 break
3976 count = count + 1
3977 if count > 10:
3978 raise Exception("Unexpected number of EAP status messages")
3979
3980 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3981 if ev is None:
3982 raise Exception("Timeout on EAP failure report")
3983 dev[0].request("REMOVE_NETWORK all")
3984 dev[0].wait_disconnected()
3985 finally:
3986 os.unlink(fn)
3987
3988def test_ap_wpa2_eap_tls_intermediate_ca_ocsp_multi(dev, apdev, params):
3989 """EAP-TLS with intermediate server/user CA and OCSP multi OK"""
3990 check_ocsp_support(dev[0])
3991 check_ocsp_multi_support(dev[0])
3992
3993 params = int_eap_server_params()
3994 params["ca_cert"] = "auth_serv/iCA-server/ca-and-root.pem"
3995 params["server_cert"] = "auth_serv/iCA-server/server.pem"
3996 params["private_key"] = "auth_serv/iCA-server/server.key"
3997 fn = ica_ocsp("server.pem")
3998 fn2 = root_ocsp("auth_serv/iCA-server/cacert.pem")
3999 params["ocsp_stapling_response"] = fn
4000
4001 with open(fn, "r") as f:
4002 resp_server = f.read()
4003 with open(fn2, "r") as f:
4004 resp_ica = f.read()
4005
4006 fd3, fn3 = tempfile.mkstemp()
4007 try:
4008 f = os.fdopen(fd3, 'w')
4009 f.write(struct.pack(">L", len(resp_server))[1:4])
4010 f.write(resp_server)
4011 f.write(struct.pack(">L", len(resp_ica))[1:4])
4012 f.write(resp_ica)
4013 f.close()
4014
4015 params["ocsp_stapling_response_multi"] = fn3
4016
8b8a1864 4017 hostapd.add_ap(apdev[0], params)
52811b8c
JM		 4018 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4019 identity="tls user",
4020 ca_cert="auth_serv/iCA-user/ca-and-root.pem",
4021 client_cert="auth_serv/iCA-user/user.pem",
4022 private_key="auth_serv/iCA-user/user.key",
40ae4a2f 4023 scan_freq="2412", ocsp=3)
52811b8c
JM		 4024 dev[0].request("REMOVE_NETWORK all")
4025 dev[0].wait_disconnected()
4026 finally:
4027 os.unlink(fn)
4028 os.unlink(fn2)
4029 os.unlink(fn3)
4030
98d125ca
JM		 4031def test_ap_wpa2_eap_tls_ocsp_multi_revoked(dev, apdev, params):
4032 """EAP-TLS and CA signed OCSP multi response (revoked)"""
4033 check_ocsp_support(dev[0])
4034 check_ocsp_multi_support(dev[0])
4035
4036 ocsp_revoked = os.path.join(params['logdir'],
4037 "ocsp-resp-ca-signed-revoked.der")
4038 if not os.path.exists(ocsp_revoked):
4039 raise HwsimSkip("No OCSP response (revoked) available")
4040 ocsp_unknown = os.path.join(params['logdir'],
4041 "ocsp-resp-ca-signed-unknown.der")
4042 if not os.path.exists(ocsp_unknown):
4043 raise HwsimSkip("No OCSP response(unknown) available")
4044
4045 with open(ocsp_revoked, "r") as f:
4046 resp_revoked = f.read()
4047 with open(ocsp_unknown, "r") as f:
4048 resp_unknown = f.read()
4049
4050 fd, fn = tempfile.mkstemp()
4051 try:
4052 # This is not really a valid order of the OCSPResponse items in the
4053 # list, but this works for now to verify parsing and processing of
4054 # multiple responses.
4055 f = os.fdopen(fd, 'w')
4056 f.write(struct.pack(">L", len(resp_unknown))[1:4])
4057 f.write(resp_unknown)
4058 f.write(struct.pack(">L", len(resp_revoked))[1:4])
4059 f.write(resp_revoked)
4060 f.write(struct.pack(">L", 0)[1:4])
4061 f.write(struct.pack(">L", len(resp_unknown))[1:4])
4062 f.write(resp_unknown)
4063 f.close()
4064
4065 params = int_eap_server_params()
4066 params["ocsp_stapling_response_multi"] = fn
8b8a1864 4067 hostapd.add_ap(apdev[0], params)
98d125ca
JM		 4068 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4069 identity="tls user", ca_cert="auth_serv/ca.pem",
4070 private_key="auth_serv/user.pkcs12",
4071 private_key_passwd="whatever", ocsp=1,
4072 wait_connect=False, scan_freq="2412")
4073 count = 0
4074 while True:
4075 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS",
4076 "CTRL-EVENT-EAP-SUCCESS"])
4077 if ev is None:
4078 raise Exception("Timeout on EAP status")
4079 if "CTRL-EVENT-EAP-SUCCESS" in ev:
4080 raise Exception("Unexpected EAP-Success")
4081 if 'bad certificate status response' in ev:
4082 break
4083 if 'certificate revoked' in ev:
4084 break
4085 count = count + 1
4086 if count > 10:
4087 raise Exception("Unexpected number of EAP status messages")
4088 finally:
4089 os.unlink(fn)
4090
24579e70 4091def test_ap_wpa2_eap_tls_domain_suffix_match_cn_full(dev, apdev):
64e05f96 4092 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
e78eb404 4093 check_domain_match_full(dev[0])
64e05f96
JM		 4094 params = int_eap_server_params()
4095 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
4096 params["private_key"] = "auth_serv/server-no-dnsname.key"
8b8a1864 4097 hostapd.add_ap(apdev[0], params)
64e05f96
JM		 4098 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4099 identity="tls user", ca_cert="auth_serv/ca.pem",
4100 private_key="auth_serv/user.pkcs12",
4101 private_key_passwd="whatever",
4102 domain_suffix_match="server3.w1.fi",
4103 scan_freq="2412")
24579e70 4104
061cbb25
JM		 4105def test_ap_wpa2_eap_tls_domain_match_cn(dev, apdev):
4106 """WPA2-Enterprise using EAP-TLS and domainmatch (CN)"""
e78eb404 4107 check_domain_match(dev[0])
061cbb25
JM		 4108 params = int_eap_server_params()
4109 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
4110 params["private_key"] = "auth_serv/server-no-dnsname.key"
8b8a1864 4111 hostapd.add_ap(apdev[0], params)
061cbb25
JM		 4112 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4113 identity="tls user", ca_cert="auth_serv/ca.pem",
4114 private_key="auth_serv/user.pkcs12",
4115 private_key_passwd="whatever",
4116 domain_match="server3.w1.fi",
4117 scan_freq="2412")
4118
24579e70
JM		 4119def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev):
4120 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
4121 check_domain_match_full(dev[0])
4122 params = int_eap_server_params()
4123 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
4124 params["private_key"] = "auth_serv/server-no-dnsname.key"
8b8a1864 4125 hostapd.add_ap(apdev[0], params)
64e05f96
JM		 4126 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4127 identity="tls user", ca_cert="auth_serv/ca.pem",
4128 private_key="auth_serv/user.pkcs12",
4129 private_key_passwd="whatever",
4130 domain_suffix_match="w1.fi",
4131 scan_freq="2412")
4132
4133def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev):
4134 """WPA2-Enterprise using EAP-TLS and domain suffix mismatch (CN)"""
e78eb404 4135 check_domain_suffix_match(dev[0])
64e05f96
JM		 4136 params = int_eap_server_params()
4137 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
4138 params["private_key"] = "auth_serv/server-no-dnsname.key"
8b8a1864 4139 hostapd.add_ap(apdev[0], params)
64e05f96
JM		 4140 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4141 identity="tls user", ca_cert="auth_serv/ca.pem",
4142 private_key="auth_serv/user.pkcs12",
4143 private_key_passwd="whatever",
4144 domain_suffix_match="example.com",
4145 wait_connect=False,
4146 scan_freq="2412")
c61dca40
JM		 4147 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4148 identity="tls user", ca_cert="auth_serv/ca.pem",
4149 private_key="auth_serv/user.pkcs12",
4150 private_key_passwd="whatever",
4151 domain_suffix_match="erver3.w1.fi",
4152 wait_connect=False,
4153 scan_freq="2412")
64e05f96
JM		 4154 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4155 if ev is None:
4156 raise Exception("Timeout on EAP failure report")
c61dca40
JM		 4157 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4158 if ev is None:
4159 raise Exception("Timeout on EAP failure report (2)")
6a4d0dbe 4160
061cbb25
JM		 4161def test_ap_wpa2_eap_tls_domain_mismatch_cn(dev, apdev):
4162 """WPA2-Enterprise using EAP-TLS and domain mismatch (CN)"""
e78eb404 4163 check_domain_match(dev[0])
061cbb25
JM		 4164 params = int_eap_server_params()
4165 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
4166 params["private_key"] = "auth_serv/server-no-dnsname.key"
8b8a1864 4167 hostapd.add_ap(apdev[0], params)
061cbb25
JM		 4168 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4169 identity="tls user", ca_cert="auth_serv/ca.pem",
4170 private_key="auth_serv/user.pkcs12",
4171 private_key_passwd="whatever",
4172 domain_match="example.com",
4173 wait_connect=False,
4174 scan_freq="2412")
4175 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4176 identity="tls user", ca_cert="auth_serv/ca.pem",
4177 private_key="auth_serv/user.pkcs12",
4178 private_key_passwd="whatever",
4179 domain_match="w1.fi",
4180 wait_connect=False,
4181 scan_freq="2412")
4182 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4183 if ev is None:
4184 raise Exception("Timeout on EAP failure report")
4185 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4186 if ev is None:
4187 raise Exception("Timeout on EAP failure report (2)")
4188
6a4d0dbe
JM		 4189def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev):
4190 """WPA2-Enterprise using EAP-TTLS and expired certificate"""
ca158ea6 4191 skip_with_fips(dev[0])
6a4d0dbe
JM		 4192 params = int_eap_server_params()
4193 params["server_cert"] = "auth_serv/server-expired.pem"
4194 params["private_key"] = "auth_serv/server-expired.key"
8b8a1864 4195 hostapd.add_ap(apdev[0], params)
6a4d0dbe
JM		 4196 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4197 identity="mschap user", password="password",
4198 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4199 wait_connect=False,
4200 scan_freq="2412")
4201 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"])
4202 if ev is None:
4203 raise Exception("Timeout on EAP certificate error report")
4204 if "reason=4" not in ev or "certificate has expired" not in ev:
4205 raise Exception("Unexpected failure reason: " + ev)
4206 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4207 if ev is None:
4208 raise Exception("Timeout on EAP failure report")
4209
4210def test_ap_wpa2_eap_ttls_ignore_expired_cert(dev, apdev):
4211 """WPA2-Enterprise using EAP-TTLS and ignore certificate expiration"""
ca158ea6 4212 skip_with_fips(dev[0])
6a4d0dbe
JM		 4213 params = int_eap_server_params()
4214 params["server_cert"] = "auth_serv/server-expired.pem"
4215 params["private_key"] = "auth_serv/server-expired.key"
8b8a1864 4216 hostapd.add_ap(apdev[0], params)
6a4d0dbe
JM		 4217 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4218 identity="mschap user", password="password",
4219 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4220 phase1="tls_disable_time_checks=1",
