]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_eap.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: Write GTK locations into debug log in key_lifetime_in_memory
[thirdparty/hostap.git] / tests / hwsim / test_ap_eap.py
CommitLineData
eac67440 1# -*- coding: utf-8 -*-
9626962d 2# WPA2-Enterprise tests
3b51cc63 3# Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
9626962d
JM		 4#
5# This software may be distributed under the terms of the BSD license.
6# See README for more details.
7
6ea231e6 8import base64
5b3c40a6 9import binascii
9626962d
JM		 10import time
11import subprocess
12import logging
c9aa4308 13logger = logging.getLogger()
873e7c29 14import os
d4c3c055
JM		 15import socket
16import SocketServer
9626962d
JM		 17
18import hwsim_utils
19import hostapd
7c0d66cf 20from utils import HwsimSkip, alloc_fail, fail_test, skip_with_fips, wait_fail_trigger
52352802 21from wpasupplicant import WpaSupplicant
5b3c40a6 22from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
9626962d 23
81e787b7
JM		 24def check_hlr_auc_gw_support():
25 if not os.path.exists("/tmp/hlr_auc_gw.sock"):
26 raise HwsimSkip("No hlr_auc_gw available")
27
3b51cc63
JM		 28def check_eap_capa(dev, method):
29 res = dev.get_capability("eap")
30 if method not in res:
31 raise HwsimSkip("EAP method %s not supported in the build" % method)
32
506b2f05
JM		 33def check_subject_match_support(dev):
34 tls = dev.request("GET tls_library")
35 if not tls.startswith("OpenSSL"):
36 raise HwsimSkip("subject_match not supported with this TLS library: " + tls)
37
38def check_altsubject_match_support(dev):
39 tls = dev.request("GET tls_library")
40 if not tls.startswith("OpenSSL"):
41 raise HwsimSkip("altsubject_match not supported with this TLS library: " + tls)
42
e78eb404
JM		 43def check_domain_match(dev):
44 tls = dev.request("GET tls_library")
45 if tls.startswith("internal"):
46 raise HwsimSkip("domain_match not supported with this TLS library: " + tls)
47
48def check_domain_suffix_match(dev):
49 tls = dev.request("GET tls_library")
50 if tls.startswith("internal"):
51 raise HwsimSkip("domain_suffix_match not supported with this TLS library: " + tls)
52
24579e70
JM		 53def check_domain_match_full(dev):
54 tls = dev.request("GET tls_library")
55 if not tls.startswith("OpenSSL"):
56 raise HwsimSkip("domain_suffix_match requires full match with this TLS library: " + tls)
57
4bf4e9db
JM		 58def check_cert_probe_support(dev):
59 tls = dev.request("GET tls_library")
0fc1b583 60 if not tls.startswith("OpenSSL") and not tls.startswith("internal"):
4bf4e9db
JM		 61 raise HwsimSkip("Certificate probing not supported with this TLS library: " + tls)
62
0dae8c99
JM		 63def check_ocsp_support(dev):
64 tls = dev.request("GET tls_library")
bb0a72ab
JM		 65 if tls.startswith("internal"):
66 raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0c6185fc
JM		 67 #if "BoringSSL" in tls:
68 # raise HwsimSkip("OCSP not supported with this TLS library: " + tls)
0dae8c99 69
686eee77
JM		 70def check_pkcs12_support(dev):
71 tls = dev.request("GET tls_library")
72 if tls.startswith("internal"):
73 raise HwsimSkip("PKCS#12 not supported with this TLS library: " + tls)
74
404597e6
JM		 75def check_dh_dsa_support(dev):
76 tls = dev.request("GET tls_library")
77 if tls.startswith("internal"):
78 raise HwsimSkip("DH DSA not supported with this TLS library: " + tls)
79
6ea231e6
JM		 80def read_pem(fname):
81 with open(fname, "r") as f:
82 lines = f.readlines()
83 copy = False
84 cert = ""
85 for l in lines:
86 if "-----END" in l:
87 break
88 if copy:
89 cert = cert + l
90 if "-----BEGIN" in l:
91 copy = True
92 return base64.b64decode(cert)
93
6f939e59
JM		 94def eap_connect(dev, ap, method, identity,
95 sha256=False, expect_failure=False, local_error_report=False,
9dd21d51 96 maybe_local_error=False, **kwargs):
cb33ee14 97 hapd = hostapd.Hostapd(ap['ifname'])
2bb9e283
JM		 98 id = dev.connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
99 eap=method, identity=identity,
6f939e59
JM		 100 wait_connect=False, scan_freq="2412", ieee80211w="1",
101 **kwargs)
f10ba3b2
JM		 102 eap_check_auth(dev, method, True, sha256=sha256,
103 expect_failure=expect_failure,
9dd21d51
JM		 104 local_error_report=local_error_report,
105 maybe_local_error=maybe_local_error)
f10ba3b2
JM		 106 if expect_failure:
107 return id
cb33ee14
JM		 108 ev = hapd.wait_event([ "AP-STA-CONNECTED" ], timeout=5)
109 if ev is None:
110 raise Exception("No connection event received from hostapd")
2bb9e283 111 return id
75b2b9cf 112
f10ba3b2 113def eap_check_auth(dev, method, initial, rsn=True, sha256=False,
9dd21d51
JM		 114 expect_failure=False, local_error_report=False,
115 maybe_local_error=False):
9626962d
JM		 116 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
117 if ev is None:
118 raise Exception("Association and EAP start timed out")
06cdd1cd
JM		 119 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD",
120 "CTRL-EVENT-EAP-FAILURE"], timeout=10)
9626962d
JM		 121 if ev is None:
122 raise Exception("EAP method selection timed out")
06cdd1cd
JM		 123 if "CTRL-EVENT-EAP-FAILURE" in ev:
124 if maybe_local_error:
125 return
126 raise Exception("Could not select EAP method")
9626962d
JM		 127 if method not in ev:
128 raise Exception("Unexpected EAP method")
f10ba3b2
JM		 129 if expect_failure:
130 ev = dev.wait_event(["CTRL-EVENT-EAP-FAILURE"])
131 if ev is None:
132 raise Exception("EAP failure timed out")
5f35a5e2 133 ev = dev.wait_disconnected(timeout=10)
9dd21d51
JM		 134 if maybe_local_error and "locally_generated=1" in ev:
135 return
f10ba3b2
JM		 136 if not local_error_report:
137 if "reason=23" not in ev:
138 raise Exception("Proper reason code for disconnection not reported")
139 return
9626962d
JM		 140 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
141 if ev is None:
142 raise Exception("EAP success timed out")
9626962d 143
75b2b9cf
JM		 144 if initial:
145 ev = dev.wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
75b2b9cf 146 else:
bce774ad
JM		 147 ev = dev.wait_event(["WPA: Key negotiation completed"], timeout=10)
148 if ev is None:
149 raise Exception("Association with the AP timed out")
150 status = dev.get_status()
151 if status["wpa_state"] != "COMPLETED":
152 raise Exception("Connection not completed")
75b2b9cf 153
9626962d
JM		 154 if status["suppPortStatus"] != "Authorized":
155 raise Exception("Port not authorized")
156 if method not in status["selectedMethod"]:
157 raise Exception("Incorrect EAP method status")
2b005194
JM		 158 if sha256:
159 e = "WPA2-EAP-SHA256"
160 elif rsn:
71390dc8
JM		 161 e = "WPA2/IEEE 802.1X/EAP"
162 else:
163 e = "WPA/IEEE 802.1X/EAP"
164 if status["key_mgmt"] != e:
165 raise Exception("Unexpected key_mgmt status: " + status["key_mgmt"])
2fc4749c 166 return status
9626962d 167
5b1aaf6c 168def eap_reauth(dev, method, rsn=True, sha256=False, expect_failure=False):
75b2b9cf 169 dev.request("REAUTHENTICATE")
2fc4749c
JM		 170 return eap_check_auth(dev, method, False, rsn=rsn, sha256=sha256,
171 expect_failure=expect_failure)
75b2b9cf 172
9626962d
JM		 173def test_ap_wpa2_eap_sim(dev, apdev):
174 """WPA2-Enterprise connection using EAP-SIM"""
81e787b7 175 check_hlr_auc_gw_support()
9626962d 176 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 177 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 178 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
9626962d 179 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
a8375c94 180 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 181 eap_reauth(dev[0], "SIM")
9626962d 182
a0f350fd
JM		 183 eap_connect(dev[1], apdev[0], "SIM", "1232010000000001",
184 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
185 eap_connect(dev[2], apdev[0], "SIM", "1232010000000002",
186 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
187 expect_failure=True)
188
f10ba3b2
JM		 189 logger.info("Negative test with incorrect key")
190 dev[0].request("REMOVE_NETWORK all")
191 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
192 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
193 expect_failure=True)
194
32747a3e
JM		 195 logger.info("Invalid GSM-Milenage key")
196 dev[0].request("REMOVE_NETWORK all")
197 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
198 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
199 expect_failure=True)
200
201 logger.info("Invalid GSM-Milenage key(2)")
202 dev[0].request("REMOVE_NETWORK all")
203 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
204 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581",
205 expect_failure=True)
206
207 logger.info("Invalid GSM-Milenage key(3)")
208 dev[0].request("REMOVE_NETWORK all")
209 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
210 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q",
211 expect_failure=True)
212
213 logger.info("Invalid GSM-Milenage key(4)")
214 dev[0].request("REMOVE_NETWORK all")
215 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
216 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581",
217 expect_failure=True)
218
219 logger.info("Missing key configuration")
220 dev[0].request("REMOVE_NETWORK all")
221 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
222 expect_failure=True)
223
5b1aaf6c
JM		 224def test_ap_wpa2_eap_sim_sql(dev, apdev, params):
225 """WPA2-Enterprise connection using EAP-SIM (SQL)"""
81e787b7 226 check_hlr_auc_gw_support()
5b1aaf6c
JM		 227 try:
228 import sqlite3
229 except ImportError:
81e787b7 230 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 231 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
232 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
233 params['auth_server_port'] = "1814"
234 hostapd.add_ap(apdev[0]['ifname'], params)
235 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
236 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
237
238 logger.info("SIM fast re-authentication")
239 eap_reauth(dev[0], "SIM")
240
241 logger.info("SIM full auth with pseudonym")
242 with con:
243 cur = con.cursor()
244 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
245 eap_reauth(dev[0], "SIM")
246
247 logger.info("SIM full auth with permanent identity")
248 with con:
249 cur = con.cursor()
250 cur.execute("DELETE FROM reauth WHERE permanent='1232010000000000'")
251 cur.execute("DELETE FROM pseudonyms WHERE permanent='1232010000000000'")
252 eap_reauth(dev[0], "SIM")
253
254 logger.info("SIM reauth with mismatching MK")
255 with con:
256 cur = con.cursor()
257 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='1232010000000000'")
258 eap_reauth(dev[0], "SIM", expect_failure=True)
259 dev[0].request("REMOVE_NETWORK all")
260
261 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
262 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
263 with con:
264 cur = con.cursor()
265 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
266 eap_reauth(dev[0], "SIM")
267 with con:
268 cur = con.cursor()
269 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='1232010000000000'")
270 logger.info("SIM reauth with mismatching counter")
271 eap_reauth(dev[0], "SIM")
272 dev[0].request("REMOVE_NETWORK all")
273
274 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
275 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
276 with con:
277 cur = con.cursor()
278 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='1232010000000000'")
279 logger.info("SIM reauth with max reauth count reached")
280 eap_reauth(dev[0], "SIM")
281
e2a90a4c
JM		 282def test_ap_wpa2_eap_sim_config(dev, apdev):
283 """EAP-SIM configuration options"""
284 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
285 hostapd.add_ap(apdev[0]['ifname'], params)
286 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
287 identity="1232010000000000",
288 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
289 phase1="sim_min_num_chal=1",
290 wait_connect=False, scan_freq="2412")
291 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
292 if ev is None:
293 raise Exception("No EAP error message seen")
294 dev[0].request("REMOVE_NETWORK all")
295
296 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
297 identity="1232010000000000",
298 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
299 phase1="sim_min_num_chal=4",
300 wait_connect=False, scan_freq="2412")
301 ev = dev[0].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 18 (SIM)"], timeout=10)
302 if ev is None:
303 raise Exception("No EAP error message seen (2)")
304 dev[0].request("REMOVE_NETWORK all")
305
306 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
307 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
308 phase1="sim_min_num_chal=2")
309 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
310 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
311 anonymous_identity="345678")
312
72cbc684
JM		 313def test_ap_wpa2_eap_sim_ext(dev, apdev):
314 """WPA2-Enterprise connection using EAP-SIM and external GSM auth"""
47dcb118 315 try:
81e787b7 316 _test_ap_wpa2_eap_sim_ext(dev, apdev)
47dcb118
JM		 317 finally:
318 dev[0].request("SET external_sim 0")
319
320def _test_ap_wpa2_eap_sim_ext(dev, apdev):
81e787b7 321 check_hlr_auc_gw_support()
72cbc684
JM		 322 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
323 hostapd.add_ap(apdev[0]['ifname'], params)
324 dev[0].request("SET external_sim 1")
325 id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP",
326 identity="1232010000000000",
327 wait_connect=False, scan_freq="2412")
328 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
329 if ev is None:
330 raise Exception("Network connected timed out")
331
332 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
333 if ev is None:
334 raise Exception("Wait for external SIM processing request timed out")
335 p = ev.split(':', 2)
336 if p[1] != "GSM-AUTH":
337 raise Exception("Unexpected CTRL-REQ-SIM type")
338 rid = p[0].split('-')[3]
339
340 # IK:CK:RES
341 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
342 # This will fail during processing, but the ctrl_iface command succeeds
343 dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTH:" + resp)
344 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
345 if ev is None:
346 raise Exception("EAP failure not reported")
347 dev[0].request("DISCONNECT")
90ad11e6
JM		 348 dev[0].wait_disconnected()
349 time.sleep(0.1)
72cbc684
JM		 350
351 dev[0].select_network(id, freq="2412")
352 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
353 if ev is None:
354 raise Exception("Wait for external SIM processing request timed out")
355 p = ev.split(':', 2)
356 if p[1] != "GSM-AUTH":
357 raise Exception("Unexpected CTRL-REQ-SIM type")
358 rid = p[0].split('-')[3]
359 # This will fail during GSM auth validation
360 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:q"):
361 raise Exception("CTRL-RSP-SIM failed")
362 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
363 if ev is None:
364 raise Exception("EAP failure not reported")
365 dev[0].request("DISCONNECT")
90ad11e6
JM		 366 dev[0].wait_disconnected()
367 time.sleep(0.1)
72cbc684
JM		 368
369 dev[0].select_network(id, freq="2412")
370 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
371 if ev is None:
372 raise Exception("Wait for external SIM processing request timed out")
373 p = ev.split(':', 2)
374 if p[1] != "GSM-AUTH":
375 raise Exception("Unexpected CTRL-REQ-SIM type")
376 rid = p[0].split('-')[3]
377 # This will fail during GSM auth validation
378 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:34"):
379 raise Exception("CTRL-RSP-SIM failed")
380 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
381 if ev is None:
382 raise Exception("EAP failure not reported")
383 dev[0].request("DISCONNECT")
90ad11e6
JM		 384 dev[0].wait_disconnected()
385 time.sleep(0.1)
72cbc684
JM		 386
387 dev[0].select_network(id, freq="2412")
388 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
389 if ev is None:
390 raise Exception("Wait for external SIM processing request timed out")
391 p = ev.split(':', 2)
392 if p[1] != "GSM-AUTH":
393 raise Exception("Unexpected CTRL-REQ-SIM type")
394 rid = p[0].split('-')[3]
395 # This will fail during GSM auth validation
396 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677"):
397 raise Exception("CTRL-RSP-SIM failed")
398 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
399 if ev is None:
400 raise Exception("EAP failure not reported")
401 dev[0].request("DISCONNECT")
90ad11e6
JM		 402 dev[0].wait_disconnected()
403 time.sleep(0.1)
72cbc684
JM		 404
405 dev[0].select_network(id, freq="2412")
406 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
407 if ev is None:
408 raise Exception("Wait for external SIM processing request timed out")
409 p = ev.split(':', 2)
410 if p[1] != "GSM-AUTH":
411 raise Exception("Unexpected CTRL-REQ-SIM type")
412 rid = p[0].split('-')[3]
413 # This will fail during GSM auth validation
414 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:q"):
415 raise Exception("CTRL-RSP-SIM failed")
416 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
417 if ev is None:
418 raise Exception("EAP failure not reported")
419 dev[0].request("DISCONNECT")
90ad11e6
JM		 420 dev[0].wait_disconnected()
421 time.sleep(0.1)
72cbc684
JM		 422
423 dev[0].select_network(id, freq="2412")
424 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
425 if ev is None:
426 raise Exception("Wait for external SIM processing request timed out")
427 p = ev.split(':', 2)
428 if p[1] != "GSM-AUTH":
429 raise Exception("Unexpected CTRL-REQ-SIM type")
430 rid = p[0].split('-')[3]
431 # This will fail during GSM auth validation
432 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233"):
433 raise Exception("CTRL-RSP-SIM failed")
434 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
435 if ev is None:
436 raise Exception("EAP failure not reported")
437 dev[0].request("DISCONNECT")
90ad11e6
JM		 438 dev[0].wait_disconnected()
439 time.sleep(0.1)
72cbc684
JM		 440
441 dev[0].select_network(id, freq="2412")
442 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
443 if ev is None:
444 raise Exception("Wait for external SIM processing request timed out")
445 p = ev.split(':', 2)
446 if p[1] != "GSM-AUTH":
447 raise Exception("Unexpected CTRL-REQ-SIM type")
448 rid = p[0].split('-')[3]
449 # This will fail during GSM auth validation
450 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:0011223344556677:00112233:q"):
451 raise Exception("CTRL-RSP-SIM failed")
452 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
453 if ev is None:
454 raise Exception("EAP failure not reported")
455
486f4e3c
JM		 456def test_ap_wpa2_eap_sim_oom(dev, apdev):
457 """EAP-SIM and OOM"""
458 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
459 hostapd.add_ap(apdev[0]['ifname'], params)
460 tests = [ (1, "milenage_f2345"),
461 (2, "milenage_f2345"),
462 (3, "milenage_f2345"),
463 (4, "milenage_f2345"),
464 (5, "milenage_f2345"),
465 (6, "milenage_f2345"),
466 (7, "milenage_f2345"),
467 (8, "milenage_f2345"),
468 (9, "milenage_f2345"),
469 (10, "milenage_f2345"),
470 (11, "milenage_f2345"),
471 (12, "milenage_f2345") ]
472 for count, func in tests:
473 with alloc_fail(dev[0], count, func):
474 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="SIM",
475 identity="1232010000000000",
476 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
477 wait_connect=False, scan_freq="2412")
478 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
479 if ev is None:
480 raise Exception("EAP method not selected")
481 dev[0].wait_disconnected()
482 dev[0].request("REMOVE_NETWORK all")
483
9626962d
JM		 484def test_ap_wpa2_eap_aka(dev, apdev):
485 """WPA2-Enterprise connection using EAP-AKA"""
81e787b7 486 check_hlr_auc_gw_support()
9626962d 487 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 488 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 489 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
9626962d 490 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
a8375c94 491 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 492 eap_reauth(dev[0], "AKA")
9626962d 493
f10ba3b2
JM		 494 logger.info("Negative test with incorrect key")
495 dev[0].request("REMOVE_NETWORK all")
496 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
497 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
498 expect_failure=True)
499
32747a3e
JM		 500 logger.info("Invalid Milenage key")
501 dev[0].request("REMOVE_NETWORK all")
502 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
503 password="ffdca4eda45b53cf0f12d7c9c3bc6a",
504 expect_failure=True)
505
506 logger.info("Invalid Milenage key(2)")
507 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
508 password="ffdca4eda45b53cf0f12d7c9c3bc6a8q:cb9cccc4b9258e6dca4760379fb82581:000000000123",
509 expect_failure=True)
510
511 logger.info("Invalid Milenage key(3)")
512 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
513 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb8258q:000000000123",
514 expect_failure=True)
515
516 logger.info("Invalid Milenage key(4)")
517 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
518 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:00000000012q",
519 expect_failure=True)
520
521 logger.info("Invalid Milenage key(5)")
522 dev[0].request("REMOVE_NETWORK all")
523 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
524 password="ffdca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581q000000000123",
525 expect_failure=True)
526
527 logger.info("Invalid Milenage key(6)")
528 dev[0].request("REMOVE_NETWORK all")
529 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
530 password="ffdca4eda45b53cf0f12d7c9c3bc6a89qcb9cccc4b9258e6dca4760379fb82581q000000000123",
531 expect_failure=True)
532
533 logger.info("Missing key configuration")
534 dev[0].request("REMOVE_NETWORK all")
535 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
536 expect_failure=True)
537
5b1aaf6c
JM		 538def test_ap_wpa2_eap_aka_sql(dev, apdev, params):
539 """WPA2-Enterprise connection using EAP-AKA (SQL)"""
81e787b7 540 check_hlr_auc_gw_support()
5b1aaf6c
JM		 541 try:
542 import sqlite3
543 except ImportError:
81e787b7 544 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 545 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
546 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
547 params['auth_server_port'] = "1814"
548 hostapd.add_ap(apdev[0]['ifname'], params)
549 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
550 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
551
552 logger.info("AKA fast re-authentication")
553 eap_reauth(dev[0], "AKA")
554
555 logger.info("AKA full auth with pseudonym")
556 with con:
557 cur = con.cursor()
558 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
559 eap_reauth(dev[0], "AKA")
560
561 logger.info("AKA full auth with permanent identity")
562 with con:
563 cur = con.cursor()
564 cur.execute("DELETE FROM reauth WHERE permanent='0232010000000000'")
565 cur.execute("DELETE FROM pseudonyms WHERE permanent='0232010000000000'")
566 eap_reauth(dev[0], "AKA")
567
568 logger.info("AKA reauth with mismatching MK")
569 with con:
570 cur = con.cursor()
571 cur.execute("UPDATE reauth SET mk='0000000000000000000000000000000000000000' WHERE permanent='0232010000000000'")
572 eap_reauth(dev[0], "AKA", expect_failure=True)
573 dev[0].request("REMOVE_NETWORK all")
574
575 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
576 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
577 with con:
578 cur = con.cursor()
579 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
580 eap_reauth(dev[0], "AKA")
581 with con:
582 cur = con.cursor()
583 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='0232010000000000'")
584 logger.info("AKA reauth with mismatching counter")
585 eap_reauth(dev[0], "AKA")
586 dev[0].request("REMOVE_NETWORK all")
587
588 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
589 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
590 with con:
591 cur = con.cursor()
592 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='0232010000000000'")
593 logger.info("AKA reauth with max reauth count reached")
594 eap_reauth(dev[0], "AKA")
595
e2a90a4c
JM		 596def test_ap_wpa2_eap_aka_config(dev, apdev):
597 """EAP-AKA configuration options"""
598 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
599 hostapd.add_ap(apdev[0]['ifname'], params)
600 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
601 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
602 anonymous_identity="2345678")
603
d314bedf
JM		 604def test_ap_wpa2_eap_aka_ext(dev, apdev):
605 """WPA2-Enterprise connection using EAP-AKA and external UMTS auth"""
47dcb118 606 try:
81e787b7 607 _test_ap_wpa2_eap_aka_ext(dev, apdev)
47dcb118
JM		 608 finally:
609 dev[0].request("SET external_sim 0")
610
611def _test_ap_wpa2_eap_aka_ext(dev, apdev):
81e787b7 612 check_hlr_auc_gw_support()
d314bedf
JM		 613 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
614 hostapd.add_ap(apdev[0]['ifname'], params)
615 dev[0].request("SET external_sim 1")
616 id = dev[0].connect("test-wpa2-eap", eap="AKA", key_mgmt="WPA-EAP",
617 identity="0232010000000000",
618 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
619 wait_connect=False, scan_freq="2412")
620 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
621 if ev is None:
622 raise Exception("Network connected timed out")
623
624 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
625 if ev is None:
626 raise Exception("Wait for external SIM processing request timed out")
627 p = ev.split(':', 2)
628 if p[1] != "UMTS-AUTH":
629 raise Exception("Unexpected CTRL-REQ-SIM type")
630 rid = p[0].split('-')[3]
631
632 # IK:CK:RES
633 resp = "00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344"
634 # This will fail during processing, but the ctrl_iface command succeeds
635 dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp)
636 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
637 if ev is None:
638 raise Exception("EAP failure not reported")
639 dev[0].request("DISCONNECT")
