]>
Commit | Line | Data |
---|---|---|
eac67440 | 1 | # -*- coding: utf-8 -*- |
9626962d | 2 | # WPA2-Enterprise tests |
bce774ad | 3 | # Copyright (c) 2013-2014, Jouni Malinen <j@w1.fi> |
9626962d JM |
4 | # |
5 | # This software may be distributed under the terms of the BSD license. | |
6 | # See README for more details. | |
7 | ||
8 | import time | |
9 | import subprocess | |
10 | import logging | |
c9aa4308 | 11 | logger = logging.getLogger() |
0d4c5494 | 12 | import os.path |
9626962d JM |
13 | |
14 | import hwsim_utils | |
15 | import hostapd | |
16 | ||
6f939e59 JM |
17 | def eap_connect(dev, ap, method, identity, |
18 | sha256=False, expect_failure=False, local_error_report=False, | |
19 | **kwargs): | |
cb33ee14 | 20 | hapd = hostapd.Hostapd(ap['ifname']) |
2bb9e283 JM |
21 | id = dev.connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256", |
22 | eap=method, identity=identity, | |
6f939e59 JM |
23 | wait_connect=False, scan_freq="2412", ieee80211w="1", |
24 | **kwargs) | |
f10ba3b2 JM |
25 | eap_check_auth(dev, method, True, sha256=sha256, |
26 | expect_failure=expect_failure, | |
27 | local_error_report=local_error_report) | |
28 | if expect_failure: | |
29 | return id | |
cb33ee14 JM |
30 | ev = hapd.wait_event([ "AP-STA-CONNECTED" ], timeout=5) |
31 | if ev is None: | |
32 | raise Exception("No connection event received from hostapd") | |
2bb9e283 | 33 | return id |
75b2b9cf | 34 | |
f10ba3b2 JM |
35 | def eap_check_auth(dev, method, initial, rsn=True, sha256=False, |
36 | expect_failure=False, local_error_report=False): | |
9626962d JM |
37 | ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) |
38 | if ev is None: | |
39 | raise Exception("Association and EAP start timed out") | |
40 | ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) | |
41 | if ev is None: | |
42 | raise Exception("EAP method selection timed out") | |
43 | if method not in ev: | |
44 | raise Exception("Unexpected EAP method") | |
f10ba3b2 JM |
45 | if expect_failure: |
46 | ev = dev.wait_event(["CTRL-EVENT-EAP-FAILURE"]) | |
47 | if ev is None: | |
48 | raise Exception("EAP failure timed out") | |
49 | ev = dev.wait_event(["CTRL-EVENT-DISCONNECTED"]) | |
50 | if ev is None: | |
51 | raise Exception("Disconnection timed out") | |
52 | if not local_error_report: | |
53 | if "reason=23" not in ev: | |
54 | raise Exception("Proper reason code for disconnection not reported") | |
55 | return | |
9626962d JM |
56 | ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) |
57 | if ev is None: | |
58 | raise Exception("EAP success timed out") | |
9626962d | 59 | |
75b2b9cf JM |
60 | if initial: |
61 | ev = dev.wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) | |
75b2b9cf | 62 | else: |
bce774ad JM |
63 | ev = dev.wait_event(["WPA: Key negotiation completed"], timeout=10) |
64 | if ev is None: | |
65 | raise Exception("Association with the AP timed out") | |
66 | status = dev.get_status() | |
67 | if status["wpa_state"] != "COMPLETED": | |
68 | raise Exception("Connection not completed") | |
75b2b9cf | 69 | |
9626962d JM |
70 | if status["suppPortStatus"] != "Authorized": |
71 | raise Exception("Port not authorized") | |
72 | if method not in status["selectedMethod"]: | |
73 | raise Exception("Incorrect EAP method status") | |
2b005194 JM |
74 | if sha256: |
75 | e = "WPA2-EAP-SHA256" | |
76 | elif rsn: | |
71390dc8 JM |
77 | e = "WPA2/IEEE 802.1X/EAP" |
78 | else: | |
79 | e = "WPA/IEEE 802.1X/EAP" | |
80 | if status["key_mgmt"] != e: | |
81 | raise Exception("Unexpected key_mgmt status: " + status["key_mgmt"]) | |
9626962d | 82 | |
2b005194 | 83 | def eap_reauth(dev, method, rsn=True, sha256=False): |
75b2b9cf | 84 | dev.request("REAUTHENTICATE") |
2b005194 | 85 | eap_check_auth(dev, method, False, rsn=rsn, sha256=sha256) |
75b2b9cf | 86 | |
9626962d JM |
87 | def test_ap_wpa2_eap_sim(dev, apdev): |
88 | """WPA2-Enterprise connection using EAP-SIM""" | |
0d4c5494 JM |
89 | if not os.path.exists("/tmp/hlr_auc_gw.sock"): |
90 | logger.info("No hlr_auc_gw available"); | |
91 | return "skip" | |
9626962d JM |
92 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") |
93 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 94 | eap_connect(dev[0], apdev[0], "SIM", "1232010000000000", |
9626962d JM |
95 | password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581") |
96 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 97 | eap_reauth(dev[0], "SIM") |
9626962d | 98 | |
f10ba3b2 JM |
99 | logger.info("Negative test with incorrect key") |
100 | dev[0].request("REMOVE_NETWORK all") | |
101 | eap_connect(dev[0], apdev[0], "SIM", "1232010000000000", | |
102 | password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581", | |
103 | expect_failure=True) | |
104 | ||
9626962d JM |
105 | def test_ap_wpa2_eap_aka(dev, apdev): |
106 | """WPA2-Enterprise connection using EAP-AKA""" | |
0d4c5494 JM |
107 | if not os.path.exists("/tmp/hlr_auc_gw.sock"): |
108 | logger.info("No hlr_auc_gw available"); | |
109 | return "skip" | |
9626962d JM |
110 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") |
111 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 112 | eap_connect(dev[0], apdev[0], "AKA", "0232010000000000", |
9626962d JM |
113 | password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123") |
114 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 115 | eap_reauth(dev[0], "AKA") |
9626962d | 116 | |
f10ba3b2 JM |
117 | logger.info("Negative test with incorrect key") |
118 | dev[0].request("REMOVE_NETWORK all") | |
119 | eap_connect(dev[0], apdev[0], "AKA", "0232010000000000", | |
120 | password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123", | |
121 | expect_failure=True) | |
122 | ||
9626962d JM |
123 | def test_ap_wpa2_eap_aka_prime(dev, apdev): |
124 | """WPA2-Enterprise connection using EAP-AKA'""" | |
0d4c5494 JM |
125 | if not os.path.exists("/tmp/hlr_auc_gw.sock"): |
126 | logger.info("No hlr_auc_gw available"); | |
127 | return "skip" | |
9626962d JM |
128 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") |
129 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 130 | eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111", |
9626962d JM |
131 | password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123") |
132 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 133 | eap_reauth(dev[0], "AKA'") |