4221 scan_freq="2412")
6ab4a7aa 4222
5748d1e5
JM		 4223def test_ap_wpa2_eap_ttls_long_duration(dev, apdev):
4224 """WPA2-Enterprise using EAP-TTLS and long certificate duration"""
ca158ea6 4225 skip_with_fips(dev[0])
5748d1e5
JM		 4226 params = int_eap_server_params()
4227 params["server_cert"] = "auth_serv/server-long-duration.pem"
4228 params["private_key"] = "auth_serv/server-long-duration.key"
8b8a1864 4229 hostapd.add_ap(apdev[0], params)
5748d1e5
JM		 4230 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4231 identity="mschap user", password="password",
4232 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4233 scan_freq="2412")
4234
6ab4a7aa
JM		 4235def test_ap_wpa2_eap_ttls_server_cert_eku_client(dev, apdev):
4236 """WPA2-Enterprise using EAP-TTLS and server cert with client EKU"""
ca158ea6 4237 skip_with_fips(dev[0])
6ab4a7aa
JM		 4238 params = int_eap_server_params()
4239 params["server_cert"] = "auth_serv/server-eku-client.pem"
4240 params["private_key"] = "auth_serv/server-eku-client.key"
8b8a1864 4241 hostapd.add_ap(apdev[0], params)
6ab4a7aa
JM		 4242 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4243 identity="mschap user", password="password",
4244 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4245 wait_connect=False,
4246 scan_freq="2412")
4247 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4248 if ev is None:
4249 raise Exception("Timeout on EAP failure report")
242219c5 4250
14bef66d
JM		 4251def test_ap_wpa2_eap_ttls_server_cert_eku_client_server(dev, apdev):
4252 """WPA2-Enterprise using EAP-TTLS and server cert with client and server EKU"""
ca158ea6 4253 skip_with_fips(dev[0])
14bef66d
JM		 4254 params = int_eap_server_params()
4255 params["server_cert"] = "auth_serv/server-eku-client-server.pem"
4256 params["private_key"] = "auth_serv/server-eku-client-server.key"
8b8a1864 4257 hostapd.add_ap(apdev[0], params)
14bef66d
JM		 4258 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4259 identity="mschap user", password="password",
4260 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4261 scan_freq="2412")
4262
c37b02fc
JM		 4263def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
4264 """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
ca158ea6 4265 skip_with_fips(dev[0])
c37b02fc
JM		 4266 params = int_eap_server_params()
4267 del params["server_cert"]
4268 params["private_key"] = "auth_serv/server.pkcs12"
8b8a1864 4269 hostapd.add_ap(apdev[0], params)
c37b02fc
JM		 4270 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4271 identity="mschap user", password="password",
4272 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4273 scan_freq="2412")
4274
31dd3153
JM		 4275def test_ap_wpa2_eap_ttls_server_pkcs12_extra(dev, apdev):
4276 """EAP-TTLS and server PKCS#12 file with extra certs"""
4277 skip_with_fips(dev[0])
4278 params = int_eap_server_params()
4279 del params["server_cert"]
4280 params["private_key"] = "auth_serv/server-extra.pkcs12"
4281 params["private_key_passwd"] = "whatever"
8b8a1864 4282 hostapd.add_ap(apdev[0], params)
31dd3153
JM		 4283 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4284 identity="mschap user", password="password",
4285 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4286 scan_freq="2412")
4287
242219c5
JM		 4288def test_ap_wpa2_eap_ttls_dh_params(dev, apdev):
4289 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params"""
4290 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 4291 hapd = hostapd.add_ap(apdev[0], params)
4292 eap_connect(dev[0], hapd, "TTLS", "pap user",
242219c5 4293 anonymous_identity="ttls", password="password",
ca158ea6 4294 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
242219c5 4295 dh_file="auth_serv/dh.conf")
7c50093f 4296
b3ff3dec
JM		 4297def test_ap_wpa2_eap_ttls_dh_params_dsa(dev, apdev):
4298 """WPA2-Enterprise connection using EAP-TTLS and setting DH params (DSA)"""
404597e6 4299 check_dh_dsa_support(dev[0])
b3ff3dec 4300 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687
JD		 4301 hapd = hostapd.add_ap(apdev[0], params)
4302 eap_connect(dev[0], hapd, "TTLS", "pap user",
b3ff3dec 4303 anonymous_identity="ttls", password="password",
ca158ea6 4304 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
b3ff3dec
JM		 4305 dh_file="auth_serv/dsaparam.pem")
4306
4307def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
4308 """EAP-TTLS and DH params file not found"""
ca158ea6 4309 skip_with_fips(dev[0])
b3ff3dec 4310 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4311 hostapd.add_ap(apdev[0], params)
b3ff3dec
JM		 4312 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4313 identity="mschap user", password="password",
4314 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4315 dh_file="auth_serv/dh-no-such-file.conf",
4316 scan_freq="2412", wait_connect=False)
4317 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4318 if ev is None:
4319 raise Exception("EAP failure timed out")
4320 dev[0].request("REMOVE_NETWORK all")
4321 dev[0].wait_disconnected()
4322
4323def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
4324 """EAP-TTLS and invalid DH params file"""
ca158ea6 4325 skip_with_fips(dev[0])
b3ff3dec 4326 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4327 hostapd.add_ap(apdev[0], params)
b3ff3dec
JM		 4328 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4329 identity="mschap user", password="password",
4330 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
4331 dh_file="auth_serv/ca.pem",
4332 scan_freq="2412", wait_connect=False)
4333 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4334 if ev is None:
4335 raise Exception("EAP failure timed out")
4336 dev[0].request("REMOVE_NETWORK all")
4337 dev[0].wait_disconnected()
4338
6ea231e6
JM		 4339def test_ap_wpa2_eap_ttls_dh_params_blob(dev, apdev):
4340 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params from blob"""
4341 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 4342 hapd = hostapd.add_ap(apdev[0], params)
768ea0bc 4343 dh = read_pem("auth_serv/dh2.conf")
6ea231e6
JM		 4344 if "OK" not in dev[0].request("SET blob dhparams " + dh.encode("hex")):
4345 raise Exception("Could not set dhparams blob")
3b3e2687 4346 eap_connect(dev[0], hapd, "TTLS", "pap user",
6ea231e6 4347 anonymous_identity="ttls", password="password",
ca158ea6 4348 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
6ea231e6
JM		 4349 dh_file="blob://dhparams")
4350
768ea0bc
JM		 4351def test_ap_wpa2_eap_ttls_dh_params_server(dev, apdev):
4352 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams"""
4353 params = int_eap_server_params()
4354 params["dh_file"] = "auth_serv/dh2.conf"
3b3e2687
JD		 4355 hapd = hostapd.add_ap(apdev[0], params)
4356 eap_connect(dev[0], hapd, "TTLS", "pap user",
768ea0bc 4357 anonymous_identity="ttls", password="password",
ca158ea6 4358 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
768ea0bc 4359
b3ff3dec
JM		 4360def test_ap_wpa2_eap_ttls_dh_params_dsa_server(dev, apdev):
4361 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams (DSA)"""
4362 params = int_eap_server_params()
4363 params["dh_file"] = "auth_serv/dsaparam.pem"
3b3e2687
JD		 4364 hapd = hostapd.add_ap(apdev[0], params)
4365 eap_connect(dev[0], hapd, "TTLS", "pap user",
b3ff3dec 4366 anonymous_identity="ttls", password="password",
ca158ea6 4367 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
b3ff3dec
JM		 4368
4369def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
4370 """EAP-TLS server and dhparams file not found"""
4371 params = int_eap_server_params()
4372 params["dh_file"] = "auth_serv/dh-no-such-file.conf"
8b8a1864 4373 hapd = hostapd.add_ap(apdev[0], params, no_enable=True)
b3ff3dec
JM		 4374 if "FAIL" not in hapd.request("ENABLE"):
4375 raise Exception("Invalid configuration accepted")
4376
4377def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
4378 """EAP-TLS server and invalid dhparams file"""
4379 params = int_eap_server_params()
4380 params["dh_file"] = "auth_serv/ca.pem"
8b8a1864 4381 hapd = hostapd.add_ap(apdev[0], params, no_enable=True)
b3ff3dec
JM		 4382 if "FAIL" not in hapd.request("ENABLE"):
4383 raise Exception("Invalid configuration accepted")
4384
7c50093f
JM		 4385def test_ap_wpa2_eap_reauth(dev, apdev):
4386 """WPA2-Enterprise and Authenticator forcing reauthentication"""
4387 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4388 params['eap_reauth_period'] = '2'
3b3e2687
JD		 4389 hapd = hostapd.add_ap(apdev[0], params)
4390 eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
7c50093f
JM		 4391 password_hex="0123456789abcdef0123456789abcdef")
4392 logger.info("Wait for reauthentication")
4393 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
4394 if ev is None:
4395 raise Exception("Timeout on reauthentication")
4396 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4397 if ev is None:
4398 raise Exception("Timeout on reauthentication")
4399 for i in range(0, 20):
4400 state = dev[0].get_status_field("wpa_state")
4401 if state == "COMPLETED":
4402 break
4403 time.sleep(0.1)
4404 if state != "COMPLETED":
4405 raise Exception("Reauthentication did not complete")
8b56743e
JM		 4406
4407def test_ap_wpa2_eap_request_identity_message(dev, apdev):
4408 """Optional displayable message in EAP Request-Identity"""
4409 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4410 params['eap_message'] = 'hello\\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com'
3b3e2687
JD		 4411 hapd = hostapd.add_ap(apdev[0], params)
4412 eap_connect(dev[0], hapd, "PAX", "pax.user@example.com",
8b56743e 4413 password_hex="0123456789abcdef0123456789abcdef")
910f16ca
JM		 4414
4415def test_ap_wpa2_eap_sim_aka_result_ind(dev, apdev):
4416 """WPA2-Enterprise using EAP-SIM/AKA and protected result indication"""
81e787b7 4417 check_hlr_auc_gw_support()
910f16ca
JM		 4418 params = int_eap_server_params()
4419 params['eap_sim_db'] = "unix:/tmp/hlr_auc_gw.sock"
4420 params['eap_sim_aka_result_ind'] = "1"
3b3e2687 4421 hapd = hostapd.add_ap(apdev[0], params)
910f16ca 4422
3b3e2687 4423 eap_connect(dev[0], hapd, "SIM", "1232010000000000",
910f16ca
JM		 4424 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
4425 phase1="result_ind=1")
4426 eap_reauth(dev[0], "SIM")
3b3e2687 4427 eap_connect(dev[1], hapd, "SIM", "1232010000000000",
910f16ca
