]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: DPP and provisoning DPP and legacy AKMs
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
cd7f1b9a
JM		 25
26def ft_base_rsn():
27 params = { "wpa": "2",
28 "wpa_key_mgmt": "FT-PSK",
29 "rsn_pairwise": "CCMP" }
30 return params
31
32def ft_base_mixed():
33 params = { "wpa": "3",
34 "wpa_key_mgmt": "WPA-PSK FT-PSK",
35 "wpa_pairwise": "TKIP",
36 "rsn_pairwise": "CCMP" }
37 return params
38
39def ft_params(rsn=True, ssid=None, passphrase=None):
40 if rsn:
41 params = ft_base_rsn()
42 else:
43 params = ft_base_mixed()
44 if ssid:
45 params["ssid"] = ssid
46 if passphrase:
47 params["wpa_passphrase"] = passphrase
48
49 params["mobility_domain"] = "a1b2"
50 params["r0_key_lifetime"] = "10000"
51 params["pmk_r1_push"] = "1"
52 params["reassociation_deadline"] = "1000"
53 return params
54
d0175d6e 55def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 56 params = ft_params(rsn, ssid, passphrase)
57 params['nas_identifier'] = "nas1.w1.fi"
58 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 59 return params
60
942b52a8 61def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 62 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 63 if discovery:
64 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
65 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 else:
67 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
68 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
69 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 70 return params
71
c95dd8e4
JM		 72def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
73 params = ft_params1a(rsn, ssid, passphrase)
74 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
75 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
76 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
77 return params
78
d0175d6e 79def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 80 params = ft_params(rsn, ssid, passphrase)
81 params['nas_identifier'] = "nas2.w1.fi"
82 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 83 return params
84
942b52a8 85def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 86 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 87 if discovery:
88 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
89 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 else:
91 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
92 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
93 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 94 return params
95
c95dd8e4
JM		 96def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
97 params = ft_params2a(rsn, ssid, passphrase)
98 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
99 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
100 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
101 return params
102
3b808945
JM		 103def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
104 params = ft_params(rsn, ssid, passphrase)
105 params['nas_identifier'] = "nas1.w1.fi"
106 params['r1_key_holder'] = "000102030405"
9441a227
MB		 107 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
108 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
109 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 110 return params
111
112def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
113 params = ft_params(rsn, ssid, passphrase)
114 params['nas_identifier'] = "nas2.w1.fi"
115 params['r1_key_holder'] = "000102030406"
9441a227
MB		 116 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
117 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
118 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 119 return params
120
121def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
122 params = ft_params(rsn, ssid, passphrase)
123 params['nas_identifier'] = "nas2.w1.fi"
124 params['r1_key_holder'] = "000102030406"
9441a227
MB		 125 params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
126 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
127 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 128 return params
129
7b741a53
JM		 130def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
131 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 132 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 133 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 134 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5
JM		 135 group_mgmt=None, ocv=None, sae_password=None,
136 sae_password_id=None):
cd7f1b9a 137 logger.info("Connect to first AP")
473e5176
MB		 138
139 copts = {}
140 copts["proto"] = "WPA2"
141 copts["ieee80211w"] = "1"
142 copts["scan_freq"] = "2412"
143 copts["pairwise"] = pairwise_cipher
144 copts["group"] = group_cipher
145 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 146 if group_mgmt:
147 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 148 if ocv:
149 copts["ocv"] = ocv
6f62809b 150 if eap:
55b3cda7 151 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 152 copts["eap"] = "GPSK"
153 copts["identity"] = eap_identity
154 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 155 else:
6f62809b 156 if sae:
473e5176 157 copts["key_mgmt"] = "FT-SAE"
6f62809b 158 else:
473e5176 159 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 160 if passphrase:
161 copts["psk"] = passphrase
162 if sae_password:
163 copts["sae_password"] = sae_password
164 if sae_password_id:
165 copts["sae_password_id"] = sae_password_id
473e5176
MB		 166 if force_initial_conn_to_first_ap:
167 copts["bssid"] = apdev[0]['bssid']
168 dev.connect(ssid, **copts)
169
cd7f1b9a
JM		 170 if dev.get_status_field('bssid') == apdev[0]['bssid']:
171 ap1 = apdev[0]
172 ap2 = apdev[1]
a8375c94
JM		 173 hapd1ap = hapd0
174 hapd2ap = hapd1
cd7f1b9a
JM		 175 else:
176 ap1 = apdev[1]
177 ap2 = apdev[0]
a8375c94
JM		 178 hapd1ap = hapd1
179 hapd2ap = hapd0
fd7205fa 180 if test_connectivity:
9c50a6d3
MB		 181 if conndev:
182 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
183 else:
184 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 185
655bc8bf 186 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 187
188 for i in range(0, roams):
e0382291
MB		 189 # Roaming artificially fast can make data test fail because the key is
190 # set later.