9626962d | 134 | |
f10ba3b2 JM |
135 | logger.info("Negative test with incorrect key") |
136 | dev[0].request("REMOVE_NETWORK all") | |
137 | eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111", | |
138 | password="ff22250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123", | |
139 | expect_failure=True) | |
140 | ||
9626962d JM |
141 | def test_ap_wpa2_eap_ttls_pap(dev, apdev): |
142 | """WPA2-Enterprise connection using EAP-TTLS/PAP""" | |
143 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
144 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 145 | eap_connect(dev[0], apdev[0], "TTLS", "pap user", |
9626962d | 146 | anonymous_identity="ttls", password="password", |
3b74982f JM |
147 | ca_cert="auth_serv/ca.pem", phase2="auth=PAP", |
148 | subject_match="/C=FI/O=w1.fi/CN=server.w1.fi", | |
149 | altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/") | |
9626962d | 150 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) |
75b2b9cf | 151 | eap_reauth(dev[0], "TTLS") |
9626962d JM |
152 | |
153 | def test_ap_wpa2_eap_ttls_chap(dev, apdev): | |
154 | """WPA2-Enterprise connection using EAP-TTLS/CHAP""" | |
155 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
156 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 157 | eap_connect(dev[0], apdev[0], "TTLS", "chap user", |
9626962d | 158 | anonymous_identity="ttls", password="password", |
9f8994c6 | 159 | ca_cert="auth_serv/ca.der", phase2="auth=CHAP") |
9626962d | 160 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) |
75b2b9cf | 161 | eap_reauth(dev[0], "TTLS") |
9626962d JM |
162 | |
163 | def test_ap_wpa2_eap_ttls_mschap(dev, apdev): | |
164 | """WPA2-Enterprise connection using EAP-TTLS/MSCHAP""" | |
165 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
166 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 167 | eap_connect(dev[0], apdev[0], "TTLS", "mschap user", |
9626962d | 168 | anonymous_identity="ttls", password="password", |
72c052d5 JM |
169 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", |
170 | domain_suffix_match="server.w1.fi") | |
9626962d | 171 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) |
75b2b9cf | 172 | eap_reauth(dev[0], "TTLS") |
6daf5b9c JM |
173 | dev[0].request("REMOVE_NETWORK all") |
174 | eap_connect(dev[0], apdev[0], "TTLS", "mschap user", | |
175 | anonymous_identity="ttls", password="password", | |
176 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", | |
177 | fragment_size="200") | |
9626962d JM |
178 | |
179 | def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev): | |
180 | """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2""" | |
181 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
182 | hostapd.add_ap(apdev[0]['ifname'], params) | |
5dec879d | 183 | hapd = hostapd.Hostapd(apdev[0]['ifname']) |
cb33ee14 | 184 | eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user", |
9626962d | 185 | anonymous_identity="ttls", password="password", |
72c052d5 JM |
186 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", |
187 | domain_suffix_match="w1.fi") | |
9626962d | 188 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) |
5dec879d JM |
189 | sta1 = hapd.get_sta(dev[0].p2p_interface_addr()) |
190 | eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol") | |
75b2b9cf | 191 | eap_reauth(dev[0], "TTLS") |
5dec879d JM |
192 | sta2 = hapd.get_sta(dev[0].p2p_interface_addr()) |
193 | eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol") | |
194 | if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']): | |
195 | raise Exception("dot1xAuthEapolFramesRx did not increase") | |
196 | if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1: | |
197 | raise Exception("authAuthEapStartsWhileAuthenticated did not increase") | |
198 | if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']): | |
199 | raise Exception("backendAuthSuccesses did not increase") | |
9626962d | 200 | |
fa0ddb14 JM |
201 | logger.info("Password as hash value") |
202 | dev[0].request("REMOVE_NETWORK all") | |
203 | eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user", | |
204 | anonymous_identity="ttls", | |
205 | password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c", | |
206 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") | |
207 | ||
f10ba3b2 JM |
208 | logger.info("Negative test with incorrect password") |
209 | dev[0].request("REMOVE_NETWORK all") | |
210 | eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user", | |
211 | anonymous_identity="ttls", password="password1", | |
212 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", | |
213 | expect_failure=True) | |
214 | ||
eac67440 JM |
215 | def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev): |
216 | """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 and UTF-8 password""" | |
217 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
218 | hostapd.add_ap(apdev[0]['ifname'], params) | |
219 | hapd = hostapd.Hostapd(apdev[0]['ifname']) | |
220 | eap_connect(dev[0], apdev[0], "TTLS", "utf8-user-hash", | |
221 | anonymous_identity="ttls", password="secret-åäö-€-password", | |
222 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") | |
223 | eap_connect(dev[1], apdev[0], "TTLS", "utf8-user", | |
224 | anonymous_identity="ttls", | |
225 | password_hex="hash:bd5844fad2489992da7fe8c5a01559cf", | |
226 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") | |
227 | ||
9626962d JM |
228 | def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev): |
229 | """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC""" | |
230 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
231 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 232 | eap_connect(dev[0], apdev[0], "TTLS", "user", |
9626962d JM |
233 | anonymous_identity="ttls", password="password", |
234 | ca_cert="auth_serv/ca.pem", phase2="autheap=GTC") | |
235 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 236 | eap_reauth(dev[0], "TTLS") |
9626962d JM |
237 | |
238 | def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev): | |
239 | """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5""" | |
240 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
241 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 242 | eap_connect(dev[0], apdev[0], "TTLS", "user", |
9626962d JM |
243 | anonymous_identity="ttls", password="password", |