584e4197 640 dev[0].wait_disconnected()
90ad11e6 641 time.sleep(0.1)
a359c7bb 642 dev[0].dump_monitor()
d314bedf 643
d8e02214
JM		 644 dev[0].select_network(id, freq="2412")
645 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
646 if ev is None:
647 raise Exception("Wait for external SIM processing request timed out")
648 p = ev.split(':', 2)
649 if p[1] != "UMTS-AUTH":
650 raise Exception("Unexpected CTRL-REQ-SIM type")
651 rid = p[0].split('-')[3]
652 # This will fail during UMTS auth validation
653 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:112233445566778899aabbccddee"):
654 raise Exception("CTRL-RSP-SIM failed")
655 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
656 if ev is None:
657 raise Exception("Wait for external SIM processing request timed out")
658 p = ev.split(':', 2)
659 if p[1] != "UMTS-AUTH":
660 raise Exception("Unexpected CTRL-REQ-SIM type")
661 rid = p[0].split('-')[3]
662 # This will fail during UMTS auth validation
663 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + ":UMTS-AUTS:12"):
664 raise Exception("CTRL-RSP-SIM failed")
665 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
666 if ev is None:
667 raise Exception("EAP failure not reported")
668 dev[0].request("DISCONNECT")
584e4197 669 dev[0].wait_disconnected()
90ad11e6 670 time.sleep(0.1)
a359c7bb 671 dev[0].dump_monitor()
d8e02214 672
0258cf10
JM		 673 tests = [ ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:0011223344",
674 ":UMTS-AUTH:34",
675 ":UMTS-AUTH:00112233445566778899aabbccddeeff.00112233445566778899aabbccddeeff:0011223344",
676 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddee:0011223344",
677 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff.0011223344",
678 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff0011223344",
679 ":UMTS-AUTH:00112233445566778899aabbccddeeff:00112233445566778899aabbccddeeff:001122334q" ]
680 for t in tests:
681 dev[0].select_network(id, freq="2412")
682 ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15)
683 if ev is None:
684 raise Exception("Wait for external SIM processing request timed out")
685 p = ev.split(':', 2)
686 if p[1] != "UMTS-AUTH":
687 raise Exception("Unexpected CTRL-REQ-SIM type")
688 rid = p[0].split('-')[3]
689 # This will fail during UMTS auth validation
690 if "OK" not in dev[0].request("CTRL-RSP-SIM-" + rid + t):
691 raise Exception("CTRL-RSP-SIM failed")
692 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
693 if ev is None:
694 raise Exception("EAP failure not reported")
695 dev[0].request("DISCONNECT")
696 dev[0].wait_disconnected()
90ad11e6 697 time.sleep(0.1)
a359c7bb 698 dev[0].dump_monitor()
d314bedf 699
9626962d
JM		 700def test_ap_wpa2_eap_aka_prime(dev, apdev):
701 """WPA2-Enterprise connection using EAP-AKA'"""
81e787b7 702 check_hlr_auc_gw_support()
9626962d 703 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 704 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 705 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
9626962d 706 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
a8375c94 707 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 708 eap_reauth(dev[0], "AKA'")
9626962d 709
8583d664
JM		 710 logger.info("EAP-AKA' bidding protection when EAP-AKA enabled as well")
711 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="AKA' AKA",
712 identity="6555444333222111@both",
713 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
714 wait_connect=False, scan_freq="2412")
5f35a5e2 715 dev[1].wait_connected(timeout=15)
8583d664 716
f10ba3b2
JM		 717 logger.info("Negative test with incorrect key")
718 dev[0].request("REMOVE_NETWORK all")
719 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
720 password="ff22250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
721 expect_failure=True)
722
5b1aaf6c
JM		 723def test_ap_wpa2_eap_aka_prime_sql(dev, apdev, params):
724 """WPA2-Enterprise connection using EAP-AKA' (SQL)"""
81e787b7 725 check_hlr_auc_gw_support()
5b1aaf6c
JM		 726 try:
727 import sqlite3
728 except ImportError:
81e787b7 729 raise HwsimSkip("No sqlite3 module available")
5b1aaf6c
JM		 730 con = sqlite3.connect(os.path.join(params['logdir'], "hostapd.db"))
731 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
732 params['auth_server_port'] = "1814"
733 hostapd.add_ap(apdev[0]['ifname'], params)
734 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
735 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
736
737 logger.info("AKA' fast re-authentication")
738 eap_reauth(dev[0], "AKA'")
739
740 logger.info("AKA' full auth with pseudonym")
741 with con:
742 cur = con.cursor()
743 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
744 eap_reauth(dev[0], "AKA'")
745
746 logger.info("AKA' full auth with permanent identity")
747 with con:
748 cur = con.cursor()
749 cur.execute("DELETE FROM reauth WHERE permanent='6555444333222111'")
750 cur.execute("DELETE FROM pseudonyms WHERE permanent='6555444333222111'")
751 eap_reauth(dev[0], "AKA'")
752
753 logger.info("AKA' reauth with mismatching k_aut")
754 with con:
755 cur = con.cursor()
756 cur.execute("UPDATE reauth SET k_aut='0000000000000000000000000000000000000000000000000000000000000000' WHERE permanent='6555444333222111'")
757 eap_reauth(dev[0], "AKA'", expect_failure=True)
758 dev[0].request("REMOVE_NETWORK all")
759
760 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
761 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
762 with con:
763 cur = con.cursor()
764 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
765 eap_reauth(dev[0], "AKA'")
766 with con:
767 cur = con.cursor()
768 cur.execute("UPDATE reauth SET counter='10' WHERE permanent='6555444333222111'")
769 logger.info("AKA' reauth with mismatching counter")
770 eap_reauth(dev[0], "AKA'")
771 dev[0].request("REMOVE_NETWORK all")
772
773 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
774 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
775 with con:
776 cur = con.cursor()
777 cur.execute("UPDATE reauth SET counter='1001' WHERE permanent='6555444333222111'")
778 logger.info("AKA' reauth with max reauth count reached")
779 eap_reauth(dev[0], "AKA'")
780
9626962d
JM		 781def test_ap_wpa2_eap_ttls_pap(dev, apdev):
782 """WPA2-Enterprise connection using EAP-TTLS/PAP"""
783 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
65038313
JM		 784 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
785 key_mgmt = hapd.get_config()['key_mgmt']
786 if key_mgmt.split(' ')[0] != "WPA-EAP":
787 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cb33ee14 788 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
9626962d 789 anonymous_identity="ttls", password="password",
506b2f05 790 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
a8375c94 791 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 792 eap_reauth(dev[0], "TTLS")
eaf3f9b1
JM		 793 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-1"),
794 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-1") ])
9626962d 795
506b2f05
JM		 796def test_ap_wpa2_eap_ttls_pap_subject_match(dev, apdev):
797 """WPA2-Enterprise connection using EAP-TTLS/PAP and (alt)subject_match"""
798 check_subject_match_support(dev[0])
799 check_altsubject_match_support(dev[0])
800 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
801 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
802 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
803 anonymous_identity="ttls", password="password",
804 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
805 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
806 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/")
807 eap_reauth(dev[0], "TTLS")
808
82a8f5b5
JM		 809def test_ap_wpa2_eap_ttls_pap_incorrect_password(dev, apdev):
810 """WPA2-Enterprise connection using EAP-TTLS/PAP - incorrect password"""
811 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
812 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
813 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
814 anonymous_identity="ttls", password="wrong",
815 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
816 expect_failure=True)
817 eap_connect(dev[1], apdev[0], "TTLS", "user",
818 anonymous_identity="ttls", password="password",
819 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
820 expect_failure=True)
821
9626962d
JM		 822def test_ap_wpa2_eap_ttls_chap(dev, apdev):
823 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 824 skip_with_fips(dev[0])
9626962d 825 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 826 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
506b2f05
JM		 827 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
828 anonymous_identity="ttls", password="password",
829 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
830 hwsim_utils.test_connectivity(dev[0], hapd)
831 eap_reauth(dev[0], "TTLS")
832
833def test_ap_wpa2_eap_ttls_chap_altsubject_match(dev, apdev):
834 """WPA2-Enterprise connection using EAP-TTLS/CHAP"""
ca158ea6 835 skip_with_fips(dev[0])
506b2f05
JM		 836 check_altsubject_match_support(dev[0])
837 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
838 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 839 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
9626962d 840 anonymous_identity="ttls", password="password",
5c65e277
JM		 841 ca_cert="auth_serv/ca.der", phase2="auth=CHAP",
842 altsubject_match="EMAIL:noone@example.com;URI:http://example.com/;DNS:server.w1.fi")
75b2b9cf 843 eap_reauth(dev[0], "TTLS")
9626962d 844
82a8f5b5
JM		 845def test_ap_wpa2_eap_ttls_chap_incorrect_password(dev, apdev):
846 """WPA2-Enterprise connection using EAP-TTLS/CHAP - incorrect password"""
ca158ea6 847 skip_with_fips(dev[0])
82a8f5b5
JM		 848 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
849 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
850 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
851 anonymous_identity="ttls", password="wrong",
852 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
853 expect_failure=True)
854 eap_connect(dev[1], apdev[0], "TTLS", "user",
855 anonymous_identity="ttls", password="password",
856 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP",
857 expect_failure=True)
858
9626962d
JM		 859def test_ap_wpa2_eap_ttls_mschap(dev, apdev):
860 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP"""
ca158ea6 861 skip_with_fips(dev[0])
e78eb404 862 check_domain_suffix_match(dev[0])
9626962d 863 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 864 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 865 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
9626962d 866 anonymous_identity="ttls", password="password",
72c052d5
JM		 867 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
868 domain_suffix_match="server.w1.fi")
a8375c94 869 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 870 eap_reauth(dev[0], "TTLS")
6daf5b9c
JM		 871 dev[0].request("REMOVE_NETWORK all")
872 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
873 anonymous_identity="ttls", password="password",
874 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
875 fragment_size="200")
9626962d 876
82a8f5b5 877def test_ap_wpa2_eap_ttls_mschap_incorrect_password(dev, apdev):
ca158ea6
JM		 878 """WPA2-Enterprise connection using EAP-TTLS/MSCHAP - incorrect password"""
879 skip_with_fips(dev[0])
82a8f5b5
JM		 880 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
881 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
882 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
883 anonymous_identity="ttls", password="wrong",
884 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
885 expect_failure=True)
886 eap_connect(dev[1], apdev[0], "TTLS", "user",
887 anonymous_identity="ttls", password="password",
888 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
889 expect_failure=True)
890 eap_connect(dev[2], apdev[0], "TTLS", "no such user",
891 anonymous_identity="ttls", password="password",
892 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
893 expect_failure=True)
894
9626962d
JM		 895def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev):
896 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
e78eb404 897 check_domain_suffix_match(dev[0])
ca158ea6 898 check_eap_capa(dev[0], "MSCHAPV2")
9626962d
JM		 899 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
900 hostapd.add_ap(apdev[0]['ifname'], params)
5dec879d 901 hapd = hostapd.Hostapd(apdev[0]['ifname'])
cb33ee14 902 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
9626962d 903 anonymous_identity="ttls", password="password",
72c052d5 904 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
24579e70 905 domain_suffix_match="server.w1.fi")
a8375c94 906 hwsim_utils.test_connectivity(dev[0], hapd)
5dec879d
JM		 907 sta1 = hapd.get_sta(dev[0].p2p_interface_addr())
908 eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
75b2b9cf 909 eap_reauth(dev[0], "TTLS")
5dec879d
JM		 910 sta2 = hapd.get_sta(dev[0].p2p_interface_addr())
911 eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol")
912 if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']):
913 raise Exception("dot1xAuthEapolFramesRx did not increase")
914 if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1:
915 raise Exception("authAuthEapStartsWhileAuthenticated did not increase")
916 if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']):
917 raise Exception("backendAuthSuccesses did not increase")
9626962d 918
fa0ddb14
JM		 919 logger.info("Password as hash value")
920 dev[0].request("REMOVE_NETWORK all")
921 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
922 anonymous_identity="ttls",
923 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
924 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
925
24579e70
JM		 926def test_ap_wpa2_eap_ttls_mschapv2_suffix_match(dev, apdev):
927 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2"""
928 check_domain_match_full(dev[0])
ca158ea6 929 skip_with_fips(dev[0])
24579e70
JM		 930 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
931 hostapd.add_ap(apdev[0]['ifname'], params)
932 hapd = hostapd.Hostapd(apdev[0]['ifname'])
933 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
934 anonymous_identity="ttls", password="password",
935 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
936 domain_suffix_match="w1.fi")
937 hwsim_utils.test_connectivity(dev[0], hapd)
938 eap_reauth(dev[0], "TTLS")
939
061cbb25
JM		 940def test_ap_wpa2_eap_ttls_mschapv2_domain_match(dev, apdev):
941 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 (domain_match)"""
e78eb404 942 check_domain_match(dev[0])
ca158ea6 943 skip_with_fips(dev[0])
061cbb25
JM		 944 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
945 hostapd.add_ap(apdev[0]['ifname'], params)
946 hapd = hostapd.Hostapd(apdev[0]['ifname'])
947 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
948 anonymous_identity="ttls", password="password",
949 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
950 domain_match="Server.w1.fi")
951 hwsim_utils.test_connectivity(dev[0], hapd)
952 eap_reauth(dev[0], "TTLS")
953
82a8f5b5
JM		 954def test_ap_wpa2_eap_ttls_mschapv2_incorrect_password(dev, apdev):
955 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 - incorrect password"""
ca158ea6 956 skip_with_fips(dev[0])
82a8f5b5
JM		 957 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
958 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
f10ba3b2
JM		 959 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
960 anonymous_identity="ttls", password="password1",
961 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
962 expect_failure=True)
82a8f5b5
JM		 963 eap_connect(dev[1], apdev[0], "TTLS", "user",
964 anonymous_identity="ttls", password="password",
965 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
966 expect_failure=True)
f10ba3b2 967
eac67440
JM		 968def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev):
969 """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 and UTF-8 password"""
ca158ea6 970 skip_with_fips(dev[0])
eac67440
JM		 971 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
972 hostapd.add_ap(apdev[0]['ifname'], params)
973 hapd = hostapd.Hostapd(apdev[0]['ifname'])
974 eap_connect(dev[0], apdev[0], "TTLS", "utf8-user-hash",
975 anonymous_identity="ttls", password="secret-åäö-€-password",
976 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
977 eap_connect(dev[1], apdev[0], "TTLS", "utf8-user",
978 anonymous_identity="ttls",
979 password_hex="hash:bd5844fad2489992da7fe8c5a01559cf",
980 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
0d2a7bad
JM		 981 for p in [ "80", "41c041e04141e041", 257*"41" ]:
982 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
983 eap="TTLS", identity="utf8-user-hash",
984 anonymous_identity="ttls", password_hex=p,
985 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
986 wait_connect=False, scan_freq="2412")
987 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=1)
988 if ev is None:
989 raise Exception("No failure reported")
990 dev[2].request("REMOVE_NETWORK all")
991 dev[2].wait_disconnected()
eac67440 992
9626962d
JM		 993def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev):
994 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC"""
995 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 996 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 997 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 998 anonymous_identity="ttls", password="password",
999 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
a8375c94 1000 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1001 eap_reauth(dev[0], "TTLS")
9626962d 1002
95a15d79
JM		 1003def test_ap_wpa2_eap_ttls_eap_gtc_incorrect_password(dev, apdev):
1004 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - incorrect password"""
1005 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1006 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1007 eap_connect(dev[0], apdev[0], "TTLS", "user",
1008 anonymous_identity="ttls", password="wrong",
1009 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1010 expect_failure=True)
1011
1012def test_ap_wpa2_eap_ttls_eap_gtc_no_password(dev, apdev):
1013 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - no password"""
1014 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1015 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1016 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1017 anonymous_identity="ttls", password="password",
1018 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1019 expect_failure=True)
1020
1021def test_ap_wpa2_eap_ttls_eap_gtc_server_oom(dev, apdev):
1022 """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - server OOM"""
1023 params = int_eap_server_params()
1024 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1025 with alloc_fail(hapd, 1, "eap_gtc_init"):
1026 eap_connect(dev[0], apdev[0], "TTLS", "user",
1027 anonymous_identity="ttls", password="password",
1028 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1029 expect_failure=True)
1030 dev[0].request("REMOVE_NETWORK all")
1031
1032 with alloc_fail(hapd, 1, "eap_gtc_buildReq"):
1033 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1034 eap="TTLS", identity="user",
1035 anonymous_identity="ttls", password="password",
1036 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC",
1037 wait_connect=False, scan_freq="2412")
1038 # This would eventually time out, but we can stop after having reached
1039 # the allocation failure.
1040 for i in range(20):
1041 time.sleep(0.1)
1042 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1043 break
1044
9626962d
JM		 1045def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev):
1046 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5"""
e7ac04ce 1047 check_eap_capa(dev[0], "MD5")
9626962d 1048 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1049 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1050 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 1051 anonymous_identity="ttls", password="password",
1052 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5")
a8375c94 1053 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1054 eap_reauth(dev[0], "TTLS")
9626962d 1055
ee9533eb
JM		 1056def test_ap_wpa2_eap_ttls_eap_md5_incorrect_password(dev, apdev):
1057 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - incorrect password"""
e7ac04ce 1058 check_eap_capa(dev[0], "MD5")
ee9533eb
JM		 1059 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1060 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1061 eap_connect(dev[0], apdev[0], "TTLS", "user",
1062 anonymous_identity="ttls", password="wrong",
1063 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1064 expect_failure=True)
1065
95a15d79
JM		 1066def test_ap_wpa2_eap_ttls_eap_md5_no_password(dev, apdev):
1067 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - no password"""
e7ac04ce 1068 check_eap_capa(dev[0], "MD5")
95a15d79
JM		 1069 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1070 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1071 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1072 anonymous_identity="ttls", password="password",
1073 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1074 expect_failure=True)
1075
ee9533eb
JM		 1076def test_ap_wpa2_eap_ttls_eap_md5_server_oom(dev, apdev):
1077 """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - server OOM"""
e7ac04ce 1078 check_eap_capa(dev[0], "MD5")
ee9533eb
JM		 1079 params = int_eap_server_params()
1080 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1081 with alloc_fail(hapd, 1, "eap_md5_init"):
1082 eap_connect(dev[0], apdev[0], "TTLS", "user",
1083 anonymous_identity="ttls", password="password",
1084 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1085 expect_failure=True)
1086 dev[0].request("REMOVE_NETWORK all")
1087
1088 with alloc_fail(hapd, 1, "eap_md5_buildReq"):
1089 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1090 eap="TTLS", identity="user",
1091 anonymous_identity="ttls", password="password",
1092 ca_cert="auth_serv/ca.pem", phase2="autheap=MD5",
1093 wait_connect=False, scan_freq="2412")
1094 # This would eventually time out, but we can stop after having reached
1095 # the allocation failure.
1096 for i in range(20):
1097 time.sleep(0.1)
1098 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1099 break
1100
9626962d
JM		 1101def test_ap_wpa2_eap_ttls_eap_mschapv2(dev, apdev):
1102 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2"""
e7ac04ce 1103 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1104 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1105 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1106 eap_connect(dev[0], apdev[0], "TTLS", "user",
9626962d
JM		 1107 anonymous_identity="ttls", password="password",
1108 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2")
a8375c94 1109 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1110 eap_reauth(dev[0], "TTLS")
9626962d 1111
f10ba3b2
JM		 1112 logger.info("Negative test with incorrect password")
1113 dev[0].request("REMOVE_NETWORK all")
1114 eap_connect(dev[0], apdev[0], "TTLS", "user",
1115 anonymous_identity="ttls", password="password1",
1116 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1117 expect_failure=True)
1118
95a15d79
JM		 1119def test_ap_wpa2_eap_ttls_eap_mschapv2_no_password(dev, apdev):
1120 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - no password"""
e7ac04ce 1121 check_eap_capa(dev[0], "MSCHAPV2")
95a15d79
JM		 1122 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1123 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1124 eap_connect(dev[0], apdev[0], "TTLS", "user-no-passwd",
1125 anonymous_identity="ttls", password="password",
1126 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1127 expect_failure=True)
1128
ef318402
JM		 1129def test_ap_wpa2_eap_ttls_eap_mschapv2_server_oom(dev, apdev):
1130 """WPA2-Enterprise connection using EAP-TTLS/EAP-MSCHAPv2 - server OOM"""
e7ac04ce 1131 check_eap_capa(dev[0], "MSCHAPV2")
ef318402
JM		 1132 params = int_eap_server_params()
1133 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1134 with alloc_fail(hapd, 1, "eap_mschapv2_init"):
1135 eap_connect(dev[0], apdev[0], "TTLS", "user",
1136 anonymous_identity="ttls", password="password",
1137 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1138 expect_failure=True)
1139 dev[0].request("REMOVE_NETWORK all")
1140
1141 with alloc_fail(hapd, 1, "eap_mschapv2_build_challenge"):
1142 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1143 eap="TTLS", identity="user",
1144 anonymous_identity="ttls", password="password",
1145 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1146 wait_connect=False, scan_freq="2412")
1147 # This would eventually time out, but we can stop after having reached
1148 # the allocation failure.
1149 for i in range(20):
1150 time.sleep(0.1)
1151 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1152 break
1153 dev[0].request("REMOVE_NETWORK all")
1154
1155 with alloc_fail(hapd, 1, "eap_mschapv2_build_success_req"):
1156 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1157 eap="TTLS", identity="user",
1158 anonymous_identity="ttls", password="password",
1159 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1160 wait_connect=False, scan_freq="2412")
1161 # This would eventually time out, but we can stop after having reached
1162 # the allocation failure.
1163 for i in range(20):
1164 time.sleep(0.1)
1165 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1166 break
1167 dev[0].request("REMOVE_NETWORK all")
1168
1169 with alloc_fail(hapd, 1, "eap_mschapv2_build_failure_req"):
1170 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
1171 eap="TTLS", identity="user",
1172 anonymous_identity="ttls", password="wrong",
1173 ca_cert="auth_serv/ca.pem", phase2="autheap=MSCHAPV2",
1174 wait_connect=False, scan_freq="2412")
1175 # This would eventually time out, but we can stop after having reached
1176 # the allocation failure.