191 time.sleep(0.01)
40602101
JM		 192 logger.info("Roam to the second AP")
193 if over_ds:
194 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
195 else:
196 dev.roam(ap2['bssid'], fail_test=fail_test)
197 if fail_test:
198 return
199 if dev.get_status_field('bssid') != ap2['bssid']:
200 raise Exception("Did not connect to correct AP")
fd7205fa 201 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 202 if conndev:
203 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
204 else:
205 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 206
e0382291
MB		 207 # Roaming artificially fast can make data test fail because the key is
208 # set later.
209 time.sleep(0.01)
40602101
JM		 210 logger.info("Roam back to the first AP")
211 if over_ds:
212 dev.roam_over_ds(ap1['bssid'])
213 else:
214 dev.roam(ap1['bssid'])
215 if dev.get_status_field('bssid') != ap1['bssid']:
216 raise Exception("Did not connect to correct AP")
fd7205fa 217 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 218 if conndev:
219 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
220 else:
221 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 222
223def test_ap_ft(dev, apdev):
224 """WPA2-PSK-FT AP"""
225 ssid = "test-ft"
226 passphrase="12345678"
227
228 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 229 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 230 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 231 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 232
a8375c94 233 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 234 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
235 raise Exception("Scan results missing RSN element info")
cd7f1b9a 236
c95dd8e4
JM		 237def test_ap_ft_old_key(dev, apdev):
238 """WPA2-PSK-FT AP (old key)"""
239 ssid = "test-ft"
240 passphrase="12345678"
241
242 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
243 hapd0 = hostapd.add_ap(apdev[0], params)
244 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
245 hapd1 = hostapd.add_ap(apdev[1], params)
246
247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
248
e4612f84
JM		 249def test_ap_ft_multi_akm(dev, apdev):
250 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
251 ssid = "test-ft"
252 passphrase="12345678"
253
254 params = ft_params1(ssid=ssid, passphrase=passphrase)
255 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
256 hapd0 = hostapd.add_ap(apdev[0], params)
257 params = ft_params2(ssid=ssid, passphrase=passphrase)
258 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
259 hapd1 = hostapd.add_ap(apdev[1], params)
260
261 Wlantest.setup(hapd0)
262 wt = Wlantest()
263 wt.flush()
264 wt.add_passphrase(passphrase)
265
266 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
267 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
268 raise Exception("Scan results missing RSN element info")
269 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
270 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
271 scan_freq="2412")
272
d0175d6e
MB		 273def test_ap_ft_local_key_gen(dev, apdev):
274 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
275 ssid = "test-ft"
276 passphrase="12345678"
277
278 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 279 params['ft_psk_generate_local'] = "1"
8344ba12 280 del params['pmk_r1_push']
b098542c 281 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 282 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 283 params['ft_psk_generate_local'] = "1"
8344ba12 284 del params['pmk_r1_push']
b098542c 285 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
289 raise Exception("Scan results missing RSN element info")
290
473e5176
MB		 291def test_ap_ft_vlan(dev, apdev):
292 """WPA2-PSK-FT AP with VLAN"""
293 ssid = "test-ft"
294 passphrase="12345678"
295
296 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 297 params['dynamic_vlan'] = "1"
298 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 299 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
300
301 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 302 params['dynamic_vlan'] = "1"
303 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 304 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
307 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309
310def test_ap_ft_vlan_disconnected(dev, apdev):
311 """WPA2-PSK-FT AP with VLAN and local key generation"""
312 ssid = "test-ft"
313 passphrase="12345678"
314
315 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 316 params['dynamic_vlan'] = "1"
317 params['accept_mac_file'] = "hostapd.accept"