244 | ca_cert="auth_serv/ca.pem", phase2="autheap=MD5") | |
245 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 246 | eap_reauth(dev[0], "TTLS") |
9626962d JM |
247 | |
248 | def test_ap_wpa2_eap_ttls_eap_mschapv2(dev, apdev): | |
249 | """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2""" | |
250 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
251 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 252 | eap_connect(dev[0], apdev[0], "TTLS", "user", |
9626962d JM |
253 | anonymous_identity="ttls", password="password", |
254 | ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2") | |
255 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 256 | eap_reauth(dev[0], "TTLS") |
9626962d | 257 | |
f10ba3b2 JM |
258 | logger.info("Negative test with incorrect password") |
259 | dev[0].request("REMOVE_NETWORK all") | |
260 | eap_connect(dev[0], apdev[0], "TTLS", "user", | |
261 | anonymous_identity="ttls", password="password1", | |
262 | ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2", | |
263 | expect_failure=True) | |
264 | ||
9626962d JM |
265 | def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev): |
266 | """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2""" | |
267 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
268 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 269 | eap_connect(dev[0], apdev[0], "PEAP", "user", |
698f8324 | 270 | anonymous_identity="peap", password="password", |
9626962d JM |
271 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") |
272 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 273 | eap_reauth(dev[0], "PEAP") |
6daf5b9c JM |
274 | dev[0].request("REMOVE_NETWORK all") |
275 | eap_connect(dev[0], apdev[0], "PEAP", "user", | |
276 | anonymous_identity="peap", password="password", | |
277 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", | |
278 | fragment_size="200") | |
c7afc078 | 279 | |
fa0ddb14 JM |
280 | logger.info("Password as hash value") |
281 | dev[0].request("REMOVE_NETWORK all") | |
282 | eap_connect(dev[0], apdev[0], "PEAP", "user", | |
283 | anonymous_identity="peap", | |
284 | password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c", | |
285 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") | |
286 | ||
f10ba3b2 JM |
287 | logger.info("Negative test with incorrect password") |
288 | dev[0].request("REMOVE_NETWORK all") | |
289 | eap_connect(dev[0], apdev[0], "PEAP", "user", | |
290 | anonymous_identity="peap", password="password1", | |
291 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", | |
292 | expect_failure=True) | |
293 | ||
698f8324 JM |
294 | def test_ap_wpa2_eap_peap_crypto_binding(dev, apdev): |
295 | """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding""" | |
296 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
297 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 298 | eap_connect(dev[0], apdev[0], "PEAP", "user", password="password", |
698f8324 JM |
299 | ca_cert="auth_serv/ca.pem", |
300 | phase1="peapver=0 crypto_binding=2", | |
301 | phase2="auth=MSCHAPV2") | |
302 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
75b2b9cf | 303 | eap_reauth(dev[0], "PEAP") |
698f8324 | 304 | |
d0ce1050 JM |
305 | def test_ap_wpa2_eap_peap_eap_tls(dev, apdev): |
306 | """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS""" | |
307 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
308 | hostapd.add_ap(apdev[0]['ifname'], params) | |
309 | eap_connect(dev[0], apdev[0], "PEAP", "cert user", | |
310 | ca_cert="auth_serv/ca.pem", phase2="auth=TLS", | |
311 | ca_cert2="auth_serv/ca.pem", | |
312 | client_cert2="auth_serv/user.pem", | |
313 | private_key2="auth_serv/user.key") | |
314 | eap_reauth(dev[0], "PEAP") | |
315 | ||
e114c49c JM |
316 | def test_ap_wpa2_eap_tls(dev, apdev): |
317 | """WPA2-Enterprise connection using EAP-TLS""" | |
318 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
319 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 320 | eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem", |
e114c49c JM |
321 | client_cert="auth_serv/user.pem", |
322 | private_key="auth_serv/user.key") | |
75b2b9cf | 323 | eap_reauth(dev[0], "TLS") |
e114c49c | 324 | |
2d10eb0e JM |
325 | def test_ap_wpa2_eap_tls_pkcs12(dev, apdev): |
326 | """WPA2-Enterprise connection using EAP-TLS and PKCS#12""" | |
327 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
328 | hostapd.add_ap(apdev[0]['ifname'], params) | |
329 | eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem", | |
330 | private_key="auth_serv/user.pkcs12", | |
331 | private_key_passwd="whatever") | |
332 | dev[0].request("REMOVE_NETWORK all") | |
333 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", | |
334 | identity="tls user", | |
335 | ca_cert="auth_serv/ca.pem", | |
336 | private_key="auth_serv/user.pkcs12", | |
337 | wait_connect=False, scan_freq="2412") | |
338 | ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"]) | |
339 | if ev is None: | |
340 | raise Exception("Request for private key passphrase timed out") | |
341 | id = ev.split(':')[0].split('-')[-1] | |
342 | dev[0].request("CTRL-RSP-PASSPHRASE-" + id + ":whatever") | |
343 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) | |
344 | if ev is None: | |
345 | raise Exception("Connection timed out") | |
346 | ||
c7afc078 JM |
347 | def test_ap_wpa2_eap_tls_neg_incorrect_trust_root(dev, apdev): |
348 | """WPA2-Enterprise negative test - incorrect trust root""" | |
349 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
350 | hostapd.add_ap(apdev[0]['ifname'], params) | |
351 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
352 | identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", | |
353 | password="password", phase2="auth=MSCHAPV2", | |
354 | ca_cert="auth_serv/ca-incorrect.pem", | |
c65f23ab | 355 | wait_connect=False, scan_freq="2412") |
c7afc078 JM |
356 | |
357 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
358 | if ev is None: | |
359 | raise Exception("Association and EAP start timed out") | |
360 | ||
361 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) | |
362 | if ev is None: | |
363 | raise Exception("EAP method selection timed out") | |
364 | if "TTLS" not in ev: | |
365 | raise Exception("Unexpected EAP method") | |
366 | ||
367 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR", | |