JM		 4428 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
4429
4430 dev[0].request("REMOVE_NETWORK all")
4431 dev[1].request("REMOVE_NETWORK all")
4432
3b3e2687 4433 eap_connect(dev[0], hapd, "AKA", "0232010000000000",
910f16ca
JM		 4434 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
4435 phase1="result_ind=1")
4436 eap_reauth(dev[0], "AKA")
3b3e2687 4437 eap_connect(dev[1], hapd, "AKA", "0232010000000000",
910f16ca
JM		 4438 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
4439
4440 dev[0].request("REMOVE_NETWORK all")
4441 dev[1].request("REMOVE_NETWORK all")
4442
3b3e2687 4443 eap_connect(dev[0], hapd, "AKA'", "6555444333222111",
910f16ca
JM		 4444 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
4445 phase1="result_ind=1")
4446 eap_reauth(dev[0], "AKA'")
3b3e2687 4447 eap_connect(dev[1], hapd, "AKA'", "6555444333222111",
910f16ca 4448 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
633e364b
JM		 4449
4450def test_ap_wpa2_eap_too_many_roundtrips(dev, apdev):
4451 """WPA2-Enterprise connection resulting in too many EAP roundtrips"""
ca158ea6 4452 skip_with_fips(dev[0])
633e364b 4453 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4454 hostapd.add_ap(apdev[0], params)
633e364b
JM		 4455 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
4456 eap="TTLS", identity="mschap user",
4457 wait_connect=False, scan_freq="2412", ieee80211w="1",
4458 anonymous_identity="ttls", password="password",
4459 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
78d2233f
JM		 4460 fragment_size="8")
4461 ev = dev[0].wait_event(["EAP: more than",
4462 "CTRL-EVENT-EAP-SUCCESS"], timeout=20)
4463 if ev is None or "EAP: more than" not in ev:
633e364b 4464 raise Exception("EAP roundtrip limit not reached")
32dca985
JM		 4465
4466def test_ap_wpa2_eap_expanded_nak(dev, apdev):
4467 """WPA2-Enterprise connection with EAP resulting in expanded NAK"""
4468 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4469 hostapd.add_ap(apdev[0], params)
32dca985
JM		 4470 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
4471 eap="PSK", identity="vendor-test",
4472 password_hex="ff23456789abcdef0123456789abcdef",
4473 wait_connect=False)
4474
4475 found = False
4476 for i in range(0, 5):
412c6030 4477 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"], timeout=16)
32dca985
JM		 4478 if ev is None:
4479 raise Exception("Association and EAP start timed out")
4480 if "refuse proposed method" in ev:
4481 found = True
4482 break
4483 if not found:
4484 raise Exception("Unexpected EAP status: " + ev)
4485
4486 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
4487 if ev is None:
4488 raise Exception("EAP failure timed out")
745f8771
JM		 4489
4490def test_ap_wpa2_eap_sql(dev, apdev, params):
4491 """WPA2-Enterprise connection using SQLite for user DB"""
ca158ea6 4492 skip_with_fips(dev[0])
745f8771
JM		 4493 try:
4494 import sqlite3
4495 except ImportError:
81e787b7 4496 raise HwsimSkip("No sqlite3 module available")
745f8771
JM		 4497 dbfile = os.path.join(params['logdir'], "eap-user.db")
4498 try:
4499 os.remove(dbfile)
4500 except:
4501 pass
4502 con = sqlite3.connect(dbfile)
4503 with con:
4504 cur = con.cursor()
4505 cur.execute("CREATE TABLE users(identity TEXT PRIMARY KEY, methods TEXT, password TEXT, remediation TEXT, phase2 INTEGER)")
4506 cur.execute("CREATE TABLE wildcards(identity TEXT PRIMARY KEY, methods TEXT)")
4507 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-pap','TTLS-PAP','password',1)")
4508 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-chap','TTLS-CHAP','password',1)")
4509 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschap','TTLS-MSCHAP','password',1)")
4510 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschapv2','TTLS-MSCHAPV2','password',1)")
4511 cur.execute("INSERT INTO wildcards(identity,methods) VALUES ('','TTLS,TLS')")
4512 cur.execute("CREATE TABLE authlog(timestamp TEXT, session TEXT, nas_ip TEXT, username TEXT, note TEXT)")
4513
4514 try:
4515 params = int_eap_server_params()
4516 params["eap_user_file"] = "sqlite:" + dbfile
3b3e2687
JD		 4517 hapd = hostapd.add_ap(apdev[0], params)
4518 eap_connect(dev[0], hapd, "TTLS", "user-mschapv2",
745f8771
JM		 4519 anonymous_identity="ttls", password="password",
4520 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
4521 dev[0].request("REMOVE_NETWORK all")
3b3e2687 4522 eap_connect(dev[1], hapd, "TTLS", "user-mschap",
745f8771
JM		 4523 anonymous_identity="ttls", password="password",
4524 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP")
4525 dev[1].request("REMOVE_NETWORK all")
3b3e2687 4526 eap_connect(dev[0], hapd, "TTLS", "user-chap",
745f8771
JM		 4527 anonymous_identity="ttls", password="password",
4528 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP")
3b3e2687 4529 eap_connect(dev[1], hapd, "TTLS", "user-pap",
745f8771
JM		 4530 anonymous_identity="ttls", password="password",
4531 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
4532 finally:
4533 os.remove(dbfile)
b246e2af
JM		 4534
4535def test_ap_wpa2_eap_non_ascii_identity(dev, apdev):
4536 """WPA2-Enterprise connection attempt using non-ASCII identity"""
4537 params = int_eap_server_params()
8b8a1864 4538 hostapd.add_ap(apdev[0], params)
b246e2af
JM		 4539 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4540 identity="\x80", password="password", wait_connect=False)
4541 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4542 identity="a\x80", password="password", wait_connect=False)
4543 for i in range(0, 2):
412c6030 4544 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
b246e2af
JM		 4545 if ev is None:
4546 raise Exception("Association and EAP start timed out")
4547 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
4548 if ev is None:
4549 raise Exception("EAP method selection timed out")
4550
4551def test_ap_wpa2_eap_non_ascii_identity2(dev, apdev):
4552 """WPA2-Enterprise connection attempt using non-ASCII identity"""
4553 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4554 hostapd.add_ap(apdev[0], params)
b246e2af
JM		 4555 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4556 identity="\x80", password="password", wait_connect=False)
4557 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4558 identity="a\x80", password="password", wait_connect=False)
4559 for i in range(0, 2):
412c6030 4560 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=16)
b246e2af
JM		 4561 if ev is None:
4562 raise Exception("Association and EAP start timed out")
4563 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
4564 if ev is None:
4565 raise Exception("EAP method selection timed out")
89f20842
JM		 4566
4567def test_openssl_cipher_suite_config_wpas(dev, apdev):
4568 """OpenSSL cipher suite configuration on wpa_supplicant"""
a783340d
JM		 4569 tls = dev[0].request("GET tls_library")
4570 if not tls.startswith("OpenSSL"):
4571 raise HwsimSkip("TLS library is not OpenSSL: " + tls)
89f20842 4572 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4573 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 4574 eap_connect(dev[0], hapd, "TTLS", "pap user",
89f20842
JM		 4575 anonymous_identity="ttls", password="password",
4576 openssl_ciphers="AES128",
4577 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3b3e2687 4578 eap_connect(dev[1], hapd, "TTLS", "pap user",
89f20842
JM		 4579 anonymous_identity="ttls", password="password",
4580 openssl_ciphers="EXPORT",
4581 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
9dd21d51 4582 expect_failure=True, maybe_local_error=True)
7be5ec99
JM		 4583 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
4584 identity="pap user", anonymous_identity="ttls",
4585 password="password",
4586 openssl_ciphers="FOO",
4587 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
4588 wait_connect=False)
4589 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
4590 if ev is None:
4591 raise Exception("EAP failure after invalid openssl_ciphers not reported")
4592 dev[2].request("DISCONNECT")
89f20842
JM		 4593
4594def test_openssl_cipher_suite_config_hapd(dev, apdev):
4595 """OpenSSL cipher suite configuration on hostapd"""
a783340d
JM		 4596 tls = dev[0].request("GET tls_library")
4597 if not tls.startswith("OpenSSL"):
4598 raise HwsimSkip("wpa_supplicant TLS library is not OpenSSL: " + tls)
89f20842
JM		 4599 params = int_eap_server_params()
4600 params['openssl_ciphers'] = "AES256"
8b8a1864 4601 hapd = hostapd.add_ap(apdev[0], params)
a783340d
JM		 4602 tls = hapd.request("GET tls_library")
4603 if not tls.startswith("OpenSSL"):
4604 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
3b3e2687 4605 eap_connect(dev[0], hapd, "TTLS", "pap user",
89f20842
JM		 4606 anonymous_identity="ttls", password="password",
4607 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3b3e2687 4608 eap_connect(dev[1], hapd, "TTLS", "pap user",
89f20842
JM		 4609 anonymous_identity="ttls", password="password",
4610 openssl_ciphers="AES128",
4611 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
4612 expect_failure=True)
3b3e2687 4613 eap_connect(dev[2], hapd, "TTLS", "pap user",
89f20842
JM		 4614 anonymous_identity="ttls", password="password",
4615 openssl_ciphers="HIGH:!ADH",
4616 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
5b3c40a6 4617
7be5ec99 4618 params['openssl_ciphers'] = "FOO"
8b8a1864 4619 hapd2 = hostapd.add_ap(apdev[1], params, no_enable=True)
7be5ec99
JM		 4620 if "FAIL" not in hapd2.request("ENABLE"):
4621 raise Exception("Invalid openssl_ciphers value accepted")
4622
5b3c40a6
JM		 4623def test_wpa2_eap_ttls_pap_key_lifetime_in_memory(dev, apdev, params):
4624 """Key lifetime in memory with WPA2-Enterprise using EAP-TTLS/PAP"""
4625 p = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4626 hapd = hostapd.add_ap(apdev[0], p)
5b3c40a6
JM		 4627 password = "63d2d21ac3c09ed567ee004a34490f1d16e7fa5835edf17ddba70a63f1a90a25"
4628 pid = find_wpas_process(dev[0])
3b3e2687 4629 id = eap_connect(dev[0], hapd, "TTLS", "pap-secret",
5b3c40a6
JM		 4630 anonymous_identity="ttls", password=password,
4631 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
8e416cec
JM		 4632 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
4633 # event has been delivered, so verify that wpa_supplicant has returned to
4634 # eloop before reading process memory.