1177 for i in range(20):
1178 time.sleep(0.1)
1179 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
1180 break
1181 dev[0].request("REMOVE_NETWORK all")
1182
95fb531c
JM		 1183def test_ap_wpa2_eap_ttls_eap_aka(dev, apdev):
1184 """WPA2-Enterprise connection using EAP-TTLS/EAP-AKA"""
1185 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1186 hostapd.add_ap(apdev[0]['ifname'], params)
1187 eap_connect(dev[0], apdev[0], "TTLS", "0232010000000000",
1188 anonymous_identity="0232010000000000@ttls",
1189 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1190 ca_cert="auth_serv/ca.pem", phase2="autheap=AKA")
1191
1192def test_ap_wpa2_eap_peap_eap_aka(dev, apdev):
1193 """WPA2-Enterprise connection using EAP-PEAP/EAP-AKA"""
1194 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1195 hostapd.add_ap(apdev[0]['ifname'], params)
1196 eap_connect(dev[0], apdev[0], "PEAP", "0232010000000000",
1197 anonymous_identity="0232010000000000@peap",
1198 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1199 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1200
1201def test_ap_wpa2_eap_fast_eap_aka(dev, apdev):
1202 """WPA2-Enterprise connection using EAP-FAST/EAP-AKA"""
3b51cc63 1203 check_eap_capa(dev[0], "FAST")
95fb531c
JM		 1204 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1205 hostapd.add_ap(apdev[0]['ifname'], params)
1206 eap_connect(dev[0], apdev[0], "FAST", "0232010000000000",
1207 anonymous_identity="0232010000000000@fast",
1208 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
1209 phase1="fast_provisioning=2",
1210 pac_file="blob://fast_pac_auth_aka",
1211 ca_cert="auth_serv/ca.pem", phase2="auth=AKA")
1212
9626962d
JM		 1213def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev):
1214 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 1215 check_eap_capa(dev[0], "MSCHAPV2")
9626962d 1216 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1217 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1218 eap_connect(dev[0], apdev[0], "PEAP", "user",
698f8324 1219 anonymous_identity="peap", password="password",
9626962d 1220 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
a8375c94 1221 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1222 eap_reauth(dev[0], "PEAP")
6daf5b9c
JM		 1223 dev[0].request("REMOVE_NETWORK all")
1224 eap_connect(dev[0], apdev[0], "PEAP", "user",
1225 anonymous_identity="peap", password="password",
1226 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1227 fragment_size="200")
c7afc078 1228
fa0ddb14
JM		 1229 logger.info("Password as hash value")
1230 dev[0].request("REMOVE_NETWORK all")
1231 eap_connect(dev[0], apdev[0], "PEAP", "user",
1232 anonymous_identity="peap",
1233 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
1234 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1235
f10ba3b2
JM		 1236 logger.info("Negative test with incorrect password")
1237 dev[0].request("REMOVE_NETWORK all")
1238 eap_connect(dev[0], apdev[0], "PEAP", "user",
1239 anonymous_identity="peap", password="password1",
1240 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1241 expect_failure=True)
1242
0d33f504
JM		 1243def test_ap_wpa2_eap_peap_eap_mschapv2_domain(dev, apdev):
1244 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 with domain"""
e7ac04ce 1245 check_eap_capa(dev[0], "MSCHAPV2")
0d33f504
JM		 1246 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1247 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1248 eap_connect(dev[0], apdev[0], "PEAP", "DOMAIN\user3",
1249 anonymous_identity="peap", password="password",
1250 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
1251 hwsim_utils.test_connectivity(dev[0], hapd)
1252 eap_reauth(dev[0], "PEAP")
1253
f4cd0f64
JM		 1254def test_ap_wpa2_eap_peap_eap_mschapv2_incorrect_password(dev, apdev):
1255 """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 - incorrect password"""
e7ac04ce 1256 check_eap_capa(dev[0], "MSCHAPV2")
f4cd0f64
JM		 1257 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1258 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1259 eap_connect(dev[0], apdev[0], "PEAP", "user",
1260 anonymous_identity="peap", password="wrong",
1261 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1262 expect_failure=True)
1263
698f8324
JM		 1264def test_ap_wpa2_eap_peap_crypto_binding(dev, apdev):
1265 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding"""
e7ac04ce 1266 check_eap_capa(dev[0], "MSCHAPV2")
698f8324 1267 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 1268 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1269 eap_connect(dev[0], apdev[0], "PEAP", "user", password="password",
698f8324
JM		 1270 ca_cert="auth_serv/ca.pem",
1271 phase1="peapver=0 crypto_binding=2",
1272 phase2="auth=MSCHAPV2")
a8375c94 1273 hwsim_utils.test_connectivity(dev[0], hapd)
75b2b9cf 1274 eap_reauth(dev[0], "PEAP")
698f8324 1275
ea6464b0
JM		 1276 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
1277 ca_cert="auth_serv/ca.pem",
1278 phase1="peapver=0 crypto_binding=1",
1279 phase2="auth=MSCHAPV2")
1280 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
1281 ca_cert="auth_serv/ca.pem",
1282 phase1="peapver=0 crypto_binding=0",
1283 phase2="auth=MSCHAPV2")
1284
ef318402
JM		 1285def test_ap_wpa2_eap_peap_crypto_binding_server_oom(dev, apdev):
1286 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and crypto binding with server OOM"""
e7ac04ce 1287 check_eap_capa(dev[0], "MSCHAPV2")
ef318402
JM		 1288 params = int_eap_server_params()
1289 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1290 with alloc_fail(hapd, 1, "eap_mschapv2_getKey"):
1291 eap_connect(dev[0], apdev[0], "PEAP", "user", password="password",
1292 ca_cert="auth_serv/ca.pem",
1293 phase1="peapver=0 crypto_binding=2",
1294 phase2="auth=MSCHAPV2",
1295 expect_failure=True, local_error_report=True)
1296
c4d37011
JM		 1297def test_ap_wpa2_eap_peap_params(dev, apdev):
1298 """WPA2-Enterprise connection using EAP-PEAPv0/EAP-MSCHAPv2 and various parameters"""
e7ac04ce 1299 check_eap_capa(dev[0], "MSCHAPV2")
c4d37011
JM		 1300 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1301 hostapd.add_ap(apdev[0]['ifname'], params)
1302 eap_connect(dev[0], apdev[0], "PEAP", "user",
1303 anonymous_identity="peap", password="password",
1304 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1305 phase1="peapver=0 peaplabel=1",
1306 expect_failure=True)
1307 dev[0].request("REMOVE_NETWORK all")
1308 eap_connect(dev[1], apdev[0], "PEAP", "user", password="password",
1309 ca_cert="auth_serv/ca.pem",
1310 phase1="peap_outer_success=1",
1311 phase2="auth=MSCHAPV2")
1312 eap_connect(dev[2], apdev[0], "PEAP", "user", password="password",
1313 ca_cert="auth_serv/ca.pem",
1314 phase1="peap_outer_success=2",
1315 phase2="auth=MSCHAPV2")
1316 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PEAP",
1317 identity="user",
1318 anonymous_identity="peap", password="password",
1319 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
1320 phase1="peapver=1 peaplabel=1",
1321 wait_connect=False, scan_freq="2412")
1322 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
1323 if ev is None:
1324 raise Exception("No EAP success seen")
1325 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
1326 if ev is not None:
1327 raise Exception("Unexpected connection")
1328
d0ce1050
JM		 1329def test_ap_wpa2_eap_peap_eap_tls(dev, apdev):
1330 """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS"""
1331 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1332 hostapd.add_ap(apdev[0]['ifname'], params)
1333 eap_connect(dev[0], apdev[0], "PEAP", "cert user",
1334 ca_cert="auth_serv/ca.pem", phase2="auth=TLS",
1335 ca_cert2="auth_serv/ca.pem",
1336 client_cert2="auth_serv/user.pem",
1337 private_key2="auth_serv/user.key")
1338 eap_reauth(dev[0], "PEAP")
1339
e114c49c
JM		 1340def test_ap_wpa2_eap_tls(dev, apdev):
1341 """WPA2-Enterprise connection using EAP-TLS"""
1342 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1343 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1344 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
e114c49c
JM		 1345 client_cert="auth_serv/user.pem",
1346 private_key="auth_serv/user.key")
75b2b9cf 1347 eap_reauth(dev[0], "TLS")
e114c49c 1348
96bf8fe1
JM		 1349def test_eap_tls_pkcs8_pkcs5_v2_des3(dev, apdev):
1350 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v2 DES3 key"""
1351 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1352 hostapd.add_ap(apdev[0]['ifname'], params)
1353 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1354 client_cert="auth_serv/user.pem",
1355 private_key="auth_serv/user.key.pkcs8",
1356 private_key_passwd="whatever")
1357
1358def test_eap_tls_pkcs8_pkcs5_v15(dev, apdev):
1359 """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v1.5 key"""
1360 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1361 hostapd.add_ap(apdev[0]['ifname'], params)
1362 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1363 client_cert="auth_serv/user.pem",
1364 private_key="auth_serv/user.key.pkcs8.pkcs5v15",
1365 private_key_passwd="whatever")
1366
6ea231e6
JM		 1367def test_ap_wpa2_eap_tls_blob(dev, apdev):
1368 """WPA2-Enterprise connection using EAP-TLS and config blobs"""
1369 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1370 hostapd.add_ap(apdev[0]['ifname'], params)
1371 cert = read_pem("auth_serv/ca.pem")
1372 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1373 raise Exception("Could not set cacert blob")
1374 cert = read_pem("auth_serv/user.pem")
1375 if "OK" not in dev[0].request("SET blob usercert " + cert.encode("hex")):
1376 raise Exception("Could not set usercert blob")
62750c3e 1377 key = read_pem("auth_serv/user.rsa-key")
6ea231e6
JM		 1378 if "OK" not in dev[0].request("SET blob userkey " + key.encode("hex")):
1379 raise Exception("Could not set cacert blob")
1380 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
1381 client_cert="blob://usercert",
1382 private_key="blob://userkey")
1383
2d10eb0e
JM		 1384def test_ap_wpa2_eap_tls_pkcs12(dev, apdev):
1385 """WPA2-Enterprise connection using EAP-TLS and PKCS#12"""
686eee77 1386 check_pkcs12_support(dev[0])
2d10eb0e
JM		 1387 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1388 hostapd.add_ap(apdev[0]['ifname'], params)
1389 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
1390 private_key="auth_serv/user.pkcs12",
1391 private_key_passwd="whatever")
1392 dev[0].request("REMOVE_NETWORK all")
0c83ae04
JM		 1393 dev[0].wait_disconnected()
1394
2d10eb0e
JM		 1395 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
1396 identity="tls user",
1397 ca_cert="auth_serv/ca.pem",
1398 private_key="auth_serv/user.pkcs12",
1399 wait_connect=False, scan_freq="2412")
1400 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"])
1401 if ev is None:
1402 raise Exception("Request for private key passphrase timed out")
1403 id = ev.split(':')[0].split('-')[-1]
1404 dev[0].request("CTRL-RSP-PASSPHRASE-" + id + ":whatever")
5f35a5e2 1405 dev[0].wait_connected(timeout=10)
0c83ae04
JM		 1406 dev[0].request("REMOVE_NETWORK all")
1407 dev[0].wait_disconnected()
1408
6da3b745
JM		 1409 # Run this twice to verify certificate chain handling with OpenSSL. Use two
1410 # different files to cover both cases of the extra certificate being the
1411 # one that signed the client certificate and it being unrelated to the
1412 # client certificate.
1413 for pkcs12 in "auth_serv/user2.pkcs12", "auth_serv/user3.pkcs12":
1414 for i in range(2):
1415 eap_connect(dev[0], apdev[0], "TLS", "tls user",
1416 ca_cert="auth_serv/ca.pem",
1417 private_key=pkcs12,
1418 private_key_passwd="whatever")
1419 dev[0].request("REMOVE_NETWORK all")
1420 dev[0].wait_disconnected()
2d10eb0e 1421
6ea231e6
JM		 1422def test_ap_wpa2_eap_tls_pkcs12_blob(dev, apdev):
1423 """WPA2-Enterprise connection using EAP-TLS and PKCS#12 from configuration blob"""
686eee77 1424 check_pkcs12_support(dev[0])
6ea231e6
JM		 1425 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1426 hostapd.add_ap(apdev[0]['ifname'], params)
1427 cert = read_pem("auth_serv/ca.pem")
1428 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1429 raise Exception("Could not set cacert blob")
1430 with open("auth_serv/user.pkcs12", "rb") as f:
1431 if "OK" not in dev[0].request("SET blob pkcs12 " + f.read().encode("hex")):
1432 raise Exception("Could not set pkcs12 blob")
1433 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="blob://cacert",
1434 private_key="blob://pkcs12",
1435 private_key_passwd="whatever")
1436
c7afc078
JM		 1437def test_ap_wpa2_eap_tls_neg_incorrect_trust_root(dev, apdev):
1438 """WPA2-Enterprise negative test - incorrect trust root"""
e7ac04ce 1439 check_eap_capa(dev[0], "MSCHAPV2")
c7afc078
JM		 1440 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1441 hostapd.add_ap(apdev[0]['ifname'], params)
6ea231e6
JM		 1442 cert = read_pem("auth_serv/ca-incorrect.pem")
1443 if "OK" not in dev[0].request("SET blob cacert " + cert.encode("hex")):
1444 raise Exception("Could not set cacert blob")
c7afc078 1445 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
6ea231e6
JM		 1446 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1447 password="password", phase2="auth=MSCHAPV2",
1448 ca_cert="blob://cacert",
1449 wait_connect=False, scan_freq="2412")
1450 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
c7afc078
JM		 1451 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1452 password="password", phase2="auth=MSCHAPV2",
1453 ca_cert="auth_serv/ca-incorrect.pem",
c65f23ab 1454 wait_connect=False, scan_freq="2412")
c7afc078 1455
6ea231e6
JM		 1456 for dev in (dev[0], dev[1]):
1457 ev = dev.wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1458 if ev is None:
1459 raise Exception("Association and EAP start timed out")
c7afc078 1460
6ea231e6
JM		 1461 ev = dev.wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1462 if ev is None:
1463 raise Exception("EAP method selection timed out")
1464 if "TTLS" not in ev:
1465 raise Exception("Unexpected EAP method")
1466
1467 ev = dev.wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1468 "CTRL-EVENT-EAP-SUCCESS",
1469 "CTRL-EVENT-EAP-FAILURE",
1470 "CTRL-EVENT-CONNECTED",
1471 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1472 if ev is None:
1473 raise Exception("EAP result timed out")
1474 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1475 raise Exception("TLS certificate error not reported")
1476
1477 ev = dev.wait_event(["CTRL-EVENT-EAP-SUCCESS",
1478 "CTRL-EVENT-EAP-FAILURE",
1479 "CTRL-EVENT-CONNECTED",
1480 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1481 if ev is None:
1482 raise Exception("EAP result(2) timed out")
1483 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1484 raise Exception("EAP failure not reported")
c7afc078 1485
6ea231e6
JM		 1486 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
1487 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1488 if ev is None:
1489 raise Exception("EAP result(3) timed out")
1490 if "CTRL-EVENT-DISCONNECTED" not in ev:
1491 raise Exception("Disconnection not reported")
c7afc078 1492
6ea231e6
JM		 1493 ev = dev.wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1494 if ev is None:
1495 raise Exception("Network block disabling not reported")
72c052d5 1496
9a5cfd70
JM		 1497def test_ap_wpa2_eap_tls_diff_ca_trust(dev, apdev):
1498 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1499 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1500 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1501 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1502 identity="pap user", anonymous_identity="ttls",
1503 password="password", phase2="auth=PAP",
1504 ca_cert="auth_serv/ca.pem",
1505 wait_connect=True, scan_freq="2412")
1506 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1507 identity="pap user", anonymous_identity="ttls",
1508 password="password", phase2="auth=PAP",
1509 ca_cert="auth_serv/ca-incorrect.pem",
1510 only_add_network=True, scan_freq="2412")
1511
1512 dev[0].request("DISCONNECT")
90ad11e6 1513 dev[0].wait_disconnected()
9a5cfd70
JM		 1514 dev[0].dump_monitor()
1515 dev[0].select_network(id, freq="2412")
1516
1517 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1518 if ev is None:
1519 raise Exception("EAP-TTLS not re-started")
1520
5f35a5e2 1521 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1522 if "reason=23" not in ev:
1523 raise Exception("Proper reason code for disconnection not reported")
1524
1525def test_ap_wpa2_eap_tls_diff_ca_trust2(dev, apdev):
1526 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1527 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1528 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1529 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1530 identity="pap user", anonymous_identity="ttls",
1531 password="password", phase2="auth=PAP",
1532 wait_connect=True, scan_freq="2412")
1533 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1534 identity="pap user", anonymous_identity="ttls",
1535 password="password", phase2="auth=PAP",
1536 ca_cert="auth_serv/ca-incorrect.pem",
1537 only_add_network=True, scan_freq="2412")
1538
1539 dev[0].request("DISCONNECT")
90ad11e6 1540 dev[0].wait_disconnected()
9a5cfd70
JM		 1541 dev[0].dump_monitor()
1542 dev[0].select_network(id, freq="2412")
1543
1544 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1545 if ev is None:
1546 raise Exception("EAP-TTLS not re-started")
1547
5f35a5e2 1548 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1549 if "reason=23" not in ev:
1550 raise Exception("Proper reason code for disconnection not reported")
1551
1552def test_ap_wpa2_eap_tls_diff_ca_trust3(dev, apdev):
1553 """WPA2-Enterprise connection using EAP-TTLS/PAP and different CA trust"""
1554 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1555 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
1556 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1557 identity="pap user", anonymous_identity="ttls",
1558 password="password", phase2="auth=PAP",
1559 ca_cert="auth_serv/ca.pem",
1560 wait_connect=True, scan_freq="2412")
1561 dev[0].request("DISCONNECT")
90ad11e6 1562 dev[0].wait_disconnected()
9a5cfd70
JM		 1563 dev[0].dump_monitor()
1564 dev[0].set_network_quoted(id, "ca_cert", "auth_serv/ca-incorrect.pem")
1565 dev[0].select_network(id, freq="2412")
1566
1567 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=21"], timeout=15)
1568 if ev is None:
1569 raise Exception("EAP-TTLS not re-started")
1570
5f35a5e2 1571 ev = dev[0].wait_disconnected(timeout=15)
9a5cfd70
JM		 1572 if "reason=23" not in ev:
1573 raise Exception("Proper reason code for disconnection not reported")
1574
72c052d5
JM		 1575def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev):
1576 """WPA2-Enterprise negative test - domain suffix mismatch"""
e78eb404 1577 check_domain_suffix_match(dev[0])
72c052d5
JM		 1578 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1579 hostapd.add_ap(apdev[0]['ifname'], params)
1580 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1581 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1582 password="password", phase2="auth=MSCHAPV2",
1583 ca_cert="auth_serv/ca.pem",
1584 domain_suffix_match="incorrect.example.com",
c65f23ab 1585 wait_connect=False, scan_freq="2412")
72c052d5
JM		 1586
1587 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1588 if ev is None:
1589 raise Exception("Association and EAP start timed out")
1590
1591 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1592 if ev is None:
1593 raise Exception("EAP method selection timed out")
1594 if "TTLS" not in ev:
1595 raise Exception("Unexpected EAP method")
1596
1597 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1598 "CTRL-EVENT-EAP-SUCCESS",
1599 "CTRL-EVENT-EAP-FAILURE",
1600 "CTRL-EVENT-CONNECTED",
1601 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1602 if ev is None:
1603 raise Exception("EAP result timed out")
1604 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1605 raise Exception("TLS certificate error not reported")
1606 if "Domain suffix mismatch" not in ev:
1607 raise Exception("Domain suffix mismatch not reported")
1608
1609 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1610 "CTRL-EVENT-EAP-FAILURE",
1611 "CTRL-EVENT-CONNECTED",
1612 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1613 if ev is None:
1614 raise Exception("EAP result(2) timed out")
1615 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1616 raise Exception("EAP failure not reported")
1617
1618 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1619 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1620 if ev is None:
1621 raise Exception("EAP result(3) timed out")
1622 if "CTRL-EVENT-DISCONNECTED" not in ev:
1623 raise Exception("Disconnection not reported")
1624
1625 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1626 if ev is None:
1627 raise Exception("Network block disabling not reported")
22b99086 1628
061cbb25
JM		 1629def test_ap_wpa2_eap_tls_neg_domain_match(dev, apdev):
1630 """WPA2-Enterprise negative test - domain mismatch"""
e78eb404 1631 check_domain_match(dev[0])
061cbb25
JM		 1632 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1633 hostapd.add_ap(apdev[0]['ifname'], params)
1634 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1635 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1636 password="password", phase2="auth=MSCHAPV2",
1637 ca_cert="auth_serv/ca.pem",
1638 domain_match="w1.fi",
1639 wait_connect=False, scan_freq="2412")
1640