368 | "CTRL-EVENT-EAP-SUCCESS", | |
369 | "CTRL-EVENT-EAP-FAILURE", | |
370 | "CTRL-EVENT-CONNECTED", | |
371 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
372 | if ev is None: | |
373 | raise Exception("EAP result timed out") | |
374 | if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev: | |
375 | raise Exception("TLS certificate error not reported") | |
376 | ||
377 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS", | |
378 | "CTRL-EVENT-EAP-FAILURE", | |
379 | "CTRL-EVENT-CONNECTED", | |
380 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
381 | if ev is None: | |
382 | raise Exception("EAP result(2) timed out") | |
383 | if "CTRL-EVENT-EAP-FAILURE" not in ev: | |
384 | raise Exception("EAP failure not reported") | |
385 | ||
386 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", | |
387 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
388 | if ev is None: | |
389 | raise Exception("EAP result(3) timed out") | |
390 | if "CTRL-EVENT-DISCONNECTED" not in ev: | |
391 | raise Exception("Disconnection not reported") | |
392 | ||
393 | ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10) | |
394 | if ev is None: | |
395 | raise Exception("Network block disabling not reported") | |
72c052d5 JM |
396 | |
397 | def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev): | |
398 | """WPA2-Enterprise negative test - domain suffix mismatch""" | |
399 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
400 | hostapd.add_ap(apdev[0]['ifname'], params) | |
401 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
402 | identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", | |
403 | password="password", phase2="auth=MSCHAPV2", | |
404 | ca_cert="auth_serv/ca.pem", | |
405 | domain_suffix_match="incorrect.example.com", | |
c65f23ab | 406 | wait_connect=False, scan_freq="2412") |
72c052d5 JM |
407 | |
408 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
409 | if ev is None: | |
410 | raise Exception("Association and EAP start timed out") | |
411 | ||
412 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) | |
413 | if ev is None: | |
414 | raise Exception("EAP method selection timed out") | |
415 | if "TTLS" not in ev: | |
416 | raise Exception("Unexpected EAP method") | |
417 | ||
418 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR", | |
419 | "CTRL-EVENT-EAP-SUCCESS", | |
420 | "CTRL-EVENT-EAP-FAILURE", | |
421 | "CTRL-EVENT-CONNECTED", | |
422 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
423 | if ev is None: | |
424 | raise Exception("EAP result timed out") | |
425 | if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev: | |
426 | raise Exception("TLS certificate error not reported") | |
427 | if "Domain suffix mismatch" not in ev: | |
428 | raise Exception("Domain suffix mismatch not reported") | |
429 | ||
430 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS", | |
431 | "CTRL-EVENT-EAP-FAILURE", | |
432 | "CTRL-EVENT-CONNECTED", | |
433 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
434 | if ev is None: | |
435 | raise Exception("EAP result(2) timed out") | |
436 | if "CTRL-EVENT-EAP-FAILURE" not in ev: | |
437 | raise Exception("EAP failure not reported") | |
438 | ||
439 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", | |
440 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
441 | if ev is None: | |
442 | raise Exception("EAP result(3) timed out") | |
443 | if "CTRL-EVENT-DISCONNECTED" not in ev: | |
444 | raise Exception("Disconnection not reported") | |
445 | ||
446 | ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10) | |
447 | if ev is None: | |
448 | raise Exception("Network block disabling not reported") | |
22b99086 | 449 | |
3b74982f JM |
450 | def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev): |
451 | """WPA2-Enterprise negative test - subject mismatch""" | |
452 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
453 | hostapd.add_ap(apdev[0]['ifname'], params) | |
454 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
455 | identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", | |
456 | password="password", phase2="auth=MSCHAPV2", | |
457 | ca_cert="auth_serv/ca.pem", | |
458 | subject_match="/C=FI/O=w1.fi/CN=example.com", | |
459 | wait_connect=False, scan_freq="2412") | |
460 | ||
461 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
462 | if ev is None: | |
463 | raise Exception("Association and EAP start timed out") | |
464 | ||
465 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) | |
466 | if ev is None: | |
467 | raise Exception("EAP method selection timed out") | |
468 | if "TTLS" not in ev: | |
469 | raise Exception("Unexpected EAP method") | |
470 | ||
471 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR", | |
472 | "CTRL-EVENT-EAP-SUCCESS", | |
473 | "CTRL-EVENT-EAP-FAILURE", | |
474 | "CTRL-EVENT-CONNECTED", | |
475 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
476 | if ev is None: | |
477 | raise Exception("EAP result timed out") | |
478 | if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev: | |
479 | raise Exception("TLS certificate error not reported") | |
480 | if "Subject mismatch" not in ev: | |
481 | raise Exception("Subject mismatch not reported") | |
482 | ||
483 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS", | |
484 | "CTRL-EVENT-EAP-FAILURE", | |
485 | "CTRL-EVENT-CONNECTED", | |
486 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
487 | if ev is None: | |
488 | raise Exception("EAP result(2) timed out") | |
489 | if "CTRL-EVENT-EAP-FAILURE" not in ev: | |
490 | raise Exception("EAP failure not reported") | |
491 | ||
492 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", | |
493 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
494 | if ev is None: | |
495 | raise Exception("EAP result(3) timed out") | |
496 | if "CTRL-EVENT-DISCONNECTED" not in ev: | |
497 | raise Exception("Disconnection not reported") | |
498 | ||
499 | ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10) | |
500 | if ev is None: | |
501 | raise Exception("Network block disabling not reported") | |
502 | ||
503 | def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev): | |
504 | """WPA2-Enterprise negative test - altsubject mismatch""" | |
505 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
506 | hostapd.add_ap(apdev[0]['ifname'], params) | |