318 params['ft_psk_generate_local'] = "1"
473e5176
MB		 319 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
320
321 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 322 params['dynamic_vlan'] = "1"
323 params['accept_mac_file'] = "hostapd.accept"
324 params['ft_psk_generate_local'] = "1"
473e5176
MB		 325 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
331def test_ap_ft_vlan_2(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
333 ssid = "test-ft"
334 passphrase="12345678"
335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 342 params['dynamic_vlan'] = "1"
473e5176
MB		 343 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
344
345 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
346 force_initial_conn_to_first_ap=True)
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
40602101
JM		 350def test_ap_ft_many(dev, apdev):
351 """WPA2-PSK-FT AP multiple times"""
352 ssid = "test-ft"
353 passphrase="12345678"
354
355 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 356 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 357 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 358 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 359
a8375c94 360 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 361
473e5176
MB		 362def test_ap_ft_many_vlan(dev, apdev):
363 """WPA2-PSK-FT AP with VLAN multiple times"""
364 ssid = "test-ft"
365 passphrase="12345678"
366
367 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 368 params['dynamic_vlan'] = "1"
369 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 370 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
371
372 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 373 params['dynamic_vlan'] = "1"
374 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 375 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
376
377 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
378 conndev="brvlan1")
379
cd7f1b9a
JM		 380def test_ap_ft_mixed(dev, apdev):
381 """WPA2-PSK-FT mixed-mode AP"""
382 ssid = "test-ft-mixed"
383 passphrase="12345678"
384
385 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 386 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 387 key_mgmt = hapd.get_config()['key_mgmt']
388 vals = key_mgmt.split(' ')
389 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
390 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 391 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 392 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 393
a8375c94 394 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 395
396def test_ap_ft_pmf(dev, apdev):
397 """WPA2-PSK-FT AP with PMF"""
398 ssid = "test-ft"
399 passphrase="12345678"
400
401 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 402 params["ieee80211w"] = "2"
8b8a1864 403 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 404 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 405 params["ieee80211w"] = "2"
8b8a1864 406 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 407
a8375c94 408 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 409
ffcaca68
JM		 410def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
411 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
412 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
413
414def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
415 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
416 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
417
418def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
419 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
420 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
421
422def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
423 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
424 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
425
426def run_ap_ft_pmf_bip(dev, apdev, cipher):
427 if cipher not in dev[0].get_capability("group_mgmt"):
428 raise HwsimSkip("Cipher %s not supported" % cipher)
429
430 ssid = "test-ft"
431 passphrase="12345678"
432
433 params = ft_params1(ssid=ssid, passphrase=passphrase)
434 params["ieee80211w"] = "2"
435 params["group_mgmt_cipher"] = cipher
436 hapd0 = hostapd.add_ap(apdev[0], params)
437 params = ft_params2(ssid=ssid, passphrase=passphrase)
438 params["ieee80211w"] = "2"
439 params["group_mgmt_cipher"] = cipher
440 hapd1 = hostapd.add_ap(apdev[1], params)
441
442 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
443 group_mgmt=cipher)
444
e63d8837
MV		 445def test_ap_ft_ocv(dev, apdev):
446 """WPA2-PSK-FT AP with OCV"""
447 ssid = "test-ft"