54f2cae2 4635 time.sleep(1)
8e416cec 4636 dev[0].ping()
5b3c40a6
JM		 4637 buf = read_process_memory(pid, password)
4638
4639 dev[0].request("DISCONNECT")
4640 dev[0].wait_disconnected()
4641
4642 dev[0].relog()
750904dd
JM		 4643 msk = None
4644 emsk = None
5b3c40a6
JM		 4645 pmk = None
4646 ptk = None
4647 gtk = None
4648 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
4649 for l in f.readlines():
750904dd
JM		 4650 if "EAP-TTLS: Derived key - hexdump" in l:
4651 val = l.strip().split(':')[3].replace(' ', '')
4652 msk = binascii.unhexlify(val)
4653 if "EAP-TTLS: Derived EMSK - hexdump" in l:
4654 val = l.strip().split(':')[3].replace(' ', '')
4655 emsk = binascii.unhexlify(val)
5b3c40a6
JM		 4656 if "WPA: PMK - hexdump" in l:
4657 val = l.strip().split(':')[3].replace(' ', '')
4658 pmk = binascii.unhexlify(val)
4659 if "WPA: PTK - hexdump" in l:
4660 val = l.strip().split(':')[3].replace(' ', '')
4661 ptk = binascii.unhexlify(val)
4662 if "WPA: Group Key - hexdump" in l:
4663 val = l.strip().split(':')[3].replace(' ', '')
4664 gtk = binascii.unhexlify(val)
750904dd 4665 if not msk or not emsk or not pmk or not ptk or not gtk:
5b3c40a6
JM		 4666 raise Exception("Could not find keys from debug log")
4667 if len(gtk) != 16:
4668 raise Exception("Unexpected GTK length")
4669
4670 kck = ptk[0:16]
4671 kek = ptk[16:32]
4672 tk = ptk[32:48]
4673
4674 fname = os.path.join(params['logdir'],
4675 'wpa2_eap_ttls_pap_key_lifetime_in_memory.memctx-')
4676
4677 logger.info("Checking keys in memory while associated")
4678 get_key_locations(buf, password, "Password")
4679 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 4680 get_key_locations(buf, msk, "MSK")
4681 get_key_locations(buf, emsk, "EMSK")
5b3c40a6 4682 if password not in buf:
81e787b7 4683 raise HwsimSkip("Password not found while associated")
5b3c40a6 4684 if pmk not in buf:
81e787b7 4685 raise HwsimSkip("PMK not found while associated")
5b3c40a6
JM		 4686 if kck not in buf:
4687 raise Exception("KCK not found while associated")
4688 if kek not in buf:
4689 raise Exception("KEK not found while associated")
4690 if tk in buf:
4691 raise Exception("TK found from memory")
4692 if gtk in buf:
8eb45bde 4693 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 4694 raise Exception("GTK found from memory")
4695
4696 logger.info("Checking keys in memory after disassociation")
4697 buf = read_process_memory(pid, password)
4698
4699 # Note: Password is still present in network configuration
4700 # Note: PMK is in PMKSA cache and EAP fast re-auth data
4701
4702 get_key_locations(buf, password, "Password")
4703 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 4704 get_key_locations(buf, msk, "MSK")
4705 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 4706 verify_not_present(buf, kck, fname, "KCK")
4707 verify_not_present(buf, kek, fname, "KEK")
4708 verify_not_present(buf, tk, fname, "TK")
4709 verify_not_present(buf, gtk, fname, "GTK")
4710
4711 dev[0].request("PMKSA_FLUSH")
4712 dev[0].set_network_quoted(id, "identity", "foo")
4713 logger.info("Checking keys in memory after PMKSA cache and EAP fast reauth flush")
4714 buf = read_process_memory(pid, password)
4715 get_key_locations(buf, password, "Password")
4716 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 4717 get_key_locations(buf, msk, "MSK")
4718 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 4719 verify_not_present(buf, pmk, fname, "PMK")
4720
4721 dev[0].request("REMOVE_NETWORK all")
4722
4723 logger.info("Checking keys in memory after network profile removal")
4724 buf = read_process_memory(pid, password)
4725
4726 get_key_locations(buf, password, "Password")
4727 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 4728 get_key_locations(buf, msk, "MSK")
4729 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 4730 verify_not_present(buf, password, fname, "password")
4731 verify_not_present(buf, pmk, fname, "PMK")
4732 verify_not_present(buf, kck, fname, "KCK")
4733 verify_not_present(buf, kek, fname, "KEK")
4734 verify_not_present(buf, tk, fname, "TK")
4735 verify_not_present(buf, gtk, fname, "GTK")
750904dd
JM		 4736 verify_not_present(buf, msk, fname, "MSK")
4737 verify_not_present(buf, emsk, fname, "EMSK")
a08fdb17
JM		 4738
4739def test_ap_wpa2_eap_unexpected_wep_eapol_key(dev, apdev):
4740 """WPA2-Enterprise connection and unexpected WEP EAPOL-Key"""
4741 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4742 hapd = hostapd.add_ap(apdev[0], params)
a08fdb17 4743 bssid = apdev[0]['bssid']
3b3e2687 4744 eap_connect(dev[0], hapd, "TTLS", "pap user",
a08fdb17
JM		 4745 anonymous_identity="ttls", password="password",
4746 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
4747
4748 # Send unexpected WEP EAPOL-Key; this gets dropped
4749 res = dev[0].request("EAPOL_RX " + bssid + " 0203002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
4750 if "OK" not in res:
4751 raise Exception("EAPOL_RX to wpa_supplicant failed")
52352802
JM		 4752
4753def test_ap_wpa2_eap_in_bridge(dev, apdev):
4754 """WPA2-EAP and wpas interface in a bridge"""
4755 br_ifname='sta-br0'
4756 ifname='wlan5'
4757 try:
4758 _test_ap_wpa2_eap_in_bridge(dev, apdev)
4759 finally:
4760 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'down'])
4761 subprocess.call(['brctl', 'delif', br_ifname, ifname])
4762 subprocess.call(['brctl', 'delbr', br_ifname])
4763 subprocess.call(['iw', ifname, 'set', '4addr', 'off'])
4764
4765def _test_ap_wpa2_eap_in_bridge(dev, apdev):
4766 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4767 hapd = hostapd.add_ap(apdev[0], params)
52352802
JM		 4768
4769 br_ifname='sta-br0'
4770 ifname='wlan5'
4771 wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
4772 subprocess.call(['brctl', 'addbr', br_ifname])
4773 subprocess.call(['brctl', 'setfd', br_ifname, '0'])
4774 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
4775 subprocess.call(['iw', ifname, 'set', '4addr', 'on'])
4776 subprocess.check_call(['brctl', 'addif', br_ifname, ifname])
4777 wpas.interface_add(ifname, br_ifname=br_ifname)
4b9d79b6 4778 wpas.dump_monitor()
52352802 4779
3b3e2687 4780 id = eap_connect(wpas, hapd, "PAX", "pax.user@example.com",
52352802 4781 password_hex="0123456789abcdef0123456789abcdef")
4b9d79b6 4782 wpas.dump_monitor()
52352802 4783 eap_reauth(wpas, "PAX")
4b9d79b6 4784 wpas.dump_monitor()
52352802
JM		 4785 # Try again as a regression test for packet socket workaround
4786 eap_reauth(wpas, "PAX")
4b9d79b6 4787 wpas.dump_monitor()
52352802
JM		 4788 wpas.request("DISCONNECT")
4789 wpas.wait_disconnected()
4b9d79b6 4790 wpas.dump_monitor()
52352802
JM		 4791 wpas.request("RECONNECT")
4792 wpas.wait_connected()
4b9d79b6 4793 wpas.dump_monitor()
febf5752
JM		 4794
4795def test_ap_wpa2_eap_session_ticket(dev, apdev):
4796 """WPA2-Enterprise connection using EAP-TTLS and TLS session ticket enabled"""
4797 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4798 hapd = hostapd.add_ap(apdev[0], params)
febf5752
JM		 4799 key_mgmt = hapd.get_config()['key_mgmt']
4800 if key_mgmt.split(' ')[0] != "WPA-EAP":
4801 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3b3e2687 4802 eap_connect(dev[0], hapd, "TTLS", "pap user",
febf5752
JM		 4803 anonymous_identity="ttls", password="password",
4804 ca_cert="auth_serv/ca.pem",
4805 phase1="tls_disable_session_ticket=0", phase2="auth=PAP")
4806 eap_reauth(dev[0], "TTLS")
4807
4808def test_ap_wpa2_eap_no_workaround(dev, apdev):
4809 """WPA2-Enterprise connection using EAP-TTLS and eap_workaround=0"""
4810 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4811 hapd = hostapd.add_ap(apdev[0], params)
febf5752
JM		 4812 key_mgmt = hapd.get_config()['key_mgmt']
4813 if key_mgmt.split(' ')[0] != "WPA-EAP":
4814 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3b3e2687 4815 eap_connect(dev[0], hapd, "TTLS", "pap user",
febf5752
JM		 4816 anonymous_identity="ttls", password="password",
4817 ca_cert="auth_serv/ca.pem", eap_workaround='0',
4818 phase2="auth=PAP")
4819 eap_reauth(dev[0], "TTLS")
b197a819
JM		 4820
4821def test_ap_wpa2_eap_tls_check_crl(dev, apdev):
4822 """EAP-TLS and server checking CRL"""
4823 params = int_eap_server_params()
4824 params['check_crl'] = '1'
8b8a1864 4825 hapd = hostapd.add_ap(apdev[0], params)
b197a819
JM		 4826
4827 # check_crl=1 and no CRL available --> reject connection
3b3e2687 4828 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
b197a819
JM		 4829 client_cert="auth_serv/user.pem",
4830 private_key="auth_serv/user.key", expect_failure=True)
4831 dev[0].request("REMOVE_NETWORK all")
4832
4833 hapd.disable()
4834 hapd.set("ca_cert", "auth_serv/ca-and-crl.pem")
4835 hapd.enable()
4836
4837 # check_crl=1 and valid CRL --> accept
3b3e2687 4838 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
b197a819
JM		 4839 client_cert="auth_serv/user.pem",
4840 private_key="auth_serv/user.key")
4841 dev[0].request("REMOVE_NETWORK all")
4842
4843 hapd.disable()
4844 hapd.set("check_crl", "2")
4845 hapd.enable()
4846
4847 # check_crl=2 and valid CRL --> accept
3b3e2687 4848 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
b197a819
JM		 4849 client_cert="auth_serv/user.pem",
4850 private_key="auth_serv/user.key")
4851 dev[0].request("REMOVE_NETWORK all")
b1fb4275
JM		 4852
4853def test_ap_wpa2_eap_tls_oom(dev, apdev):
4854 """EAP-TLS and OOM"""
4855 check_subject_match_support(dev[0])
4856 check_altsubject_match_support(dev[0])
e78eb404 4857 check_domain_match(dev[0])
b1fb4275
JM		 4858 check_domain_match_full(dev[0])
4859
4860 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4861 hostapd.add_ap(apdev[0], params)
b1fb4275
JM		 4862
4863 tests = [ (1, "tls_connection_set_subject_match"),
4864 (2, "tls_connection_set_subject_match"),
4865 (3, "tls_connection_set_subject_match"),
4866 (4, "tls_connection_set_subject_match") ]
4867 for count, func in tests:
4868 with alloc_fail(dev[0], count, func):
4869 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4870 identity="tls user", ca_cert="auth_serv/ca.pem",
4871 client_cert="auth_serv/user.pem",
4872 private_key="auth_serv/user.key",
4873 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
4874 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/",
4875 domain_suffix_match="server.w1.fi",
4876 domain_match="server.w1.fi",
4877 wait_connect=False, scan_freq="2412")
4878 # TLS parameter configuration error results in CTRL-REQ-PASSPHRASE
4879 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"], timeout=5)
4880 if ev is None:
4881 raise Exception("No passphrase request")
4882 dev[0].request("REMOVE_NETWORK all")
4883 dev[0].wait_disconnected()
405c621c
JM		 4884
4885def test_ap_wpa2_eap_tls_macacl(dev, apdev):
4886 """WPA2-Enterprise connection using MAC ACL"""
4887 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4888 params["macaddr_acl"] = "2"
3b3e2687
JD		 4889 hapd = hostapd.add_ap(apdev[0], params)
4890 eap_connect(dev[1], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
405c621c
JM		 4891 client_cert="auth_serv/user.pem",
4892 private_key="auth_serv/user.key")
85774b70
JM		 4893
4894def test_ap_wpa2_eap_oom(dev, apdev):
4895 """EAP server and OOM"""
4896 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 4897 hapd = hostapd.add_ap(apdev[0], params)
85774b70
JM		 4898 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
4899
4900 with alloc_fail(hapd, 1, "eapol_auth_alloc"):
4901 # The first attempt fails, but STA will send EAPOL-Start to retry and
4902 # that succeeds.
