]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_eap.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
HS 2.0: Include OSU client sample in wpa_supplicant release package
[thirdparty/hostap.git] / tests / hwsim / test_ap_eap.py
CommitLineData
eac67440 1# -*- coding: utf-8 -*-
9626962d 2# WPA2-Enterprise tests
bce774ad 3# Copyright (c) 2013-2014, Jouni Malinen <j@w1.fi>
9626962d
JM		 4#
5# This software may be distributed under the terms of the BSD license.
6# See README for more details.
7
6ea231e6 8import base64
9626962d
JM		 9import time
10import subprocess
11import logging
c9aa4308 12logger = logging.getLogger()
873e7c29 13import os
9626962d
JM		 14
15import hwsim_utils
16import hostapd
eaf3f9b1 17from test_ap_psk import check_mib
9626962d 18
6ea231e6
JM		 19def read_pem(fname):
20 with open(fname, "r") as f:
21 lines = f.readlines()
22 copy = False
23 cert = ""
24 for l in lines:
25 if "-----END" in l:
26 break
27 if copy:
28 cert = cert + l
29 if "-----BEGIN" in l:
30 copy = True
31 return base64.b64decode(cert)
32
6f939e59
JM		 33def eap_connect(dev, ap, method, identity,
34 sha256=False, expect_failure=False, local_error_report=False,
35 **kwargs):
cb33ee14 36 hapd = hostapd.Hostapd(ap['ifname'])
2bb9e283
JM		 37 id = dev.connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
38 eap=method, identity=identity,
6f939e59
JM		 39 wait_connect=False, scan_freq="2412", ieee80211w="1",
40 **kwargs)
f10ba3b2
JM		 41 eap_check_auth(dev, method, True, sha256=sha256,
42 expect_failure=expect_failure,
43 local_error_report=local_error_report)
44 if expect_failure:
45 return id
cb33ee14
JM		 46 ev = hapd.wait_event([ "AP-STA-CONNECTED" ], timeout=5)
47 if ev is None:
48 raise Exception("No connection event received from hostapd")
2bb9e283 49 return id
75b2b9cf 50
f10ba3b2
JM		 51def eap_check_auth(dev, method, initial, rsn=True, sha256=False,
52 expect_failure=False, local_error_report=False):
9626962d
JM		 53 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
54 if ev is None:
55 raise Exception("Association and EAP start timed out")
56 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
57 if ev is None:
58 raise Exception("EAP method selection timed out")
59 if method not in ev:
60 raise Exception("Unexpected EAP method")
f10ba3b2
JM		 61 if expect_failure:
62 ev = dev.wait_event(["CTRL-EVENT-EAP-FAILURE"])
63 if ev is None:
64 raise Exception("EAP failure timed out")
65 ev = dev.wait_event(["CTRL-EVENT-DISCONNECTED"])
66 if ev is None:
67 raise Exception("Disconnection timed out")
68 if not local_error_report:
69 if "reason=23" not in ev:
70 raise Exception("Proper reason code for disconnection not reported")
71 return
9626962d
JM		 72 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
73 if ev is None:
74 raise Exception("EAP success timed out")
9626962d 75
75b2b9cf
JM		 76 if initial:
77 ev = dev.wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
75b2b9cf 78 else:
bce774ad
JM		 79 ev = dev.wait_event(["WPA: Key negotiation completed"], timeout=10)
80 if ev is None:
81 raise Exception("Association with the AP timed out")
82 status = dev.get_status()
83 if status["wpa_state"] != "COMPLETED":
84 raise Exception("Connection not completed")
75b2b9cf 85
9626962d
JM		 86 if status["suppPortStatus"] != "Authorized":
87 raise Exception("Port not authorized")
88 if method not in status["selectedMethod"]:
89 raise Exception("Incorrect EAP method status")
2b005194
JM		 90 if sha256:
91 e = "WPA2-EAP-SHA256"
92 elif rsn:
71390dc8
JM		 93 e = "WPA2/IEEE 802.1X/EAP"
94 else:
95 e = "WPA/IEEE 802.1X/EAP"
96 if status["key_mgmt"] != e:
97 raise Exception("Unexpected key_mgmt status: " + status["key_mgmt"])
9626962d 98
5b1aaf6c 99def eap_reauth(dev, method, rsn=True, sha256=False, expect_failure=False):
75b2b9cf 100 dev.request("REAUTHENTICATE")
5b1aaf6c
JM		 101 eap_check_auth(dev, method, False, rsn=rsn, sha256=sha256,
102 expect_failure=expect_failure)
75b2b9cf 103
9626962d
JM		 104def test_ap_wpa2_eap_sim(dev, apdev):
105 """WPA2-Enterprise connection using EAP-SIM"""
0d4c5494
JM		 106 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
107 logger.info("No hlr_auc_gw available");
108 return "skip"
9626962d
JM		 109 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
110 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 111 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
9626962d
JM		 112 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
113 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 114 eap_reauth(dev[0], "SIM")
9626962d 115
a0f350fd
JM		 116 eap_connect(dev[1], apdev[0], "SIM", "1232010000000001",
117 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
118 eap_connect(dev[2], apdev[0], "SIM", "1232010000000002",
119 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
120 expect_failure=True)
121
f10ba3b2
JM		 122 logger.info("Negative test with incorrect key")
123 dev[0].request("REMOVE_NETWORK all")
124 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
125 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
126 expect_failure=True)
127
5b1aaf6c
JM		 128def test_ap_wpa2_eap_sim_sql(dev, apdev, params):
129 """WPA2-Enterprise connection using EAP-SIM (SQL)"""
130 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
131 logger.info("No hlr_auc_gw available");
132 return "skip"
133 try:
134 import sqlite3
135 except ImportError:
136 return "skip"
137 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
138 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
139 params['auth_server_port'] = "1814"
140 hostapd.add_ap(apdev[0]['ifname'], params)
141 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
142 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
143
144 logger.info("SIM fast re-authentication")
145 eap_reauth(dev[0], "SIM")
146
147 logger.info("SIM full auth with pseudonym")
148 with con:
149 cur = con.cursor()
150 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
151 eap_reauth(dev[0], "SIM")
152
153 logger.info("SIM full auth with permanent identity")
154 with con:
155 cur = con.cursor()
156 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
157 cur.execute("DELETE FROM pseudonyms WHERE permanent='1232010000000000'")
158 eap_reauth(dev[0], "SIM")
159
160 logger.info("SIM reauth with mismatching MK")
161 with con:
162 cur = con.cursor()
163 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='1232010000000000'")
164 eap_reauth(dev[0], "SIM", expect_failure=True)
165 dev[0].request("REMOVE_NETWORK all")
166
167 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
168 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
169 with con:
170 cur = con.cursor()
171 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
172 eap_reauth(dev[0], "SIM")
173 with con:
174 cur = con.cursor()
175 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
176 logger.info("SIM reauth with mismatching counter")
177 eap_reauth(dev[0], "SIM")
178 dev[0].request("REMOVE_NETWORK all")
179
180 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
181 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
182 with con:
183 cur = con.cursor()
184 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='1232010000000000'")
185 logger.info("SIM reauth with max reauth count reached")
186 eap_reauth(dev[0], "SIM")
187
e2a90a4c
JM		 188def test_ap_wpa2_eap_sim_config(dev, apdev):
189 """EAP-SIM configuration options"""
190 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
191 hostapd.add_ap(apdev[0]['ifname'], params)
192 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
193 identity="1232010000000000",
194 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
195 phase1="sim_min_num_chal=1",
196 wait_connect=False, scan_freq="2412")
197 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
198 if ev is None:
199 raise Exception("No EAP error message seen")
200 dev[0].request("REMOVE_NETWORK all")
201
202 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
203 identity="1232010000000000",
204 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
205 phase1="sim_min_num_chal=4",
206 wait_connect=False, scan_freq="2412")
207 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
208 if ev is None:
209 raise Exception("No EAP error message seen (2)")
210 dev[0].request("REMOVE_NETWORK all")
211
212 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
213 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
214 phase1="sim_min_num_chal=2")
215 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
216 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
217 anonymous_identity="345678")
218
9626962d
JM		 219def test_ap_wpa2_eap_aka(dev, apdev):
220 """WPA2-Enterprise connection using EAP-AKA"""
0d4c5494
JM		 221 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
222 logger.info("No hlr_auc_gw available");
223 return "skip"
9626962d
JM		 224 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
225 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 226 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
9626962d
JM		 227 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
228 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 229 eap_reauth(dev[0], "AKA")
9626962d 230
f10ba3b2
JM		 231 logger.info("Negative test with incorrect key")
232 dev[0].request("REMOVE_NETWORK all")
233 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
234 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
235 expect_failure=True)
236
5b1aaf6c
JM		 237def test_ap_wpa2_eap_aka_sql(dev, apdev, params):
238 """WPA2-Enterprise connection using EAP-AKA (SQL)"""
239 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
240 logger.info("No hlr_auc_gw available");
241 return "skip"
242 try:
243 import sqlite3
244 except ImportError:
245 return "skip"
246 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