1641 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1642 if ev is None:
1643 raise Exception("Association and EAP start timed out")
1644
1645 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
1646 if ev is None:
1647 raise Exception("EAP method selection timed out")
1648 if "TTLS" not in ev:
1649 raise Exception("Unexpected EAP method")
1650
1651 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1652 "CTRL-EVENT-EAP-SUCCESS",
1653 "CTRL-EVENT-EAP-FAILURE",
1654 "CTRL-EVENT-CONNECTED",
1655 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1656 if ev is None:
1657 raise Exception("EAP result timed out")
1658 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1659 raise Exception("TLS certificate error not reported")
1660 if "Domain mismatch" not in ev:
1661 raise Exception("Domain mismatch not reported")
1662
1663 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1664 "CTRL-EVENT-EAP-FAILURE",
1665 "CTRL-EVENT-CONNECTED",
1666 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1667 if ev is None:
1668 raise Exception("EAP result(2) timed out")
1669 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1670 raise Exception("EAP failure not reported")
1671
1672 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1673 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1674 if ev is None:
1675 raise Exception("EAP result(3) timed out")
1676 if "CTRL-EVENT-DISCONNECTED" not in ev:
1677 raise Exception("Disconnection not reported")
1678
1679 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1680 if ev is None:
1681 raise Exception("Network block disabling not reported")
1682
3b74982f
JM		 1683def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev):
1684 """WPA2-Enterprise negative test - subject mismatch"""
1685 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1686 hostapd.add_ap(apdev[0]['ifname'], params)
1687 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1688 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1689 password="password", phase2="auth=MSCHAPV2",
1690 ca_cert="auth_serv/ca.pem",
1691 subject_match="/C=FI/O=w1.fi/CN=example.com",
1692 wait_connect=False, scan_freq="2412")
1693
1694 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1695 if ev is None:
1696 raise Exception("Association and EAP start timed out")
1697
506b2f05
JM		 1698 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
1699 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 1700 if ev is None:
1701 raise Exception("EAP method selection timed out")
506b2f05
JM		 1702 if "EAP: Failed to initialize EAP method" in ev:
1703 tls = dev[0].request("GET tls_library")
1704 if tls.startswith("OpenSSL"):
1705 raise Exception("Failed to select EAP method")
1706 logger.info("subject_match not supported - connection failed, so test succeeded")
1707 return
3b74982f
JM		 1708 if "TTLS" not in ev:
1709 raise Exception("Unexpected EAP method")
1710
1711 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1712 "CTRL-EVENT-EAP-SUCCESS",
1713 "CTRL-EVENT-EAP-FAILURE",
1714 "CTRL-EVENT-CONNECTED",
1715 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1716 if ev is None:
1717 raise Exception("EAP result timed out")
1718 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1719 raise Exception("TLS certificate error not reported")
1720 if "Subject mismatch" not in ev:
1721 raise Exception("Subject mismatch not reported")
1722
1723 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1724 "CTRL-EVENT-EAP-FAILURE",
1725 "CTRL-EVENT-CONNECTED",
1726 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1727 if ev is None:
1728 raise Exception("EAP result(2) timed out")
1729 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1730 raise Exception("EAP failure not reported")
1731
1732 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1733 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1734 if ev is None:
1735 raise Exception("EAP result(3) timed out")
1736 if "CTRL-EVENT-DISCONNECTED" not in ev:
1737 raise Exception("Disconnection not reported")
1738
1739 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1740 if ev is None:
1741 raise Exception("Network block disabling not reported")
1742
1743def test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev):
1744 """WPA2-Enterprise negative test - altsubject mismatch"""
1745 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1746 hostapd.add_ap(apdev[0]['ifname'], params)
37d61355
JM		 1747
1748 tests = [ "incorrect.example.com",
1749 "DNS:incorrect.example.com",
1750 "DNS:w1.fi",
1751 "DNS:erver.w1.fi" ]
1752 for match in tests:
1753 _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match)
1754
1755def _test_ap_wpa2_eap_tls_neg_altsubject_match(dev, apdev, match):
3b74982f
JM		 1756 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1757 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1758 password="password", phase2="auth=MSCHAPV2",
1759 ca_cert="auth_serv/ca.pem",
37d61355 1760 altsubject_match=match,
3b74982f
JM		 1761 wait_connect=False, scan_freq="2412")
1762
1763 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1764 if ev is None:
1765 raise Exception("Association and EAP start timed out")
1766
506b2f05
JM		 1767 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD",
1768 "EAP: Failed to initialize EAP method"], timeout=10)
3b74982f
JM		 1769 if ev is None:
1770 raise Exception("EAP method selection timed out")
506b2f05
JM		 1771 if "EAP: Failed to initialize EAP method" in ev:
1772 tls = dev[0].request("GET tls_library")
1773 if tls.startswith("OpenSSL"):
1774 raise Exception("Failed to select EAP method")
1775 logger.info("altsubject_match not supported - connection failed, so test succeeded")
1776 return
3b74982f
JM		 1777 if "TTLS" not in ev:
1778 raise Exception("Unexpected EAP method")
1779
1780 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR",
1781 "CTRL-EVENT-EAP-SUCCESS",
1782 "CTRL-EVENT-EAP-FAILURE",
1783 "CTRL-EVENT-CONNECTED",
1784 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1785 if ev is None:
1786 raise Exception("EAP result timed out")
1787 if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev:
1788 raise Exception("TLS certificate error not reported")
1789 if "AltSubject mismatch" not in ev:
1790 raise Exception("altsubject mismatch not reported")
1791
1792 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
1793 "CTRL-EVENT-EAP-FAILURE",
1794 "CTRL-EVENT-CONNECTED",
1795 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1796 if ev is None:
1797 raise Exception("EAP result(2) timed out")
1798 if "CTRL-EVENT-EAP-FAILURE" not in ev:
1799 raise Exception("EAP failure not reported")
1800
1801 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
1802 "CTRL-EVENT-DISCONNECTED"], timeout=10)
1803 if ev is None:
1804 raise Exception("EAP result(3) timed out")
1805 if "CTRL-EVENT-DISCONNECTED" not in ev:
1806 raise Exception("Disconnection not reported")
1807
1808 ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10)
1809 if ev is None:
1810 raise Exception("Network block disabling not reported")
1811
37d61355
JM		 1812 dev[0].request("REMOVE_NETWORK all")
1813
5a0c1517
JM		 1814def test_ap_wpa2_eap_unauth_tls(dev, apdev):
1815 """WPA2-Enterprise connection using UNAUTH-TLS"""
1816 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1817 hostapd.add_ap(apdev[0]['ifname'], params)
1818 eap_connect(dev[0], apdev[0], "UNAUTH-TLS", "unauth-tls",
1819 ca_cert="auth_serv/ca.pem")
1820 eap_reauth(dev[0], "UNAUTH-TLS")
1821
57be05e1
JM		 1822def test_ap_wpa2_eap_ttls_server_cert_hash(dev, apdev):
1823 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash"""
4bf4e9db 1824 check_cert_probe_support(dev[0])
ca158ea6 1825 skip_with_fips(dev[0])
403610d3 1826 srv_cert_hash = "e75bd454c7b02d312e5006d75067c28ffa5baea422effeb2bbd572179cd000ca"
57be05e1
JM		 1827 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1828 hostapd.add_ap(apdev[0]['ifname'], params)
1829 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1830 identity="probe", ca_cert="probe://",
1831 wait_connect=False, scan_freq="2412")
1832 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1833 if ev is None:
1834 raise Exception("Association and EAP start timed out")
1835 ev = dev[0].wait_event(["CTRL-EVENT-EAP-PEER-CERT depth=0"], timeout=10)
1836 if ev is None:
1837 raise Exception("No peer server certificate event seen")
1838 if "hash=" + srv_cert_hash not in ev:
1839 raise Exception("Expected server certificate hash not reported")
1840 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1841 if ev is None:
1842 raise Exception("EAP result timed out")
1843 if "Server certificate chain probe" not in ev:
1844 raise Exception("Server certificate probe not reported")
5f35a5e2 1845 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 1846 dev[0].request("REMOVE_NETWORK all")
1847
1848 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1849 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1850 password="password", phase2="auth=MSCHAPV2",
1851 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1852 wait_connect=False, scan_freq="2412")
1853 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1854 if ev is None:
1855 raise Exception("Association and EAP start timed out")
1856 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"], timeout=10)
1857 if ev is None:
1858 raise Exception("EAP result timed out")
1859 if "Server certificate mismatch" not in ev:
1860 raise Exception("Server certificate mismatch not reported")
5f35a5e2 1861 dev[0].wait_disconnected(timeout=10)
57be05e1
JM		 1862 dev[0].request("REMOVE_NETWORK all")
1863
1864 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
1865 anonymous_identity="ttls", password="password",
1866 ca_cert="hash://server/sha256/" + srv_cert_hash,
1867 phase2="auth=MSCHAPV2")
1868
2a6a2192
JM		 1869def test_ap_wpa2_eap_ttls_server_cert_hash_invalid(dev, apdev):
1870 """WPA2-Enterprise connection using EAP-TTLS and server certificate hash (invalid config)"""
1871 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1872 hostapd.add_ap(apdev[0]['ifname'], params)
1873 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1874 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1875 password="password", phase2="auth=MSCHAPV2",
1876 ca_cert="hash://server/md5/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6a",
1877 wait_connect=False, scan_freq="2412")
1878 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1879 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1880 password="password", phase2="auth=MSCHAPV2",
1881 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca",
1882 wait_connect=False, scan_freq="2412")
1883 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
1884 identity="DOMAIN\mschapv2 user", anonymous_identity="ttls",
1885 password="password", phase2="auth=MSCHAPV2",
1886 ca_cert="hash://server/sha256/5a1bc1296205e6fdbe3979728efe3920798885c1c4590b5f90f43222d239ca6Q",
1887 wait_connect=False, scan_freq="2412")
1888 for i in range(0, 3):
1889 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
1890 if ev is None:
1891 raise Exception("Association and EAP start timed out")
cbb85a03
JM		 1892 ev = dev[i].wait_event(["EAP: Failed to initialize EAP method: vendor 0 method 21 (TTLS)"], timeout=5)
1893 if ev is None:
1894 raise Exception("Did not report EAP method initialization failure")
2a6a2192 1895
22b99086
JM		 1896def test_ap_wpa2_eap_pwd(dev, apdev):
1897 """WPA2-Enterprise connection using EAP-pwd"""
3b51cc63 1898 check_eap_capa(dev[0], "PWD")
22b99086
JM		 1899 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1900 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1901 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
75b2b9cf 1902 eap_reauth(dev[0], "PWD")
6daf5b9c 1903 dev[0].request("REMOVE_NETWORK all")
0403fa0a
JM		 1904
1905 eap_connect(dev[1], apdev[0], "PWD",
1906 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
1907 password="secret password",
6daf5b9c
JM		 1908 fragment_size="90")
1909
f10ba3b2 1910 logger.info("Negative test with incorrect password")
0403fa0a 1911 eap_connect(dev[2], apdev[0], "PWD", "pwd user", password="secret-password",
f10ba3b2
JM		 1912 expect_failure=True, local_error_report=True)
1913
0403fa0a
JM		 1914 eap_connect(dev[0], apdev[0], "PWD",
1915 "pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com",
1916 password="secret password",
1917 fragment_size="31")
1918
b898a6ee
JM		 1919def test_ap_wpa2_eap_pwd_nthash(dev, apdev):
1920 """WPA2-Enterprise connection using EAP-pwd and NTHash"""
1921 check_eap_capa(dev[0], "PWD")
0392867b 1922 skip_with_fips(dev[0])
b898a6ee
JM		 1923 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1924 hostapd.add_ap(apdev[0]['ifname'], params)
1925 eap_connect(dev[0], apdev[0], "PWD", "pwd-hash", password="secret password")
1926 eap_connect(dev[1], apdev[0], "PWD", "pwd-hash",
1927 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a")
1928 eap_connect(dev[2], apdev[0], "PWD", "pwd user",
1929 password_hex="hash:e3718ece8ab74792cbbfffd316d2d19a",
1930 expect_failure=True, local_error_report=True)
1931
c075f040
JM		 1932def test_ap_wpa2_eap_pwd_groups(dev, apdev):
1933 """WPA2-Enterprise connection using various EAP-pwd groups"""
3b51cc63 1934 check_eap_capa(dev[0], "PWD")
5f2e4547 1935 tls = dev[0].request("GET tls_library")
c075f040
JM		 1936 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1937 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1938 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
f2d789f2
JM		 1939 groups = [ 19, 20, 21, 25, 26 ]
1940 if tls.startswith("OpenSSL") and "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
1941 logger.info("Add Brainpool EC groups since OpenSSL is new enough")
1942 groups += [ 27, 28, 29, 30 ]
1943 for i in groups:
1944 logger.info("Group %d" % i)
c075f040
JM		 1945 params['pwd_group'] = str(i)
1946 hostapd.add_ap(apdev[0]['ifname'], params)
5f2e4547
JM		 1947 try:
1948 eap_connect(dev[0], apdev[0], "PWD", "pwd user",
1949 password="secret password")
f2d789f2
JM		 1950 dev[0].request("REMOVE_NETWORK all")
1951 dev[0].wait_disconnected()
1952 dev[0].dump_monitor()
5f2e4547
JM		 1953 except:
1954 if "BoringSSL" in tls and i in [ 25 ]:
1955 logger.info("Ignore connection failure with group %d with BoringSSL" % i)
1956 dev[0].request("DISCONNECT")
1957 time.sleep(0.1)
f2d789f2
JM		 1958 dev[0].request("REMOVE_NETWORK all")
1959 dev[0].dump_monitor()
5f2e4547
JM		 1960 continue
1961 raise
c075f040 1962
4b2d2098
JM		 1963def test_ap_wpa2_eap_pwd_invalid_group(dev, apdev):
1964 """WPA2-Enterprise connection using invalid EAP-pwd group"""
3b51cc63 1965 check_eap_capa(dev[0], "PWD")
4b2d2098
JM		 1966 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1967 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1968 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf" }
1969 params['pwd_group'] = "0"
1970 hostapd.add_ap(apdev[0]['ifname'], params)
1971 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PWD",
1972 identity="pwd user", password="secret password",
1973 scan_freq="2412", wait_connect=False)
1974 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
1975 if ev is None:
1976 raise Exception("Timeout on EAP failure report")
1977
8ba89e0a
JM		 1978def test_ap_wpa2_eap_pwd_as_frag(dev, apdev):
1979 """WPA2-Enterprise connection using EAP-pwd with server fragmentation"""
3b51cc63 1980 check_eap_capa(dev[0], "PWD")
8ba89e0a
JM		 1981 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1982 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
1983 "rsn_pairwise": "CCMP", "ieee8021x": "1",
1984 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
1985 "pwd_group": "19", "fragment_size": "40" }
1986 hostapd.add_ap(apdev[0]['ifname'], params)
1987 eap_connect(dev[0], apdev[0], "PWD", "pwd user", password="secret password")
1988
22b99086
JM		 1989def test_ap_wpa2_eap_gpsk(dev, apdev):
1990 """WPA2-Enterprise connection using EAP-GPSK"""
1991 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
1992 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 1993 id = eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
369f9c20 1994 password="abcdefghijklmnop0123456789abcdef")
75b2b9cf 1995 eap_reauth(dev[0], "GPSK")
22b99086 1996
369f9c20
JM		 1997 logger.info("Test forced algorithm selection")
1998 for phase1 in [ "cipher=1", "cipher=2" ]:
1999 dev[0].set_network_quoted(id, "phase1", phase1)
2000 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2001 if ev is None:
2002 raise Exception("EAP success timed out")
5f35a5e2 2003 dev[0].wait_connected(timeout=10)
369f9c20
JM		 2004
2005 logger.info("Test failed algorithm negotiation")
2006 dev[0].set_network_quoted(id, "phase1", "cipher=9")
2007 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2008 if ev is None:
2009 raise Exception("EAP failure timed out")
2010
f10ba3b2
JM		 2011 logger.info("Negative test with incorrect password")
2012 dev[0].request("REMOVE_NETWORK all")
2013 eap_connect(dev[0], apdev[0], "GPSK", "gpsk user",
2014 password="ffcdefghijklmnop0123456789abcdef",
2015 expect_failure=True)
2016
22b99086
JM		 2017def test_ap_wpa2_eap_sake(dev, apdev):
2018 """WPA2-Enterprise connection using EAP-SAKE"""
2019 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2020 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2021 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
22b99086 2022 password_hex="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
75b2b9cf 2023 eap_reauth(dev[0], "SAKE")
22b99086 2024
f10ba3b2
JM		 2025 logger.info("Negative test with incorrect password")
2026 dev[0].request("REMOVE_NETWORK all")
2027 eap_connect(dev[0], apdev[0], "SAKE", "sake user",
2028 password_hex="ff23456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
2029 expect_failure=True)
2030
22b99086
JM		 2031def test_ap_wpa2_eap_eke(dev, apdev):
2032 """WPA2-Enterprise connection using EAP-EKE"""
2033 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2034 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2035 id = eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello")
75b2b9cf 2036 eap_reauth(dev[0], "EKE")
22b99086 2037
2bb9e283
JM		 2038 logger.info("Test forced algorithm selection")
2039 for phase1 in [ "dhgroup=5 encr=1 prf=2 mac=2",
2040 "dhgroup=4 encr=1 prf=2 mac=2",
2041 "dhgroup=3 encr=1 prf=2 mac=2",
2042 "dhgroup=3 encr=1 prf=1 mac=1" ]:
2043 dev[0].set_network_quoted(id, "phase1", phase1)
2044 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
2045 if ev is None:
2046 raise Exception("EAP success timed out")
5f35a5e2 2047 dev[0].wait_connected(timeout=10)
2bb9e283
JM		 2048
2049 logger.info("Test failed algorithm negotiation")
2050 dev[0].set_network_quoted(id, "phase1", "dhgroup=9 encr=9 prf=9 mac=9")
2051 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2052 if ev is None:
2053 raise Exception("EAP failure timed out")
2054
f10ba3b2
JM		 2055 logger.info("Negative test with incorrect password")
2056 dev[0].request("REMOVE_NETWORK all")
2057 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello1",
2058 expect_failure=True)
2059
f7e3c17b
JM		 2060def test_ap_wpa2_eap_eke_serverid_nai(dev, apdev):
2061 """WPA2-Enterprise connection using EAP-EKE with serverid NAI"""
2062 params = int_eap_server_params()
2063 params['server_id'] = 'example.server@w1.fi'
2064 hostapd.add_ap(apdev[0]['ifname'], params)
2065 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello")
2066
5e0bedc6
JM		 2067def test_ap_wpa2_eap_eke_server_oom(dev, apdev):
2068 """WPA2-Enterprise connection using EAP-EKE with server OOM"""
2069 params = int_eap_server_params()
2070 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2071 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
2072
2073 for count,func in [ (1, "eap_eke_build_commit"),
2074 (2, "eap_eke_build_commit"),
2075 (3, "eap_eke_build_commit"),
2076 (1, "eap_eke_build_confirm"),
2077 (2, "eap_eke_build_confirm"),
2078 (1, "eap_eke_process_commit"),
2079 (2, "eap_eke_process_commit"),
2080 (1, "eap_eke_process_confirm"),
2081 (1, "eap_eke_process_identity"),
2082 (2, "eap_eke_process_identity"),
2083 (3, "eap_eke_process_identity"),
2084 (4, "eap_eke_process_identity") ]:
2085 with alloc_fail(hapd, count, func):
2086 eap_connect(dev[0], apdev[0], "EKE", "eke user", password="hello",
2087 expect_failure=True)
2088 dev[0].request("REMOVE_NETWORK all")
2089
2090 for count,func,pw in [ (1, "eap_eke_init", "hello"),
2091 (1, "eap_eke_get_session_id", "hello"),
2092 (1, "eap_eke_getKey", "hello"),
2093 (1, "eap_eke_build_msg", "hello"),
2094 (1, "eap_eke_build_failure", "wrong"),
2095 (1, "eap_eke_build_identity", "hello"),
2096 (2, "eap_eke_build_identity", "hello") ]:
2097 with alloc_fail(hapd, count, func):
2098 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
2099 eap="EKE", identity="eke user", password=pw,
2100 wait_connect=False, scan_freq="2412")
2101 # This would eventually time out, but we can stop after having
2102 # reached the allocation failure.
2103 for i in range(20):
2104 time.sleep(0.1)
2105 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2106 break
2107 dev[0].request("REMOVE_NETWORK all")
2108
2109 for count in range(1, 1000):
2110 try:
2111 with alloc_fail(hapd, count, "eap_server_sm_step"):
2112 dev[0].connect("test-wpa2-eap",
2113 key_mgmt="WPA-EAP WPA-EAP-SHA256",
2114 eap="EKE", identity="eke user", password=pw,
2115 wait_connect=False, scan_freq="2412")
2116 # This would eventually time out, but we can stop after having
2117 # reached the allocation failure.