507 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
508 | identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", | |
509 | password="password", phase2="auth=MSCHAPV2", | |
510 | ca_cert="auth_serv/ca.pem", | |
511 | altsubject_match="incorrect.example.com", | |
512 | wait_connect=False, scan_freq="2412") | |
513 | ||
514 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
515 | if ev is None: | |
516 | raise Exception("Association and EAP start timed out") | |
517 | ||
518 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) | |
519 | if ev is None: | |
520 | raise Exception("EAP method selection timed out") | |
521 | if "TTLS" not in ev: | |
522 | raise Exception("Unexpected EAP method") | |
523 | ||
524 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR", | |
525 | "CTRL-EVENT-EAP-SUCCESS", | |
526 | "CTRL-EVENT-EAP-FAILURE", | |
527 | "CTRL-EVENT-CONNECTED", | |
528 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
529 | if ev is None: | |
530 | raise Exception("EAP result timed out") | |
531 | if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev: | |
532 | raise Exception("TLS certificate error not reported") | |
533 | if "AltSubject mismatch" not in ev: | |
534 | raise Exception("altsubject mismatch not reported") | |
535 | ||
536 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS", | |
537 | "CTRL-EVENT-EAP-FAILURE", | |
538 | "CTRL-EVENT-CONNECTED", | |
539 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
540 | if ev is None: | |
541 | raise Exception("EAP result(2) timed out") | |
542 | if "CTRL-EVENT-EAP-FAILURE" not in ev: | |
543 | raise Exception("EAP failure not reported") | |
544 | ||
545 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", | |
546 | "CTRL-EVENT-DISCONNECTED"], timeout=10) | |
547 | if ev is None: | |
548 | raise Exception("EAP result(3) timed out") | |
549 | if "CTRL-EVENT-DISCONNECTED" not in ev: | |
550 | raise Exception("Disconnection not reported") | |
551 | ||
552 | ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10) | |
553 | if ev is None: | |
554 | raise Exception("Network block disabling not reported") | |
555 | ||
57be05e1 JM |
556 | def test_ap_wpa2_eap_ttls_server_cert_hash(dev, apdev): |
557 | """WPA2-Enterprise connection using EAP-TTLS and server certificate hash""" | |
558 | srv_cert_hash = "0a3f81f63569226657a069855bb13f3b922670437a2b87585a4734f70ac7315b" | |
559 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
560 | hostapd.add_ap(apdev[0]['ifname'], params) | |
561 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
562 | identity="probe", ca_cert="probe://", | |
563 | wait_connect=False, scan_freq="2412") | |
564 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
565 | if ev is None: | |
566 | raise Exception("Association and EAP start timed out") | |
567 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT depth=0"], timeout=10) | |
568 | if ev is None: | |
569 | raise Exception("No peer server certificate event seen") | |
570 | if "hash=" + srv_cert_hash not in ev: | |
571 | raise Exception("Expected server certificate hash not reported") | |
572 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10) | |
573 | if ev is None: | |
574 | raise Exception("EAP result timed out") | |
575 | if "Server certificate chain probe" not in ev: | |
576 | raise Exception("Server certificate probe not reported") | |
577 | ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=10) | |
578 | if ev is None: | |
579 | raise Exception("Disconnection event not seen") | |
580 | dev[0].request("REMOVE_NETWORK all") | |
581 | ||
582 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
583 | identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", | |
584 | password="password", phase2="auth=MSCHAPV2", | |
585 | ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a", | |
586 | wait_connect=False, scan_freq="2412") | |
587 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
588 | if ev is None: | |
589 | raise Exception("Association and EAP start timed out") | |
590 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10) | |
591 | if ev is None: | |
592 | raise Exception("EAP result timed out") | |
593 | if "Server certificate mismatch" not in ev: | |
594 | raise Exception("Server certificate mismatch not reported") | |
595 | ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=10) | |
596 | if ev is None: | |
597 | raise Exception("Disconnection event not seen") | |
598 | dev[0].request("REMOVE_NETWORK all") | |
599 | ||
600 | eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user", | |
601 | anonymous_identity="ttls", password="password", | |
602 | ca_cert="hash://server/sha256/" + srv_cert_hash, | |
603 | phase2="auth=MSCHAPV2") | |
604 | ||
22b99086 JM |
605 | def test_ap_wpa2_eap_pwd(dev, apdev): |
606 | """WPA2-Enterprise connection using EAP-pwd""" | |
607 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
608 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 609 | eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password") |
75b2b9cf | 610 | eap_reauth(dev[0], "PWD") |
22b99086 | 611 | |
6daf5b9c JM |
612 | dev[0].request("REMOVE_NETWORK all") |
613 | eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password", | |
614 | fragment_size="90") | |
615 | ||
f10ba3b2 JM |
616 | logger.info("Negative test with incorrect password") |
617 | dev[0].request("REMOVE_NETWORK all") | |
618 | eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret-password", | |
619 | expect_failure=True, local_error_report=True) | |
620 | ||
c075f040 JM |
621 | def test_ap_wpa2_eap_pwd_groups(dev, apdev): |
622 | """WPA2-Enterprise connection using various EAP-pwd groups""" | |
623 | params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP", | |
624 | "rsn_pairwise": "CCMP", "ieee8021x": "1", | |
625 | "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" } | |
626 | for i in [ 19, 20, 21, 25, 26 ]: | |
627 | params['pwd_group'] = str(i) | |
628 | hostapd.add_ap(apdev[0]['ifname'], params) | |
629 | dev[0].request("REMOVE_NETWORK all") | |
630 | eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password") | |
631 | ||
22b99086 JM |
632 | def test_ap_wpa2_eap_gpsk(dev, apdev): |
633 | """WPA2-Enterprise connection using EAP-GPSK""" | |
634 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