247 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
248 params['auth_server_port'] = "1814"
249 hostapd.add_ap(apdev[0]['ifname'], params)
250 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
251 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
252
253 logger.info("AKA fast re-authentication")
254 eap_reauth(dev[0], "AKA")
255
256 logger.info("AKA full auth with pseudonym")
257 with con:
258 cur = con.cursor()
259 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
260 eap_reauth(dev[0], "AKA")
261
262 logger.info("AKA full auth with permanent identity")
263 with con:
264 cur = con.cursor()
265 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
266 cur.execute("DELETE FROM pseudonyms WHERE permanent='0232010000000000'")
267 eap_reauth(dev[0], "AKA")
268
269 logger.info("AKA reauth with mismatching MK")
270 with con:
271 cur = con.cursor()
272 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='0232010000000000'")
273 eap_reauth(dev[0], "AKA", expect_failure=True)
274 dev[0].request("REMOVE_NETWORK all")
275
276 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
277 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
278 with con:
279 cur = con.cursor()
280 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
281 eap_reauth(dev[0], "AKA")
282 with con:
283 cur = con.cursor()
284 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
285 logger.info("AKA reauth with mismatching counter")
286 eap_reauth(dev[0], "AKA")
287 dev[0].request("REMOVE_NETWORK all")
288
289 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
290 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
291 with con:
292 cur = con.cursor()
293 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='0232010000000000'")
294 logger.info("AKA reauth with max reauth count reached")
295 eap_reauth(dev[0], "AKA")
296
e2a90a4c
JM		 297def test_ap_wpa2_eap_aka_config(dev, apdev):
298 """EAP-AKA configuration options"""
299 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
300 hostapd.add_ap(apdev[0]['ifname'], params)
301 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
302 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
303 anonymous_identity="2345678")
304
d314bedf
JM		 305def test_ap_wpa2_eap_aka_ext(dev, apdev):
306 """WPA2-Enterprise connection using EAP-AKA and external UMTS auth"""
307 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
308 logger.info("No hlr_auc_gw available");
309 return "skip"
310 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
311 hostapd.add_ap(apdev[0]['ifname'], params)
312 dev[0].request("SET external_sim 1")
313 id = dev[0].connect("test-wpa2-eap", eap="AKA", key_mgmt="WPA-EAP",
314 identity="0232010000000000",
315 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
316 wait_connect=False, scan_freq="2412")
317 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
318 if ev is None:
319 raise Exception("Network connected timed out")
320
321 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
322 if ev is None:
323 raise Exception("Wait for external SIM processing request timed out")
324 p = ev.split(':', 2)
325 if p[1] != "UMTS-AUTH":
326 raise Exception("Unexpected CTRL-REQ-SIM type")
327 rid = p[0].split('-')[3]
328
329 # IK:CK:RES
330 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
331 # This will fail during processing, but the ctrl_iface command succeeds
332 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
333 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
334 if ev is None:
335 raise Exception("EAP failure not reported")
336 dev[0].request("DISCONNECT")
337
338 dev[0].request("REASSOCIATE")
339 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
340 if ev is None:
341 raise Exception("Wait for external SIM processing request timed out")
342 p = ev.split(':', 2)
343 if p[1] != "UMTS-AUTH":
344 raise Exception("Unexpected CTRL-REQ-SIM type")
345 rid = p[0].split('-')[3]
346 # This will fail during UMTS auth validation
347 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTH:" + resp):
348 raise Exception("CTRL-RSP-SIM failed")
349 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
350 if ev is None:
351 raise Exception("EAP failure not reported")
352
9626962d
JM		 353def test_ap_wpa2_eap_aka_prime(dev, apdev):
354 """WPA2-Enterprise connection using EAP-AKA'"""
0d4c5494
JM		 355 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
356 logger.info("No hlr_auc_gw available");
357 return "skip"
9626962d
JM		 358 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
359 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 360 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
9626962d
JM		 361 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
362 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 363 eap_reauth(dev[0], "AKA'")
9626962d 364
8583d664
JM		 365 logger.info("EAP-AKA' bidding protection when EAP-AKA enabled as well")
366 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="AKA' AKA",
367 identity="6555444333222111@both",
368 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
369 wait_connect=False, scan_freq="2412")
370 ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=15)
371 if ev is None:
372 raise Exception("Connection with the AP timed out")
373
f10ba3b2
JM		 374 logger.info("Negative test with incorrect key")
375 dev[0].request("REMOVE_NETWORK all")
376 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
377 password="ff22250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
378 expect_failure=True)
379
5b1aaf6c
JM		 380def test_ap_wpa2_eap_aka_prime_sql(dev, apdev, params):
381 """WPA2-Enterprise connection using EAP-AKA' (SQL)"""
382 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
383 logger.info("No hlr_auc_gw available");
384 return "skip"
385 try:
386 import sqlite3
387 except ImportError:
388 return "skip"
389 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
390 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
391 params['auth_server_port'] = "1814"
392 hostapd.add_ap(apdev[0]['ifname'], params)
393 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
394 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
395
396 logger.info("AKA' fast re-authentication")
397 eap_reauth(dev[0], "AKA'")
398
399 logger.info("AKA' full auth with pseudonym")
400 with con:
401 cur = con.cursor()
402 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
403 eap_reauth(dev[0], "AKA'")
404
405 logger.info("AKA' full auth with permanent identity")
406 with con:
407 cur = con.cursor()
408 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
409 cur.execute("DELETE FROM pseudonyms WHERE permanent='6555444333222111'")
410 eap_reauth(dev[0], "AKA'")
411
412 logger.info("AKA' reauth with mismatching k_aut")
413 with con:
414 cur = con.cursor()
415 cur.execute("UPDATE reauth SET k_aut='0000000000000000000000000000000000000000000000000000000000000000' WHERE permanent='6555444333222111'")
416 eap_reauth(dev[0], "AKA'", expect_failure=True)
417 dev[0].request("REMOVE_NETWORK all")
418
419 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
420 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
421 with con:
422 cur = con.cursor()
423 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
424 eap_reauth(dev[0], "AKA'")
425 with con:
426 cur = con.cursor()
427 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
428 logger.info("AKA' reauth with mismatching counter")
429 eap_reauth(dev[0], "AKA'")
430 dev[0].request("REMOVE_NETWORK all")
431
432 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
433 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
434 with con:
435 cur = con.cursor()
436 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='6555444333222111'")
437 logger.info("AKA' reauth with max reauth count reached")
438 eap_reauth(dev[0], "AKA'")
439
9626962d
JM		 440def test_ap_wpa2_eap_ttls_pap(dev, apdev):
441 """WPA2-Enterprise connection using EAP-TTLS/PAP"""
442 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
65038313
JM		 443 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
444 key_mgmt = hapd.get_config()['key_mgmt']
445 if key_mgmt.split(' ')[0] != "WPA-EAP":
446 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cb33ee14 447 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
9626962d 448 anonymous_identity="ttls", password="password",
3b74982f
JM		 449 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
450 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
451 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
9626962d 452 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 453 eap_reauth(dev[0], "TTLS")
eaf3f9b1
JM		 454 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-1"),
455 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-1") ])
9626962d 456
82a8f5b5
JM		 457def test_ap_wpa2_eap_ttls_pap_incorrect_password(dev, apdev):
458 """WPA2-Enterprise connection using EAP-TTLS/PAP - incorrect password"""
459 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
460 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
461 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
462 anonymous_identity="ttls", password="wrong",
463 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
464 expect_failure=True)
465 eap_connect(dev[1], apdev[0], "TTLS", "user",
466 anonymous_identity="ttls", password="password",
467 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
468 expect_failure=True)
469
9626962d
JM		 470def test_ap_wpa2_eap_ttls_chap(dev, apdev):
471 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
472 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
473 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 474 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
9626962d 475 anonymous_identity="ttls", password="password",