2118 for i in range(10):
2119 time.sleep(0.1)
2120 if hapd.request("GET_ALLOC_FAIL").startswith('0'):
2121 break
2122 dev[0].request("REMOVE_NETWORK all")
2123 except Exception, e:
2124 if str(e) == "Allocation failure did not trigger":
2125 if count < 30:
2126 raise Exception("Too few allocation failures")
2127 logger.info("%d allocation failures tested" % (count - 1))
2128 break
2129 raise e
2130
22b99086
JM		 2131def test_ap_wpa2_eap_ikev2(dev, apdev):
2132 """WPA2-Enterprise connection using EAP-IKEv2"""
c8e82c94 2133 check_eap_capa(dev[0], "IKEV2")
22b99086
JM		 2134 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2135 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14
JM		 2136 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2137 password="ike password")
75b2b9cf 2138 eap_reauth(dev[0], "IKEV2")
6daf5b9c
JM		 2139 dev[0].request("REMOVE_NETWORK all")
2140 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
47a74ad8 2141 password="ike password", fragment_size="50")
22b99086 2142
f10ba3b2
JM		 2143 logger.info("Negative test with incorrect password")
2144 dev[0].request("REMOVE_NETWORK all")
2145 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2146 password="ike-password", expect_failure=True)
2147
47a74ad8
JM		 2148def test_ap_wpa2_eap_ikev2_as_frag(dev, apdev):
2149 """WPA2-Enterprise connection using EAP-IKEv2 with server fragmentation"""
c8e82c94 2150 check_eap_capa(dev[0], "IKEV2")
47a74ad8
JM		 2151 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2152 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2153 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2154 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2155 "fragment_size": "50" }
2156 hostapd.add_ap(apdev[0]['ifname'], params)
2157 eap_connect(dev[0], apdev[0], "IKEV2", "ikev2 user",
2158 password="ike password")
2159 eap_reauth(dev[0], "IKEV2")
2160
f1ab79c3
JM		 2161def test_ap_wpa2_eap_ikev2_oom(dev, apdev):
2162 """WPA2-Enterprise connection using EAP-IKEv2 and OOM"""
c8e82c94 2163 check_eap_capa(dev[0], "IKEV2")
f1ab79c3
JM		 2164 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2165 hostapd.add_ap(apdev[0]['ifname'], params)
2166
2167 tests = [ (1, "dh_init"),
2168 (2, "dh_init"),
2169 (1, "dh_derive_shared") ]
2170 for count, func in tests:
2171 with alloc_fail(dev[0], count, func):
2172 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2173 identity="ikev2 user", password="ike password",
2174 wait_connect=False, scan_freq="2412")
2175 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2176 if ev is None:
2177 raise Exception("EAP method not selected")
2178 for i in range(10):
2179 if "0:" in dev[0].request("GET_ALLOC_FAIL"):
2180 break
2181 time.sleep(0.02)
2182 dev[0].request("REMOVE_NETWORK all")
2183
2184 tests = [ (1, "os_get_random;dh_init") ]
2185 for count, func in tests:
2186 with fail_test(dev[0], count, func):
2187 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="IKEV2",
2188 identity="ikev2 user", password="ike password",
2189 wait_connect=False, scan_freq="2412")
2190 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2191 if ev is None:
2192 raise Exception("EAP method not selected")
2193 for i in range(10):
2194 if "0:" in dev[0].request("GET_FAIL"):
2195 break
2196 time.sleep(0.02)
2197 dev[0].request("REMOVE_NETWORK all")
2198
22b99086
JM		 2199def test_ap_wpa2_eap_pax(dev, apdev):
2200 """WPA2-Enterprise connection using EAP-PAX"""
2201 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2202 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2203 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
22b99086 2204 password_hex="0123456789abcdef0123456789abcdef")
75b2b9cf 2205 eap_reauth(dev[0], "PAX")
22b99086 2206
f10ba3b2
JM		 2207 logger.info("Negative test with incorrect password")
2208 dev[0].request("REMOVE_NETWORK all")
2209 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
2210 password_hex="ff23456789abcdef0123456789abcdef",
2211 expect_failure=True)
2212
22b99086
JM		 2213def test_ap_wpa2_eap_psk(dev, apdev):
2214 """WPA2-Enterprise connection using EAP-PSK"""
2215 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2b005194
JM		 2216 params["wpa_key_mgmt"] = "WPA-EAP-SHA256"
2217 params["ieee80211w"] = "2"
22b99086 2218 hostapd.add_ap(apdev[0]['ifname'], params)
cb33ee14 2219 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
2b005194
JM		 2220 password_hex="0123456789abcdef0123456789abcdef", sha256=True)
2221 eap_reauth(dev[0], "PSK", sha256=True)
eaf3f9b1
JM		 2222 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-5"),
2223 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-5") ])
71390dc8 2224
d463c556
JM		 2225 bss = dev[0].get_bss(apdev[0]['bssid'])
2226 if 'flags' not in bss:
2227 raise Exception("Could not get BSS flags from BSS table")
2228 if "[WPA2-EAP-SHA256-CCMP]" not in bss['flags']:
2229 raise Exception("Unexpected BSS flags: " + bss['flags'])
2230
f10ba3b2
JM		 2231 logger.info("Negative test with incorrect password")
2232 dev[0].request("REMOVE_NETWORK all")
2233 eap_connect(dev[0], apdev[0], "PSK", "psk.user@example.com",
2234 password_hex="ff23456789abcdef0123456789abcdef", sha256=True,
2235 expect_failure=True)
2236
8c4e4c01
JM		 2237def test_ap_wpa2_eap_psk_oom(dev, apdev):
2238 """WPA2-Enterprise connection using EAP-PSK and OOM"""
38934ed1 2239 skip_with_fips(dev[0])
8c4e4c01
JM		 2240 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2241 hostapd.add_ap(apdev[0]['ifname'], params)
2242 tests = [ (1, "aes_128_ctr_encrypt;aes_128_eax_encrypt"),
2243 (1, "omac1_aes_128;aes_128_eax_encrypt"),
2244 (2, "omac1_aes_128;aes_128_eax_encrypt"),
2245 (3, "omac1_aes_128;aes_128_eax_encrypt"),
2246 (1, "=aes_128_eax_encrypt"),
2247 (1, "omac1_aes_vector"),
2248 (1, "aes_128_ctr_encrypt;aes_128_eax_decrypt"),
2249 (1, "omac1_aes_128;aes_128_eax_decrypt"),
2250 (2, "omac1_aes_128;aes_128_eax_decrypt"),
2251 (3, "omac1_aes_128;aes_128_eax_decrypt"),
2252 (1, "=aes_128_eax_decrypt") ]
2253 for count, func in tests:
2254 with alloc_fail(dev[0], count, func):
2255 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2256 identity="psk.user@example.com",
2257 password_hex="0123456789abcdef0123456789abcdef",
2258 wait_connect=False, scan_freq="2412")
2259 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=5)
2260 if ev is None:
2261 raise Exception("EAP method not selected")
2262 for i in range(10):
2263 if "0:" in dev[0].request("GET_ALLOC_FAIL"):
2264 break
2265 time.sleep(0.02)
2266 dev[0].request("REMOVE_NETWORK all")
2267
2268 with alloc_fail(dev[0], 1, "aes_128_encrypt_block"):
2269 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="PSK",
2270 identity="psk.user@example.com",
2271 password_hex="0123456789abcdef0123456789abcdef",
2272 wait_connect=False, scan_freq="2412")
2273 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2274 if ev is None:
2275 raise Exception("EAP method failure not reported")
2276 dev[0].request("REMOVE_NETWORK all")
2277
71390dc8
JM		 2278def test_ap_wpa_eap_peap_eap_mschapv2(dev, apdev):
2279 """WPA-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2"""
e7ac04ce 2280 check_eap_capa(dev[0], "MSCHAPV2")
71390dc8 2281 params = hostapd.wpa_eap_params(ssid="test-wpa-eap")
a8375c94 2282 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
71390dc8
JM		 2283 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="PEAP",
2284 identity="user", password="password", phase2="auth=MSCHAPV2",
2285 ca_cert="auth_serv/ca.pem", wait_connect=False,
2286 scan_freq="2412")
2287 eap_check_auth(dev[0], "PEAP", True, rsn=False)
a8375c94 2288 hwsim_utils.test_connectivity(dev[0], hapd)
71390dc8 2289 eap_reauth(dev[0], "PEAP", rsn=False)
eaf3f9b1
JM		 2290 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-50-f2-1"),
2291 ("dot11RSNAAuthenticationSuiteSelected", "00-50-f2-1") ])
48bb2e68
JM		 2292 status = dev[0].get_status(extra="VERBOSE")
2293 if 'portControl' not in status:
2294 raise Exception("portControl missing from STATUS-VERBOSE")
2295 if status['portControl'] != 'Auto':
2296 raise Exception("Unexpected portControl value: " + status['portControl'])
2297 if 'eap_session_id' not in status:
2298 raise Exception("eap_session_id missing from STATUS-VERBOSE")
2299 if not status['eap_session_id'].startswith("19"):
2300 raise Exception("Unexpected eap_session_id value: " + status['eap_session_id'])
40759604
JM		 2301
2302def test_ap_wpa2_eap_interactive(dev, apdev):
2303 """WPA2-Enterprise connection using interactive identity/password entry"""
e7ac04ce 2304 check_eap_capa(dev[0], "MSCHAPV2")
40759604
JM		 2305 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2306 hostapd.add_ap(apdev[0]['ifname'], params)
2307 hapd = hostapd.Hostapd(apdev[0]['ifname'])
2308
2309 tests = [ ("Connection with dynamic TTLS/MSCHAPv2 password entry",
2310 "TTLS", "ttls", "DOMAIN\mschapv2 user", "auth=MSCHAPV2",
2311 None, "password"),
2312 ("Connection with dynamic TTLS/MSCHAPv2 identity and password entry",
2313 "TTLS", "ttls", None, "auth=MSCHAPV2",
2314 "DOMAIN\mschapv2 user", "password"),
2315 ("Connection with dynamic TTLS/EAP-MSCHAPv2 password entry",
2316 "TTLS", "ttls", "user", "autheap=MSCHAPV2", None, "password"),
2317 ("Connection with dynamic TTLS/EAP-MD5 password entry",
2318 "TTLS", "ttls", "user", "autheap=MD5", None, "password"),
2319 ("Connection with dynamic PEAP/EAP-MSCHAPv2 password entry",
2320 "PEAP", None, "user", "auth=MSCHAPV2", None, "password"),
2321 ("Connection with dynamic PEAP/EAP-GTC password entry",
2322 "PEAP", None, "user", "auth=GTC", None, "password") ]
2323 for [desc,eap,anon,identity,phase2,req_id,req_pw] in tests:
2324 logger.info(desc)
2325 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap=eap,
2326 anonymous_identity=anon, identity=identity,
2327 ca_cert="auth_serv/ca.pem", phase2=phase2,
2328 wait_connect=False, scan_freq="2412")
2329 if req_id:
2330 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2331 if ev is None:
2332 raise Exception("Request for identity timed out")
2333 id = ev.split(':')[0].split('-')[-1]
2334 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2335 ev = dev[0].wait_event(["CTRL-REQ-PASSWORD","CTRL-REQ-OTP"])
2336 if ev is None:
2337 raise Exception("Request for password timed out")
2338 id = ev.split(':')[0].split('-')[-1]
2339 type = "OTP" if "CTRL-REQ-OTP" in ev else "PASSWORD"
2340 dev[0].request("CTRL-RSP-" + type + "-" + id + ":" + req_pw)
5f35a5e2 2341 dev[0].wait_connected(timeout=10)
40759604 2342 dev[0].request("REMOVE_NETWORK all")
e745c811 2343
f455998a
JM		 2344def test_ap_wpa2_eap_ext_enable_network_while_connected(dev, apdev):
2345 """WPA2-Enterprise interactive identity entry and ENABLE_NETWORK"""
2346 check_eap_capa(dev[0], "MSCHAPV2")
2347 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2348 hostapd.add_ap(apdev[0]['ifname'], params)
2349 hapd = hostapd.Hostapd(apdev[0]['ifname'])
2350
2351 id_other = dev[0].connect("other", key_mgmt="NONE", scan_freq="2412",
2352 only_add_network=True)
2353
2354 req_id = "DOMAIN\mschapv2 user"
2355 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2356 anonymous_identity="ttls", identity=None,
2357 password="password",
2358 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2359 wait_connect=False, scan_freq="2412")
2360 ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"])
2361 if ev is None:
2362 raise Exception("Request for identity timed out")
2363 id = ev.split(':')[0].split('-')[-1]
2364 dev[0].request("CTRL-RSP-IDENTITY-" + id + ":" + req_id)
2365 dev[0].wait_connected(timeout=10)
2366
2367 if "OK" not in dev[0].request("ENABLE_NETWORK " + str(id_other)):
2368 raise Exception("Failed to enable network")
2369 ev = dev[0].wait_event(["SME: Trying to authenticate"], timeout=1)
2370 if ev is not None:
2371 raise Exception("Unexpected reconnection attempt on ENABLE_NETWORK")
2372 dev[0].request("REMOVE_NETWORK all")
2373
e745c811
JM		 2374def test_ap_wpa2_eap_vendor_test(dev, apdev):
2375 """WPA2-Enterprise connection using EAP vendor test"""
2376 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2377 hostapd.add_ap(apdev[0]['ifname'], params)
2378 eap_connect(dev[0], apdev[0], "VENDOR-TEST", "vendor-test")
2379 eap_reauth(dev[0], "VENDOR-TEST")
467775c5
JM		 2380 eap_connect(dev[1], apdev[0], "VENDOR-TEST", "vendor-test",
2381 password="pending")
53a6f06a
JM		 2382
2383def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev):
2384 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning"""
3b51cc63 2385 check_eap_capa(dev[0], "FAST")
53a6f06a 2386 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 2387 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
53a6f06a
JM		 2388 eap_connect(dev[0], apdev[0], "FAST", "user",
2389 anonymous_identity="FAST", password="password",
2390 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2391 phase1="fast_provisioning=1", pac_file="blob://fast_pac")
a8375c94 2392 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 2393 res = eap_reauth(dev[0], "FAST")
2394 if res['tls_session_reused'] != '1':
2395 raise Exception("EAP-FAST could not use PAC session ticket")
53a6f06a 2396
873e7c29
JM		 2397def test_ap_wpa2_eap_fast_pac_file(dev, apdev, params):
2398 """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and PAC file"""
3b51cc63 2399 check_eap_capa(dev[0], "FAST")
873e7c29
JM		 2400 pac_file = os.path.join(params['logdir'], "fast.pac")
2401 pac_file2 = os.path.join(params['logdir'], "fast-bin.pac")
2402 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2403 hostapd.add_ap(apdev[0]['ifname'], params)
2404
2405 try:
2406 eap_connect(dev[0], apdev[0], "FAST", "user",
2407 anonymous_identity="FAST", password="password",
2408 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2409 phase1="fast_provisioning=1", pac_file=pac_file)
2410 with open(pac_file, "r") as f:
2411 data = f.read()
2412 if "wpa_supplicant EAP-FAST PAC file - version 1" not in data:
2413 raise Exception("PAC file header missing")
2414 if "PAC-Key=" not in data:
2415 raise Exception("PAC-Key missing from PAC file")
2416 dev[0].request("REMOVE_NETWORK all")
2417 eap_connect(dev[0], apdev[0], "FAST", "user",
2418 anonymous_identity="FAST", password="password",
2419 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2420 pac_file=pac_file)
2421
2422 eap_connect(dev[1], apdev[0], "FAST", "user",
2423 anonymous_identity="FAST", password="password",
2424 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2425 phase1="fast_provisioning=1 fast_pac_format=binary",
2426 pac_file=pac_file2)
2427 dev[1].request("REMOVE_NETWORK all")
2428 eap_connect(dev[1], apdev[0], "FAST", "user",
2429 anonymous_identity="FAST", password="password",
2430 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2431 phase1="fast_pac_format=binary",
2432 pac_file=pac_file2)
2433 finally:
b638f703
JM		 2434 try:
2435 os.remove(pac_file)
2436 except:
2437 pass
2438 try:
2439 os.remove(pac_file2)
2440 except:
2441 pass
873e7c29 2442
c6ab1cdb
JM		 2443def test_ap_wpa2_eap_fast_binary_pac(dev, apdev):
2444 """WPA2-Enterprise connection using EAP-FAST and binary PAC format"""
3b51cc63 2445 check_eap_capa(dev[0], "FAST")
c6ab1cdb
JM		 2446 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2447 hostapd.add_ap(apdev[0]['ifname'], params)
2448 eap_connect(dev[0], apdev[0], "FAST", "user",
2449 anonymous_identity="FAST", password="password",
2450 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2451 phase1="fast_provisioning=1 fast_max_pac_list_len=1 fast_pac_format=binary",
2452 pac_file="blob://fast_pac_bin")
2fc4749c
JM		 2453 res = eap_reauth(dev[0], "FAST")
2454 if res['tls_session_reused'] != '1':
2455 raise Exception("EAP-FAST could not use PAC session ticket")
c6ab1cdb 2456
46e094bd
JM		 2457def test_ap_wpa2_eap_fast_missing_pac_config(dev, apdev):
2458 """WPA2-Enterprise connection using EAP-FAST and missing PAC config"""
3b51cc63 2459 check_eap_capa(dev[0], "FAST")
46e094bd
JM		 2460 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2461 hostapd.add_ap(apdev[0]['ifname'], params)
2462
2463 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2464 identity="user", anonymous_identity="FAST",
2465 password="password",
2466 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2467 pac_file="blob://fast_pac_not_in_use",
2468 wait_connect=False, scan_freq="2412")
2469 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2470 if ev is None:
2471 raise Exception("Timeout on EAP failure report")
2472 dev[0].request("REMOVE_NETWORK all")
2473
2474 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2475 identity="user", anonymous_identity="FAST",
2476 password="password",
2477 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2478 wait_connect=False, scan_freq="2412")
2479 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2480 if ev is None:
2481 raise Exception("Timeout on EAP failure report")
2482
53a6f06a
JM		 2483def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev):
2484 """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning"""
3b51cc63 2485 check_eap_capa(dev[0], "FAST")
53a6f06a 2486 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
a8375c94 2487 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
53a6f06a
JM		 2488 eap_connect(dev[0], apdev[0], "FAST", "user",
2489 anonymous_identity="FAST", password="password",
2490 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
2491 phase1="fast_provisioning=2", pac_file="blob://fast_pac_auth")
a8375c94 2492 hwsim_utils.test_connectivity(dev[0], hapd)
2fc4749c
JM		 2493 res = eap_reauth(dev[0], "FAST")
2494 if res['tls_session_reused'] != '1':
2495 raise Exception("EAP-FAST could not use PAC session ticket")
d4c7a2b9 2496
95a15d79
JM		 2497def test_ap_wpa2_eap_fast_gtc_identity_change(dev, apdev):
2498 """WPA2-Enterprise connection using EAP-FAST/GTC and identity changing"""
2499 check_eap_capa(dev[0], "FAST")
2500 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2501 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2502 id = eap_connect(dev[0], apdev[0], "FAST", "user",
2503 anonymous_identity="FAST", password="password",
2504 ca_cert="auth_serv/ca.pem", phase2="auth=GTC",
2505 phase1="fast_provisioning=2",
2506 pac_file="blob://fast_pac_auth")
2507 dev[0].set_network_quoted(id, "identity", "user2")
2508 dev[0].wait_disconnected()
2509 ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=15)
2510 if ev is None:
2511 raise Exception("EAP-FAST not started")
2512 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=5)
2513 if ev is None:
2514 raise Exception("EAP failure not reported")
2515 dev[0].wait_disconnected()
2516
27f2fab0
JM		 2517def test_ap_wpa2_eap_fast_prf_oom(dev, apdev):
2518 """WPA2-Enterprise connection using EAP-FAST and OOM in PRF"""
2519 check_eap_capa(dev[0], "FAST")
cc71035f
JM		 2520 tls = dev[0].request("GET tls_library")
2521 if tls.startswith("OpenSSL"):
2522 func = "openssl_tls_prf"
2523 count = 2
2524 elif tls.startswith("internal"):
2525 func = "tls_connection_prf"
2526 count = 1
2527 else:
2528 raise HwsimSkip("Unsupported TLS library")
27f2fab0
JM		 2529 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2530 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
cc71035f 2531 with alloc_fail(dev[0], count, func):
27f2fab0
JM		 2532 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST",
2533 identity="user", anonymous_identity="FAST",
2534 password="password", ca_cert="auth_serv/ca.pem",
2535 phase2="auth=GTC",
2536 phase1="fast_provisioning=2",
2537 pac_file="blob://fast_pac_auth",
2538 wait_connect=False, scan_freq="2412")
2539 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15)
2540 if ev is None:
2541 raise Exception("EAP failure not reported")
2542 dev[0].request("DISCONNECT")
2543
6eddd530
JM		 2544def test_ap_wpa2_eap_fast_server_oom(dev, apdev):
2545 """EAP-FAST/MSCHAPv2 and server OOM"""
2546 check_eap_capa(dev[0], "FAST")
2547
2548 params = int_eap_server_params()
2549 params['dh_file'] = 'auth_serv/dh.conf'
2550 params['pac_opaque_encr_key'] = '000102030405060708090a0b0c0d0e0f'
2551 params['eap_fast_a_id'] = '1011'
2552 params['eap_fast_a_id_info'] = 'another test server'
2553 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
2554
2555 with alloc_fail(hapd, 1, "tls_session_ticket_ext_cb"):
2556 id = eap_connect(dev[0], apdev[0], "FAST", "user",
2557 anonymous_identity="FAST", password="password",
2558 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
2559 phase1="fast_provisioning=1",
2560 pac_file="blob://fast_pac",
2561 expect_failure=True)
2562 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
2563 if ev is None:
2564 raise Exception("No EAP failure reported")
2565 dev[0].wait_disconnected()
2566 dev[0].request("DISCONNECT")
2567
2568 dev[0].select_network(id, freq="2412")
2569
d4c7a2b9
JM		 2570def test_ap_wpa2_eap_tls_ocsp(dev, apdev):
2571 """WPA2-Enterprise connection using EAP-TLS and verifying OCSP"""
0dae8c99 2572 check_ocsp_support(dev[0])
d4c7a2b9
JM		 2573 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
2574 hostapd.add_ap(apdev[0]['ifname'], params)
2575 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
2576 private_key="auth_serv/user.pkcs12",
2577 private_key_passwd="whatever", ocsp=2)
2578
64e05f96 2579def int_eap_server_params():
d4c7a2b9
JM		 2580 params = { "ssid": "test-wpa2-eap", "wpa": "2", "wpa_key_mgmt": "WPA-EAP",
2581 "rsn_pairwise": "CCMP", "ieee8021x": "1",
2582 "eap_server": "1", "eap_user_file": "auth_serv/eap_user.conf",
2583 "ca_cert": "auth_serv/ca.pem",
2584 "server_cert": "auth_serv/server.pem",
64e05f96
JM		 2585 "private_key": "auth_serv/server.key" }
2586 return params
d2a1047e 2587
d79ce4a6
JM		 2588def test_ap_wpa2_eap_tls_ocsp_ca_signed_good(dev, apdev, params):
2589 """EAP-TLS and CA signed OCSP response (good)"""
2590 check_ocsp_support(dev[0])
2591 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed.der")
2592 if not os.path.exists(ocsp):
2593 raise HwsimSkip("No OCSP response available")
2594 params = int_eap_server_params()
2595 params["ocsp_stapling_response"] = ocsp
2596 hostapd.add_ap(apdev[0]['ifname'], params)
2597 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2598 identity="tls user", ca_cert="auth_serv/ca.pem",
2599 private_key="auth_serv/user.pkcs12",
2600 private_key_passwd="whatever", ocsp=2,
2601 scan_freq="2412")
2602
2603def test_ap_wpa2_eap_tls_ocsp_ca_signed_revoked(dev, apdev, params):
2604 """EAP-TLS and CA signed OCSP response (revoked)"""
2605 check_ocsp_support(dev[0])
2606 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-revoked.der")
2607 if not os.path.exists(ocsp):
2608 raise HwsimSkip("No OCSP response available")
2609 params = int_eap_server_params()
2610 params["ocsp_stapling_response"] = ocsp
2611 hostapd.add_ap(apdev[0]['ifname'], params)
2612 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2613 identity="tls user", ca_cert="auth_serv/ca.pem",
2614 private_key="auth_serv/user.pkcs12",
2615 private_key_passwd="whatever", ocsp=2,
2616 wait_connect=False, scan_freq="2412")