635 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 636 | id = eap_connect(dev[0], apdev[0], "GPSK", "gpsk user", |
369f9c20 | 637 | password="abcdefghijklmnop0123456789abcdef") |
75b2b9cf | 638 | eap_reauth(dev[0], "GPSK") |
22b99086 | 639 | |
369f9c20 JM |
640 | logger.info("Test forced algorithm selection") |
641 | for phase1 in [ "cipher=1", "cipher=2" ]: | |
642 | dev[0].set_network_quoted(id, "phase1", phase1) | |
643 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) | |
644 | if ev is None: | |
645 | raise Exception("EAP success timed out") | |
646 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) | |
647 | if ev is None: | |
648 | raise Exception("Association with the AP timed out") | |
649 | ||
650 | logger.info("Test failed algorithm negotiation") | |
651 | dev[0].set_network_quoted(id, "phase1", "cipher=9") | |
652 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10) | |
653 | if ev is None: | |
654 | raise Exception("EAP failure timed out") | |
655 | ||
f10ba3b2 JM |
656 | logger.info("Negative test with incorrect password") |
657 | dev[0].request("REMOVE_NETWORK all") | |
658 | eap_connect(dev[0], apdev[0], "GPSK", "gpsk user", | |
659 | password="ffcdefghijklmnop0123456789abcdef", | |
660 | expect_failure=True) | |
661 | ||
22b99086 JM |
662 | def test_ap_wpa2_eap_sake(dev, apdev): |
663 | """WPA2-Enterprise connection using EAP-SAKE""" | |
664 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
665 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 666 | eap_connect(dev[0], apdev[0], "SAKE", "sake user", |
22b99086 | 667 | password_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef") |
75b2b9cf | 668 | eap_reauth(dev[0], "SAKE") |
22b99086 | 669 | |
f10ba3b2 JM |
670 | logger.info("Negative test with incorrect password") |
671 | dev[0].request("REMOVE_NETWORK all") | |
672 | eap_connect(dev[0], apdev[0], "SAKE", "sake user", | |
673 | password_hex="ff23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", | |
674 | expect_failure=True) | |
675 | ||
22b99086 JM |
676 | def test_ap_wpa2_eap_eke(dev, apdev): |
677 | """WPA2-Enterprise connection using EAP-EKE""" | |
678 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
679 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 680 | id = eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello") |
75b2b9cf | 681 | eap_reauth(dev[0], "EKE") |
22b99086 | 682 | |
2bb9e283 JM |
683 | logger.info("Test forced algorithm selection") |
684 | for phase1 in [ "dhgroup=5 encr=1 prf=2 mac=2", | |
685 | "dhgroup=4 encr=1 prf=2 mac=2", | |
686 | "dhgroup=3 encr=1 prf=2 mac=2", | |
687 | "dhgroup=3 encr=1 prf=1 mac=1" ]: | |
688 | dev[0].set_network_quoted(id, "phase1", phase1) | |
689 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) | |
690 | if ev is None: | |
691 | raise Exception("EAP success timed out") | |
692 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) | |
693 | if ev is None: | |
694 | raise Exception("Association with the AP timed out") | |
695 | ||
696 | logger.info("Test failed algorithm negotiation") | |
697 | dev[0].set_network_quoted(id, "phase1", "dhgroup=9 encr=9 prf=9 mac=9") | |
698 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10) | |
699 | if ev is None: | |
700 | raise Exception("EAP failure timed out") | |
701 | ||
f10ba3b2 JM |
702 | logger.info("Negative test with incorrect password") |
703 | dev[0].request("REMOVE_NETWORK all") | |
704 | eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello1", | |
705 | expect_failure=True) | |
706 | ||
22b99086 JM |
707 | def test_ap_wpa2_eap_ikev2(dev, apdev): |
708 | """WPA2-Enterprise connection using EAP-IKEv2""" | |
709 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
710 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 JM |
711 | eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user", |
712 | password="ike password") | |
75b2b9cf | 713 | eap_reauth(dev[0], "IKEV2") |
6daf5b9c JM |
714 | dev[0].request("REMOVE_NETWORK all") |
715 | eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user", | |
716 | password="ike password", fragment_size="250") | |
22b99086 | 717 | |
f10ba3b2 JM |
718 | logger.info("Negative test with incorrect password") |
719 | dev[0].request("REMOVE_NETWORK all") | |
720 | eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user", | |
721 | password="ike-password", expect_failure=True) | |
722 | ||
22b99086 JM |
723 | def test_ap_wpa2_eap_pax(dev, apdev): |
724 | """WPA2-Enterprise connection using EAP-PAX""" | |
725 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
726 | hostapd.add_ap(apdev[0]['ifname'], params) | |
cb33ee14 | 727 | eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com", |
22b99086 | 728 | password_hex="0123456789abcdef0123456789abcdef") |
75b2b9cf | 729 | eap_reauth(dev[0], "PAX") |
22b99086 | 730 | |
f10ba3b2 JM |
731 | logger.info("Negative test with incorrect password") |
732 | dev[0].request("REMOVE_NETWORK all") | |
733 | eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com", | |
734 | password_hex="ff23456789abcdef0123456789abcdef", | |
735 | expect_failure=True) | |
736 | ||
22b99086 JM |
737 | def test_ap_wpa2_eap_psk(dev, apdev): |
738 | """WPA2-Enterprise connection using EAP-PSK""" | |
739 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
2b005194 JM |
740 | params["wpa_key_mgmt"] = "WPA-EAP-SHA256" |
741 | params["ieee80211w"] = "2" | |
22b99086 | 742 | hostapd.add_ap(apdev[0]['ifname'], params) |
cb33ee14 | 743 | eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com", |
2b005194 JM |
744 | password_hex="0123456789abcdef0123456789abcdef", sha256=True) |
745 | eap_reauth(dev[0], "PSK", sha256=True) | |
71390dc8 | 746 | |
f10ba3b2 JM |
747 | logger.info("Negative test with incorrect password") |
748 | dev[0].request("REMOVE_NETWORK all") | |
749 | eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com", | |
750 | password_hex="ff23456789abcdef0123456789abcdef", sha256=True, | |
751 | expect_failure=True) | |
752 | ||
71390dc8 JM |
753 | def test_ap_wpa_eap_peap_eap_mschapv2(dev, apdev): |
754 | """WPA-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2""" | |
755 | params = hostapd.wpa_eap_params(ssid="test-wpa-eap") | |
756 | hostapd.add_ap(apdev[0]['ifname'], params) | |
757 | dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="PEAP", | |
758 | identity="user", password="password", phase2="auth=MSCHAPV2", | |