5c65e277
JM		 476 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
477 altsubject_match="EMAIL:noone@example.com;URI:http://example.com/;DNS:server.w1.fi")
9626962d 478 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 479 eap_reauth(dev[0], "TTLS")
9626962d 480
82a8f5b5
JM		 481def test_ap_wpa2_eap_ttls_chap_incorrect_password(dev, apdev):
482 """WPA2-Enterprise connection using EAP-TTLS/CHAP - incorrect password"""
483 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
484 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
485 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
486 anonymous_identity="ttls", password="wrong",
487 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
488 expect_failure=True)
489 eap_connect(dev[1], apdev[0], "TTLS", "user",
490 anonymous_identity="ttls", password="password",
491 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
492 expect_failure=True)
493
9626962d
JM		 494def test_ap_wpa2_eap_ttls_mschap(dev, apdev):
495 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP"""
496 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
497 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 498 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
9626962d 499 anonymous_identity="ttls", password="password",
72c052d5
JM		 500 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
501 domain_suffix_match="server.w1.fi")
9626962d 502 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 503 eap_reauth(dev[0], "TTLS")
6daf5b9c
JM		 504 dev[0].request("REMOVE_NETWORK all")
505 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
506 anonymous_identity="ttls", password="password",
507 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
508 fragment_size="200")
9626962d 509
82a8f5b5
JM		 510def test_ap_wpa2_eap_ttls_mschap_incorrect_password(dev, apdev):
511 """WPA2-Enterprise connection using EAP-TTLS/CHAP - incorrect password"""
512 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
513 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
514 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
515 anonymous_identity="ttls", password="wrong",
516 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
517 expect_failure=True)
518 eap_connect(dev[1], apdev[0], "TTLS", "user",
519 anonymous_identity="ttls", password="password",
520 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
521 expect_failure=True)
522 eap_connect(dev[2], apdev[0], "TTLS", "no such user",
523 anonymous_identity="ttls", password="password",
524 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
525 expect_failure=True)
526
9626962d
JM		 527def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev):
528 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
529 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
530 hostapd.add_ap(apdev[0]['ifname'], params)
5dec879d 531 hapd = hostapd.Hostapd(apdev[0]['ifname'])
cb33ee14 532 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
9626962d 533 anonymous_identity="ttls", password="password",
72c052d5
JM		 534 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
535 domain_suffix_match="w1.fi")
9626962d 536 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
5dec879d
JM		 537 sta1 = hapd.get_sta(dev[0].p2p_interface_addr())
538 eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
75b2b9cf 539 eap_reauth(dev[0], "TTLS")
5dec879d
JM		 540 sta2 = hapd.get_sta(dev[0].p2p_interface_addr())
541 eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
542 if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']):
543 raise Exception("dot1xAuthEapolFramesRx did not increase")
544 if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1:
545 raise Exception("authAuthEapStartsWhileAuthenticated did not increase")
546 if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']):
547 raise Exception("backendAuthSuccesses did not increase")
9626962d 548
fa0ddb14
JM		 549 logger.info("Password as hash value")
550 dev[0].request("REMOVE_NETWORK all")
551 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
552 anonymous_identity="ttls",
553 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
554 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
555
82a8f5b5
JM		 556def test_ap_wpa2_eap_ttls_mschapv2_incorrect_password(dev, apdev):
557 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 - incorrect password"""
558 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
559 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
f10ba3b2
JM		 560 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
561 anonymous_identity="ttls", password="password1",
562 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
563 expect_failure=True)
82a8f5b5
JM		 564 eap_connect(dev[1], apdev[0], "TTLS", "user",
565 anonymous_identity="ttls", password="password",
566 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
567 expect_failure=True)
f10ba3b2 568
eac67440
JM		 569def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev):
570 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 and UTF-8 password"""
571 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
572 hostapd.add_ap(apdev[0]['ifname'], params)
573 hapd = hostapd.Hostapd(apdev[0]['ifname'])
574 eap_connect(dev[0], apdev[0], "TTLS", "utf8-user-hash",
575 anonymous_identity="ttls", password="secret-åäö-€-password",
576 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
577 eap_connect(dev[1], apdev[0], "TTLS", "utf8-user",
578 anonymous_identity="ttls",
579 password_hex="hash:bd5844fad2489992da7fe8c5a01559cf",
580 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
581
9626962d
JM		 582def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev):
583 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC"""
584 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
585 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 586 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 587 anonymous_identity="ttls", password="password",
588 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
589 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 590 eap_reauth(dev[0], "TTLS")
9626962d
JM		 591
592def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev):
593 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5"""
594 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
595 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 596 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 597 anonymous_identity="ttls", password="password",
598 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5")
599 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 600 eap_reauth(dev[0], "TTLS")
9626962d
JM		 601
602def test_ap_wpa2_eap_ttls_eap_mschapv2(dev, apdev):
603 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2"""
604 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
605 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 606 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 607 anonymous_identity="ttls", password="password",
608 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2")
609 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 610 eap_reauth(dev[0], "TTLS")
9626962d 611
f10ba3b2
JM		 612 logger.info("Negative test with incorrect password")
613 dev[0].request("REMOVE_NETWORK all")
614 eap_connect(dev[0], apdev[0], "TTLS", "user",
615 anonymous_identity="ttls", password="password1",
616 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
617 expect_failure=True)
618
95fb531c
JM		 619def test_ap_wpa2_eap_ttls_eap_aka(dev, apdev):
620 """WPA2-Enterprise connection using EAP-TTLS/EAP-AKA"""
621 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
622 hostapd.add_ap(apdev[0]['ifname'], params)
623 eap_connect(dev[0], apdev[0], "TTLS", "0232010000000000",
624 anonymous_identity="0232010000000000@ttls",
625 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
626 ca_cert="auth_serv/ca.pem", phase2="autheap=AKA")
627
628def test_ap_wpa2_eap_peap_eap_aka(dev, apdev):
629 """WPA2-Enterprise connection using EAP-PEAP/EAP-AKA"""
630 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
631 hostapd.add_ap(apdev[0]['ifname'], params)
632 eap_connect(dev[0], apdev[0], "PEAP", "0232010000000000",
633 anonymous_identity="0232010000000000@peap",
634 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
635 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
636
637def test_ap_wpa2_eap_fast_eap_aka(dev, apdev):
638 """WPA2-Enterprise connection using EAP-FAST/EAP-AKA"""
639 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
640 hostapd.add_ap(apdev[0]['ifname'], params)
641 eap_connect(dev[0], apdev[0], "FAST", "0232010000000000",
642 anonymous_identity="0232010000000000@fast",
643 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
644 phase1="fast_provisioning=2",
645 pac_file="blob://fast_pac_auth_aka",
646 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
647
9626962d
JM		 648def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev):
649 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
650 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
651 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 652 eap_connect(dev[0], apdev[0], "PEAP", "user",
698f8324 653 anonymous_identity="peap", password="password",
9626962d
JM		 654 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
655 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 656 eap_reauth(dev[0], "PEAP")
6daf5b9c
JM		 657 dev[0].request("REMOVE_NETWORK all")
658 eap_connect(dev[0], apdev[0], "PEAP", "user",
659 anonymous_identity="peap", password="password",
660 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
661 fragment_size="200")
c7afc078 662
fa0ddb14
JM		 663 logger.info("Password as hash value")
664 dev[0].request("REMOVE_NETWORK all")
665 eap_connect(dev[0], apdev[0], "PEAP", "user",