448 passphrase="12345678"
449
450 params = ft_params1(ssid=ssid, passphrase=passphrase)
451 params["ieee80211w"] = "2"
452 params["ocv"] = "1"
453 try:
454 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 455 except Exception as e:
e63d8837
MV		 456 if "Failed to set hostapd parameter ocv" in str(e):
457 raise HwsimSkip("OCV not supported")
458 raise
459 params = ft_params2(ssid=ssid, passphrase=passphrase)
460 params["ieee80211w"] = "2"
461 params["ocv"] = "1"
462 hapd1 = hostapd.add_ap(apdev[1], params)
463
464 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
465
b553eab1
JM		 466def test_ap_ft_over_ds(dev, apdev):
467 """WPA2-PSK-FT AP over DS"""
468 ssid = "test-ft"
469 passphrase="12345678"
470
471 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 472 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 473 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 474 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 475
a8375c94 476 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
eaf3f9b1
JM		 477 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
478 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
b553eab1 479
02a4ac0f
JM		 480def cleanup_ap_ft_separate_hostapd():
481 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
482 stderr=open('/dev/null', 'w'))
483 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
484 stderr=open('/dev/null', 'w'))
485 subprocess.call(["ip", "link", "del", "veth0"],
486 stderr=open('/dev/null', 'w'))
487 subprocess.call(["ip", "link", "del", "veth1"],
488 stderr=open('/dev/null', 'w'))
489 for ifname in [ 'br0ft', 'br1ft', 'br-ft' ]:
490 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
491 stderr=open('/dev/null', 'w'))
492 subprocess.call(['brctl', 'delbr', ifname],
493 stderr=open('/dev/null', 'w'))
494
495def test_ap_ft_separate_hostapd(dev, apdev, params):
496 """WPA2-PSK-FT AP and separate hostapd process"""
497 try:
498 run_ap_ft_separate_hostapd(dev, apdev, params, False)
499 finally:
500 cleanup_ap_ft_separate_hostapd()
501
502def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
503 """WPA2-PSK-FT AP over DS and separate hostapd process"""
504 try:
505 run_ap_ft_separate_hostapd(dev, apdev, params, True)
506 finally:
507 cleanup_ap_ft_separate_hostapd()
508
509def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
510 ssid = "test-ft"
511 passphrase="12345678"
512 logdir = params['logdir']
513 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
514 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
515 global_ctrl = '/var/run/hostapd-ft'
516 br_ifname = 'br-ft'
517
518 try:
519 subprocess.check_call(['brctl', 'addbr', br_ifname])
520 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
521 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
522
523 subprocess.check_call([ "ip", "link", "add", "veth0", "type", "veth",
524 "peer", "name", "veth0br" ])
525 subprocess.check_call([ "ip", "link", "add", "veth1", "type", "veth",
526 "peer", "name", "veth1br" ])
527 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
528 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
529 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
530 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
531
532 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
533 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
534 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
535 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
536 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
537 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
538 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
539 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
540 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
541 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
542 except subprocess.CalledProcessError:
543 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
544
545 with HWSimRadio() as (radio, iface):
546 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
547 if not os.path.exists(prg):
548 prg = '../../hostapd/hostapd'
549 cmd = [ prg, '-B', '-ddKt',
550 '-P', pidfile, '-f', logfile, '-g', global_ctrl ]
551 subprocess.check_call(cmd)
552
553 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
554 apdev_ft = { 'ifname': iface }
555 apdev2 = [ apdev_ft, apdev[1] ]
556
557 params = ft_params1(ssid=ssid, passphrase=passphrase)
558 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
559 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
560 params['bridge'] = 'br0ft'
561 hapd0 = hostapd.add_ap(apdev2[0], params,