2617 count = 0
2618 while True:
2619 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2620 if ev is None:
2621 raise Exception("Timeout on EAP status")
2622 if 'bad certificate status response' in ev:
2623 break
2624 if 'certificate revoked' in ev:
2625 break
2626 count = count + 1
2627 if count > 10:
2628 raise Exception("Unexpected number of EAP status messages")
2629
2630 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2631 if ev is None:
2632 raise Exception("Timeout on EAP failure report")
2633
2634def test_ap_wpa2_eap_tls_ocsp_ca_signed_unknown(dev, apdev, params):
2635 """EAP-TLS and CA signed OCSP response (unknown)"""
2636 check_ocsp_support(dev[0])
2637 ocsp = os.path.join(params['logdir'], "ocsp-resp-ca-signed-unknown.der")
2638 if not os.path.exists(ocsp):
2639 raise HwsimSkip("No OCSP response available")
2640 params = int_eap_server_params()
2641 params["ocsp_stapling_response"] = ocsp
2642 hostapd.add_ap(apdev[0]['ifname'], params)
2643 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2644 identity="tls user", ca_cert="auth_serv/ca.pem",
2645 private_key="auth_serv/user.pkcs12",
2646 private_key_passwd="whatever", ocsp=2,
2647 wait_connect=False, scan_freq="2412")
2648 count = 0
2649 while True:
2650 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2651 if ev is None:
2652 raise Exception("Timeout on EAP status")
2653 if 'bad certificate status response' in ev:
2654 break
2655 count = count + 1
2656 if count > 10:
2657 raise Exception("Unexpected number of EAP status messages")
2658
2659 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2660 if ev is None:
2661 raise Exception("Timeout on EAP failure report")
2662
2663def test_ap_wpa2_eap_tls_ocsp_server_signed(dev, apdev, params):
2664 """EAP-TLS and server signed OCSP response"""
2665 check_ocsp_support(dev[0])
2666 ocsp = os.path.join(params['logdir'], "ocsp-resp-server-signed.der")
2667 if not os.path.exists(ocsp):
2668 raise HwsimSkip("No OCSP response available")
2669 params = int_eap_server_params()
2670 params["ocsp_stapling_response"] = ocsp
2671 hostapd.add_ap(apdev[0]['ifname'], params)
2672 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2673 identity="tls user", ca_cert="auth_serv/ca.pem",
2674 private_key="auth_serv/user.pkcs12",
2675 private_key_passwd="whatever", ocsp=2,
2676 wait_connect=False, scan_freq="2412")
2677 count = 0
2678 while True:
2679 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2680 if ev is None:
2681 raise Exception("Timeout on EAP status")
2682 if 'bad certificate status response' in ev:
2683 break
2684 count = count + 1
2685 if count > 10:
2686 raise Exception("Unexpected number of EAP status messages")
2687
2688 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2689 if ev is None:
2690 raise Exception("Timeout on EAP failure report")
2691
d2a1047e
JM		 2692def test_ap_wpa2_eap_tls_ocsp_invalid_data(dev, apdev):
2693 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP data"""
0dae8c99 2694 check_ocsp_support(dev[0])
d2a1047e
JM		 2695 params = int_eap_server_params()
2696 params["ocsp_stapling_response"] = "auth_serv/ocsp-req.der"
2697 hostapd.add_ap(apdev[0]['ifname'], params)
2698 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2699 identity="tls user", ca_cert="auth_serv/ca.pem",
2700 private_key="auth_serv/user.pkcs12",
2701 private_key_passwd="whatever", ocsp=2,
2702 wait_connect=False, scan_freq="2412")
2703 count = 0
2704 while True:
2705 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2706 if ev is None:
2707 raise Exception("Timeout on EAP status")
2708 if 'bad certificate status response' in ev:
2709 break
2710 count = count + 1
2711 if count > 10:
2712 raise Exception("Unexpected number of EAP status messages")
2713
2714 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2715 if ev is None:
2716 raise Exception("Timeout on EAP failure report")
2717
64e05f96
JM		 2718def test_ap_wpa2_eap_tls_ocsp_invalid(dev, apdev):
2719 """WPA2-Enterprise connection using EAP-TLS and invalid OCSP response"""
0dae8c99 2720 check_ocsp_support(dev[0])
64e05f96
JM		 2721 params = int_eap_server_params()
2722 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-invalid"
d4c7a2b9 2723 hostapd.add_ap(apdev[0]['ifname'], params)
df7ad0fa
JM		 2724 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2725 identity="tls user", ca_cert="auth_serv/ca.pem",
2726 private_key="auth_serv/user.pkcs12",
2727 private_key_passwd="whatever", ocsp=2,
2728 wait_connect=False, scan_freq="2412")
2729 count = 0
2730 while True:
2731 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2732 if ev is None:
2733 raise Exception("Timeout on EAP status")
2734 if 'bad certificate status response' in ev:
2735 break
2736 count = count + 1
2737 if count > 10:
2738 raise Exception("Unexpected number of EAP status messages")
2739
2740 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2741 if ev is None:
2742 raise Exception("Timeout on EAP failure report")
2743
2744def test_ap_wpa2_eap_tls_ocsp_unknown_sign(dev, apdev):
2745 """WPA2-Enterprise connection using EAP-TLS and unknown OCSP signer"""
0dae8c99 2746 check_ocsp_support(dev[0])
df7ad0fa
JM		 2747 params = int_eap_server_params()
2748 params["ocsp_stapling_response"] = "auth_serv/ocsp-server-cache.der-unknown-sign"
2749 hostapd.add_ap(apdev[0]['ifname'], params)
d4c7a2b9
JM		 2750 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2751 identity="tls user", ca_cert="auth_serv/ca.pem",
2752 private_key="auth_serv/user.pkcs12",
2753 private_key_passwd="whatever", ocsp=2,
2754 wait_connect=False, scan_freq="2412")
2755 count = 0
2756 while True:
2757 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2758 if ev is None:
2759 raise Exception("Timeout on EAP status")
2760 if 'bad certificate status response' in ev:
2761 break
2762 count = count + 1
2763 if count > 10:
2764 raise Exception("Unexpected number of EAP status messages")
2765
2766 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2767 if ev is None:
2768 raise Exception("Timeout on EAP failure report")
64e05f96 2769
37b4a66c
JM		 2770def test_ap_wpa2_eap_ttls_ocsp_revoked(dev, apdev, params):
2771 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 2772 check_ocsp_support(dev[0])
37b4a66c
JM		 2773 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-revoked.der")
2774 if not os.path.exists(ocsp):
2775 raise HwsimSkip("No OCSP response available")
2776 params = int_eap_server_params()
2777 params["ocsp_stapling_response"] = ocsp
2778 hostapd.add_ap(apdev[0]['ifname'], params)
2779 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2780 identity="pap user", ca_cert="auth_serv/ca.pem",
2781 anonymous_identity="ttls", password="password",
2782 phase2="auth=PAP", ocsp=2,
2783 wait_connect=False, scan_freq="2412")
2784 count = 0
2785 while True:
2786 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2787 if ev is None:
2788 raise Exception("Timeout on EAP status")
2789 if 'bad certificate status response' in ev:
2790 break
2791 if 'certificate revoked' in ev:
2792 break
2793 count = count + 1
2794 if count > 10:
2795 raise Exception("Unexpected number of EAP status messages")
2796
2797 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2798 if ev is None:
2799 raise Exception("Timeout on EAP failure report")
2800
2801def test_ap_wpa2_eap_ttls_ocsp_unknown(dev, apdev, params):
2802 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
0dae8c99 2803 check_ocsp_support(dev[0])
37b4a66c
JM		 2804 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
2805 if not os.path.exists(ocsp):
2806 raise HwsimSkip("No OCSP response available")
2807 params = int_eap_server_params()
2808 params["ocsp_stapling_response"] = ocsp
2809 hostapd.add_ap(apdev[0]['ifname'], params)
2810 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2811 identity="pap user", ca_cert="auth_serv/ca.pem",
2812 anonymous_identity="ttls", password="password",
2813 phase2="auth=PAP", ocsp=2,
2814 wait_connect=False, scan_freq="2412")
2815 count = 0
2816 while True:
2817 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"])
2818 if ev is None:
2819 raise Exception("Timeout on EAP status")
2820 if 'bad certificate status response' in ev:
2821 break
2822 count = count + 1
2823 if count > 10:
2824 raise Exception("Unexpected number of EAP status messages")
2825
2826 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2827 if ev is None:
2828 raise Exception("Timeout on EAP failure report")
2829
2830def test_ap_wpa2_eap_ttls_optional_ocsp_unknown(dev, apdev, params):
2831 """WPA2-Enterprise connection using EAP-TTLS and OCSP status revoked"""
2832 ocsp = os.path.join(params['logdir'], "ocsp-server-cache-unknown.der")
2833 if not os.path.exists(ocsp):
2834 raise HwsimSkip("No OCSP response available")
2835 params = int_eap_server_params()
2836 params["ocsp_stapling_response"] = ocsp
2837 hostapd.add_ap(apdev[0]['ifname'], params)
2838 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2839 identity="pap user", ca_cert="auth_serv/ca.pem",
2840 anonymous_identity="ttls", password="password",
2841 phase2="auth=PAP", ocsp=1, scan_freq="2412")
2842
24579e70 2843def test_ap_wpa2_eap_tls_domain_suffix_match_cn_full(dev, apdev):
64e05f96 2844 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
e78eb404 2845 check_domain_match_full(dev[0])
64e05f96
JM		 2846 params = int_eap_server_params()
2847 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2848 params["private_key"] = "auth_serv/server-no-dnsname.key"
2849 hostapd.add_ap(apdev[0]['ifname'], params)
2850 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2851 identity="tls user", ca_cert="auth_serv/ca.pem",
2852 private_key="auth_serv/user.pkcs12",
2853 private_key_passwd="whatever",
2854 domain_suffix_match="server3.w1.fi",
2855 scan_freq="2412")
24579e70 2856
061cbb25
JM		 2857def test_ap_wpa2_eap_tls_domain_match_cn(dev, apdev):
2858 """WPA2-Enterprise using EAP-TLS and domainmatch (CN)"""
e78eb404 2859 check_domain_match(dev[0])
061cbb25
JM		 2860 params = int_eap_server_params()
2861 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2862 params["private_key"] = "auth_serv/server-no-dnsname.key"
2863 hostapd.add_ap(apdev[0]['ifname'], params)
2864 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2865 identity="tls user", ca_cert="auth_serv/ca.pem",
2866 private_key="auth_serv/user.pkcs12",
2867 private_key_passwd="whatever",
2868 domain_match="server3.w1.fi",
2869 scan_freq="2412")
2870
24579e70
JM		 2871def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev):
2872 """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)"""
2873 check_domain_match_full(dev[0])
2874 params = int_eap_server_params()
2875 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2876 params["private_key"] = "auth_serv/server-no-dnsname.key"
2877 hostapd.add_ap(apdev[0]['ifname'], params)
64e05f96
JM		 2878 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2879 identity="tls user", ca_cert="auth_serv/ca.pem",
2880 private_key="auth_serv/user.pkcs12",
2881 private_key_passwd="whatever",
2882 domain_suffix_match="w1.fi",
2883 scan_freq="2412")
2884
2885def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev):
2886 """WPA2-Enterprise using EAP-TLS and domain suffix mismatch (CN)"""
e78eb404 2887 check_domain_suffix_match(dev[0])
64e05f96
JM		 2888 params = int_eap_server_params()
2889 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2890 params["private_key"] = "auth_serv/server-no-dnsname.key"
2891 hostapd.add_ap(apdev[0]['ifname'], params)
2892 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2893 identity="tls user", ca_cert="auth_serv/ca.pem",
2894 private_key="auth_serv/user.pkcs12",
2895 private_key_passwd="whatever",
2896 domain_suffix_match="example.com",
2897 wait_connect=False,
2898 scan_freq="2412")
c61dca40
JM		 2899 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2900 identity="tls user", ca_cert="auth_serv/ca.pem",
2901 private_key="auth_serv/user.pkcs12",
2902 private_key_passwd="whatever",
2903 domain_suffix_match="erver3.w1.fi",
2904 wait_connect=False,
2905 scan_freq="2412")
64e05f96
JM		 2906 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2907 if ev is None:
2908 raise Exception("Timeout on EAP failure report")
c61dca40
JM		 2909 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2910 if ev is None:
2911 raise Exception("Timeout on EAP failure report (2)")
6a4d0dbe 2912
061cbb25
JM		 2913def test_ap_wpa2_eap_tls_domain_mismatch_cn(dev, apdev):
2914 """WPA2-Enterprise using EAP-TLS and domain mismatch (CN)"""
e78eb404 2915 check_domain_match(dev[0])
061cbb25
JM		 2916 params = int_eap_server_params()
2917 params["server_cert"] = "auth_serv/server-no-dnsname.pem"
2918 params["private_key"] = "auth_serv/server-no-dnsname.key"
2919 hostapd.add_ap(apdev[0]['ifname'], params)
2920 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2921 identity="tls user", ca_cert="auth_serv/ca.pem",
2922 private_key="auth_serv/user.pkcs12",
2923 private_key_passwd="whatever",
2924 domain_match="example.com",
2925 wait_connect=False,
2926 scan_freq="2412")
2927 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
2928 identity="tls user", ca_cert="auth_serv/ca.pem",
2929 private_key="auth_serv/user.pkcs12",
2930 private_key_passwd="whatever",
2931 domain_match="w1.fi",
2932 wait_connect=False,
2933 scan_freq="2412")
2934 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2935 if ev is None:
2936 raise Exception("Timeout on EAP failure report")
2937 ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2938 if ev is None:
2939 raise Exception("Timeout on EAP failure report (2)")
2940
6a4d0dbe
JM		 2941def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev):
2942 """WPA2-Enterprise using EAP-TTLS and expired certificate"""
ca158ea6 2943 skip_with_fips(dev[0])
6a4d0dbe
JM		 2944 params = int_eap_server_params()
2945 params["server_cert"] = "auth_serv/server-expired.pem"
2946 params["private_key"] = "auth_serv/server-expired.key"
2947 hostapd.add_ap(apdev[0]['ifname'], params)
2948 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2949 identity="mschap user", password="password",
2950 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
2951 wait_connect=False,
2952 scan_freq="2412")
2953 ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR"])
2954 if ev is None:
2955 raise Exception("Timeout on EAP certificate error report")
2956 if "reason=4" not in ev or "certificate has expired" not in ev:
2957 raise Exception("Unexpected failure reason: " + ev)
2958 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
2959 if ev is None:
2960 raise Exception("Timeout on EAP failure report")
2961
2962def test_ap_wpa2_eap_ttls_ignore_expired_cert(dev, apdev):
2963 """WPA2-Enterprise using EAP-TTLS and ignore certificate expiration"""
ca158ea6 2964 skip_with_fips(dev[0])
6a4d0dbe
JM		 2965 params = int_eap_server_params()
2966 params["server_cert"] = "auth_serv/server-expired.pem"
2967 params["private_key"] = "auth_serv/server-expired.key"
2968 hostapd.add_ap(apdev[0]['ifname'], params)
2969 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2970 identity="mschap user", password="password",
2971 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
2972 phase1="tls_disable_time_checks=1",
2973 scan_freq="2412")
6ab4a7aa 2974
5748d1e5
JM		 2975def test_ap_wpa2_eap_ttls_long_duration(dev, apdev):
2976 """WPA2-Enterprise using EAP-TTLS and long certificate duration"""
ca158ea6 2977 skip_with_fips(dev[0])
5748d1e5
JM		 2978 params = int_eap_server_params()
2979 params["server_cert"] = "auth_serv/server-long-duration.pem"
2980 params["private_key"] = "auth_serv/server-long-duration.key"
2981 hostapd.add_ap(apdev[0]['ifname'], params)
2982 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2983 identity="mschap user", password="password",
2984 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
2985 scan_freq="2412")
2986
6ab4a7aa
JM		 2987def test_ap_wpa2_eap_ttls_server_cert_eku_client(dev, apdev):
2988 """WPA2-Enterprise using EAP-TTLS and server cert with client EKU"""
ca158ea6 2989 skip_with_fips(dev[0])
6ab4a7aa
JM		 2990 params = int_eap_server_params()
2991 params["server_cert"] = "auth_serv/server-eku-client.pem"
2992 params["private_key"] = "auth_serv/server-eku-client.key"
2993 hostapd.add_ap(apdev[0]['ifname'], params)
2994 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
2995 identity="mschap user", password="password",
2996 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
2997 wait_connect=False,
2998 scan_freq="2412")
2999 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3000 if ev is None:
3001 raise Exception("Timeout on EAP failure report")
242219c5 3002
14bef66d
JM		 3003def test_ap_wpa2_eap_ttls_server_cert_eku_client_server(dev, apdev):
3004 """WPA2-Enterprise using EAP-TTLS and server cert with client and server EKU"""
ca158ea6 3005 skip_with_fips(dev[0])
14bef66d
JM		 3006 params = int_eap_server_params()
3007 params["server_cert"] = "auth_serv/server-eku-client-server.pem"
3008 params["private_key"] = "auth_serv/server-eku-client-server.key"
3009 hostapd.add_ap(apdev[0]['ifname'], params)
3010 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3011 identity="mschap user", password="password",
3012 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3013 scan_freq="2412")
3014
c37b02fc
JM		 3015def test_ap_wpa2_eap_ttls_server_pkcs12(dev, apdev):
3016 """WPA2-Enterprise using EAP-TTLS and server PKCS#12 file"""
ca158ea6 3017 skip_with_fips(dev[0])
c37b02fc
JM		 3018 params = int_eap_server_params()
3019 del params["server_cert"]
3020 params["private_key"] = "auth_serv/server.pkcs12"
3021 hostapd.add_ap(apdev[0]['ifname'], params)
3022 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3023 identity="mschap user", password="password",
3024 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3025 scan_freq="2412")
3026
242219c5
JM		 3027def test_ap_wpa2_eap_ttls_dh_params(dev, apdev):
3028 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params"""
3029 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3030 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3031 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
242219c5 3032 anonymous_identity="ttls", password="password",
ca158ea6 3033 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
242219c5 3034 dh_file="auth_serv/dh.conf")
7c50093f 3035
b3ff3dec
JM		 3036def test_ap_wpa2_eap_ttls_dh_params_dsa(dev, apdev):
3037 """WPA2-Enterprise connection using EAP-TTLS and setting DH params (DSA)"""
404597e6 3038 check_dh_dsa_support(dev[0])
b3ff3dec
JM		 3039 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3040 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3041 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
b3ff3dec 3042 anonymous_identity="ttls", password="password",
ca158ea6 3043 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
b3ff3dec
JM		 3044 dh_file="auth_serv/dsaparam.pem")
3045
3046def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
3047 """EAP-TTLS and DH params file not found"""
ca158ea6 3048 skip_with_fips(dev[0])
b3ff3dec
JM		 3049 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3050 hostapd.add_ap(apdev[0]['ifname'], params)
3051 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3052 identity="mschap user", password="password",
3053 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3054 dh_file="auth_serv/dh-no-such-file.conf",
3055 scan_freq="2412", wait_connect=False)
3056 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3057 if ev is None:
3058 raise Exception("EAP failure timed out")
3059 dev[0].request("REMOVE_NETWORK all")
3060 dev[0].wait_disconnected()
3061
3062def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
3063 """EAP-TTLS and invalid DH params file"""
ca158ea6 3064 skip_with_fips(dev[0])
b3ff3dec
JM		 3065 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3066 hostapd.add_ap(apdev[0]['ifname'], params)
3067 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3068 identity="mschap user", password="password",
3069 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3070 dh_file="auth_serv/ca.pem",
3071 scan_freq="2412", wait_connect=False)
3072 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3073 if ev is None:
3074 raise Exception("EAP failure timed out")
3075 dev[0].request("REMOVE_NETWORK all")
3076 dev[0].wait_disconnected()
3077
6ea231e6
JM		 3078def test_ap_wpa2_eap_ttls_dh_params_blob(dev, apdev):
3079 """WPA2-Enterprise connection using EAP-TTLS/CHAP and setting DH params from blob"""
3080 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3081 hostapd.add_ap(apdev[0]['ifname'], params)
768ea0bc 3082 dh = read_pem("auth_serv/dh2.conf")
6ea231e6
JM		 3083 if "OK" not in dev[0].request("SET blob dhparams " + dh.encode("hex")):
3084 raise Exception("Could not set dhparams blob")
ca158ea6 3085 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
6ea231e6 3086 anonymous_identity="ttls", password="password",
ca158ea6 3087 ca_cert="auth_serv/ca.der", phase2="auth=PAP",
6ea231e6
JM		 3088 dh_file="blob://dhparams")
3089
768ea0bc
JM		 3090def test_ap_wpa2_eap_ttls_dh_params_server(dev, apdev):
3091 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams"""
3092 params = int_eap_server_params()
3093 params["dh_file"] = "auth_serv/dh2.conf"
3094 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3095 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
768ea0bc 3096 anonymous_identity="ttls", password="password",
ca158ea6 3097 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
768ea0bc 3098
b3ff3dec
JM		 3099def test_ap_wpa2_eap_ttls_dh_params_dsa_server(dev, apdev):
3100 """WPA2-Enterprise using EAP-TTLS and alternative server dhparams (DSA)"""
3101 params = int_eap_server_params()
3102 params["dh_file"] = "auth_serv/dsaparam.pem"
3103 hostapd.add_ap(apdev[0]['ifname'], params)
ca158ea6 3104 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
b3ff3dec 3105 anonymous_identity="ttls", password="password",
ca158ea6 3106 ca_cert="auth_serv/ca.der", phase2="auth=PAP")
b3ff3dec
JM		 3107
3108def test_ap_wpa2_eap_ttls_dh_params_not_found(dev, apdev):
3109 """EAP-TLS server and dhparams file not found"""
3110 params = int_eap_server_params()
3111 params["dh_file"] = "auth_serv/dh-no-such-file.conf"
3112 hapd = hostapd.add_ap(apdev[0]['ifname'], params, no_enable=True)
3113 if "FAIL" not in hapd.request("ENABLE"):
3114 raise Exception("Invalid configuration accepted")
3115
3116def test_ap_wpa2_eap_ttls_dh_params_invalid(dev, apdev):
3117 """EAP-TLS server and invalid dhparams file"""
3118 params = int_eap_server_params()
3119 params["dh_file"] = "auth_serv/ca.pem"
3120 hapd = hostapd.add_ap(apdev[0]['ifname'], params, no_enable=True)
3121 if "FAIL" not in hapd.request("ENABLE"):
3122 raise Exception("Invalid configuration accepted")
3123
7c50093f
JM		 3124def test_ap_wpa2_eap_reauth(dev, apdev):
3125 """WPA2-Enterprise and Authenticator forcing reauthentication"""