666 anonymous_identity="peap",
667 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
668 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
669
f10ba3b2
JM		 670 logger.info("Negative test with incorrect password")
671 dev[0].request("REMOVE_NETWORK all")
672 eap_connect(dev[0], apdev[0], "PEAP", "user",
673 anonymous_identity="peap", password="password1",
674 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
675 expect_failure=True)
676
698f8324
JM		 677def test_ap_wpa2_eap_peap_crypto_binding(dev, apdev):
678 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding"""
679 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
680 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 681 eap_connect(dev[0], apdev[0], "PEAP", "user", password="password",
698f8324
JM		 682 ca_cert="auth_serv/ca.pem",
683 phase1="peapver=0 crypto_binding=2",
684 phase2="auth=MSCHAPV2")
685 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
75b2b9cf 686 eap_reauth(dev[0], "PEAP")
698f8324 687
ea6464b0
JM		 688 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
689 ca_cert="auth_serv/ca.pem",
690 phase1="peapver=0 crypto_binding=1",
691 phase2="auth=MSCHAPV2")
692 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
693 ca_cert="auth_serv/ca.pem",
694 phase1="peapver=0 crypto_binding=0",
695 phase2="auth=MSCHAPV2")
696
c4d37011
JM		 697def test_ap_wpa2_eap_peap_params(dev, apdev):
698 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and various parameters"""
699 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
700 hostapd.add_ap(apdev[0]['ifname'], params)
701 eap_connect(dev[0], apdev[0], "PEAP", "user",
702 anonymous_identity="peap", password="password",
703 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
704 phase1="peapver=0 peaplabel=1",
705 expect_failure=True)
706 dev[0].request("REMOVE_NETWORK all")
707 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
708 ca_cert="auth_serv/ca.pem",
709 phase1="peap_outer_success=1",
710 phase2="auth=MSCHAPV2")
711 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
712 ca_cert="auth_serv/ca.pem",
713 phase1="peap_outer_success=2",
714 phase2="auth=MSCHAPV2")
715 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
716 identity="user",
717 anonymous_identity="peap", password="password",
718 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
719 phase1="peapver=1 peaplabel=1",
720 wait_connect=False, scan_freq="2412")
721 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
722 if ev is None:
723 raise Exception("No EAP success seen")
724 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
725 if ev is not None:
726 raise Exception("Unexpected connection")
727
d0ce1050
JM		 728def test_ap_wpa2_eap_peap_eap_tls(dev, apdev):
729 """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS"""
730 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
731 hostapd.add_ap(apdev[0]['ifname'], params)
732 eap_connect(dev[0], apdev[0], "PEAP", "cert user",
733 ca_cert="auth_serv/ca.pem", phase2="auth=TLS",
734 ca_cert2="auth_serv/ca.pem",
735 client_cert2="auth_serv/user.pem",
736 private_key2="auth_serv/user.key")
737 eap_reauth(dev[0], "PEAP")
738
e114c49c
JM		 739def test_ap_wpa2_eap_tls(dev, apdev):
740 """WPA2-Enterprise connection using EAP-TLS"""
741 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
742 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 743 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
e114c49c
JM		 744 client_cert="auth_serv/user.pem",
745 private_key="auth_serv/user.key")
75b2b9cf 746 eap_reauth(dev[0], "TLS")
e114c49c 747
6ea231e6
JM		 748def test_ap_wpa2_eap_tls_blob(dev, apdev):
749 """WPA2-Enterprise connection using EAP-TLS and config blobs"""
750 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
751 hostapd.add_ap(apdev[0]['ifname'], params)
752 cert = read_pem("auth_serv/ca.pem")
753 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
754 raise Exception("Could not set cacert blob")
755 cert = read_pem("auth_serv/user.pem")
756 if "OK" not in dev[0].request("SET blob usercert " + cert.encode("hex")):
757 raise Exception("Could not set usercert blob")
758 key = read_pem("auth_serv/user.key")
759 if "OK" not in dev[0].request("SET blob userkey " + key.encode("hex")):
760 raise Exception("Could not set cacert blob")
761 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
762 client_cert="blob://usercert",
763 private_key="blob://userkey")
764
2d10eb0e
JM		 765def test_ap_wpa2_eap_tls_pkcs12(dev, apdev):
766 """WPA2-Enterprise connection using EAP-TLS and PKCS#12"""
767 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
768 hostapd.add_ap(apdev[0]['ifname'], params)
769 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
770 private_key="auth_serv/user.pkcs12",
771 private_key_passwd="whatever")
772 dev[0].request("REMOVE_NETWORK all")
773 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
774 identity="tls user",
775 ca_cert="auth_serv/ca.pem",
776 private_key="auth_serv/user.pkcs12",
777 wait_connect=False, scan_freq="2412")
778 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"])
779 if ev is None:
780 raise Exception("Request for private key passphrase timed out")
781 id = ev.split(':')[0].split('-')[-1]
782 dev[0].request("CTRL-RSP-PASSPHRASE-" + id + ":whatever")
783 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
784 if ev is None:
785 raise Exception("Connection timed out")
786
6ea231e6
JM		 787def test_ap_wpa2_eap_tls_pkcs12_blob(dev, apdev):
788 """WPA2-Enterprise connection using EAP-TLS and PKCS#12 from configuration blob"""
789 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
790 hostapd.add_ap(apdev[0]['ifname'], params)
791 cert = read_pem("auth_serv/ca.pem")
792 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
793 raise Exception("Could not set cacert blob")
794 with open("auth_serv/user.pkcs12", "rb") as f:
795 if "OK" not in dev[0].request("SET blob pkcs12 " + f.read().encode("hex")):
796 raise Exception("Could not set pkcs12 blob")
797 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
798 private_key="blob://pkcs12",
799 private_key_passwd="whatever")
800
c7afc078
JM		 801def test_ap_wpa2_eap_tls_neg_incorrect_trust_root(dev, apdev):
802 """WPA2-Enterprise negative test - incorrect trust root"""
803 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
804 hostapd.add_ap(apdev[0]['ifname'], params)
6ea231e6
JM		 805 cert = read_pem("auth_serv/ca-incorrect.pem")
806 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
807 raise Exception("Could not set cacert blob")
c7afc078 808 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
6ea231e6
JM		 809 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
810 password="password", phase2="auth=MSCHAPV2",
811 ca_cert="blob://cacert",
812 wait_connect=False, scan_freq="2412")
813 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
c7afc078
JM		 814 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
815 password="password", phase2="auth=MSCHAPV2",
816 ca_cert="auth_serv/ca-incorrect.pem",
c65f23ab 817 wait_connect=False, scan_freq="2412")
c7afc078 818
6ea231e6
JM		 819 for dev in (dev[0], dev[1]):
820 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
821 if ev is None:
822 raise Exception("Association and EAP start timed out")
c7afc078 823
6ea231e6
JM		 824 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
825 if ev is None:
826 raise Exception("EAP method selection timed out")
827 if "TTLS" not in ev:
828 raise Exception("Unexpected EAP method")
829
830 ev = dev.wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
831 "CTRL-EVENT-EAP-SUCCESS",
832 "CTRL-EVENT-EAP-FAILURE",
833 "CTRL-EVENT-CONNECTED",
834 "CTRL-EVENT-DISCONNECTED"], timeout=10)
835 if ev is None:
836 raise Exception("EAP result timed out")
837 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
838 raise Exception("TLS certificate error not reported")
839
840 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS",
841 "CTRL-EVENT-EAP-FAILURE",
842 "CTRL-EVENT-CONNECTED",
843 "CTRL-EVENT-DISCONNECTED"], timeout=10)
844 if ev is None:
845 raise Exception("EAP result(2) timed out")
846 if "CTRL-EVENT-EAP-FAILURE" not in ev:
847 raise Exception("EAP failure not reported")
c7afc078 848
6ea231e6
JM		 849 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
850 "CTRL-EVENT-DISCONNECTED"], timeout=10)
851 if ev is None:
852 raise Exception("EAP result(3) timed out")
853 if "CTRL-EVENT-DISCONNECTED" not in ev:
854 raise Exception("Disconnection not reported")
c7afc078 855
6ea231e6
JM		 856 ev = dev.wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
857 if ev is None:
858 raise Exception("Network block disabling not reported")
72c052d5
JM		 859
860def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev):
861 """WPA2-Enterprise negative test - domain suffix mismatch"""
862 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
863 hostapd.add_ap(apdev[0]['ifname'], params)
864 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
865 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
866 password="password", phase2="auth=MSCHAPV2",
867 ca_cert="auth_serv/ca.pem",
868 domain_suffix_match="incorrect.example.com",
c65f23ab 869 wait_connect=False, scan_freq="2412")
72c052d5
JM		 870
871 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
872 if ev is None:
873 raise Exception("Association and EAP start timed out")
874
875 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
876 if ev is None:
877 raise Exception("EAP method selection timed out")
878 if "TTLS" not in ev:
879 raise Exception("Unexpected EAP method")
880
881 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
882 "CTRL-EVENT-EAP-SUCCESS",
883 "CTRL-EVENT-EAP-FAILURE",
884 "CTRL-EVENT-CONNECTED",
885 "CTRL-EVENT-DISCONNECTED"], timeout=10)