562 global_ctrl_override=global_ctrl)
563 apdev2[0]['bssid'] = hapd0.own_addr()
564 params = ft_params2(ssid=ssid, passphrase=passphrase)
565 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
566 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
567 params['bridge'] = 'br1ft'
568 hapd1 = hostapd.add_ap(apdev2[1], params)
569
570 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
571 over_ds=over_ds, test_connectivity=False)
572
573 hglobal.terminate()
574
575 if os.path.exists(pidfile):
576 with open(pidfile, 'r') as f:
577 pid = int(f.read())
578 f.close()
579 os.kill(pid, signal.SIGTERM)
580
e63d8837
MV		 581def test_ap_ft_over_ds_ocv(dev, apdev):
582 """WPA2-PSK-FT AP over DS"""
583 ssid = "test-ft"
584 passphrase="12345678"
585
586 params = ft_params1(ssid=ssid, passphrase=passphrase)
587 params["ieee80211w"] = "2"
588 params["ocv"] = "1"
589 try:
590 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 591 except Exception as e:
e63d8837
MV		 592 if "Failed to set hostapd parameter ocv" in str(e):
593 raise HwsimSkip("OCV not supported")
594 raise
595 params = ft_params2(ssid=ssid, passphrase=passphrase)
596 params["ieee80211w"] = "2"
597 params["ocv"] = "1"
598 hapd1 = hostapd.add_ap(apdev[1], params)
599
600 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
601 ocv="1")
602
55139acb
JM		 603def test_ap_ft_over_ds_disabled(dev, apdev):
604 """WPA2-PSK-FT AP over DS disabled"""
605 ssid = "test-ft"
606 passphrase="12345678"
607
608 params = ft_params1(ssid=ssid, passphrase=passphrase)
609 params['ft_over_ds'] = '0'
610 hapd0 = hostapd.add_ap(apdev[0], params)
611 params = ft_params2(ssid=ssid, passphrase=passphrase)
612 params['ft_over_ds'] = '0'
613 hapd1 = hostapd.add_ap(apdev[1], params)
614
615 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
616 fail_test=True)
617
473e5176
MB		 618def test_ap_ft_vlan_over_ds(dev, apdev):
619 """WPA2-PSK-FT AP over DS with VLAN"""
620 ssid = "test-ft"
621 passphrase="12345678"
622
623 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 624 params['dynamic_vlan'] = "1"
625 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 626 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
627 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 628 params['dynamic_vlan'] = "1"
629 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 630 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
631
632 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
633 conndev="brvlan1")
634 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
635 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
636
40602101
JM		 637def test_ap_ft_over_ds_many(dev, apdev):
638 """WPA2-PSK-FT AP over DS multiple times"""
639 ssid = "test-ft"
640 passphrase="12345678"
641
642 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 643 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 644 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 645 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 646
a8375c94
JM		 647 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
648 roams=50)
40602101 649
473e5176
MB		 650def test_ap_ft_vlan_over_ds_many(dev, apdev):
651 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
652 ssid = "test-ft"
653 passphrase="12345678"
654
655 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 656 params['dynamic_vlan'] = "1"
657 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 658 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
659 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 660 params['dynamic_vlan'] = "1"
661 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 662 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
663
664 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
665 roams=50, conndev="brvlan1")
666
9fd6804d 667@remote_compatible
c337d07a
JM		 668def test_ap_ft_over_ds_unknown_target(dev, apdev):
669 """WPA2-PSK-FT AP"""
670 ssid = "test-ft"
671 passphrase="12345678"
672
673 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 674 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 675
676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
677 scan_freq="2412")
678 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
679
9fd6804d 680@remote_compatible
211bb7c5
JM		 681def test_ap_ft_over_ds_unexpected(dev, apdev):
682 """WPA2-PSK-FT AP over DS and unexpected response"""
683 ssid = "test-ft"
684 passphrase="12345678"
685
686 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 687 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 688 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 689 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 690