759 | ca_cert="auth_serv/ca.pem", wait_connect=False, | |
760 | scan_freq="2412") | |
761 | eap_check_auth(dev[0], "PEAP", True, rsn=False) | |
762 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
763 | eap_reauth(dev[0], "PEAP", rsn=False) | |
40759604 JM |
764 | |
765 | def test_ap_wpa2_eap_interactive(dev, apdev): | |
766 | """WPA2-Enterprise connection using interactive identity/password entry""" | |
767 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
768 | hostapd.add_ap(apdev[0]['ifname'], params) | |
769 | hapd = hostapd.Hostapd(apdev[0]['ifname']) | |
770 | ||
771 | tests = [ ("Connection with dynamic TTLS/MSCHAPv2 password entry", | |
772 | "TTLS", "ttls", "DOMAIN\mschapv2 user", "auth=MSCHAPV2", | |
773 | None, "password"), | |
774 | ("Connection with dynamic TTLS/MSCHAPv2 identity and password entry", | |
775 | "TTLS", "ttls", None, "auth=MSCHAPV2", | |
776 | "DOMAIN\mschapv2 user", "password"), | |
777 | ("Connection with dynamic TTLS/EAP-MSCHAPv2 password entry", | |
778 | "TTLS", "ttls", "user", "autheap=MSCHAPV2", None, "password"), | |
779 | ("Connection with dynamic TTLS/EAP-MD5 password entry", | |
780 | "TTLS", "ttls", "user", "autheap=MD5", None, "password"), | |
781 | ("Connection with dynamic PEAP/EAP-MSCHAPv2 password entry", | |
782 | "PEAP", None, "user", "auth=MSCHAPV2", None, "password"), | |
783 | ("Connection with dynamic PEAP/EAP-GTC password entry", | |
784 | "PEAP", None, "user", "auth=GTC", None, "password") ] | |
785 | for [desc,eap,anon,identity,phase2,req_id,req_pw] in tests: | |
786 | logger.info(desc) | |
787 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap=eap, | |
788 | anonymous_identity=anon, identity=identity, | |
789 | ca_cert="auth_serv/ca.pem", phase2=phase2, | |
790 | wait_connect=False, scan_freq="2412") | |
791 | if req_id: | |
792 | ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"]) | |
793 | if ev is None: | |
794 | raise Exception("Request for identity timed out") | |
795 | id = ev.split(':')[0].split('-')[-1] | |
796 | dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id) | |
797 | ev = dev[0].wait_event(["CTRL-REQ-PASSWORD","CTRL-REQ-OTP"]) | |
798 | if ev is None: | |
799 | raise Exception("Request for password timed out") | |
800 | id = ev.split(':')[0].split('-')[-1] | |
801 | type = "OTP" if "CTRL-REQ-OTP" in ev else "PASSWORD" | |
802 | dev[0].request("CTRL-RSP-" + type + "-" + id + ":" + req_pw) | |
803 | ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) | |
804 | if ev is None: | |
805 | raise Exception("Connection timed out") | |
806 | dev[0].request("REMOVE_NETWORK all") | |
e745c811 JM |
807 | |
808 | def test_ap_wpa2_eap_vendor_test(dev, apdev): | |
809 | """WPA2-Enterprise connection using EAP vendor test""" | |
810 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
811 | hostapd.add_ap(apdev[0]['ifname'], params) | |
812 | eap_connect(dev[0], apdev[0], "VENDOR-TEST", "vendor-test") | |
813 | eap_reauth(dev[0], "VENDOR-TEST") | |
53a6f06a JM |
814 | |
815 | def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev): | |
816 | """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning""" | |
817 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
818 | hostapd.add_ap(apdev[0]['ifname'], params) | |
819 | eap_connect(dev[0], apdev[0], "FAST", "user", | |
820 | anonymous_identity="FAST", password="password", | |
821 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", | |
822 | phase1="fast_provisioning=1", pac_file="blob://fast_pac") | |
823 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
824 | eap_reauth(dev[0], "FAST") | |
825 | ||
826 | def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev): | |
827 | """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning""" | |
828 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
829 | hostapd.add_ap(apdev[0]['ifname'], params) | |
830 | eap_connect(dev[0], apdev[0], "FAST", "user", | |
831 | anonymous_identity="FAST", password="password", | |
832 | ca_cert="auth_serv/ca.pem", phase2="auth=GTC", | |
833 | phase1="fast_provisioning=2", pac_file="blob://fast_pac_auth") | |
834 | hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname']) | |
835 | eap_reauth(dev[0], "FAST") | |
d4c7a2b9 JM |
836 | |
837 | def test_ap_wpa2_eap_tls_ocsp(dev, apdev): | |
838 | """WPA2-Enterprise connection using EAP-TLS and verifying OCSP""" | |
839 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
840 | hostapd.add_ap(apdev[0]['ifname'], params) | |
841 | eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem", | |
842 | private_key="auth_serv/user.pkcs12", | |
843 | private_key_passwd="whatever", ocsp=2) | |
844 | ||
64e05f96 | 845 | def int_eap_server_params(): |
d4c7a2b9 JM |
846 | params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP", |
847 | "rsn_pairwise": "CCMP", "ieee8021x": "1", | |
848 | "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf", | |
849 | "ca_cert": "auth_serv/ca.pem", | |
850 | "server_cert": "auth_serv/server.pem", | |
64e05f96 JM |
851 | "private_key": "auth_serv/server.key" } |
852 | return params | |
853 | ||
854 | def test_ap_wpa2_eap_tls_ocsp_invalid(dev, apdev): | |
855 | """WPA2-Enterprise connection using EAP-TLS and invalid OCSP response""" | |
856 | params = int_eap_server_params() | |
857 | params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-invalid" | |
d4c7a2b9 JM |
858 | hostapd.add_ap(apdev[0]['ifname'], params) |
859 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", | |
860 | identity="tls user", ca_cert="auth_serv/ca.pem", | |
861 | private_key="auth_serv/user.pkcs12", | |
862 | private_key_passwd="whatever", ocsp=2, | |
863 | wait_connect=False, scan_freq="2412") | |
864 | count = 0 | |
865 | while True: | |
866 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"]) | |
867 | if ev is None: | |
868 | raise Exception("Timeout on EAP status") | |
869 | if 'bad certificate status response' in ev: | |
870 | break | |
871 | count = count + 1 | |
872 | if count > 10: | |
873 | raise Exception("Unexpected number of EAP status messages") | |
874 | ||
875 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) | |
876 | if ev is None: | |
877 | raise Exception("Timeout on EAP failure report") | |
64e05f96 JM |
878 | |
879 | def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev): | |
880 | """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)""" | |