886 if ev is None:
887 raise Exception("EAP result timed out")
888 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
889 raise Exception("TLS certificate error not reported")
890 if "Domain suffix mismatch" not in ev:
891 raise Exception("Domain suffix mismatch not reported")
892
893 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
894 "CTRL-EVENT-EAP-FAILURE",
895 "CTRL-EVENT-CONNECTED",
896 "CTRL-EVENT-DISCONNECTED"], timeout=10)
897 if ev is None:
898 raise Exception("EAP result(2) timed out")
899 if "CTRL-EVENT-EAP-FAILURE" not in ev:
900 raise Exception("EAP failure not reported")
901
902 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
903 "CTRL-EVENT-DISCONNECTED"], timeout=10)
904 if ev is None:
905 raise Exception("EAP result(3) timed out")
906 if "CTRL-EVENT-DISCONNECTED" not in ev:
907 raise Exception("Disconnection not reported")
908
909 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
910 if ev is None:
911 raise Exception("Network block disabling not reported")
22b99086 912
3b74982f
JM		 913def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
914 """WPA2-Enterprise negative test - subject mismatch"""
915 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
916 hostapd.add_ap(apdev[0]['ifname'], params)
917 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
918 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
919 password="password", phase2="auth=MSCHAPV2",
920 ca_cert="auth_serv/ca.pem",
921 subject_match="/C=FI/O=w1.fi/CN=example.com",
922 wait_connect=False, scan_freq="2412")
923
924 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
925 if ev is None:
926 raise Exception("Association and EAP start timed out")
927
928 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
929 if ev is None:
930 raise Exception("EAP method selection timed out")
931 if "TTLS" not in ev:
932 raise Exception("Unexpected EAP method")
933
934 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
935 "CTRL-EVENT-EAP-SUCCESS",
936 "CTRL-EVENT-EAP-FAILURE",
937 "CTRL-EVENT-CONNECTED",
938 "CTRL-EVENT-DISCONNECTED"], timeout=10)
939 if ev is None:
940 raise Exception("EAP result timed out")
941 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
942 raise Exception("TLS certificate error not reported")
943 if "Subject mismatch" not in ev:
944 raise Exception("Subject mismatch not reported")
945
946 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
947 "CTRL-EVENT-EAP-FAILURE",
948 "CTRL-EVENT-CONNECTED",
949 "CTRL-EVENT-DISCONNECTED"], timeout=10)
950 if ev is None:
951 raise Exception("EAP result(2) timed out")
952 if "CTRL-EVENT-EAP-FAILURE" not in ev:
953 raise Exception("EAP failure not reported")
954
955 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
956 "CTRL-EVENT-DISCONNECTED"], timeout=10)
957 if ev is None:
958 raise Exception("EAP result(3) timed out")
959 if "CTRL-EVENT-DISCONNECTED" not in ev:
960 raise Exception("Disconnection not reported")
961
962 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
963 if ev is None:
964 raise Exception("Network block disabling not reported")
965
966def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
967 """WPA2-Enterprise negative test - altsubject mismatch"""
968 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
969 hostapd.add_ap(apdev[0]['ifname'], params)
970 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
971 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
972 password="password", phase2="auth=MSCHAPV2",
973 ca_cert="auth_serv/ca.pem",
974 altsubject_match="incorrect.example.com",
975 wait_connect=False, scan_freq="2412")
976
977 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
978 if ev is None:
979 raise Exception("Association and EAP start timed out")
980
981 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
982 if ev is None:
983 raise Exception("EAP method selection timed out")
984 if "TTLS" not in ev:
985 raise Exception("Unexpected EAP method")
986
987 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
988 "CTRL-EVENT-EAP-SUCCESS",
989 "CTRL-EVENT-EAP-FAILURE",
990 "CTRL-EVENT-CONNECTED",
991 "CTRL-EVENT-DISCONNECTED"], timeout=10)
992 if ev is None:
993 raise Exception("EAP result timed out")
994 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
995 raise Exception("TLS certificate error not reported")
996 if "AltSubject mismatch" not in ev:
997 raise Exception("altsubject mismatch not reported")
998
999 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1000 "CTRL-EVENT-EAP-FAILURE",
1001 "CTRL-EVENT-CONNECTED",
1002 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1003 if ev is None:
1004 raise Exception("EAP result(2) timed out")
1005 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1006 raise Exception("EAP failure not reported")
1007
1008 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1009 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1010 if ev is None:
1011 raise Exception("EAP result(3) timed out")
1012 if "CTRL-EVENT-DISCONNECTED" not in ev:
1013 raise Exception("Disconnection not reported")
1014
1015 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1016 if ev is None:
1017 raise Exception("Network block disabling not reported")
1018
5a0c1517
JM		 1019def test_ap_wpa2_eap_unauth_tls(dev, apdev):
1020 """WPA2-Enterprise connection using UNAUTH-TLS"""
1021 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1022 hostapd.add_ap(apdev[0]['ifname'], params)
1023 eap_connect(dev[0], apdev[0], "UNAUTH-TLS", "unauth-tls",
1024 ca_cert="auth_serv/ca.pem")
1025 eap_reauth(dev[0], "UNAUTH-TLS")
1026
57be05e1
JM		 1027def test_ap_wpa2_eap_ttls_server_cert_hash(dev, apdev):
1028 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash"""
1029 srv_cert_hash = "0a3f81f63569226657a069855bb13f3b922670437a2b87585a4734f70ac7315b"
1030 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1031 hostapd.add_ap(apdev[0]['ifname'], params)
1032 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1033 identity="probe", ca_cert="probe://",
1034 wait_connect=False, scan_freq="2412")
1035 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1036 if ev is None:
1037 raise Exception("Association and EAP start timed out")
1038 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT depth=0"], timeout=10)
1039 if ev is None:
1040 raise Exception("No peer server certificate event seen")
1041 if "hash=" + srv_cert_hash not in ev:
1042 raise Exception("Expected server certificate hash not reported")
1043 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1044 if ev is None:
1045 raise Exception("EAP result timed out")
1046 if "Server certificate chain probe" not in ev:
1047 raise Exception("Server certificate probe not reported")
1048 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=10)
1049 if ev is None:
1050 raise Exception("Disconnection event not seen")
1051 dev[0].request("REMOVE_NETWORK all")
1052
1053 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1054 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1055 password="password", phase2="auth=MSCHAPV2",
1056 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1057 wait_connect=False, scan_freq="2412")
1058 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1059 if ev is None:
1060 raise Exception("Association and EAP start timed out")
1061 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1062 if ev is None:
1063 raise Exception("EAP result timed out")
1064 if "Server certificate mismatch" not in ev:
1065 raise Exception("Server certificate mismatch not reported")
1066 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=10)
1067 if ev is None:
1068 raise Exception("Disconnection event not seen")
1069 dev[0].request("REMOVE_NETWORK all")
1070
1071 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
1072 anonymous_identity="ttls", password="password",
1073 ca_cert="hash://server/sha256/" + srv_cert_hash,
1074 phase2="auth=MSCHAPV2")
1075
2a6a2192
JM		 1076def test_ap_wpa2_eap_ttls_server_cert_hash_invalid(dev, apdev):
1077 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash (invalid config)"""
1078 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1079 hostapd.add_ap(apdev[0]['ifname'], params)
1080 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1081 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1082 password="password", phase2="auth=MSCHAPV2",
1083 ca_cert="hash://server/md5/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1084 wait_connect=False, scan_freq="2412")
1085 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1086 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1087 password="password", phase2="auth=MSCHAPV2",
1088 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca",
1089 wait_connect=False, scan_freq="2412")
1090 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1091 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1092 password="password", phase2="auth=MSCHAPV2",
1093 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6Q",
1094 wait_connect=False, scan_freq="2412")
1095 for i in range(0, 3):
1096 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1097 if ev is None:
1098 raise Exception("Association and EAP start timed out")
cbb85a03
JM		 1099 ev = dev[i].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 21 (TTLS)"], timeout=5)
1100 if ev is None:
1101 raise Exception("Did not report EAP method initialization failure")
2a6a2192 1102
22b99086
JM		 1103def test_ap_wpa2_eap_pwd(dev, apdev):
1104 """WPA2-Enterprise connection using EAP-pwd"""
1105 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1106 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1107 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
75b2b9cf 1108 eap_reauth(dev[0], "PWD")
6daf5b9c 1109 dev[0].request("REMOVE_NETWORK all")
0403fa0a
JM		 1110