3126 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3127 params['eap_reauth_period'] = '2'
3128 hostapd.add_ap(apdev[0]['ifname'], params)
3129 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
3130 password_hex="0123456789abcdef0123456789abcdef")
3131 logger.info("Wait for reauthentication")
3132 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3133 if ev is None:
3134 raise Exception("Timeout on reauthentication")
3135 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3136 if ev is None:
3137 raise Exception("Timeout on reauthentication")
3138 for i in range(0, 20):
3139 state = dev[0].get_status_field("wpa_state")
3140 if state == "COMPLETED":
3141 break
3142 time.sleep(0.1)
3143 if state != "COMPLETED":
3144 raise Exception("Reauthentication did not complete")
8b56743e
JM		 3145
3146def test_ap_wpa2_eap_request_identity_message(dev, apdev):
3147 """Optional displayable message in EAP Request-Identity"""
3148 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3149 params['eap_message'] = 'hello\\0networkid=netw,nasid=foo,portid=0,NAIRealms=example.com'
3150 hostapd.add_ap(apdev[0]['ifname'], params)
3151 eap_connect(dev[0], apdev[0], "PAX", "pax.user@example.com",
3152 password_hex="0123456789abcdef0123456789abcdef")
910f16ca
JM		 3153
3154def test_ap_wpa2_eap_sim_aka_result_ind(dev, apdev):
3155 """WPA2-Enterprise using EAP-SIM/AKA and protected result indication"""
81e787b7 3156 check_hlr_auc_gw_support()
910f16ca
JM		 3157 params = int_eap_server_params()
3158 params['eap_sim_db'] = "unix:/tmp/hlr_auc_gw.sock"
3159 params['eap_sim_aka_result_ind'] = "1"
3160 hostapd.add_ap(apdev[0]['ifname'], params)
3161
3162 eap_connect(dev[0], apdev[0], "SIM", "1232010000000000",
3163 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
3164 phase1="result_ind=1")
3165 eap_reauth(dev[0], "SIM")
3166 eap_connect(dev[1], apdev[0], "SIM", "1232010000000000",
3167 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581")
3168
3169 dev[0].request("REMOVE_NETWORK all")
3170 dev[1].request("REMOVE_NETWORK all")
3171
3172 eap_connect(dev[0], apdev[0], "AKA", "0232010000000000",
3173 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123",
3174 phase1="result_ind=1")
3175 eap_reauth(dev[0], "AKA")
3176 eap_connect(dev[1], apdev[0], "AKA", "0232010000000000",
3177 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581:000000000123")
3178
3179 dev[0].request("REMOVE_NETWORK all")
3180 dev[1].request("REMOVE_NETWORK all")
3181
3182 eap_connect(dev[0], apdev[0], "AKA'", "6555444333222111",
3183 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123",
3184 phase1="result_ind=1")
3185 eap_reauth(dev[0], "AKA'")
3186 eap_connect(dev[1], apdev[0], "AKA'", "6555444333222111",
3187 password="5122250214c33e723a5dd523fc145fc0:981d464c7c52eb6e5036234984ad0bcf:000000000123")
633e364b
JM		 3188
3189def test_ap_wpa2_eap_too_many_roundtrips(dev, apdev):
3190 """WPA2-Enterprise connection resulting in too many EAP roundtrips"""
ca158ea6 3191 skip_with_fips(dev[0])
633e364b
JM		 3192 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3193 hostapd.add_ap(apdev[0]['ifname'], params)
3194 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
3195 eap="TTLS", identity="mschap user",
3196 wait_connect=False, scan_freq="2412", ieee80211w="1",
3197 anonymous_identity="ttls", password="password",
3198 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3199 fragment_size="10")
3200 ev = dev[0].wait_event(["EAP: more than"], timeout=20)
3201 if ev is None:
3202 raise Exception("EAP roundtrip limit not reached")
32dca985
JM		 3203
3204def test_ap_wpa2_eap_expanded_nak(dev, apdev):
3205 """WPA2-Enterprise connection with EAP resulting in expanded NAK"""
3206 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3207 hostapd.add_ap(apdev[0]['ifname'], params)
3208 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
3209 eap="PSK", identity="vendor-test",
3210 password_hex="ff23456789abcdef0123456789abcdef",
3211 wait_connect=False)
3212
3213 found = False
3214 for i in range(0, 5):
3215 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS"], timeout=10)
3216 if ev is None:
3217 raise Exception("Association and EAP start timed out")
3218 if "refuse proposed method" in ev:
3219 found = True
3220 break
3221 if not found:
3222 raise Exception("Unexpected EAP status: " + ev)
3223
3224 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"])
3225 if ev is None:
3226 raise Exception("EAP failure timed out")
745f8771
JM		 3227
3228def test_ap_wpa2_eap_sql(dev, apdev, params):
3229 """WPA2-Enterprise connection using SQLite for user DB"""
ca158ea6 3230 skip_with_fips(dev[0])
745f8771
JM		 3231 try:
3232 import sqlite3
3233 except ImportError:
81e787b7 3234 raise HwsimSkip("No sqlite3 module available")
745f8771
JM		 3235 dbfile = os.path.join(params['logdir'], "eap-user.db")
3236 try:
3237 os.remove(dbfile)
3238 except:
3239 pass
3240 con = sqlite3.connect(dbfile)
3241 with con:
3242 cur = con.cursor()
3243 cur.execute("CREATE TABLE users(identity TEXT PRIMARY KEY, methods TEXT, password TEXT, remediation TEXT, phase2 INTEGER)")
3244 cur.execute("CREATE TABLE wildcards(identity TEXT PRIMARY KEY, methods TEXT)")
3245 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-pap','TTLS-PAP','password',1)")
3246 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-chap','TTLS-CHAP','password',1)")
3247 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschap','TTLS-MSCHAP','password',1)")
3248 cur.execute("INSERT INTO users(identity,methods,password,phase2) VALUES ('user-mschapv2','TTLS-MSCHAPV2','password',1)")
3249 cur.execute("INSERT INTO wildcards(identity,methods) VALUES ('','TTLS,TLS')")
3250 cur.execute("CREATE TABLE authlog(timestamp TEXT, session TEXT, nas_ip TEXT, username TEXT, note TEXT)")
3251
3252 try:
3253 params = int_eap_server_params()
3254 params["eap_user_file"] = "sqlite:" + dbfile
3255 hostapd.add_ap(apdev[0]['ifname'], params)
3256 eap_connect(dev[0], apdev[0], "TTLS", "user-mschapv2",
3257 anonymous_identity="ttls", password="password",
3258 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3259 dev[0].request("REMOVE_NETWORK all")
3260 eap_connect(dev[1], apdev[0], "TTLS", "user-mschap",
3261 anonymous_identity="ttls", password="password",
3262 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP")
3263 dev[1].request("REMOVE_NETWORK all")
3264 eap_connect(dev[0], apdev[0], "TTLS", "user-chap",
3265 anonymous_identity="ttls", password="password",
3266 ca_cert="auth_serv/ca.pem", phase2="auth=CHAP")
3267 eap_connect(dev[1], apdev[0], "TTLS", "user-pap",
3268 anonymous_identity="ttls", password="password",
3269 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3270 finally:
3271 os.remove(dbfile)
b246e2af
JM		 3272
3273def test_ap_wpa2_eap_non_ascii_identity(dev, apdev):
3274 """WPA2-Enterprise connection attempt using non-ASCII identity"""
3275 params = int_eap_server_params()
3276 hostapd.add_ap(apdev[0]['ifname'], params)
3277 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3278 identity="\x80", password="password", wait_connect=False)
3279 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3280 identity="a\x80", password="password", wait_connect=False)
3281 for i in range(0, 2):
3282 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3283 if ev is None:
3284 raise Exception("Association and EAP start timed out")
3285 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
3286 if ev is None:
3287 raise Exception("EAP method selection timed out")
3288
3289def test_ap_wpa2_eap_non_ascii_identity2(dev, apdev):
3290 """WPA2-Enterprise connection attempt using non-ASCII identity"""
3291 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3292 hostapd.add_ap(apdev[0]['ifname'], params)
3293 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3294 identity="\x80", password="password", wait_connect=False)
3295 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3296 identity="a\x80", password="password", wait_connect=False)
3297 for i in range(0, 2):
3298 ev = dev[i].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10)
3299 if ev is None:
3300 raise Exception("Association and EAP start timed out")
3301 ev = dev[i].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10)
3302 if ev is None:
3303 raise Exception("EAP method selection timed out")
89f20842
JM		 3304
3305def test_openssl_cipher_suite_config_wpas(dev, apdev):
3306 """OpenSSL cipher suite configuration on wpa_supplicant"""
a783340d
JM		 3307 tls = dev[0].request("GET tls_library")
3308 if not tls.startswith("OpenSSL"):
3309 raise HwsimSkip("TLS library is not OpenSSL: " + tls)
89f20842
JM		 3310 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3311 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3312 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3313 anonymous_identity="ttls", password="password",
3314 openssl_ciphers="AES128",
3315 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3316 eap_connect(dev[1], apdev[0], "TTLS", "pap user",
3317 anonymous_identity="ttls", password="password",
3318 openssl_ciphers="EXPORT",
3319 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
9dd21d51 3320 expect_failure=True, maybe_local_error=True)
7be5ec99
JM		 3321 dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
3322 identity="pap user", anonymous_identity="ttls",
3323 password="password",
3324 openssl_ciphers="FOO",
3325 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
3326 wait_connect=False)
3327 ev = dev[2].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
3328 if ev is None:
3329 raise Exception("EAP failure after invalid openssl_ciphers not reported")
3330 dev[2].request("DISCONNECT")
89f20842
JM		 3331
3332def test_openssl_cipher_suite_config_hapd(dev, apdev):
3333 """OpenSSL cipher suite configuration on hostapd"""
a783340d
JM		 3334 tls = dev[0].request("GET tls_library")
3335 if not tls.startswith("OpenSSL"):
3336 raise HwsimSkip("wpa_supplicant TLS library is not OpenSSL: " + tls)
89f20842
JM		 3337 params = int_eap_server_params()
3338 params['openssl_ciphers'] = "AES256"
3339 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
a783340d
JM		 3340 tls = hapd.request("GET tls_library")
3341 if not tls.startswith("OpenSSL"):
3342 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
89f20842
JM		 3343 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3344 anonymous_identity="ttls", password="password",
3345 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3346 eap_connect(dev[1], apdev[0], "TTLS", "pap user",
3347 anonymous_identity="ttls", password="password",
3348 openssl_ciphers="AES128",
3349 ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
3350 expect_failure=True)
3351 eap_connect(dev[2], apdev[0], "TTLS", "pap user",
3352 anonymous_identity="ttls", password="password",
3353 openssl_ciphers="HIGH:!ADH",
3354 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
5b3c40a6 3355
7be5ec99
JM		 3356 params['openssl_ciphers'] = "FOO"
3357 hapd2 = hostapd.add_ap(apdev[1]['ifname'], params, no_enable=True)
3358 if "FAIL" not in hapd2.request("ENABLE"):
3359 raise Exception("Invalid openssl_ciphers value accepted")
3360
5b3c40a6
JM		 3361def test_wpa2_eap_ttls_pap_key_lifetime_in_memory(dev, apdev, params):
3362 """Key lifetime in memory with WPA2-Enterprise using EAP-TTLS/PAP"""
3363 p = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3364 hapd = hostapd.add_ap(apdev[0]['ifname'], p)
3365 password = "63d2d21ac3c09ed567ee004a34490f1d16e7fa5835edf17ddba70a63f1a90a25"
3366 pid = find_wpas_process(dev[0])
3367 id = eap_connect(dev[0], apdev[0], "TTLS", "pap-secret",
3368 anonymous_identity="ttls", password=password,
3369 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
54f2cae2 3370 time.sleep(1)
5b3c40a6
JM		 3371 buf = read_process_memory(pid, password)
3372
3373 dev[0].request("DISCONNECT")
3374 dev[0].wait_disconnected()
3375
3376 dev[0].relog()
750904dd
JM		 3377 msk = None
3378 emsk = None
5b3c40a6
JM		 3379 pmk = None
3380 ptk = None
3381 gtk = None
3382 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
3383 for l in f.readlines():
750904dd
JM		 3384 if "EAP-TTLS: Derived key - hexdump" in l:
3385 val = l.strip().split(':')[3].replace(' ', '')
3386 msk = binascii.unhexlify(val)
3387 if "EAP-TTLS: Derived EMSK - hexdump" in l:
3388 val = l.strip().split(':')[3].replace(' ', '')
3389 emsk = binascii.unhexlify(val)
5b3c40a6
JM		 3390 if "WPA: PMK - hexdump" in l:
3391 val = l.strip().split(':')[3].replace(' ', '')
3392 pmk = binascii.unhexlify(val)
3393 if "WPA: PTK - hexdump" in l:
3394 val = l.strip().split(':')[3].replace(' ', '')
3395 ptk = binascii.unhexlify(val)
3396 if "WPA: Group Key - hexdump" in l:
3397 val = l.strip().split(':')[3].replace(' ', '')
3398 gtk = binascii.unhexlify(val)
750904dd 3399 if not msk or not emsk or not pmk or not ptk or not gtk:
5b3c40a6
JM		 3400 raise Exception("Could not find keys from debug log")
3401 if len(gtk) != 16:
3402 raise Exception("Unexpected GTK length")
3403
3404 kck = ptk[0:16]
3405 kek = ptk[16:32]
3406 tk = ptk[32:48]
3407
3408 fname = os.path.join(params['logdir'],
3409 'wpa2_eap_ttls_pap_key_lifetime_in_memory.memctx-')
3410
3411 logger.info("Checking keys in memory while associated")
3412 get_key_locations(buf, password, "Password")
3413 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3414 get_key_locations(buf, msk, "MSK")
3415 get_key_locations(buf, emsk, "EMSK")
5b3c40a6 3416 if password not in buf:
81e787b7 3417 raise HwsimSkip("Password not found while associated")
5b3c40a6 3418 if pmk not in buf:
81e787b7 3419 raise HwsimSkip("PMK not found while associated")
5b3c40a6
JM		 3420 if kck not in buf:
3421 raise Exception("KCK not found while associated")
3422 if kek not in buf:
3423 raise Exception("KEK not found while associated")
3424 if tk in buf:
3425 raise Exception("TK found from memory")
3426 if gtk in buf:
8eb45bde 3427 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 3428 raise Exception("GTK found from memory")
3429
3430 logger.info("Checking keys in memory after disassociation")
3431 buf = read_process_memory(pid, password)
3432
3433 # Note: Password is still present in network configuration
3434 # Note: PMK is in PMKSA cache and EAP fast re-auth data
3435
3436 get_key_locations(buf, password, "Password")
3437 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3438 get_key_locations(buf, msk, "MSK")
3439 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3440 verify_not_present(buf, kck, fname, "KCK")
3441 verify_not_present(buf, kek, fname, "KEK")
3442 verify_not_present(buf, tk, fname, "TK")
3443 verify_not_present(buf, gtk, fname, "GTK")
3444
3445 dev[0].request("PMKSA_FLUSH")
3446 dev[0].set_network_quoted(id, "identity", "foo")
3447 logger.info("Checking keys in memory after PMKSA cache and EAP fast reauth flush")
3448 buf = read_process_memory(pid, password)
3449 get_key_locations(buf, password, "Password")
3450 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3451 get_key_locations(buf, msk, "MSK")
3452 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3453 verify_not_present(buf, pmk, fname, "PMK")
3454
3455 dev[0].request("REMOVE_NETWORK all")
3456
3457 logger.info("Checking keys in memory after network profile removal")
3458 buf = read_process_memory(pid, password)
3459
3460 get_key_locations(buf, password, "Password")
3461 get_key_locations(buf, pmk, "PMK")
750904dd
JM		 3462 get_key_locations(buf, msk, "MSK")
3463 get_key_locations(buf, emsk, "EMSK")
5b3c40a6
JM		 3464 verify_not_present(buf, password, fname, "password")
3465 verify_not_present(buf, pmk, fname, "PMK")
3466 verify_not_present(buf, kck, fname, "KCK")
3467 verify_not_present(buf, kek, fname, "KEK")
3468 verify_not_present(buf, tk, fname, "TK")
3469 verify_not_present(buf, gtk, fname, "GTK")
750904dd
JM		 3470 verify_not_present(buf, msk, fname, "MSK")
3471 verify_not_present(buf, emsk, fname, "EMSK")
a08fdb17
JM		 3472
3473def test_ap_wpa2_eap_unexpected_wep_eapol_key(dev, apdev):
3474 """WPA2-Enterprise connection and unexpected WEP EAPOL-Key"""
3475 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3476 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3477 bssid = apdev[0]['bssid']
3478 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3479 anonymous_identity="ttls", password="password",
3480 ca_cert="auth_serv/ca.pem", phase2="auth=PAP")
3481
3482 # Send unexpected WEP EAPOL-Key; this gets dropped
3483 res = dev[0].request("EAPOL_RX " + bssid + " 0203002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000")
3484 if "OK" not in res:
3485 raise Exception("EAPOL_RX to wpa_supplicant failed")
52352802
JM		 3486
3487def test_ap_wpa2_eap_in_bridge(dev, apdev):
3488 """WPA2-EAP and wpas interface in a bridge"""
3489 br_ifname='sta-br0'
3490 ifname='wlan5'
3491 try:
3492 _test_ap_wpa2_eap_in_bridge(dev, apdev)
3493 finally:
3494 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'down'])
3495 subprocess.call(['brctl', 'delif', br_ifname, ifname])
3496 subprocess.call(['brctl', 'delbr', br_ifname])
3497 subprocess.call(['iw', ifname, 'set', '4addr', 'off'])
3498
3499def _test_ap_wpa2_eap_in_bridge(dev, apdev):
3500 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3501 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3502
3503 br_ifname='sta-br0'
3504 ifname='wlan5'
3505 wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
3506 subprocess.call(['brctl', 'addbr', br_ifname])
3507 subprocess.call(['brctl', 'setfd', br_ifname, '0'])
3508 subprocess.call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
3509 subprocess.call(['iw', ifname, 'set', '4addr', 'on'])
3510 subprocess.check_call(['brctl', 'addif', br_ifname, ifname])
3511 wpas.interface_add(ifname, br_ifname=br_ifname)
4b9d79b6 3512 wpas.dump_monitor()
52352802
JM		 3513
3514 id = eap_connect(wpas, apdev[0], "PAX", "pax.user@example.com",
3515 password_hex="0123456789abcdef0123456789abcdef")
4b9d79b6 3516 wpas.dump_monitor()
52352802 3517 eap_reauth(wpas, "PAX")
4b9d79b6 3518 wpas.dump_monitor()
52352802
JM		 3519 # Try again as a regression test for packet socket workaround
3520 eap_reauth(wpas, "PAX")
4b9d79b6 3521 wpas.dump_monitor()
52352802
JM		 3522 wpas.request("DISCONNECT")
3523 wpas.wait_disconnected()
4b9d79b6 3524 wpas.dump_monitor()
52352802
JM		 3525 wpas.request("RECONNECT")
3526 wpas.wait_connected()
4b9d79b6 3527 wpas.dump_monitor()
febf5752
JM		 3528
3529def test_ap_wpa2_eap_session_ticket(dev, apdev):
3530 """WPA2-Enterprise connection using EAP-TTLS and TLS session ticket enabled"""
3531 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3532 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3533 key_mgmt = hapd.get_config()['key_mgmt']
3534 if key_mgmt.split(' ')[0] != "WPA-EAP":
3535 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3536 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3537 anonymous_identity="ttls", password="password",
3538 ca_cert="auth_serv/ca.pem",
3539 phase1="tls_disable_session_ticket=0", phase2="auth=PAP")
3540 eap_reauth(dev[0], "TTLS")
3541
3542def test_ap_wpa2_eap_no_workaround(dev, apdev):
3543 """WPA2-Enterprise connection using EAP-TTLS and eap_workaround=0"""
3544 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3545 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3546 key_mgmt = hapd.get_config()['key_mgmt']
3547 if key_mgmt.split(' ')[0] != "WPA-EAP":
3548 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
3549 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3550 anonymous_identity="ttls", password="password",
3551 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3552 phase2="auth=PAP")
3553 eap_reauth(dev[0], "TTLS")
b197a819
JM		 3554
3555def test_ap_wpa2_eap_tls_check_crl(dev, apdev):
3556 """EAP-TLS and server checking CRL"""
3557 params = int_eap_server_params()
3558 params['check_crl'] = '1'
3559 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3560
3561 # check_crl=1 and no CRL available --> reject connection
3562 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3563 client_cert="auth_serv/user.pem",
3564 private_key="auth_serv/user.key", expect_failure=True)
3565 dev[0].request("REMOVE_NETWORK all")
3566
3567 hapd.disable()
3568 hapd.set("ca_cert", "auth_serv/ca-and-crl.pem")
3569 hapd.enable()
3570
3571 # check_crl=1 and valid CRL --> accept
3572 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3573 client_cert="auth_serv/user.pem",
3574 private_key="auth_serv/user.key")
3575 dev[0].request("REMOVE_NETWORK all")
3576
3577 hapd.disable()
3578 hapd.set("check_crl", "2")
3579 hapd.enable()
3580
3581 # check_crl=2 and valid CRL --> accept
3582 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3583 client_cert="auth_serv/user.pem",
3584 private_key="auth_serv/user.key")
3585 dev[0].request("REMOVE_NETWORK all")
b1fb4275
JM		 3586
3587def test_ap_wpa2_eap_tls_oom(dev, apdev):
3588 """EAP-TLS and OOM"""
3589 check_subject_match_support(dev[0])
3590 check_altsubject_match_support(dev[0])
e78eb404 3591 check_domain_match(dev[0])
b1fb4275
JM		 3592 check_domain_match_full(dev[0])
3593
3594 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3595 hostapd.add_ap(apdev[0]['ifname'], params)
3596
3597 tests = [ (1, "tls_connection_set_subject_match"),
3598 (2, "tls_connection_set_subject_match"),
3599 (3, "tls_connection_set_subject_match"),
3600 (4, "tls_connection_set_subject_match") ]
3601 for count, func in tests:
3602 with alloc_fail(dev[0], count, func):
3603 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3604 identity="tls user", ca_cert="auth_serv/ca.pem",
3605 client_cert="auth_serv/user.pem",
3606 private_key="auth_serv/user.key",
3607 subject_match="/C=FI/O=w1.fi/CN=server.w1.fi",
3608 altsubject_match="EMAIL:noone@example.com;DNS:server.w1.fi;URI:http://example.com/",
3609 domain_suffix_match="server.w1.fi",
3610 domain_match="server.w1.fi",
3611 wait_connect=False, scan_freq="2412")
3612 # TLS parameter configuration error results in CTRL-REQ-PASSPHRASE
3613 ev = dev[0].wait_event(["CTRL-REQ-PASSPHRASE"], timeout=5)
3614 if ev is None:
3615 raise Exception("No passphrase request")
3616 dev[0].request("REMOVE_NETWORK all")
3617 dev[0].wait_disconnected()
405c621c
JM		 3618
3619def test_ap_wpa2_eap_tls_macacl(dev, apdev):
3620 """WPA2-Enterprise connection using MAC ACL"""
3621 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3622 params["macaddr_acl"] = "2"
3623 hostapd.add_ap(apdev[0]['ifname'], params)
3624 eap_connect(dev[1], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3625 client_cert="auth_serv/user.pem",
3626 private_key="auth_serv/user.key")
85774b70
JM		 3627
3628def test_ap_wpa2_eap_oom(dev, apdev):
3629 """EAP server and OOM"""
3630 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3631 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3632 dev[0].scan_for_bss(apdev[0]['bssid'], freq=2412)
3633
3634 with alloc_fail(hapd, 1, "eapol_auth_alloc"):
3635 # The first attempt fails, but STA will send EAPOL-Start to retry and
3636 # that succeeds.