881 | params = int_eap_server_params() | |
882 | params["server_cert"] = "auth_serv/server-no-dnsname.pem" | |
883 | params["private_key"] = "auth_serv/server-no-dnsname.key" | |
884 | hostapd.add_ap(apdev[0]['ifname'], params) | |
885 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", | |
886 | identity="tls user", ca_cert="auth_serv/ca.pem", | |
887 | private_key="auth_serv/user.pkcs12", | |
888 | private_key_passwd="whatever", | |
889 | domain_suffix_match="server3.w1.fi", | |
890 | scan_freq="2412") | |
891 | dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", | |
892 | identity="tls user", ca_cert="auth_serv/ca.pem", | |
893 | private_key="auth_serv/user.pkcs12", | |
894 | private_key_passwd="whatever", | |
895 | domain_suffix_match="w1.fi", | |
896 | scan_freq="2412") | |
897 | ||
898 | def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev): | |
899 | """WPA2-Enterprise using EAP-TLS and domain suffix mismatch (CN)""" | |
900 | params = int_eap_server_params() | |
901 | params["server_cert"] = "auth_serv/server-no-dnsname.pem" | |
902 | params["private_key"] = "auth_serv/server-no-dnsname.key" | |
903 | hostapd.add_ap(apdev[0]['ifname'], params) | |
904 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", | |
905 | identity="tls user", ca_cert="auth_serv/ca.pem", | |
906 | private_key="auth_serv/user.pkcs12", | |
907 | private_key_passwd="whatever", | |
908 | domain_suffix_match="example.com", | |
909 | wait_connect=False, | |
910 | scan_freq="2412") | |
911 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) | |
912 | if ev is None: | |
913 | raise Exception("Timeout on EAP failure report") | |
6a4d0dbe JM |
914 | |
915 | def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev): | |
916 | """WPA2-Enterprise using EAP-TTLS and expired certificate""" | |
917 | params = int_eap_server_params() | |
918 | params["server_cert"] = "auth_serv/server-expired.pem" | |
919 | params["private_key"] = "auth_serv/server-expired.key" | |
920 | hostapd.add_ap(apdev[0]['ifname'], params) | |
921 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
922 | identity="mschap user", password="password", | |
923 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", | |
924 | wait_connect=False, | |
925 | scan_freq="2412") | |
926 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"]) | |
927 | if ev is None: | |
928 | raise Exception("Timeout on EAP certificate error report") | |
929 | if "reason=4" not in ev or "certificate has expired" not in ev: | |
930 | raise Exception("Unexpected failure reason: " + ev) | |
931 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) | |
932 | if ev is None: | |
933 | raise Exception("Timeout on EAP failure report") | |
934 | ||
935 | def test_ap_wpa2_eap_ttls_ignore_expired_cert(dev, apdev): | |
936 | """WPA2-Enterprise using EAP-TTLS and ignore certificate expiration""" | |
937 | params = int_eap_server_params() | |
938 | params["server_cert"] = "auth_serv/server-expired.pem" | |
939 | params["private_key"] = "auth_serv/server-expired.key" | |
940 | hostapd.add_ap(apdev[0]['ifname'], params) | |
941 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
942 | identity="mschap user", password="password", | |
943 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", | |
944 | phase1="tls_disable_time_checks=1", | |
945 | scan_freq="2412") | |
6ab4a7aa JM |
946 | |
947 | def test_ap_wpa2_eap_ttls_server_cert_eku_client(dev, apdev): | |
948 | """WPA2-Enterprise using EAP-TTLS and server cert with client EKU""" | |
949 | params = int_eap_server_params() | |
950 | params["server_cert"] = "auth_serv/server-eku-client.pem" | |
951 | params["private_key"] = "auth_serv/server-eku-client.key" | |
952 | hostapd.add_ap(apdev[0]['ifname'], params) | |
953 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
954 | identity="mschap user", password="password", | |
955 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", | |
956 | wait_connect=False, | |
957 | scan_freq="2412") | |
958 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) | |
959 | if ev is None: | |
960 | raise Exception("Timeout on EAP failure report") | |
242219c5 | 961 | |
14bef66d JM |
962 | def test_ap_wpa2_eap_ttls_server_cert_eku_client_server(dev, apdev): |
963 | """WPA2-Enterprise using EAP-TTLS and server cert with client and server EKU""" | |
964 | params = int_eap_server_params() | |
965 | params["server_cert"] = "auth_serv/server-eku-client-server.pem" | |
966 | params["private_key"] = "auth_serv/server-eku-client-server.key" | |
967 | hostapd.add_ap(apdev[0]['ifname'], params) | |
968 | dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", | |
969 | identity="mschap user", password="password", | |
970 | ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", | |
971 | scan_freq="2412") | |
972 | ||
242219c5 JM |
973 | def test_ap_wpa2_eap_ttls_dh_params(dev, apdev): |
974 | """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params""" | |
975 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
976 | hostapd.add_ap(apdev[0]['ifname'], params) | |
977 | eap_connect(dev[0], apdev[0], "TTLS", "chap user", | |
978 | anonymous_identity="ttls", password="password", | |
979 | ca_cert="auth_serv/ca.der", phase2="auth=CHAP", | |
980 | dh_file="auth_serv/dh.conf") | |
7c50093f JM |
981 | |
982 | def test_ap_wpa2_eap_reauth(dev, apdev): | |
983 | """WPA2-Enterprise and Authenticator forcing reauthentication""" | |
984 | params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") | |
985 | params['eap_reauth_period'] = '2' | |
986 | hostapd.add_ap(apdev[0]['ifname'], params) | |
987 | eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com", | |
988 | password_hex="0123456789abcdef0123456789abcdef") | |
989 | logger.info("Wait for reauthentication") | |
990 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) | |
991 | if ev is None: | |
992 | raise Exception("Timeout on reauthentication") | |
993 | ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) | |
994 | if ev is None: | |
995 | raise Exception("Timeout on reauthentication") | |
996 | for i in range(0, 20): | |
997 | state = dev[0].get_status_field("wpa_state") | |
998 | if state == "COMPLETED": | |
999 | break | |
1000 | time.sleep(0.1) | |
1001 | if state != "COMPLETED": | |
1002 | raise Exception("Reauthentication did not complete") |