1111 eap_connect(dev[1], apdev[0], "PWD",
1112 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
1113 password="secret password",
6daf5b9c
JM		 1114 fragment_size="90")
1115
f10ba3b2 1116 logger.info("Negative test with incorrect password")
0403fa0a 1117 eap_connect(dev[2], apdev[0], "PWD", "pwd user", password="secret-password",
f10ba3b2
JM		 1118 expect_failure=True, local_error_report=True)
1119
0403fa0a
JM		 1120 eap_connect(dev[0], apdev[0], "PWD",
1121 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
1122 password="secret password",
1123 fragment_size="31")
1124
c075f040
JM		 1125def test_ap_wpa2_eap_pwd_groups(dev, apdev):
1126 """WPA2-Enterprise connection using various EAP-pwd groups"""
1127 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1128 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1129 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
1130 for i in [ 19, 20, 21, 25, 26 ]:
1131 params['pwd_group'] = str(i)
1132 hostapd.add_ap(apdev[0]['ifname'], params)
1133 dev[0].request("REMOVE_NETWORK all")
1134 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
1135
4b2d2098
JM		 1136def test_ap_wpa2_eap_pwd_invalid_group(dev, apdev):
1137 """WPA2-Enterprise connection using invalid EAP-pwd group"""
1138 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1139 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1140 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
1141 params['pwd_group'] = "0"
1142 hostapd.add_ap(apdev[0]['ifname'], params)
1143 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PWD",
1144 identity="pwd user", password="secret password",
1145 scan_freq="2412", wait_connect=False)
1146 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1147 if ev is None:
1148 raise Exception("Timeout on EAP failure report")
1149
8ba89e0a
JM		 1150def test_ap_wpa2_eap_pwd_as_frag(dev, apdev):
1151 """WPA2-Enterprise connection using EAP-pwd with server fragmentation"""
1152 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1153 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1154 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1155 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
1156 "pwd_group": "19", "fragment_size": "40" }
1157 hostapd.add_ap(apdev[0]['ifname'], params)
1158 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
1159
22b99086
JM		 1160def test_ap_wpa2_eap_gpsk(dev, apdev):
1161 """WPA2-Enterprise connection using EAP-GPSK"""
1162 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1163 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1164 id = eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
369f9c20 1165 password="abcdefghijklmnop0123456789abcdef")
75b2b9cf 1166 eap_reauth(dev[0], "GPSK")
22b99086 1167
369f9c20
JM		 1168 logger.info("Test forced algorithm selection")
1169 for phase1 in [ "cipher=1", "cipher=2" ]:
1170 dev[0].set_network_quoted(id, "phase1", phase1)
1171 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
1172 if ev is None:
1173 raise Exception("EAP success timed out")
1174 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
1175 if ev is None:
1176 raise Exception("Association with the AP timed out")
1177
1178 logger.info("Test failed algorithm negotiation")
1179 dev[0].set_network_quoted(id, "phase1", "cipher=9")
1180 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
1181 if ev is None:
1182 raise Exception("EAP failure timed out")
1183
f10ba3b2
JM		 1184 logger.info("Negative test with incorrect password")
1185 dev[0].request("REMOVE_NETWORK all")
1186 eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
1187 password="ffcdefghijklmnop0123456789abcdef",
1188 expect_failure=True)
1189
22b99086
JM		 1190def test_ap_wpa2_eap_sake(dev, apdev):
1191 """WPA2-Enterprise connection using EAP-SAKE"""
1192 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1193 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1194 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
22b99086 1195 password_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
75b2b9cf 1196 eap_reauth(dev[0], "SAKE")
22b99086 1197
f10ba3b2
JM		 1198 logger.info("Negative test with incorrect password")
1199 dev[0].request("REMOVE_NETWORK all")
1200 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
1201 password_hex="ff23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
1202 expect_failure=True)
1203
22b99086
JM		 1204def test_ap_wpa2_eap_eke(dev, apdev):
1205 """WPA2-Enterprise connection using EAP-EKE"""
1206 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1207 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1208 id = eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello")
75b2b9cf 1209 eap_reauth(dev[0], "EKE")
22b99086 1210
2bb9e283
JM		 1211 logger.info("Test forced algorithm selection")
1212 for phase1 in [ "dhgroup=5 encr=1 prf=2 mac=2",
1213 "dhgroup=4 encr=1 prf=2 mac=2",
1214 "dhgroup=3 encr=1 prf=2 mac=2",
1215 "dhgroup=3 encr=1 prf=1 mac=1" ]:
1216 dev[0].set_network_quoted(id, "phase1", phase1)
1217 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
1218 if ev is None:
1219 raise Exception("EAP success timed out")
1220 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
1221 if ev is None:
1222 raise Exception("Association with the AP timed out")
1223
1224 logger.info("Test failed algorithm negotiation")
1225 dev[0].set_network_quoted(id, "phase1", "dhgroup=9 encr=9 prf=9 mac=9")
1226 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
1227 if ev is None:
1228 raise Exception("EAP failure timed out")
1229
f10ba3b2
JM		 1230 logger.info("Negative test with incorrect password")
1231 dev[0].request("REMOVE_NETWORK all")
1232 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello1",
1233 expect_failure=True)
1234
22b99086
JM		 1235def test_ap_wpa2_eap_ikev2(dev, apdev):
1236 """WPA2-Enterprise connection using EAP-IKEv2"""
1237 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1238 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14
JM		 1239 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
1240 password="ike password")
75b2b9cf 1241 eap_reauth(dev[0], "IKEV2")
6daf5b9c
JM		 1242 dev[0].request("REMOVE_NETWORK all")
1243 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
47a74ad8 1244 password="ike password", fragment_size="50")
22b99086 1245
f10ba3b2
JM		 1246 logger.info("Negative test with incorrect password")
1247 dev[0].request("REMOVE_NETWORK all")
1248 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
1249 password="ike-password", expect_failure=True)
1250
47a74ad8
JM		 1251def test_ap_wpa2_eap_ikev2_as_frag(dev, apdev):
1252 """WPA2-Enterprise connection using EAP-IKEv2 with server fragmentation"""
1253 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1254 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1255 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1256 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
1257 "fragment_size": "50" }
1258 hostapd.add_ap(apdev[0]['ifname'], params)
1259 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
1260 password="ike password")
1261 eap_reauth(dev[0], "IKEV2")
1262
22b99086
JM		 1263def test_ap_wpa2_eap_pax(dev, apdev):
1264 """WPA2-Enterprise connection using EAP-PAX"""
1265 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1266 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1267 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
22b99086 1268 password_hex="0123456789abcdef0123456789abcdef")
75b2b9cf 1269 eap_reauth(dev[0], "PAX")
22b99086 1270
f10ba3b2
JM		 1271 logger.info("Negative test with incorrect password")
1272 dev[0].request("REMOVE_NETWORK all")
1273 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
1274 password_hex="ff23456789abcdef0123456789abcdef",
1275 expect_failure=True)
1276
22b99086
JM		 1277def test_ap_wpa2_eap_psk(dev, apdev):
1278 """WPA2-Enterprise connection using EAP-PSK"""
1279 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2b005194
JM		 1280 params["wpa_key_mgmt"] = "WPA-EAP-SHA256"
1281 params["ieee80211w"] = "2"
22b99086 1282 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1283 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
2b005194
JM		 1284 password_hex="0123456789abcdef0123456789abcdef", sha256=True)
1285 eap_reauth(dev[0], "PSK", sha256=True)
eaf3f9b1
JM		 1286 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-5"),
1287 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-5") ])
71390dc8 1288
f10ba3b2
JM		 1289 logger.info("Negative test with incorrect password")
1290 dev[0].request("REMOVE_NETWORK all")
1291 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
1292 password_hex="ff23456789abcdef0123456789abcdef", sha256=True,
1293 expect_failure=True)
1294
71390dc8
JM		 1295def test_ap_wpa_eap_peap_eap_mschapv2(dev, apdev):
1296 """WPA-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
1297 params = hostapd.wpa_eap_params(ssid="test-wpa-eap")
1298 hostapd.add_ap(apdev[0]['ifname'], params)
1299 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="PEAP",
1300 identity="user", password="password", phase2="auth=MSCHAPV2",
1301 ca_cert="auth_serv/ca.pem", wait_connect=False,
1302 scan_freq="2412")
1303 eap_check_auth(dev[0], "PEAP", True, rsn=False)
1304 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
1305 eap_reauth(dev[0], "PEAP", rsn=False)
eaf3f9b1
JM		 1306 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-50-f2-1"),
1307 ("dot11RSNAAuthenticationSuiteSelected", "00-50-f2-1") ])
40759604
JM		 1308
1309def test_ap_wpa2_eap_interactive(dev, apdev):
1310 """WPA2-Enterprise connection using interactive identity/password entry"""
1311 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1312 hostapd.add_ap(apdev[0]['ifname'], params)
1313 hapd = hostapd.Hostapd(apdev[0]['ifname'])
1314
1315 tests = [ ("Connection with dynamic TTLS/MSCHAPv2 password entry",