4903 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4904 identity="tls user", ca_cert="auth_serv/ca.pem",
4905 client_cert="auth_serv/user.pem",
4906 private_key="auth_serv/user.key",
4907 scan_freq="2412")
6c4b5da4 4908
3b3e2687
JD		 4909def check_tls_ver(dev, hapd, phase1, expected):
4910 eap_connect(dev, hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
6c4b5da4
JM		 4911 client_cert="auth_serv/user.pem",
4912 private_key="auth_serv/user.key",
4913 phase1=phase1)
4914 ver = dev.get_status_field("eap_tls_version")
4915 if ver != expected:
4916 raise Exception("Unexpected TLS version (expected %s): %s" % (expected, ver))
4917
4918def test_ap_wpa2_eap_tls_versions(dev, apdev):
4919 """EAP-TLS and TLS version configuration"""
4920 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3b3e2687 4921 hapd = hostapd.add_ap(apdev[0], params)
6c4b5da4
JM		 4922
4923 tls = dev[0].request("GET tls_library")
4924 if tls.startswith("OpenSSL"):
4925 if "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
3b3e2687 4926 check_tls_ver(dev[0], hapd,
6c4b5da4
JM		 4927 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1",
4928 "TLSv1.2")
2286578f 4929 elif tls.startswith("internal"):
3b3e2687 4930 check_tls_ver(dev[0], hapd,
2286578f 4931 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1", "TLSv1.2")
3b3e2687 4932 check_tls_ver(dev[1], hapd,
6c4b5da4 4933 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_2=1", "TLSv1.1")
3b3e2687 4934 check_tls_ver(dev[2], hapd,
6c4b5da4 4935 "tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1")
ecafa0cf
JM		 4936
4937def test_rsn_ie_proto_eap_sta(dev, apdev):
4938 """RSN element protocol testing for EAP cases on STA side"""
4939 bssid = apdev[0]['bssid']
4940 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4941 # This is the RSN element used normally by hostapd
4942 params['own_ie_override'] = '30140100000fac040100000fac040100000fac010c00'
8b8a1864 4943 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 4944 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
4945 identity="gpsk user",
4946 password="abcdefghijklmnop0123456789abcdef",
4947 scan_freq="2412")
4948
4949 tests = [ ('No RSN Capabilities field',
4950 '30120100000fac040100000fac040100000fac01'),
4951 ('No AKM Suite fields',
4952 '300c0100000fac040100000fac04'),
4953 ('No Pairwise Cipher Suite fields',
4954 '30060100000fac04'),
4955 ('No Group Data Cipher Suite field',
4956 '30020100') ]
4957 for txt,ie in tests:
4958 dev[0].request("DISCONNECT")
4959 dev[0].wait_disconnected()
4960 logger.info(txt)
4961 hapd.disable()
4962 hapd.set('own_ie_override', ie)
4963 hapd.enable()
4964 dev[0].request("BSS_FLUSH 0")
4965 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
4966 dev[0].select_network(id, freq=2412)
4967 dev[0].wait_connected()
f9dd43ea 4968
9353f07f
JM		 4969 dev[0].request("DISCONNECT")
4970 dev[0].wait_disconnected()
4971 dev[0].flush_scan_cache()
4972
f9dd43ea
JM		 4973def check_tls_session_resumption_capa(dev, hapd):
4974 tls = hapd.request("GET tls_library")
4975 if not tls.startswith("OpenSSL"):
4976 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
4977
4978 tls = dev.request("GET tls_library")
4979 if not tls.startswith("OpenSSL"):
4980 raise HwsimSkip("Session resumption not supported with this TLS library: " + tls)
4981
4982def test_eap_ttls_pap_session_resumption(dev, apdev):
4983 """EAP-TTLS/PAP session resumption"""
4984 params = int_eap_server_params()
4985 params['tls_session_lifetime'] = '60'
8b8a1864 4986 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 4987 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 4988 eap_connect(dev[0], hapd, "TTLS", "pap user",
f9dd43ea
JM		 4989 anonymous_identity="ttls", password="password",
4990 ca_cert="auth_serv/ca.pem", eap_workaround='0',
4991 phase2="auth=PAP")
4992 if dev[0].get_status_field("tls_session_reused") != '0':
4993 raise Exception("Unexpected session resumption on the first connection")
4994
4995 dev[0].request("REAUTHENTICATE")
4996 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4997 if ev is None:
4998 raise Exception("EAP success timed out")
4999 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5000 if ev is None:
5001 raise Exception("Key handshake with the AP timed out")
5002 if dev[0].get_status_field("tls_session_reused") != '1':
5003 raise Exception("Session resumption not used on the second connection")
5004
5005def test_eap_ttls_chap_session_resumption(dev, apdev):
5006 """EAP-TTLS/CHAP session resumption"""
5007 params = int_eap_server_params()
5008 params['tls_session_lifetime'] = '60'
8b8a1864 5009 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5010 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5011 eap_connect(dev[0], hapd, "TTLS", "chap user",
f9dd43ea
JM		 5012 anonymous_identity="ttls", password="password",
5013 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
5014 if dev[0].get_status_field("tls_session_reused") != '0':
5015 raise Exception("Unexpected session resumption on the first connection")
5016
5017 dev[0].request("REAUTHENTICATE")
5018 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5019 if ev is None:
5020 raise Exception("EAP success timed out")
5021 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5022 if ev is None:
5023 raise Exception("Key handshake with the AP timed out")
5024 if dev[0].get_status_field("tls_session_reused") != '1':
5025 raise Exception("Session resumption not used on the second connection")
5026
5027def test_eap_ttls_mschap_session_resumption(dev, apdev):
5028 """EAP-TTLS/MSCHAP session resumption"""
e78eb404 5029 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 5030 params = int_eap_server_params()
5031 params['tls_session_lifetime'] = '60'
8b8a1864 5032 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5033 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5034 eap_connect(dev[0], hapd, "TTLS", "mschap user",
f9dd43ea
JM		 5035 anonymous_identity="ttls", password="password",
5036 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
5037 domain_suffix_match="server.w1.fi")
5038 if dev[0].get_status_field("tls_session_reused") != '0':
5039 raise Exception("Unexpected session resumption on the first connection")
5040
5041 dev[0].request("REAUTHENTICATE")
5042 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5043 if ev is None:
5044 raise Exception("EAP success timed out")
5045 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5046 if ev is None:
5047 raise Exception("Key handshake with the AP timed out")
5048 if dev[0].get_status_field("tls_session_reused") != '1':
5049 raise Exception("Session resumption not used on the second connection")
5050
5051def test_eap_ttls_mschapv2_session_resumption(dev, apdev):
5052 """EAP-TTLS/MSCHAPv2 session resumption"""
e78eb404 5053 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 5054 check_eap_capa(dev[0], "MSCHAPV2")
5055 params = int_eap_server_params()
5056 params['tls_session_lifetime'] = '60'
8b8a1864 5057 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5058 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5059 eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user",
f9dd43ea
JM		 5060 anonymous_identity="ttls", password="password",
5061 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
5062 domain_suffix_match="server.w1.fi")
5063 if dev[0].get_status_field("tls_session_reused") != '0':
5064 raise Exception("Unexpected session resumption on the first connection")
5065
5066 dev[0].request("REAUTHENTICATE")
5067 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5068 if ev is None:
5069 raise Exception("EAP success timed out")
5070 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5071 if ev is None:
5072 raise Exception("Key handshake with the AP timed out")
5073 if dev[0].get_status_field("tls_session_reused") != '1':
5074 raise Exception("Session resumption not used on the second connection")
5075
5076def test_eap_ttls_eap_gtc_session_resumption(dev, apdev):
5077 """EAP-TTLS/EAP-GTC session resumption"""
5078 params = int_eap_server_params()
5079 params['tls_session_lifetime'] = '60'
8b8a1864 5080 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5081 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5082 eap_connect(dev[0], hapd, "TTLS", "user",
f9dd43ea
JM		 5083 anonymous_identity="ttls", password="password",
5084 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
5085 if dev[0].get_status_field("tls_session_reused") != '0':
5086 raise Exception("Unexpected session resumption on the first connection")
5087
5088 dev[0].request("REAUTHENTICATE")
5089 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5090 if ev is None:
5091 raise Exception("EAP success timed out")
5092 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5093 if ev is None:
5094 raise Exception("Key handshake with the AP timed out")
5095 if dev[0].get_status_field("tls_session_reused") != '1':
5096 raise Exception("Session resumption not used on the second connection")
5097
5098def test_eap_ttls_no_session_resumption(dev, apdev):
5099 """EAP-TTLS session resumption disabled on server"""
5100 params = int_eap_server_params()
5101 params['tls_session_lifetime'] = '0'
8b8a1864 5102 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5103 eap_connect(dev[0], hapd, "TTLS", "pap user",
f9dd43ea
JM		 5104 anonymous_identity="ttls", password="password",
5105 ca_cert="auth_serv/ca.pem", eap_workaround='0',
5106 phase2="auth=PAP")
5107 if dev[0].get_status_field("tls_session_reused") != '0':
5108 raise Exception("Unexpected session resumption on the first connection")
5109
5110 dev[0].request("REAUTHENTICATE")
5111 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5112 if ev is None:
5113 raise Exception("EAP success timed out")
5114 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5115 if ev is None:
5116 raise Exception("Key handshake with the AP timed out")
5117 if dev[0].get_status_field("tls_session_reused") != '0':
5118 raise Exception("Unexpected session resumption on the second connection")
5119
5120def test_eap_peap_session_resumption(dev, apdev):
5121 """EAP-PEAP session resumption"""
5122 params = int_eap_server_params()
5123 params['tls_session_lifetime'] = '60'
8b8a1864 5124 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5125 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5126 eap_connect(dev[0], hapd, "PEAP", "user",
f9dd43ea
JM		 5127 anonymous_identity="peap", password="password",
5128 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
5129 if dev[0].get_status_field("tls_session_reused") != '0':
5130 raise Exception("Unexpected session resumption on the first connection")
5131
5132 dev[0].request("REAUTHENTICATE")
5133 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5134 if ev is None:
5135 raise Exception("EAP success timed out")
5136 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5137 if ev is None:
5138 raise Exception("Key handshake with the AP timed out")
5139 if dev[0].get_status_field("tls_session_reused") != '1':
5140 raise Exception("Session resumption not used on the second connection")
5141
81e1ab85
JM		 5142def test_eap_peap_session_resumption_crypto_binding(dev, apdev):
5143 """EAP-PEAP session resumption with crypto binding"""
5144 params = int_eap_server_params()
5145 params['tls_session_lifetime'] = '60'
8b8a1864 5146 hapd = hostapd.add_ap(apdev[0], params)
81e1ab85 5147 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5148 eap_connect(dev[0], hapd, "PEAP", "user",
81e1ab85
JM		 5149 anonymous_identity="peap", password="password",
5150 phase1="peapver=0 crypto_binding=2",
5151 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
5152 if dev[0].get_status_field("tls_session_reused") != '0':
5153 raise Exception("Unexpected session resumption on the first connection")
5154
5155 dev[0].request("REAUTHENTICATE")
5156 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5157 if ev is None:
5158 raise Exception("EAP success timed out")
5159 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5160 if ev is None:
5161 raise Exception("Key handshake with the AP timed out")
5162 if dev[0].get_status_field("tls_session_reused") != '1':
5163 raise Exception("Session resumption not used on the second connection")
5164
f9dd43ea
JM		 5165def test_eap_peap_no_session_resumption(dev, apdev):
5166 """EAP-PEAP session resumption disabled on server"""
5167 params = int_eap_server_params()
8b8a1864 5168 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5169 eap_connect(dev[0], hapd, "PEAP", "user",
f9dd43ea
JM		 5170 anonymous_identity="peap", password="password",
5171 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
5172 if dev[0].get_status_field("tls_session_reused") != '0':
5173 raise Exception("Unexpected session resumption on the first connection")
5174
5175 dev[0].request("REAUTHENTICATE")
5176 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5177 if ev is None:
5178 raise Exception("EAP success timed out")
5179 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5180 if ev is None:
5181 raise Exception("Key handshake with the AP timed out")
5182 if dev[0].get_status_field("tls_session_reused") != '0':
5183 raise Exception("Unexpected session resumption on the second connection")
5184
5185def test_eap_tls_session_resumption(dev, apdev):
5186 """EAP-TLS session resumption"""
5187 params = int_eap_server_params()
5188 params['tls_session_lifetime'] = '60'
8b8a1864 5189 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5190 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5191 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
f9dd43ea
JM		 5192 client_cert="auth_serv/user.pem",
5193 private_key="auth_serv/user.key")
5194 if dev[0].get_status_field("tls_session_reused") != '0':
5195 raise Exception("Unexpected session resumption on the first connection")
5196
5197 dev[0].request("REAUTHENTICATE")
5198 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5199 if ev is None:
5200 raise Exception("EAP success timed out")
5201 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5202 if ev is None:
5203 raise Exception("Key handshake with the AP timed out")
5204 if dev[0].get_status_field("tls_session_reused") != '1':
5205 raise Exception("Session resumption not used on the second connection")
5206
5207 dev[0].request("REAUTHENTICATE")
5208 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5209 if ev is None:
5210 raise Exception("EAP success timed out")
5211 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5212 if ev is None:
5213 raise Exception("Key handshake with the AP timed out")
5214 if dev[0].get_status_field("tls_session_reused") != '1':
5215 raise Exception("Session resumption not used on the third connection")
5216
5217def test_eap_tls_session_resumption_expiration(dev, apdev):
5218 """EAP-TLS session resumption"""
5219 params = int_eap_server_params()
5220 params['tls_session_lifetime'] = '1'
8b8a1864 5221 hapd = hostapd.add_ap(apdev[0], params)
f9dd43ea 5222 check_tls_session_resumption_capa(dev[0], hapd)
3b3e2687 5223 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
f9dd43ea
JM		 5224 client_cert="auth_serv/user.pem",
5225 private_key="auth_serv/user.key")
5226 if dev[0].get_status_field("tls_session_reused") != '0':
5227 raise Exception("Unexpected session resumption on the first connection")
5228
5229 # Allow multiple attempts since OpenSSL may not expire the cached entry
5230 # immediately.