3637 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
3638 identity="tls user", ca_cert="auth_serv/ca.pem",
3639 client_cert="auth_serv/user.pem",
3640 private_key="auth_serv/user.key",
3641 scan_freq="2412")
6c4b5da4
JM		 3642
3643def check_tls_ver(dev, ap, phase1, expected):
3644 eap_connect(dev, ap, "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3645 client_cert="auth_serv/user.pem",
3646 private_key="auth_serv/user.key",
3647 phase1=phase1)
3648 ver = dev.get_status_field("eap_tls_version")
3649 if ver != expected:
3650 raise Exception("Unexpected TLS version (expected %s): %s" % (expected, ver))
3651
3652def test_ap_wpa2_eap_tls_versions(dev, apdev):
3653 """EAP-TLS and TLS version configuration"""
3654 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3655 hostapd.add_ap(apdev[0]['ifname'], params)
3656
3657 tls = dev[0].request("GET tls_library")
3658 if tls.startswith("OpenSSL"):
3659 if "build=OpenSSL 1.0.2" in tls and "run=OpenSSL 1.0.2" in tls:
3660 check_tls_ver(dev[0], apdev[0],
3661 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1",
3662 "TLSv1.2")
2286578f
JM		 3663 elif tls.startswith("internal"):
3664 check_tls_ver(dev[0], apdev[0],
3665 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_1=1", "TLSv1.2")
6c4b5da4
JM		 3666 check_tls_ver(dev[1], apdev[0],
3667 "tls_disable_tlsv1_0=1 tls_disable_tlsv1_2=1", "TLSv1.1")
3668 check_tls_ver(dev[2], apdev[0],
3669 "tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1", "TLSv1")
ecafa0cf
JM		 3670
3671def test_rsn_ie_proto_eap_sta(dev, apdev):
3672 """RSN element protocol testing for EAP cases on STA side"""
3673 bssid = apdev[0]['bssid']
3674 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3675 # This is the RSN element used normally by hostapd
3676 params['own_ie_override'] = '30140100000fac040100000fac040100000fac010c00'
3677 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3678 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="GPSK",
3679 identity="gpsk user",
3680 password="abcdefghijklmnop0123456789abcdef",
3681 scan_freq="2412")
3682
3683 tests = [ ('No RSN Capabilities field',
3684 '30120100000fac040100000fac040100000fac01'),
3685 ('No AKM Suite fields',
3686 '300c0100000fac040100000fac04'),
3687 ('No Pairwise Cipher Suite fields',
3688 '30060100000fac04'),
3689 ('No Group Data Cipher Suite field',
3690 '30020100') ]
3691 for txt,ie in tests:
3692 dev[0].request("DISCONNECT")
3693 dev[0].wait_disconnected()
3694 logger.info(txt)
3695 hapd.disable()
3696 hapd.set('own_ie_override', ie)
3697 hapd.enable()
3698 dev[0].request("BSS_FLUSH 0")
3699 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
3700 dev[0].select_network(id, freq=2412)
3701 dev[0].wait_connected()
f9dd43ea
JM		 3702
3703def check_tls_session_resumption_capa(dev, hapd):
3704 tls = hapd.request("GET tls_library")
3705 if not tls.startswith("OpenSSL"):
3706 raise HwsimSkip("hostapd TLS library is not OpenSSL: " + tls)
3707
3708 tls = dev.request("GET tls_library")
3709 if not tls.startswith("OpenSSL"):
3710 raise HwsimSkip("Session resumption not supported with this TLS library: " + tls)
3711
3712def test_eap_ttls_pap_session_resumption(dev, apdev):
3713 """EAP-TTLS/PAP session resumption"""
3714 params = int_eap_server_params()
3715 params['tls_session_lifetime'] = '60'
3716 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3717 check_tls_session_resumption_capa(dev[0], hapd)
3718 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3719 anonymous_identity="ttls", password="password",
3720 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3721 phase2="auth=PAP")
3722 if dev[0].get_status_field("tls_session_reused") != '0':
3723 raise Exception("Unexpected session resumption on the first connection")
3724
3725 dev[0].request("REAUTHENTICATE")
3726 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3727 if ev is None:
3728 raise Exception("EAP success timed out")
3729 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3730 if ev is None:
3731 raise Exception("Key handshake with the AP timed out")
3732 if dev[0].get_status_field("tls_session_reused") != '1':
3733 raise Exception("Session resumption not used on the second connection")
3734
3735def test_eap_ttls_chap_session_resumption(dev, apdev):
3736 """EAP-TTLS/CHAP session resumption"""
3737 params = int_eap_server_params()
3738 params['tls_session_lifetime'] = '60'
3739 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3740 check_tls_session_resumption_capa(dev[0], hapd)
3741 eap_connect(dev[0], apdev[0], "TTLS", "chap user",
3742 anonymous_identity="ttls", password="password",
3743 ca_cert="auth_serv/ca.der", phase2="auth=CHAP")
3744 if dev[0].get_status_field("tls_session_reused") != '0':
3745 raise Exception("Unexpected session resumption on the first connection")
3746
3747 dev[0].request("REAUTHENTICATE")
3748 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3749 if ev is None:
3750 raise Exception("EAP success timed out")
3751 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3752 if ev is None:
3753 raise Exception("Key handshake with the AP timed out")
3754 if dev[0].get_status_field("tls_session_reused") != '1':
3755 raise Exception("Session resumption not used on the second connection")
3756
3757def test_eap_ttls_mschap_session_resumption(dev, apdev):
3758 """EAP-TTLS/MSCHAP session resumption"""
e78eb404 3759 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 3760 params = int_eap_server_params()
3761 params['tls_session_lifetime'] = '60'
3762 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3763 check_tls_session_resumption_capa(dev[0], hapd)
3764 eap_connect(dev[0], apdev[0], "TTLS", "mschap user",
3765 anonymous_identity="ttls", password="password",
3766 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP",
3767 domain_suffix_match="server.w1.fi")
3768 if dev[0].get_status_field("tls_session_reused") != '0':
3769 raise Exception("Unexpected session resumption on the first connection")
3770
3771 dev[0].request("REAUTHENTICATE")
3772 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3773 if ev is None:
3774 raise Exception("EAP success timed out")
3775 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3776 if ev is None:
3777 raise Exception("Key handshake with the AP timed out")
3778 if dev[0].get_status_field("tls_session_reused") != '1':
3779 raise Exception("Session resumption not used on the second connection")
3780
3781def test_eap_ttls_mschapv2_session_resumption(dev, apdev):
3782 """EAP-TTLS/MSCHAPv2 session resumption"""
e78eb404 3783 check_domain_suffix_match(dev[0])
f9dd43ea
JM		 3784 check_eap_capa(dev[0], "MSCHAPV2")
3785 params = int_eap_server_params()
3786 params['tls_session_lifetime'] = '60'
3787 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3788 check_tls_session_resumption_capa(dev[0], hapd)
3789 eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user",
3790 anonymous_identity="ttls", password="password",
3791 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
3792 domain_suffix_match="server.w1.fi")
3793 if dev[0].get_status_field("tls_session_reused") != '0':
3794 raise Exception("Unexpected session resumption on the first connection")
3795
3796 dev[0].request("REAUTHENTICATE")
3797 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3798 if ev is None:
3799 raise Exception("EAP success timed out")
3800 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3801 if ev is None:
3802 raise Exception("Key handshake with the AP timed out")
3803 if dev[0].get_status_field("tls_session_reused") != '1':
3804 raise Exception("Session resumption not used on the second connection")
3805
3806def test_eap_ttls_eap_gtc_session_resumption(dev, apdev):
3807 """EAP-TTLS/EAP-GTC session resumption"""
3808 params = int_eap_server_params()
3809 params['tls_session_lifetime'] = '60'
3810 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3811 check_tls_session_resumption_capa(dev[0], hapd)
3812 eap_connect(dev[0], apdev[0], "TTLS", "user",
3813 anonymous_identity="ttls", password="password",
3814 ca_cert="auth_serv/ca.pem", phase2="autheap=GTC")
3815 if dev[0].get_status_field("tls_session_reused") != '0':
3816 raise Exception("Unexpected session resumption on the first connection")
3817
3818 dev[0].request("REAUTHENTICATE")
3819 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3820 if ev is None:
3821 raise Exception("EAP success timed out")
3822 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3823 if ev is None:
3824 raise Exception("Key handshake with the AP timed out")
3825 if dev[0].get_status_field("tls_session_reused") != '1':
3826 raise Exception("Session resumption not used on the second connection")
3827
3828def test_eap_ttls_no_session_resumption(dev, apdev):
3829 """EAP-TTLS session resumption disabled on server"""
3830 params = int_eap_server_params()
3831 params['tls_session_lifetime'] = '0'
3832 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3833 eap_connect(dev[0], apdev[0], "TTLS", "pap user",
3834 anonymous_identity="ttls", password="password",
3835 ca_cert="auth_serv/ca.pem", eap_workaround='0',
3836 phase2="auth=PAP")
3837 if dev[0].get_status_field("tls_session_reused") != '0':
3838 raise Exception("Unexpected session resumption on the first connection")
3839
3840 dev[0].request("REAUTHENTICATE")
3841 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3842 if ev is None:
3843 raise Exception("EAP success timed out")
3844 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3845 if ev is None:
3846 raise Exception("Key handshake with the AP timed out")
3847 if dev[0].get_status_field("tls_session_reused") != '0':
3848 raise Exception("Unexpected session resumption on the second connection")
3849
3850def test_eap_peap_session_resumption(dev, apdev):
3851 """EAP-PEAP session resumption"""
3852 params = int_eap_server_params()
3853 params['tls_session_lifetime'] = '60'
3854 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3855 check_tls_session_resumption_capa(dev[0], hapd)
3856 eap_connect(dev[0], apdev[0], "PEAP", "user",
3857 anonymous_identity="peap", password="password",
3858 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3859 if dev[0].get_status_field("tls_session_reused") != '0':
3860 raise Exception("Unexpected session resumption on the first connection")
3861
3862 dev[0].request("REAUTHENTICATE")
3863 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3864 if ev is None:
3865 raise Exception("EAP success timed out")
3866 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3867 if ev is None:
3868 raise Exception("Key handshake with the AP timed out")
3869 if dev[0].get_status_field("tls_session_reused") != '1':
3870 raise Exception("Session resumption not used on the second connection")
3871
3872def test_eap_peap_no_session_resumption(dev, apdev):
3873 """EAP-PEAP session resumption disabled on server"""
3874 params = int_eap_server_params()
3875 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3876 eap_connect(dev[0], apdev[0], "PEAP", "user",
3877 anonymous_identity="peap", password="password",
3878 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2")
3879 if dev[0].get_status_field("tls_session_reused") != '0':
3880 raise Exception("Unexpected session resumption on the first connection")
3881
3882 dev[0].request("REAUTHENTICATE")
3883 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3884 if ev is None:
3885 raise Exception("EAP success timed out")
3886 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3887 if ev is None:
3888 raise Exception("Key handshake with the AP timed out")
3889 if dev[0].get_status_field("tls_session_reused") != '0':
3890 raise Exception("Unexpected session resumption on the second connection")
3891
3892def test_eap_tls_session_resumption(dev, apdev):
3893 """EAP-TLS session resumption"""
3894 params = int_eap_server_params()
3895 params['tls_session_lifetime'] = '60'
3896 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3897 check_tls_session_resumption_capa(dev[0], hapd)
3898 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3899 client_cert="auth_serv/user.pem",
3900 private_key="auth_serv/user.key")
3901 if dev[0].get_status_field("tls_session_reused") != '0':
3902 raise Exception("Unexpected session resumption on the first connection")
3903
3904 dev[0].request("REAUTHENTICATE")
3905 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3906 if ev is None:
3907 raise Exception("EAP success timed out")
3908 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3909 if ev is None:
3910 raise Exception("Key handshake with the AP timed out")
3911 if dev[0].get_status_field("tls_session_reused") != '1':
3912 raise Exception("Session resumption not used on the second connection")
3913
3914 dev[0].request("REAUTHENTICATE")
3915 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3916 if ev is None:
3917 raise Exception("EAP success timed out")
3918 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3919 if ev is None:
3920 raise Exception("Key handshake with the AP timed out")
3921 if dev[0].get_status_field("tls_session_reused") != '1':
3922 raise Exception("Session resumption not used on the third connection")
3923
3924def test_eap_tls_session_resumption_expiration(dev, apdev):
3925 """EAP-TLS session resumption"""
3926 params = int_eap_server_params()
3927 params['tls_session_lifetime'] = '1'
3928 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3929 check_tls_session_resumption_capa(dev[0], hapd)
3930 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3931 client_cert="auth_serv/user.pem",
3932 private_key="auth_serv/user.key")
3933 if dev[0].get_status_field("tls_session_reused") != '0':
3934 raise Exception("Unexpected session resumption on the first connection")
3935
3936 # Allow multiple attempts since OpenSSL may not expire the cached entry
3937 # immediately.
3938 for i in range(10):
3939 time.sleep(1.2)
3940
3941 dev[0].request("REAUTHENTICATE")
3942 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3943 if ev is None:
3944 raise Exception("EAP success timed out")
3945 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3946 if ev is None:
3947 raise Exception("Key handshake with the AP timed out")
3948 if dev[0].get_status_field("tls_session_reused") == '0':
3949 break
3950 if dev[0].get_status_field("tls_session_reused") != '0':
3951 raise Exception("Session resumption used after lifetime expiration")
3952
3953def test_eap_tls_no_session_resumption(dev, apdev):
3954 """EAP-TLS session resumption disabled on server"""
3955 params = int_eap_server_params()
3956 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3957 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3958 client_cert="auth_serv/user.pem",
3959 private_key="auth_serv/user.key")
3960 if dev[0].get_status_field("tls_session_reused") != '0':
3961 raise Exception("Unexpected session resumption on the first connection")
3962
3963 dev[0].request("REAUTHENTICATE")
3964 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3965 if ev is None:
3966 raise Exception("EAP success timed out")
3967 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
3968 if ev is None:
3969 raise Exception("Key handshake with the AP timed out")
3970 if dev[0].get_status_field("tls_session_reused") != '0':
3971 raise Exception("Unexpected session resumption on the second connection")
3972
3973def test_eap_tls_session_resumption_radius(dev, apdev):
3974 """EAP-TLS session resumption (RADIUS)"""
3975 params = { "ssid": "as", "beacon_int": "2000",
3976 "radius_server_clients": "auth_serv/radius_clients.conf",
3977 "radius_server_auth_port": '18128',
3978 "eap_server": "1",
3979 "eap_user_file": "auth_serv/eap_user.conf",
3980 "ca_cert": "auth_serv/ca.pem",
3981 "server_cert": "auth_serv/server.pem",
3982 "private_key": "auth_serv/server.key",
3983 "tls_session_lifetime": "60" }
3984 authsrv = hostapd.add_ap(apdev[1]['ifname'], params)
3985 check_tls_session_resumption_capa(dev[0], authsrv)
3986
3987 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
3988 params['auth_server_port'] = "18128"
3989 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
3990 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
3991 client_cert="auth_serv/user.pem",
3992 private_key="auth_serv/user.key")
3993 if dev[0].get_status_field("tls_session_reused") != '0':
3994 raise Exception("Unexpected session resumption on the first connection")
3995
3996 dev[0].request("REAUTHENTICATE")
3997 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
3998 if ev is None:
3999 raise Exception("EAP success timed out")
4000 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4001 if ev is None:
4002 raise Exception("Key handshake with the AP timed out")
4003 if dev[0].get_status_field("tls_session_reused") != '1':
4004 raise Exception("Session resumption not used on the second connection")
4005
4006def test_eap_tls_no_session_resumption_radius(dev, apdev):
4007 """EAP-TLS session resumption disabled (RADIUS)"""
4008 params = { "ssid": "as", "beacon_int": "2000",
4009 "radius_server_clients": "auth_serv/radius_clients.conf",
4010 "radius_server_auth_port": '18128',
4011 "eap_server": "1",
4012 "eap_user_file": "auth_serv/eap_user.conf",
4013 "ca_cert": "auth_serv/ca.pem",
4014 "server_cert": "auth_serv/server.pem",
4015 "private_key": "auth_serv/server.key",
4016 "tls_session_lifetime": "0" }
4017 hostapd.add_ap(apdev[1]['ifname'], params)
4018
4019 params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
4020 params['auth_server_port'] = "18128"
4021 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4022 eap_connect(dev[0], apdev[0], "TLS", "tls user", ca_cert="auth_serv/ca.pem",
4023 client_cert="auth_serv/user.pem",
4024 private_key="auth_serv/user.key")
4025 if dev[0].get_status_field("tls_session_reused") != '0':
4026 raise Exception("Unexpected session resumption on the first connection")
4027
4028 dev[0].request("REAUTHENTICATE")
4029 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10)
4030 if ev is None:
4031 raise Exception("EAP success timed out")
4032 ev = dev[0].wait_event(["WPA: Key negotiation completed"], timeout=10)
4033 if ev is None:
4034 raise Exception("Key handshake with the AP timed out")
4035 if dev[0].get_status_field("tls_session_reused") != '0':
4036 raise Exception("Unexpected session resumption on the second connection")
7c0d66cf
JM		 4037
4038def test_eap_mschapv2_errors(dev, apdev):
4039 """EAP-MSCHAPv2 error cases"""
4040 check_eap_capa(dev[0], "MSCHAPV2")
4041 check_eap_capa(dev[0], "FAST")
4042
4043 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
4044 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4045 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4046 identity="phase1-user", password="password",
4047 scan_freq="2412")
4048 dev[0].request("REMOVE_NETWORK all")
4049 dev[0].wait_disconnected()
4050
4051 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
4052 (1, "nt_password_hash;mschapv2_derive_response"),
4053 (1, "nt_password_hash;=mschapv2_derive_response"),
4054 (1, "generate_nt_response;mschapv2_derive_response"),
4055 (1, "generate_authenticator_response;mschapv2_derive_response"),
4056 (1, "nt_password_hash;=mschapv2_derive_response"),
4057 (1, "get_master_key;mschapv2_derive_response"),
4058 (1, "os_get_random;eap_mschapv2_challenge_reply") ]
4059 for count, func in tests:
4060 with fail_test(dev[0], count, func):
4061 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4062 identity="phase1-user", password="password",
4063 wait_connect=False, scan_freq="2412")
4064 wait_fail_trigger(dev[0], "GET_FAIL")
4065 dev[0].request("REMOVE_NETWORK all")
4066 dev[0].wait_disconnected()
4067
4068 tests = [ (1, "hash_nt_password_hash;mschapv2_derive_response"),
4069 (1, "hash_nt_password_hash;=mschapv2_derive_response"),
4070 (1, "generate_nt_response_pwhash;mschapv2_derive_response"),
4071 (1, "generate_authenticator_response_pwhash;mschapv2_derive_response") ]
4072 for count, func in tests:
4073 with fail_test(dev[0], count, func):
4074 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4075 identity="phase1-user",
4076 password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c",
4077 wait_connect=False, scan_freq="2412")
4078 wait_fail_trigger(dev[0], "GET_FAIL")
4079 dev[0].request("REMOVE_NETWORK all")
4080 dev[0].wait_disconnected()
4081
4082 tests = [ (1, "eap_mschapv2_init"),
4083 (1, "eap_msg_alloc;eap_mschapv2_challenge_reply"),
4084 (1, "eap_msg_alloc;eap_mschapv2_success"),
4085 (1, "eap_mschapv2_getKey") ]
4086 for count, func in tests:
4087 with alloc_fail(dev[0], count, func):
4088 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4089 identity="phase1-user", password="password",
4090 wait_connect=False, scan_freq="2412")
4091 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4092 dev[0].request("REMOVE_NETWORK all")
4093 dev[0].wait_disconnected()
4094
4095 tests = [ (1, "eap_msg_alloc;eap_mschapv2_failure") ]
4096 for count, func in tests:
4097 with alloc_fail(dev[0], count, func):
4098 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="MSCHAPV2",
4099 identity="phase1-user", password="wrong password",
4100 wait_connect=False, scan_freq="2412")
4101 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4102 dev[0].request("REMOVE_NETWORK all")
4103 dev[0].wait_disconnected()
4104
4105 tests = [ (2, "eap_mschapv2_init"),
4106 (3, "eap_mschapv2_init") ]
4107 for count, func in tests:
4108 with alloc_fail(dev[0], count, func):
4109 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="FAST",
4110 anonymous_identity="FAST", identity="user",
4111 password="password",
4112 ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
4113 phase1="fast_provisioning=1",
4114 pac_file="blob://fast_pac",
4115 wait_connect=False, scan_freq="2412")
4116 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4117 dev[0].request("REMOVE_NETWORK all")
4118 dev[0].wait_disconnected()
bf0ec17a
JM		 4119
4120def test_eap_gpsk_errors(dev, apdev):
4121 """EAP-GPSK error cases"""
4122 params = hostapd.wpa2_eap_params(ssid="test-wpa-eap")
4123 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
4124 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4125 identity="gpsk user",
4126 password="abcdefghijklmnop0123456789abcdef",
4127 scan_freq="2412")
4128 dev[0].request("REMOVE_NETWORK all")
4129 dev[0].wait_disconnected()
4130
4131 tests = [ (1, "os_get_random;eap_gpsk_send_gpsk_2", None),
4132 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
4133 "cipher=1"),
4134 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2",
4135 "cipher=2"),
4136 (1, "eap_gpsk_derive_keys_helper", None),
4137 (2, "eap_gpsk_derive_keys_helper", None),
4138 (1, "eap_gpsk_compute_mic_aes;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
4139 "cipher=1"),
4140 (1, "hmac_sha256;eap_gpsk_compute_mic;eap_gpsk_send_gpsk_2",
4141 "cipher=2"),
4142 (1, "eap_gpsk_compute_mic;eap_gpsk_validate_gpsk_3_mic", None),
4143 (1, "eap_gpsk_compute_mic;eap_gpsk_send_gpsk_4", None),
4144 (1, "eap_gpsk_derive_mid_helper", None) ]
4145 for count, func, phase1 in tests:
4146 with fail_test(dev[0], count, func):
4147 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4148 identity="gpsk user",
4149 password="abcdefghijklmnop0123456789abcdef",
4150 phase1=phase1,
4151 wait_connect=False, scan_freq="2412")
4152 wait_fail_trigger(dev[0], "GET_FAIL")
4153 dev[0].request("REMOVE_NETWORK all")
4154 dev[0].wait_disconnected()
4155
4156 tests = [ (1, "eap_gpsk_init"),
4157 (2, "eap_gpsk_init"),
4158 (3, "eap_gpsk_init"),
4159 (1, "eap_gpsk_process_id_server"),
4160 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_2"),
4161 (1, "eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
4162 (1, "eap_gpsk_derive_mid_helper;eap_gpsk_derive_session_id;eap_gpsk_send_gpsk_2"),
4163 (1, "eap_gpsk_derive_keys"),
4164 (1, "eap_gpsk_derive_keys_helper"),
4165 (1, "eap_msg_alloc;eap_gpsk_send_gpsk_4"),
4166 (1, "eap_gpsk_getKey"),
4167 (1, "eap_gpsk_get_emsk"),
4168 (1, "eap_gpsk_get_session_id") ]
4169 for count, func in tests:
4170 with alloc_fail(dev[0], count, func):
4171 dev[0].request("ERP_FLUSH")
4172 dev[0].connect("test-wpa-eap", key_mgmt="WPA-EAP", eap="GPSK",
4173 identity="gpsk user", erp="1",
4174 password="abcdefghijklmnop0123456789abcdef",
4175 wait_connect=False, scan_freq="2412")
4176 wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
4177 dev[0].request("REMOVE_NETWORK all")
4178 dev[0].wait_disconnected()
d4c3c055
JM		 4179
4180def test_ap_wpa2_eap_sim_db(dev, apdev, params):
4181 """EAP-SIM DB error cases"""
4182 sockpath = '/tmp/hlr_auc_gw.sock-test'
4183 try:
4184 os.remove(sockpath)
4185 except:
4186 pass
4187 hparams = int_eap_server_params()
4188 hparams['eap_sim_db'] = 'unix:' + sockpath
4189 hapd = hostapd.add_ap(apdev[0]['ifname'], hparams)
4190
4191 # Initial test with hlr_auc_gw socket not available
4192 id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP WPA-EAP-SHA256",
4193 eap="SIM", identity="1232010000000000",
4194 password="90dca4eda45b53cf0f12d7c9c3bc6a89:cb9cccc4b9258e6dca4760379fb82581",
4195 scan_freq="2412", wait_connect=False)
4196 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
4197 if ev is None:
4198 raise Exception("EAP-Failure not reported")
4199 dev[0].wait_disconnected()
4200 dev[0].request("DISCONNECT")
4201
4202 # Test with invalid responses and response timeout
4203
4204 class test_handler(SocketServer.DatagramRequestHandler):
4205 def handle(self):
4206 data = self.request[0].strip()
4207 socket = self.request[1]
4208 logger.debug("Received hlr_auc_gw request: " + data)
4209 # EAP-SIM DB: Failed to parse response string
4210 socket.sendto("FOO", self.client_address)
4211 # EAP-SIM DB: Failed to parse response string
4212 socket.sendto("FOO 1", self.client_address)
4213 # EAP-SIM DB: Unknown external response
4214 socket.sendto("FOO 1 2", self.client_address)
4215 logger.info("No proper response - wait for pending eap_sim_db request timeout")
4216
4217 server = SocketServer.UnixDatagramServer(sockpath, test_handler)
4218 server.timeout = 1
4219
4220 dev[0].select_network(id)
4221 server.handle_request()
4222 ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10)
4223 if ev is None:
4224 raise Exception("EAP-Failure not reported")
4225 dev[0].wait_disconnected()
4226 dev[0].request("DISCONNECT")
4227
4228 # Test with a valid response
4229
4230 class test_handler2(SocketServer.DatagramRequestHandler):
4231 def handle(self):
4232 data = self.request[0].strip()
4233 socket = self.request[1]
4234 logger.debug("Received hlr_auc_gw request: " + data)
4235 fname = os.path.join(params['logdir'],
4236 'hlr_auc_gw.milenage_db')
4237 cmd = subprocess.Popen(['../../hostapd/hlr_auc_gw',
4238 '-m', fname, data],
4239 stdout=subprocess.PIPE)
4240 res = cmd.stdout.read().strip()
4241 cmd.stdout.close()
4242 logger.debug("hlr_auc_gw response: " + res)
4243 socket.sendto(res, self.client_address)
4244
4245 server.RequestHandlerClass = test_handler2
4246
4247 dev[0].select_network(id)
4248 server.handle_request()
4249 dev[0].wait_connected()
4250 dev[0].request("DISCONNECT")
4251 dev[0].wait_disconnected()
d6ba709a
JM		 4252
4253def test_eap_tls_sha512(dev, apdev, params):
4254 """EAP-TLS with SHA512 signature"""
4255 params = int_eap_server_params()
4256 params["ca_cert"] = "auth_serv/sha512-ca.pem"
4257 params["server_cert"] = "auth_serv/sha512-server.pem"
4258 params["private_key"] = "auth_serv/sha512-server.key"
4259 hostapd.add_ap(apdev[0]['ifname'], params)
4260
4261 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4262 identity="tls user sha512",
4263 ca_cert="auth_serv/sha512-ca.pem",
4264 client_cert="auth_serv/sha512-user.pem",
4265 private_key="auth_serv/sha512-user.key",
4266 scan_freq="2412")
4267 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4268 identity="tls user sha512",
4269 ca_cert="auth_serv/sha512-ca.pem",
4270 client_cert="auth_serv/sha384-user.pem",
4271 private_key="auth_serv/sha384-user.key",
4272 scan_freq="2412")
4273
4274def test_eap_tls_sha384(dev, apdev, params):
4275 """EAP-TLS with SHA384 signature"""
4276 params = int_eap_server_params()
4277 params["ca_cert"] = "auth_serv/sha512-ca.pem"
4278 params["server_cert"] = "auth_serv/sha384-server.pem"
4279 params["private_key"] = "auth_serv/sha384-server.key"
4280 hostapd.add_ap(apdev[0]['ifname'], params)
4281
4282 dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4283 identity="tls user sha512",
4284 ca_cert="auth_serv/sha512-ca.pem",
4285 client_cert="auth_serv/sha512-user.pem",
4286 private_key="auth_serv/sha512-user.key",
4287 scan_freq="2412")
4288 dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS",
4289 identity="tls user sha512",
4290 ca_cert="auth_serv/sha512-ca.pem",
4291 client_cert="auth_serv/sha384-user.pem",
4292 private_key="auth_serv/sha384-user.key",
4293 scan_freq="2412")
Unnamed repository; edit this file 'description' to name the repository.