1316 "TTLS", "ttls", "DOMAIN\mschapv2 user", "auth=MSCHAPV2",
1317 None, "password"),
1318 ("Connection with dynamic TTLS/MSCHAPv2 identity and password entry",
1319 "TTLS", "ttls", None, "auth=MSCHAPV2",
1320 "DOMAIN\mschapv2 user", "password"),
1321 ("Connection with dynamic TTLS/EAP-MSCHAPv2 password entry",
1322 "TTLS", "ttls", "user", "autheap=MSCHAPV2", None, "password"),
1323 ("Connection with dynamic TTLS/EAP-MD5 password entry",
1324 "TTLS", "ttls", "user", "autheap=MD5", None, "password"),
1325 ("Connection with dynamic PEAP/EAP-MSCHAPv2 password entry",
1326 "PEAP", None, "user", "auth=MSCHAPV2", None, "password"),
1327 ("Connection with dynamic PEAP/EAP-GTC password entry",
1328 "PEAP", None, "user", "auth=GTC", None, "password") ]
1329 for [desc,eap,anon,identity,phase2,req_id,req_pw] in tests:
1330 logger.info(desc)
1331 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap=eap,
1332 anonymous_identity=anon, identity=identity,
1333 ca_cert="auth_serv/ca.pem", phase2=phase2,
1334 wait_connect=False, scan_freq="2412")
1335 if req_id:
1336 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
1337 if ev is None:
1338 raise Exception("Request for identity timed out")
1339 id = ev.split(':')[0].split('-')[-1]
1340 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
1341 ev = dev[0].wait_event(["CTRL-REQ-PASSWORD","CTRL-REQ-OTP"])
1342 if ev is None:
1343 raise Exception("Request for password timed out")
1344 id = ev.split(':')[0].split('-')[-1]
1345 type = "OTP" if "CTRL-REQ-OTP" in ev else "PASSWORD"
1346 dev[0].request("CTRL-RSP-" + type + "-" + id + ":" + req_pw)
1347 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
1348 if ev is None:
1349 raise Exception("Connection timed out")
1350 dev[0].request("REMOVE_NETWORK all")
e745c811
JM		 1351
1352def test_ap_wpa2_eap_vendor_test(dev, apdev):
1353 """WPA2-Enterprise connection using EAP vendor test"""
1354 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1355 hostapd.add_ap(apdev[0]['ifname'], params)
1356 eap_connect(dev[0], apdev[0], "VENDOR-TEST", "vendor-test")
1357 eap_reauth(dev[0], "VENDOR-TEST")
53a6f06a
JM		 1358
1359def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev):
1360 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning"""
1361 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1362 hostapd.add_ap(apdev[0]['ifname'], params)
1363 eap_connect(dev[0], apdev[0], "FAST", "user",
1364 anonymous_identity="FAST", password="password",
1365 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1366 phase1="fast_provisioning=1", pac_file="blob://fast_pac")
1367 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
1368 eap_reauth(dev[0], "FAST")
1369
873e7c29
JM		 1370def test_ap_wpa2_eap_fast_pac_file(dev, apdev, params):
1371 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and PAC file"""
1372 pac_file = os.path.join(params['logdir'], "fast.pac")
1373 pac_file2 = os.path.join(params['logdir'], "fast-bin.pac")
1374 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1375 hostapd.add_ap(apdev[0]['ifname'], params)
1376
1377 try:
1378 eap_connect(dev[0], apdev[0], "FAST", "user",
1379 anonymous_identity="FAST", password="password",
1380 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1381 phase1="fast_provisioning=1", pac_file=pac_file)
1382 with open(pac_file, "r") as f:
1383 data = f.read()
1384 if "wpa_supplicant EAP-FAST PAC file - version 1" not in data:
1385 raise Exception("PAC file header missing")
1386 if "PAC-Key=" not in data:
1387 raise Exception("PAC-Key missing from PAC file")
1388 dev[0].request("REMOVE_NETWORK all")
1389 eap_connect(dev[0], apdev[0], "FAST", "user",
1390 anonymous_identity="FAST", password="password",
1391 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1392 pac_file=pac_file)
1393
1394 eap_connect(dev[1], apdev[0], "FAST", "user",
1395 anonymous_identity="FAST", password="password",
1396 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1397 phase1="fast_provisioning=1 fast_pac_format=binary",
1398 pac_file=pac_file2)
1399 dev[1].request("REMOVE_NETWORK all")
1400 eap_connect(dev[1], apdev[0], "FAST", "user",
1401 anonymous_identity="FAST", password="password",
1402 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1403 phase1="fast_pac_format=binary",
1404 pac_file=pac_file2)
1405 finally:
1406 subprocess.call(['sudo', 'rm', pac_file])
1407 subprocess.call(['sudo', 'rm', pac_file2])
1408
c6ab1cdb
JM		 1409def test_ap_wpa2_eap_fast_binary_pac(dev, apdev):
1410 """WPA2-Enterprise connection using EAP-FAST and binary PAC format"""
1411 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1412 hostapd.add_ap(apdev[0]['ifname'], params)
1413 eap_connect(dev[0], apdev[0], "FAST", "user",
1414 anonymous_identity="FAST", password="password",
1415 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1416 phase1="fast_provisioning=1 fast_max_pac_list_len=1 fast_pac_format=binary",
1417 pac_file="blob://fast_pac_bin")
1418 eap_reauth(dev[0], "FAST")
1419
46e094bd
JM		 1420def test_ap_wpa2_eap_fast_missing_pac_config(dev, apdev):
1421 """WPA2-Enterprise connection using EAP-FAST and missing PAC config"""
1422 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1423 hostapd.add_ap(apdev[0]['ifname'], params)
1424
1425 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
1426 identity="user", anonymous_identity="FAST",
1427 password="password",
1428 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1429 pac_file="blob://fast_pac_not_in_use",
1430 wait_connect=False, scan_freq="2412")
1431 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1432 if ev is None:
1433 raise Exception("Timeout on EAP failure report")
1434 dev[0].request("REMOVE_NETWORK all")
1435
1436 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
1437 identity="user", anonymous_identity="FAST",
1438 password="password",
1439 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1440 wait_connect=False, scan_freq="2412")
1441 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1442 if ev is None:
1443 raise Exception("Timeout on EAP failure report")
1444
53a6f06a
JM		 1445def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev):
1446 """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning"""
1447 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1448 hostapd.add_ap(apdev[0]['ifname'], params)
1449 eap_connect(dev[0], apdev[0], "FAST", "user",
1450 anonymous_identity="FAST", password="password",
1451 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
1452 phase1="fast_provisioning=2", pac_file="blob://fast_pac_auth")
1453 hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
1454 eap_reauth(dev[0], "FAST")
d4c7a2b9
JM		 1455
1456def test_ap_wpa2_eap_tls_ocsp(dev, apdev):
1457 """WPA2-Enterprise connection using EAP-TLS and verifying OCSP"""
1458 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1459 hostapd.add_ap(apdev[0]['ifname'], params)
1460 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1461 private_key="auth_serv/user.pkcs12",
1462 private_key_passwd="whatever", ocsp=2)
1463
64e05f96 1464def int_eap_server_params():
d4c7a2b9
JM		 1465 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1466 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1467 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
1468 "ca_cert": "auth_serv/ca.pem",
1469 "server_cert": "auth_serv/server.pem",
64e05f96
JM		 1470 "private_key": "auth_serv/server.key" }
1471 return params
1472
1473def test_ap_wpa2_eap_tls_ocsp_invalid(dev, apdev):
1474 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP response"""
1475 params = int_eap_server_params()
1476 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-invalid"
d4c7a2b9
JM		 1477 hostapd.add_ap(apdev[0]['ifname'], params)
1478 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1479 identity="tls user", ca_cert="auth_serv/ca.pem",
1480 private_key="auth_serv/user.pkcs12",
1481 private_key_passwd="whatever", ocsp=2,
1482 wait_connect=False, scan_freq="2412")
1483 count = 0
1484 while True:
1485 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
1486 if ev is None:
1487 raise Exception("Timeout on EAP status")
1488 if 'bad certificate status response' in ev:
1489 break
1490 count = count + 1
1491 if count > 10:
1492 raise Exception("Unexpected number of EAP status messages")
1493
1494 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1495 if ev is None:
1496 raise Exception("Timeout on EAP failure report")
64e05f96
JM		 1497
1498def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev):
1499 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
1500 params = int_eap_server_params()
1501 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
1502 params["private_key"] = "auth_serv/server-no-dnsname.key"
1503 hostapd.add_ap(apdev[0]['ifname'], params)
1504 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1505 identity="tls user", ca_cert="auth_serv/ca.pem",
1506 private_key="auth_serv/user.pkcs12",
1507 private_key_passwd="whatever",
1508 domain_suffix_match="server3.w1.fi",
1509 scan_freq="2412")
1510 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1511 identity="tls user", ca_cert="auth_serv/ca.pem",
1512 private_key="auth_serv/user.pkcs12",
1513 private_key_passwd="whatever",
1514 domain_suffix_match="w1.fi",
1515 scan_freq="2412")
1516
1517def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev):
1518 """WPA2-Enterprise using EAP-TLS and domain suffix mismatch (CN)"""
1519 params = int_eap_server_params()
1520 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
1521 params["private_key"] = "auth_serv/server-no-dnsname.key"
1522 hostapd.add_ap(apdev[0]['ifname'], params)
1523 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1524 identity="tls user", ca_cert="auth_serv/ca.pem",
1525 private_key="auth_serv/user.pkcs12",