691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
692 scan_freq="2412")
693 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
694 ap1 = apdev[0]
695 ap2 = apdev[1]
696 hapd1ap = hapd0
697 hapd2ap = hapd1
698 else:
699 ap1 = apdev[1]
700 ap2 = apdev[0]
701 hapd1ap = hapd1
702 hapd2ap = hapd0
703
704 addr = dev[0].own_addr()
705 hapd1ap.set("ext_mgmt_frame_handling", "1")
706 logger.info("Foreign STA address")
707 msg = {}
708 msg['fc'] = 13 << 4
709 msg['da'] = addr
710 msg['sa'] = ap1['bssid']
711 msg['bssid'] = ap1['bssid']
712 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
713 hapd1ap.mgmt_tx(msg)
714
715 logger.info("No over-the-DS in progress")
716 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
717 hapd1ap.mgmt_tx(msg)
718
719 logger.info("Non-zero status code")
720 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
721 hapd1ap.mgmt_tx(msg)
722
723 hapd1ap.dump_monitor()
724
725 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
726 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
727 raise Exception("FT_DS failed")
728
729 req = hapd1ap.mgmt_rx()
730
731 logger.info("Foreign Target AP")
732 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
733 hapd1ap.mgmt_tx(msg)
734
735 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
736
737 logger.info("No IEs")
738 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
739 hapd1ap.mgmt_tx(msg)
740
741 logger.info("Invalid IEs (trigger parsing failure)")
742 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
743 hapd1ap.mgmt_tx(msg)
744
745 logger.info("Too short MDIE")
746 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
747 hapd1ap.mgmt_tx(msg)
748
749 logger.info("Mobility domain mismatch")
750 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
751 hapd1ap.mgmt_tx(msg)
752
753 logger.info("No FTIE")
754 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
755 hapd1ap.mgmt_tx(msg)
756
757 logger.info("FTIE SNonce mismatch")
758 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
759 hapd1ap.mgmt_tx(msg)
760
761 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 762 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 763 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
764 hapd1ap.mgmt_tx(msg)
765
766 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 767 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 768 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
769 hapd1ap.mgmt_tx(msg)
770
771 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 772 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 773 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
774 hapd1ap.mgmt_tx(msg)
775
776 logger.info("No RSNE")
7ab74770 777 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 778 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
779 hapd1ap.mgmt_tx(msg)
780
b553eab1
JM		 781def test_ap_ft_pmf_over_ds(dev, apdev):
782 """WPA2-PSK-FT AP over DS with PMF"""
0c481b78 783 run_ap_ft_pmf_bip_over_ds(dev, apdev, None)
46b8ea21 784
ffcaca68
JM		 785def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
786 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
787 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
788
789def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
790 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
791 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
792
793def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
794 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
795 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
796
797def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
798 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
799 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
800
801def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
0c481b78 802 if cipher and cipher not in dev[0].get_capability("group_mgmt"):
ffcaca68
JM		 803 raise HwsimSkip("Cipher %s not supported" % cipher)
804
805 ssid = "test-ft"
806 passphrase="12345678"
807
808 params = ft_params1(ssid=ssid, passphrase=passphrase)
809 params["ieee80211w"] = "2"
0c481b78
JM		 810 if cipher:
811 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 812 hapd0 = hostapd.add_ap(apdev[0], params)
813 params = ft_params2(ssid=ssid, passphrase=passphrase)
814 params["ieee80211w"] = "2"
0c481b78
JM		 815 if cipher:
816 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 817 hapd1 = hostapd.add_ap(apdev[1], params)
818
0defc42a
JM		 819 Wlantest.setup(hapd0)