5231 for i in range(10):
5232 time.sleep(1.2)
5233
5234 dev[0].request("REAUTHENTICATE")
5235 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5236 if ev is None:
5237 raise Exception("EAP success timed out")
5238 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5239 if ev is None:
5240 raise Exception("Key handshake with the AP timed out")
5241 if dev[0].get_status_field("tls_session_reused") == '0':
5242 break
5243 if dev[0].get_status_field("tls_session_reused") != '0':
5244 raise Exception("Session resumption used after lifetime expiration")
5245
5246def test_eap_tls_no_session_resumption(dev, apdev):
5247 """EAP-TLS session resumption disabled on server"""
5248 params = int_eap_server_params()
8b8a1864 5249 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5250 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
f9dd43ea
JM		 5251 client_cert="auth_serv/user.pem",
5252 private_key="auth_serv/user.key")
5253 if dev[0].get_status_field("tls_session_reused") != '0':
5254 raise Exception("Unexpected session resumption on the first connection")
5255
5256 dev[0].request("REAUTHENTICATE")
5257 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5258 if ev is None:
5259 raise Exception("EAP success timed out")
5260 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5261 if ev is None:
5262 raise Exception("Key handshake with the AP timed out")
5263 if dev[0].get_status_field("tls_session_reused") != '0':
5264 raise Exception("Unexpected session resumption on the second connection")
5265
5266def test_eap_tls_session_resumption_radius(dev, apdev):
5267 """EAP-TLS session resumption (RADIUS)"""
5268 params = { "ssid": "as", "beacon_int": "2000",
5269 "radius_server_clients": "auth_serv/radius_clients.conf",
5270 "radius_server_auth_port": '18128',
5271 "eap_server": "1",
5272 "eap_user_file": "auth_serv/eap_user.conf",
5273 "ca_cert": "auth_serv/ca.pem",
5274 "server_cert": "auth_serv/server.pem",
5275 "private_key": "auth_serv/server.key",
5276 "tls_session_lifetime": "60" }
8b8a1864 5277 authsrv = hostapd.add_ap(apdev[1], params)
f9dd43ea
JM		 5278 check_tls_session_resumption_capa(dev[0], authsrv)
5279
5280 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
5281 params['auth_server_port'] = "18128"
8b8a1864 5282 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5283 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
f9dd43ea
JM		 5284 client_cert="auth_serv/user.pem",
5285 private_key="auth_serv/user.key")
5286 if dev[0].get_status_field("tls_session_reused") != '0':
5287 raise Exception("Unexpected session resumption on the first connection")
5288
5289 dev[0].request("REAUTHENTICATE")
5290 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5291 if ev is None:
5292 raise Exception("EAP success timed out")
5293 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5294 if ev is None:
5295 raise Exception("Key handshake with the AP timed out")
5296 if dev[0].get_status_field("tls_session_reused") != '1':
5297 raise Exception("Session resumption not used on the second connection")
5298
5299def test_eap_tls_no_session_resumption_radius(dev, apdev):
5300 """EAP-TLS session resumption disabled (RADIUS)"""
5301 params = { "ssid": "as", "beacon_int": "2000",
5302 "radius_server_clients": "auth_serv/radius_clients.conf",
5303 "radius_server_auth_port": '18128',
5304 "eap_server": "1",
5305 "eap_user_file": "auth_serv/eap_user.conf",
5306 "ca_cert": "auth_serv/ca.pem",
5307 "server_cert": "auth_serv/server.pem",
5308 "private_key": "auth_serv/server.key",
5309 "tls_session_lifetime": "0" }
8b8a1864 5310 hostapd.add_ap(apdev[1], params)
f9dd43ea
JM		 5311
5312 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
5313 params['auth_server_port'] = "18128"
8b8a1864 5314 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5315 eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
f9dd43ea
JM		 5316 client_cert="auth_serv/user.pem",
5317 private_key="auth_serv/user.key")
5318 if dev[0].get_status_field("tls_session_reused") != '0':
5319 raise Exception("Unexpected session resumption on the first connection")
5320
5321 dev[0].request("REAUTHENTICATE")
5322 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5323 if ev is None:
5324 raise Exception("EAP success timed out")
5325 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
5326 if ev is None:
5327 raise Exception("Key handshake with the AP timed out")
5328 if dev[0].get_status_field("tls_session_reused") != '0':
5329 raise Exception("Unexpected session resumption on the second connection")
7c0d66cf
JM		 5330
5331def test_eap_mschapv2_errors(dev, apdev):
5332 """EAP-MSCHAPv2 error cases"""
5333 check_eap_capa(dev[0], "MSCHAPV2")
5334 check_eap_capa(dev[0], "FAST")
5335
5336 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
8b8a1864 5337 hapd = hostapd.add_ap(apdev[0], params)
7c0d66cf
JM		 5338 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
5339 identity="phase1-user", password="password",
5340 scan_freq="2412")
5341 dev[0].request("REMOVE_NETWORK all")
5342 dev[0].wait_disconnected()
5343
5344 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
5345 (1, "nt_password_hash;mschapv2_derive_response"),
5346 (1, "nt_password_hash;=mschapv2_derive_response"),
5347 (1, "generate_nt_response;mschapv2_derive_response"),
5348 (1, "generate_authenticator_response;mschapv2_derive_response"),
5349 (1, "nt_password_hash;=mschapv2_derive_response"),
5350 (1, "get_master_key;mschapv2_derive_response"),
5351 (1, "os_get_random;eap_mschapv2_challenge_reply") ]
5352 for count, func in tests:
5353 with fail_test(dev[0], count, func):
5354 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
5355 identity="phase1-user", password="password",
5356 wait_connect=False, scan_freq="2412")
5357 wait_fail_trigger(dev[0], "GET_FAIL")
5358 dev[0].request("REMOVE_NETWORK all")
5359 dev[0].wait_disconnected()
5360
5361 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
5362 (1, "hash_nt_password_hash;=mschapv2_derive_response"),
5363 (1, "generate_nt_response_pwhash;mschapv2_derive_response"),
5364 (1, "generate_authenticator_response_pwhash;mschapv2_derive_response") ]
5365 for count, func in tests:
5366 with fail_test(dev[0], count, func):
5367 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
5368 identity="phase1-user",
5369 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
5370 wait_connect=False, scan_freq="2412")
5371 wait_fail_trigger(dev[0], "GET_FAIL")
5372 dev[0].request("REMOVE_NETWORK all")
5373 dev[0].wait_disconnected()
5374
5375 tests = [ (1, "eap_mschapv2_init"),
5376 (1, "eap_msg_alloc;eap_mschapv2_challenge_reply"),
5377 (1, "eap_msg_alloc;eap_mschapv2_success"),
5378 (1, "eap_mschapv2_getKey") ]
5379 for count, func in tests:
5380 with alloc_fail(dev[0], count, func):
5381 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
5382 identity="phase1-user", password="password",
5383 wait_connect=False, scan_freq="2412")
5384 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5385 dev[0].request("REMOVE_NETWORK all")
5386 dev[0].wait_disconnected()
5387
5388 tests = [ (1, "eap_msg_alloc;eap_mschapv2_failure") ]
5389 for count, func in tests:
5390 with alloc_fail(dev[0], count, func):
5391 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
5392 identity="phase1-user", password="wrong password",
5393 wait_connect=False, scan_freq="2412")
5394 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5395 dev[0].request("REMOVE_NETWORK all")
5396 dev[0].wait_disconnected()
5397
5398 tests = [ (2, "eap_mschapv2_init"),
5399 (3, "eap_mschapv2_init") ]
5400 for count, func in tests:
5401 with alloc_fail(dev[0], count, func):
5402 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="FAST",
5403 anonymous_identity="FAST", identity="user",
5404 password="password",
5405 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
5406 phase1="fast_provisioning=1",
5407 pac_file="blob://fast_pac",
5408 wait_connect=False, scan_freq="2412")
5409 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5410 dev[0].request("REMOVE_NETWORK all")
5411 dev[0].wait_disconnected()
bf0ec17a
JM		 5412
5413def test_eap_gpsk_errors(dev, apdev):
5414 """EAP-GPSK error cases"""
5415 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
8b8a1864 5416 hapd = hostapd.add_ap(apdev[0], params)
bf0ec17a
JM		 5417 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
5418 identity="gpsk user",
5419 password="abcdefghijklmnop0123456789abcdef",
5420 scan_freq="2412")
5421 dev[0].request("REMOVE_NETWORK all")
5422 dev[0].wait_disconnected()
5423
5424 tests = [ (1, "os_get_random;eap_gpsk_send_gpsk_2", None),
5425 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
5426 "cipher=1"),
5427 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
5428 "cipher=2"),
5429 (1, "eap_gpsk_derive_keys_helper", None),
5430 (2, "eap_gpsk_derive_keys_helper", None),
5431 (1, "eap_gpsk_compute_mic_aes;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
5432 "cipher=1"),
5433 (1, "hmac_sha256;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
5434 "cipher=2"),
5435 (1, "eap_gpsk_compute_mic;eap_gpsk_validate_gpsk_3_mic", None),
5436 (1, "eap_gpsk_compute_mic;eap_gpsk_send_gpsk_4", None),
5437 (1, "eap_gpsk_derive_mid_helper", None) ]
5438 for count, func, phase1 in tests:
5439 with fail_test(dev[0], count, func):
5440 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
5441 identity="gpsk user",
5442 password="abcdefghijklmnop0123456789abcdef",
5443 phase1=phase1,
5444 wait_connect=False, scan_freq="2412")
5445 wait_fail_trigger(dev[0], "GET_FAIL")
5446 dev[0].request("REMOVE_NETWORK all")
5447 dev[0].wait_disconnected()
5448
5449 tests = [ (1, "eap_gpsk_init"),
5450 (2, "eap_gpsk_init"),
5451 (3, "eap_gpsk_init"),
5452 (1, "eap_gpsk_process_id_server"),
5453 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_2"),
5454 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
5455 (1, "eap_gpsk_derive_mid_helper;eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
5456 (1, "eap_gpsk_derive_keys"),
5457 (1, "eap_gpsk_derive_keys_helper"),
5458 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_4"),
5459 (1, "eap_gpsk_getKey"),