1526 private_key_passwd="whatever",
1527 domain_suffix_match="example.com",
1528 wait_connect=False,
1529 scan_freq="2412")
c61dca40
JM		 1530 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1531 identity="tls user", ca_cert="auth_serv/ca.pem",
1532 private_key="auth_serv/user.pkcs12",
1533 private_key_passwd="whatever",
1534 domain_suffix_match="erver3.w1.fi",
1535 wait_connect=False,
1536 scan_freq="2412")
64e05f96
JM		 1537 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1538 if ev is None:
1539 raise Exception("Timeout on EAP failure report")
c61dca40
JM		 1540 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1541 if ev is None:
1542 raise Exception("Timeout on EAP failure report (2)")
6a4d0dbe
JM		 1543
1544def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev):
1545 """WPA2-Enterprise using EAP-TTLS and expired certificate"""
1546 params = int_eap_server_params()
1547 params["server_cert"] = "auth_serv/server-expired.pem"
1548 params["private_key"] = "auth_serv/server-expired.key"
1549 hostapd.add_ap(apdev[0]['ifname'], params)
1550 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1551 identity="mschap user", password="password",
1552 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1553 wait_connect=False,
1554 scan_freq="2412")
1555 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"])
1556 if ev is None:
1557 raise Exception("Timeout on EAP certificate error report")
1558 if "reason=4" not in ev or "certificate has expired" not in ev:
1559 raise Exception("Unexpected failure reason: " + ev)
1560 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1561 if ev is None:
1562 raise Exception("Timeout on EAP failure report")
1563
1564def test_ap_wpa2_eap_ttls_ignore_expired_cert(dev, apdev):
1565 """WPA2-Enterprise using EAP-TTLS and ignore certificate expiration"""
1566 params = int_eap_server_params()
1567 params["server_cert"] = "auth_serv/server-expired.pem"
1568 params["private_key"] = "auth_serv/server-expired.key"
1569 hostapd.add_ap(apdev[0]['ifname'], params)
1570 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1571 identity="mschap user", password="password",
1572 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1573 phase1="tls_disable_time_checks=1",
1574 scan_freq="2412")
6ab4a7aa
JM		 1575
1576def test_ap_wpa2_eap_ttls_server_cert_eku_client(dev, apdev):
1577 """WPA2-Enterprise using EAP-TTLS and server cert with client EKU"""
1578 params = int_eap_server_params()
1579 params["server_cert"] = "auth_serv/server-eku-client.pem"
1580 params["private_key"] = "auth_serv/server-eku-client.key"
1581 hostapd.add_ap(apdev[0]['ifname'], params)
1582 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1583 identity="mschap user", password="password",
1584 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1585 wait_connect=False,
1586 scan_freq="2412")
1587 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1588 if ev is None:
1589 raise Exception("Timeout on EAP failure report")
242219c5 1590
14bef66d
JM		 1591def test_ap_wpa2_eap_ttls_server_cert_eku_client_server(dev, apdev):
1592 """WPA2-Enterprise using EAP-TTLS and server cert with client and server EKU"""
1593 params = int_eap_server_params()
1594 params["server_cert"] = "auth_serv/server-eku-client-server.pem"
1595 params["private_key"] = "auth_serv/server-eku-client-server.key"
1596 hostapd.add_ap(apdev[0]['ifname'], params)
1597 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1598 identity="mschap user", password="password",
1599 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1600 scan_freq="2412")
1601
c37b02fc
JM		 1602def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
1603 """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
1604 params = int_eap_server_params()
1605 del params["server_cert"]
1606 params["private_key"] = "auth_serv/server.pkcs12"
1607 hostapd.add_ap(apdev[0]['ifname'], params)
1608 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1609 identity="mschap user", password="password",
1610 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1611 scan_freq="2412")
1612
242219c5
JM		 1613def test_ap_wpa2_eap_ttls_dh_params(dev, apdev):
1614 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params"""
1615 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1616 hostapd.add_ap(apdev[0]['ifname'], params)
1617 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
1618 anonymous_identity="ttls", password="password",
1619 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
1620 dh_file="auth_serv/dh.conf")
7c50093f 1621
6ea231e6
JM		 1622def test_ap_wpa2_eap_ttls_dh_params_blob(dev, apdev):
1623 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params from blob"""
1624 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1625 hostapd.add_ap(apdev[0]['ifname'], params)
1626 dh = read_pem("auth_serv/dh.conf")
1627 if "OK" not in dev[0].request("SET blob dhparams " + dh.encode("hex")):
1628 raise Exception("Could not set dhparams blob")
1629 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
1630 anonymous_identity="ttls", password="password",
1631 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
1632 dh_file="blob://dhparams")
1633
7c50093f
JM		 1634def test_ap_wpa2_eap_reauth(dev, apdev):
1635 """WPA2-Enterprise and Authenticator forcing reauthentication"""
1636 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1637 params['eap_reauth_period'] = '2'
1638 hostapd.add_ap(apdev[0]['ifname'], params)
1639 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
1640 password_hex="0123456789abcdef0123456789abcdef")
1641 logger.info("Wait for reauthentication")
1642 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1643 if ev is None:
1644 raise Exception("Timeout on reauthentication")
1645 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
1646 if ev is None:
1647 raise Exception("Timeout on reauthentication")
1648 for i in range(0, 20):
1649 state = dev[0].get_status_field("wpa_state")
1650 if state == "COMPLETED":
1651 break
1652 time.sleep(0.1)
1653 if state != "COMPLETED":
1654 raise Exception("Reauthentication did not complete")
8b56743e
JM		 1655
1656def test_ap_wpa2_eap_request_identity_message(dev, apdev):
1657 """Optional displayable message in EAP Request-Identity"""
1658 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1659 params['eap_message'] = 'hello\\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com'
1660 hostapd.add_ap(apdev[0]['ifname'], params)
1661 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
1662 password_hex="0123456789abcdef0123456789abcdef")
910f16ca
JM		 1663
1664def test_ap_wpa2_eap_sim_aka_result_ind(dev, apdev):
1665 """WPA2-Enterprise using EAP-SIM/AKA and protected result indication"""
1666 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
1667 logger.info("No hlr_auc_gw available");
1668 return "skip"
1669 params = int_eap_server_params()
1670 params['eap_sim_db'] = "unix:/tmp/hlr_auc_gw.sock"
1671 params['eap_sim_aka_result_ind'] = "1"
1672 hostapd.add_ap(apdev[0]['ifname'], params)
1673
1674 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
1675 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
1676 phase1="result_ind=1")
1677 eap_reauth(dev[0], "SIM")
1678 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
1679 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
1680
1681 dev[0].request("REMOVE_NETWORK all")
1682 dev[1].request("REMOVE_NETWORK all")
1683
1684 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
1685 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1686 phase1="result_ind=1")
1687 eap_reauth(dev[0], "AKA")
1688 eap_connect(dev[1], apdev[0], "AKA", "0232010000000000",
1689 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
1690
1691 dev[0].request("REMOVE_NETWORK all")
1692 dev[1].request("REMOVE_NETWORK all")
1693
1694 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
1695 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
1696 phase1="result_ind=1")
1697 eap_reauth(dev[0], "AKA'")
1698 eap_connect(dev[1], apdev[0], "AKA'", "6555444333222111",
1699 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
633e364b
JM		 1700
1701def test_ap_wpa2_eap_too_many_roundtrips(dev, apdev):
1702 """WPA2-Enterprise connection resulting in too many EAP roundtrips"""
1703 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1704 hostapd.add_ap(apdev[0]['ifname'], params)
1705 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1706 eap="TTLS", identity="mschap user",
1707 wait_connect=False, scan_freq="2412", ieee80211w="1",
1708 anonymous_identity="ttls", password="password",
1709 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
1710 fragment_size="10")
1711 ev = dev[0].wait_event(["EAP: more than"], timeout=20)
1712 if ev is None:
1713 raise Exception("EAP roundtrip limit not reached")
32dca985
JM		 1714
1715def test_ap_wpa2_eap_expanded_nak(dev, apdev):
1716 """WPA2-Enterprise connection with EAP resulting in expanded NAK"""
1717 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1718 hostapd.add_ap(apdev[0]['ifname'], params)
1719 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1720 eap="PSK", identity="vendor-test",
1721 password_hex="ff23456789abcdef0123456789abcdef",
1722 wait_connect=False)
1723
1724 found = False
1725 for i in range(0, 5):
1726 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"], timeout=10)
1727 if ev is None:
1728 raise Exception("Association and EAP start timed out")
1729 if "refuse proposed method" in ev:
1730 found = True
1731 break
1732 if not found:
1733 raise Exception("Unexpected EAP status: " + ev)
1734
1735 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1736 if ev is None:
1737 raise Exception("EAP failure timed out")
Unnamed repository; edit this file 'description' to name the repository.