820 wt = Wlantest()
821 wt.flush()
822 wt.add_passphrase(passphrase)
823
ffcaca68
JM		 824 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
825 group_mgmt=cipher)
6e658cc4 826
aaba98d3
JM		 827def test_ap_ft_over_ds_pull(dev, apdev):
828 """WPA2-PSK-FT AP over DS (pull PMK)"""
829 ssid = "test-ft"
830 passphrase="12345678"
831
832 params = ft_params1(ssid=ssid, passphrase=passphrase)
833 params["pmk_r1_push"] = "0"
8b8a1864 834 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 835 params = ft_params2(ssid=ssid, passphrase=passphrase)
836 params["pmk_r1_push"] = "0"
8b8a1864 837 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 838
a8375c94 839 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 840
c95dd8e4
JM		 841def test_ap_ft_over_ds_pull_old_key(dev, apdev):
842 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
843 ssid = "test-ft"
844 passphrase="12345678"
845
846 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
847 params["pmk_r1_push"] = "0"
848 hapd0 = hostapd.add_ap(apdev[0], params)
849 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
850 params["pmk_r1_push"] = "0"
851 hapd1 = hostapd.add_ap(apdev[1], params)
852
853 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
854
473e5176
MB		 855def test_ap_ft_over_ds_pull_vlan(dev, apdev):
856 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
857 ssid = "test-ft"
858 passphrase="12345678"
859
860 params = ft_params1(ssid=ssid, passphrase=passphrase)
861 params["pmk_r1_push"] = "0"
58be42b2
JM		 862 params['dynamic_vlan'] = "1"
863 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 864 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
865 params = ft_params2(ssid=ssid, passphrase=passphrase)
866 params["pmk_r1_push"] = "0"
58be42b2
JM		 867 params['dynamic_vlan'] = "1"
868 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 869 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
870
871 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
872 conndev="brvlan1")
873
6e658cc4
JM		 874def test_ap_ft_sae(dev, apdev):
875 """WPA2-PSK-FT-SAE AP"""
b9749b6a
JM		 876 if "SAE" not in dev[0].get_capability("auth_alg"):
877 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 878 ssid = "test-ft"
879 passphrase="12345678"
880
881 params = ft_params1(ssid=ssid, passphrase=passphrase)
882 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 883 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 884 params = ft_params2(ssid=ssid, passphrase=passphrase)
885 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 886 hapd = hostapd.add_ap(apdev[1], params)
65038313
JM		 887 key_mgmt = hapd.get_config()['key_mgmt']
888 if key_mgmt.split(' ')[0] != "FT-SAE":
889 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 890
17ffdf39 891 dev[0].request("SET sae_groups ")
a8375c94 892 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
6e658cc4
JM		 893
894def test_ap_ft_sae_over_ds(dev, apdev):
895 """WPA2-PSK-FT-SAE AP over DS"""
b9749b6a
JM		 896 if "SAE" not in dev[0].get_capability("auth_alg"):
897 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 898 ssid = "test-ft"
899 passphrase="12345678"
900
901 params = ft_params1(ssid=ssid, passphrase=passphrase)
902 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 903 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 904 params = ft_params2(ssid=ssid, passphrase=passphrase)
905 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 906 hapd1 = hostapd.add_ap(apdev[1], params)
6e658cc4 907
17ffdf39 908 dev[0].request("SET sae_groups ")
a8375c94
JM		 909 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
910 over_ds=True)
6f62809b 911
3d5b88b5
JM		 912def test_ap_ft_sae_pw_id(dev, apdev):
913 """FT-SAE with Password Identifier"""
914 if "SAE" not in dev[0].get_capability("auth_alg"):
915 raise HwsimSkip("SAE not supported")
916 ssid = "test-ft"
917
918 params = ft_params1(ssid=ssid)
919 params["ieee80211w"] = "2"
920 params['wpa_key_mgmt'] = "FT-SAE"
921 params['sae_password'] = 'secret|id=pwid'
922 hapd0 = hostapd.add_ap(apdev[0], params)
923 params = ft_params2(ssid=ssid)
924 params["ieee80211w"] = "2"
925 params['wpa_key_mgmt'] = "FT-SAE"
926 params['sae_password'] = 'secret|id=pwid'
927 hapd = hostapd.add_ap(apdev[1], params)
928
929 dev[0].request("SET sae_groups ")
930 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
931 sae_password="secret", sae_password_id="pwid")
932
d269740a
MB		 933def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
934 discovery=False, roams=1):
6f62809b
JM		 935 ssid = "test-ft"