5460 (1, "eap_gpsk_get_emsk"),
5461 (1, "eap_gpsk_get_session_id") ]
5462 for count, func in tests:
5463 with alloc_fail(dev[0], count, func):
5464 dev[0].request("ERP_FLUSH")
5465 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
5466 identity="gpsk user", erp="1",
5467 password="abcdefghijklmnop0123456789abcdef",
5468 wait_connect=False, scan_freq="2412")
5469 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5470 dev[0].request("REMOVE_NETWORK all")
5471 dev[0].wait_disconnected()
d4c3c055
JM		 5472
5473def test_ap_wpa2_eap_sim_db(dev, apdev, params):
5474 """EAP-SIM DB error cases"""
5475 sockpath = '/tmp/hlr_auc_gw.sock-test'
5476 try:
5477 os.remove(sockpath)
5478 except:
5479 pass
5480 hparams = int_eap_server_params()
5481 hparams['eap_sim_db'] = 'unix:' + sockpath
8b8a1864 5482 hapd = hostapd.add_ap(apdev[0], hparams)
d4c3c055
JM		 5483
5484 # Initial test with hlr_auc_gw socket not available
5485 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
5486 eap="SIM", identity="1232010000000000",
5487 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
5488 scan_freq="2412", wait_connect=False)
5489 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
5490 if ev is None:
5491 raise Exception("EAP-Failure not reported")
5492 dev[0].wait_disconnected()
5493 dev[0].request("DISCONNECT")
5494
5495 # Test with invalid responses and response timeout
5496
5497 class test_handler(SocketServer.DatagramRequestHandler):
5498 def handle(self):
5499 data = self.request[0].strip()
5500 socket = self.request[1]
5501 logger.debug("Received hlr_auc_gw request: " + data)
5502 # EAP-SIM DB: Failed to parse response string
5503 socket.sendto("FOO", self.client_address)
5504 # EAP-SIM DB: Failed to parse response string
5505 socket.sendto("FOO 1", self.client_address)
5506 # EAP-SIM DB: Unknown external response
5507 socket.sendto("FOO 1 2", self.client_address)
5508 logger.info("No proper response - wait for pending eap_sim_db request timeout")
5509
5510 server = SocketServer.UnixDatagramServer(sockpath, test_handler)
5511 server.timeout = 1
5512
5513 dev[0].select_network(id)
5514 server.handle_request()
5515 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
5516 if ev is None:
5517 raise Exception("EAP-Failure not reported")
5518 dev[0].wait_disconnected()
5519 dev[0].request("DISCONNECT")
5520
5521 # Test with a valid response
5522
5523 class test_handler2(SocketServer.DatagramRequestHandler):
5524 def handle(self):
5525 data = self.request[0].strip()
5526 socket = self.request[1]
5527 logger.debug("Received hlr_auc_gw request: " + data)
5528 fname = os.path.join(params['logdir'],
5529 'hlr_auc_gw.milenage_db')
5530 cmd = subprocess.Popen(['../../hostapd/hlr_auc_gw',
5531 '-m', fname, data],
5532 stdout=subprocess.PIPE)
5533 res = cmd.stdout.read().strip()
5534 cmd.stdout.close()
5535 logger.debug("hlr_auc_gw response: " + res)
5536 socket.sendto(res, self.client_address)
5537
5538 server.RequestHandlerClass = test_handler2
5539
5540 dev[0].select_network(id)
5541 server.handle_request()
5542 dev[0].wait_connected()
5543 dev[0].request("DISCONNECT")
5544 dev[0].wait_disconnected()
d6ba709a
JM		 5545
5546def test_eap_tls_sha512(dev, apdev, params):
5547 """EAP-TLS with SHA512 signature"""
5548 params = int_eap_server_params()
5549 params["ca_cert"] = "auth_serv/sha512-ca.pem"
5550 params["server_cert"] = "auth_serv/sha512-server.pem"
5551 params["private_key"] = "auth_serv/sha512-server.key"
8b8a1864 5552 hostapd.add_ap(apdev[0], params)
d6ba709a
JM		 5553
5554 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5555 identity="tls user sha512",
5556 ca_cert="auth_serv/sha512-ca.pem",
5557 client_cert="auth_serv/sha512-user.pem",
5558 private_key="auth_serv/sha512-user.key",
5559 scan_freq="2412")
5560 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5561 identity="tls user sha512",
5562 ca_cert="auth_serv/sha512-ca.pem",
5563 client_cert="auth_serv/sha384-user.pem",
5564 private_key="auth_serv/sha384-user.key",
5565 scan_freq="2412")
5566
5567def test_eap_tls_sha384(dev, apdev, params):
5568 """EAP-TLS with SHA384 signature"""
5569 params = int_eap_server_params()
5570 params["ca_cert"] = "auth_serv/sha512-ca.pem"
5571 params["server_cert"] = "auth_serv/sha384-server.pem"
5572 params["private_key"] = "auth_serv/sha384-server.key"
8b8a1864 5573 hostapd.add_ap(apdev[0], params)
d6ba709a
JM		 5574
5575 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5576 identity="tls user sha512",
5577 ca_cert="auth_serv/sha512-ca.pem",
5578 client_cert="auth_serv/sha512-user.pem",
5579 private_key="auth_serv/sha512-user.key",
5580 scan_freq="2412")
5581 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5582 identity="tls user sha512",
5583 ca_cert="auth_serv/sha512-ca.pem",
5584 client_cert="auth_serv/sha384-user.pem",
5585 private_key="auth_serv/sha384-user.key",
5586 scan_freq="2412")
0ceff76e
JM		 5587
5588def test_ap_wpa2_eap_assoc_rsn(dev, apdev):
5589 """WPA2-Enterprise AP and association request RSN IE differences"""
5590 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 5591 hostapd.add_ap(apdev[0], params)
0ceff76e
JM		 5592
5593 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap-11w")
5594 params["ieee80211w"] = "2"
8b8a1864 5595 hostapd.add_ap(apdev[1], params)
0ceff76e
JM		 5596
5597 # Success cases with optional RSN IE fields removed one by one
5598 tests = [ ("Normal wpa_supplicant assoc req RSN IE",
5599 "30140100000fac040100000fac040100000fac010000"),
5600 ("Extra PMKIDCount field in RSN IE",
5601 "30160100000fac040100000fac040100000fac0100000000"),
5602 ("Extra Group Management Cipher Suite in RSN IE",
5603 "301a0100000fac040100000fac040100000fac0100000000000fac06"),
5604 ("Extra undefined extension field in RSN IE",
5605 "301c0100000fac040100000fac040100000fac0100000000000fac061122"),
5606 ("RSN IE without RSN Capabilities",
5607 "30120100000fac040100000fac040100000fac01"),
5608 ("RSN IE without AKM", "300c0100000fac040100000fac04"),
5609 ("RSN IE without pairwise", "30060100000fac04"),
5610 ("RSN IE without group", "30020100") ]
5611 for title, ie in tests:
5612 logger.info(title)
5613 set_test_assoc_ie(dev[0], ie)
5614 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
5615 identity="gpsk user",
5616 password="abcdefghijklmnop0123456789abcdef",
5617 scan_freq="2412")
5618 dev[0].request("REMOVE_NETWORK all")
5619 dev[0].wait_disconnected()
5620
5621 tests = [ ("Normal wpa_supplicant assoc req RSN IE",
5622 "30140100000fac040100000fac040100000fac01cc00"),
5623 ("Group management cipher included in assoc req RSN IE",
5624 "301a0100000fac040100000fac040100000fac01cc000000000fac06") ]
5625 for title, ie in tests:
5626 logger.info(title)
5627 set_test_assoc_ie(dev[0], ie)
5628 dev[0].connect("test-wpa2-eap-11w", key_mgmt="WPA-EAP", ieee80211w="1",
5629 eap="GPSK", identity="gpsk user",
5630 password="abcdefghijklmnop0123456789abcdef",
5631 scan_freq="2412")
5632 dev[0].request("REMOVE_NETWORK all")
5633 dev[0].wait_disconnected()
5634
5635 tests = [ ("Invalid group cipher", "30060100000fac02", 41),
5636 ("Invalid pairwise cipher", "300c0100000fac040100000fac02", 42) ]
5637 for title, ie, status in tests:
5638 logger.info(title)
5639 set_test_assoc_ie(dev[0], ie)
5640 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
5641 identity="gpsk user",
5642 password="abcdefghijklmnop0123456789abcdef",
5643 scan_freq="2412", wait_connect=False)
5644 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"])
5645 if ev is None:
5646 raise Exception("Association rejection not reported")
5647 if "status_code=" + str(status) not in ev:
5648 raise Exception("Unexpected status code: " + ev)
5649 dev[0].request("REMOVE_NETWORK all")
5650 dev[0].dump_monitor()
5651
5652 tests = [ ("Management frame protection not enabled",
5653 "30140100000fac040100000fac040100000fac010000", 31),
5654 ("Unsupported management group cipher",
5655 "301a0100000fac040100000fac040100000fac01cc000000000fac0b", 31) ]
5656 for title, ie, status in tests:
5657 logger.info(title)
5658 set_test_assoc_ie(dev[0], ie)
5659 dev[0].connect("test-wpa2-eap-11w", key_mgmt="WPA-EAP", ieee80211w="1",
5660 eap="GPSK", identity="gpsk user",
5661 password="abcdefghijklmnop0123456789abcdef",
5662 scan_freq="2412", wait_connect=False)
5663 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"])
5664 if ev is None:
5665 raise Exception("Association rejection not reported")
5666 if "status_code=" + str(status) not in ev:
5667 raise Exception("Unexpected status code: " + ev)
5668 dev[0].request("REMOVE_NETWORK all")
5669 dev[0].dump_monitor()
ca27ee09
JM		 5670
5671def test_eap_tls_ext_cert_check(dev, apdev):
5672 """EAP-TLS and external server certification validation"""
5673 # With internal server certificate chain validation
5674 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5675 identity="tls user",
5676 ca_cert="auth_serv/ca.pem",
5677 client_cert="auth_serv/user.pem",
5678 private_key="auth_serv/user.key",
5679 phase1="tls_ext_cert_check=1", scan_freq="2412",
5680 only_add_network=True)
5681 run_ext_cert_check(dev, apdev, id)
5682
5683def test_eap_ttls_ext_cert_check(dev, apdev):
5684 """EAP-TTLS and external server certification validation"""
5685 # Without internal server certificate chain validation
5686 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
5687 identity="pap user", anonymous_identity="ttls",
5688 password="password", phase2="auth=PAP",
5689 phase1="tls_ext_cert_check=1", scan_freq="2412",
5690 only_add_network=True)
5691 run_ext_cert_check(dev, apdev, id)
5692
5693def test_eap_peap_ext_cert_check(dev, apdev):
5694 """EAP-PEAP and external server certification validation"""
5695 # With internal server certificate chain validation
5696 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
5697 identity="user", anonymous_identity="peap",
5698 ca_cert="auth_serv/ca.pem",
5699 password="password", phase2="auth=MSCHAPV2",
5700 phase1="tls_ext_cert_check=1", scan_freq="2412",
5701 only_add_network=True)
5702 run_ext_cert_check(dev, apdev, id)
5703
5704def test_eap_fast_ext_cert_check(dev, apdev):
5705 """EAP-FAST and external server certification validation"""
5706 check_eap_capa(dev[0], "FAST")
5707 # With internal server certificate chain validation
5708 dev[0].request("SET blob fast_pac_auth_ext ")
5709 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
5710 identity="user", anonymous_identity="FAST",
5711 ca_cert="auth_serv/ca.pem",
5712 password="password", phase2="auth=GTC",
5713 phase1="tls_ext_cert_check=1 fast_provisioning=2",
5714 pac_file="blob://fast_pac_auth_ext",
5715 scan_freq="2412",
5716 only_add_network=True)
5717 run_ext_cert_check(dev, apdev, id)
5718
5719def run_ext_cert_check(dev, apdev, net_id):
5720 check_ext_cert_check_support(dev[0])
5721 if not openssl_imported:
5722 raise HwsimSkip("OpenSSL python method not available")
5723
5724 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 5725 hapd = hostapd.add_ap(apdev[0], params)
ca27ee09
JM		 5726
5727 dev[0].select_network(net_id)
5728 certs = {}
5729 while True:
5730 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT",
5731 "CTRL-REQ-EXT_CERT_CHECK",
5732 "CTRL-EVENT-EAP-SUCCESS"], timeout=10)
5733 if ev is None:
5734 raise Exception("No peer server certificate event seen")
5735 if "CTRL-EVENT-EAP-PEER-CERT" in ev:
5736 depth = None
5737 cert = None
5738 vals = ev.split(' ')
5739 for v in vals:
5740 if v.startswith("depth="):
5741 depth = int(v.split('=')[1])
5742 elif v.startswith("cert="):
5743 cert = v.split('=')[1]
5744 if depth is not None and cert:
5745 certs[depth] = binascii.unhexlify(cert)
5746 elif "CTRL-EVENT-EAP-SUCCESS" in ev:
5747 raise Exception("Unexpected EAP-Success")
5748 elif "CTRL-REQ-EXT_CERT_CHECK" in ev:
5749 id = ev.split(':')[0].split('-')[-1]
5750 break
5751 if 0 not in certs:
5752 raise Exception("Server certificate not received")
5753 if 1 not in certs:
5754 raise Exception("Server certificate issuer not received")
5755
5756 cert = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1,
5757 certs[0])
5758 cn = cert.get_subject().commonName
5759 logger.info("Server certificate CN=" + cn)
5760
5761 issuer = OpenSSL.crypto.load_certificate(OpenSSL.crypto.FILETYPE_ASN1,
5762 certs[1])
5763 icn = issuer.get_subject().commonName
5764 logger.info("Issuer certificate CN=" + icn)
5765
5766 if cn != "server.w1.fi":
5767 raise Exception("Unexpected server certificate CN: " + cn)
5768 if icn != "Root CA":
5769 raise Exception("Unexpected server certificate issuer CN: " + icn)
5770
5771 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=0.1)
5772 if ev:
5773 raise Exception("Unexpected EAP-Success before external check result indication")
5774
5775 dev[0].request("CTRL-RSP-EXT_CERT_CHECK-" + id + ":good")
5776 dev[0].wait_connected()
5777
5778 dev[0].request("DISCONNECT")
5779 dev[0].wait_disconnected()
5780 if "FAIL" in dev[0].request("PMKSA_FLUSH"):
5781 raise Exception("PMKSA_FLUSH failed")
5782 dev[0].request("SET blob fast_pac_auth_ext ")
5783 dev[0].request("RECONNECT")
5784
5785 ev = dev[0].wait_event(["CTRL-REQ-EXT_CERT_CHECK"], timeout=10)
5786 if ev is None:
5787 raise Exception("No peer server certificate event seen (2)")
5788 id = ev.split(':')[0].split('-')[-1]
5789 dev[0].request("CTRL-RSP-EXT_CERT_CHECK-" + id + ":bad")
5790 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
5791 if ev is None:
5792 raise Exception("EAP-Failure not reported")
5793 dev[0].request("REMOVE_NETWORK all")
5794 dev[0].wait_disconnected()
a89faedc
JM		 5795
5796def test_eap_tls_errors(dev, apdev):
5797 """EAP-TLS error cases"""
5798 params = int_eap_server_params()
5799 params['fragment_size'] = '100'
8b8a1864 5800 hostapd.add_ap(apdev[0], params)
a89faedc
JM		 5801 with alloc_fail(dev[0], 1,
5802 "eap_peer_tls_reassemble_fragment"):
5803 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5804 identity="tls user", ca_cert="auth_serv/ca.pem",
5805 client_cert="auth_serv/user.pem",
5806 private_key="auth_serv/user.key",
5807 wait_connect=False, scan_freq="2412")
5808 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5809 dev[0].request("REMOVE_NETWORK all")
5810 dev[0].wait_disconnected()
5811
5812 with alloc_fail(dev[0], 1, "eap_tls_init"):
5813 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5814 identity="tls user", ca_cert="auth_serv/ca.pem",
5815 client_cert="auth_serv/user.pem",
5816 private_key="auth_serv/user.key",
5817 wait_connect=False, scan_freq="2412")
5818 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5819 dev[0].request("REMOVE_NETWORK all")
5820 dev[0].wait_disconnected()
5821
5822 with alloc_fail(dev[0], 1, "eap_peer_tls_ssl_init"):
5823 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5824 identity="tls user", ca_cert="auth_serv/ca.pem",
5825 client_cert="auth_serv/user.pem",
5826 private_key="auth_serv/user.key",
5827 engine="1",
5828 wait_connect=False, scan_freq="2412")
5829 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5830 ev = dev[0].wait_event(["CTRL-REQ-PIN"], timeout=5)
5831 if ev is None:
5832 raise Exception("No CTRL-REQ-PIN seen")
5833 dev[0].request("REMOVE_NETWORK all")
5834 dev[0].wait_disconnected()
5835
5836 tests = [ "eap_peer_tls_derive_key;eap_tls_success",
5837 "eap_peer_tls_derive_session_id;eap_tls_success",
5838 "eap_tls_getKey",
5839 "eap_tls_get_emsk",
5840 "eap_tls_get_session_id" ]
5841 for func in tests:
5842 with alloc_fail(dev[0], 1, func):
5843 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
5844 identity="tls user", ca_cert="auth_serv/ca.pem",
5845 client_cert="auth_serv/user.pem",
5846 private_key="auth_serv/user.key",
5847 erp="1",
5848 wait_connect=False, scan_freq="2412")
5849 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5850 dev[0].request("REMOVE_NETWORK all")
5851 dev[0].wait_disconnected()
5852
5853 with alloc_fail(dev[0], 1, "eap_unauth_tls_init"):
5854 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="UNAUTH-TLS",
5855 identity="unauth-tls", ca_cert="auth_serv/ca.pem",
5856 wait_connect=False, scan_freq="2412")
5857 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5858 dev[0].request("REMOVE_NETWORK all")
5859 dev[0].wait_disconnected()
5860
5861 with alloc_fail(dev[0], 1, "eap_peer_tls_ssl_init;eap_unauth_tls_init"):
5862 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="UNAUTH-TLS",
5863 identity="unauth-tls", ca_cert="auth_serv/ca.pem",
5864 wait_connect=False, scan_freq="2412")
5865 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5866 dev[0].request("REMOVE_NETWORK all")
5867 dev[0].wait_disconnected()
5868
5869 with alloc_fail(dev[0], 1, "eap_wfa_unauth_tls_init"):
5870 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
5871 eap="WFA-UNAUTH-TLS",
5872 identity="osen@example.com", ca_cert="auth_serv/ca.pem",
5873 wait_connect=False, scan_freq="2412")
5874 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5875 dev[0].request("REMOVE_NETWORK all")
5876 dev[0].wait_disconnected()
5877
5878 with alloc_fail(dev[0], 1, "eap_peer_tls_ssl_init;eap_wfa_unauth_tls_init"):
5879 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
5880 eap="WFA-UNAUTH-TLS",
5881 identity="osen@example.com", ca_cert="auth_serv/ca.pem",
5882 wait_connect=False, scan_freq="2412")
5883 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
5884 dev[0].request("REMOVE_NETWORK all")
5885 dev[0].wait_disconnected()
0918fe4d
JM		 5886
5887def test_ap_wpa2_eap_status(dev, apdev):
5888 """EAP state machine status information"""
5889 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
8b8a1864 5890 hostapd.add_ap(apdev[0], params)
0918fe4d
JM		 5891 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
5892 identity="cert user",
5893 ca_cert="auth_serv/ca.pem", phase2="auth=TLS",
5894 ca_cert2="auth_serv/ca.pem",
5895 client_cert2="auth_serv/user.pem",
5896 private_key2="auth_serv/user.key",
5897 scan_freq="2412", wait_connect=False)
5898 success = False
5899 states = []
5900 method_states = []
5901 decisions = []
5902 req_methods = []
5903 selected_methods = []
5904 for i in range(100000):
5905 s = dev[0].get_status(extra="VERBOSE")
5906 if 'EAP state' in s:
5907 state = s['EAP state']
5908 if state:
5909 if state not in states:
5910 states.append(state)
5911 if state == "SUCCESS":
5912 success = True
5913 break
5914 if 'methodState' in s:
5915 val = s['methodState']
5916 if val not in method_states:
5917 method_states.append(val)
5918 if 'decision' in s:
5919 val = s['decision']
5920 if val not in decisions:
5921 decisions.append(val)
5922 if 'reqMethod' in s:
5923 val = s['reqMethod']
5924 if val not in req_methods:
5925 req_methods.append(val)
5926 if 'selectedMethod' in s:
5927 val = s['selectedMethod']
5928 if val not in selected_methods:
5929 selected_methods.append(val)
5930 logger.info("Iterations: %d" % i)
5931 logger.info("EAP states: " + str(states))
5932 logger.info("methodStates: " + str(method_states))
5933 logger.info("decisions: " + str(decisions))
5934 logger.info("reqMethods: " + str(req_methods))
5935 logger.info("selectedMethods: " + str(selected_methods))
5936 if not success:
5937 raise Exception("EAP did not succeed")
5938 dev[0].wait_connected()
5939 dev[0].request("REMOVE_NETWORK all")
5940 dev[0].wait_disconnected()
29b508e7
JM		 5941
5942def test_ap_wpa2_eap_gpsk_ptk_rekey_ap(dev, apdev):
5943 """WPA2-Enterprise with EAP-GPSK and PTK rekey enforced by AP"""
5944 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
5945 params['wpa_ptk_rekey'] = '2'
8b8a1864 5946 hapd = hostapd.add_ap(apdev[0], params)
3b3e2687 5947 id = eap_connect(dev[0], hapd, "GPSK", "gpsk user",
29b508e7
JM		 5948 password="abcdefghijklmnop0123456789abcdef")
5949 ev = dev[0].wait_event(["WPA: Key negotiation completed"])
5950 if ev is None:
5951 raise Exception("PTK rekey timed out")
5952 hwsim_utils.test_connectivity(dev[0], hapd)
2833743d
JM		 5953
5954def test_ap_wpa2_eap_wildcard_ssid(dev, apdev):
5955 """WPA2-Enterprise connection using EAP-GPSK and wildcard SSID"""
5956 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
5957 hapd = hostapd.add_ap(apdev[0], params)
5958 dev[0].connect(bssid=apdev[0]['bssid'], key_mgmt="WPA-EAP", eap="GPSK",
5959 identity="gpsk user",
5960 password="abcdefghijklmnop0123456789abcdef",
5961 scan_freq="2412")
Unnamed repository; edit this file 'description' to name the repository.