936 passphrase="12345678"
9c50a6d3
MB		 937 if vlan:
938 identity="gpsk-vlan1"
939 conndev="brvlan1"
d269740a
MB		 940 elif cui:
941 identity="gpsk-cui"
942 conndev=False
9c50a6d3
MB		 943 else:
944 identity="gpsk user"
945 conndev=False
6f62809b
JM		 946
947 radius = hostapd.radius_params()
942b52a8 948 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 949 params['wpa_key_mgmt'] = "FT-EAP"
950 params["ieee8021x"] = "1"
9c50a6d3
MB		 951 if vlan:
952 params["dynamic_vlan"] = "1"
35d8c254 953 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 954 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 955 key_mgmt = hapd.get_config()['key_mgmt']
956 if key_mgmt.split(' ')[0] != "FT-EAP":
957 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 958 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 959 params['wpa_key_mgmt'] = "FT-EAP"
960 params["ieee8021x"] = "1"
9c50a6d3
MB		 961 if vlan:
962 params["dynamic_vlan"] = "1"
35d8c254 963 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 964 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 965
942b52a8 966 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3
MB		 967 over_ds=over_ds, roams=roams, eap_identity=identity,
968 conndev=conndev)
91bc6c36
JM		 969 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
970 raise Exception("Scan results missing RSN element info")
eaf3f9b1
JM		 971 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
972 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
aaba98d3 973
4013d688
JM		 974 # Verify EAPOL reauthentication after FT protocol
975 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
976 ap = hapd
977 else:
978 ap = hapd1
979 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
980 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
981 if ev is None:
982 raise Exception("EAP authentication did not start")
983 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
984 if ev is None:
985 raise Exception("EAP authentication did not succeed")
986 time.sleep(0.1)
9c50a6d3
MB		 987 if conndev:
988 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
989 else:
990 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 991
942b52a8
MB		 992def test_ap_ft_eap(dev, apdev):
993 """WPA2-EAP-FT AP"""
994 generic_ap_ft_eap(dev, apdev)
995
d269740a
MB		 996def test_ap_ft_eap_cui(dev, apdev):
997 """WPA2-EAP-FT AP with CUI"""
998 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
999
9c50a6d3
MB		 1000def test_ap_ft_eap_vlan(dev, apdev):
1001 """WPA2-EAP-FT AP with VLAN"""
1002 generic_ap_ft_eap(dev, apdev, vlan=True)
1003
1004def test_ap_ft_eap_vlan_multi(dev, apdev):
1005 """WPA2-EAP-FT AP with VLAN"""
1006 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1007
942b52a8
MB		 1008def test_ap_ft_eap_over_ds(dev, apdev):
1009 """WPA2-EAP-FT AP using over-the-DS"""
1010 generic_ap_ft_eap(dev, apdev, over_ds=True)
1011
1012def test_ap_ft_eap_dis(dev, apdev):
1013 """WPA2-EAP-FT AP with AP discovery"""
1014 generic_ap_ft_eap(dev, apdev, discovery=True)
1015
1016def test_ap_ft_eap_dis_over_ds(dev, apdev):
1017 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1018 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1019
9c50a6d3
MB		 1020def test_ap_ft_eap_vlan(dev, apdev):
1021 """WPA2-EAP-FT AP with VLAN"""
1022 generic_ap_ft_eap(dev, apdev, vlan=True)
1023
1024def test_ap_ft_eap_vlan_multi(dev, apdev):
1025 """WPA2-EAP-FT AP with VLAN"""
1026 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1027
1028def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1029 """WPA2-EAP-FT AP with VLAN + over_ds"""
1030 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1031
1032def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1033 """WPA2-EAP-FT AP with VLAN + over_ds"""
1034 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1035
1036def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1037 """WPA2-EAP-FT AP (pull PMK)"""
1038 ssid = "test-ft"
1039 passphrase="12345678"
9c50a6d3
MB		 1040 if vlan:
1041 identity="gpsk-vlan1"
1042 conndev="brvlan1"
1043 else:
1044 identity="gpsk user"
1045 conndev=False
aaba98d3
JM		 1046
1047 radius = hostapd.radius_params()
1048 params = ft_params1(ssid=ssid, passphrase=passphrase)
1049 params['wpa_key_mgmt'] = "FT-EAP"
1050 params["ieee8021x"] = "1"
1051 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1052 if vlan:
1053 params["dynamic_vlan"] = "1"
35d8c254 1054 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1055 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1056 key_mgmt = hapd.get_config()['key_mgmt']
1057 if key_mgmt.split(' ')[0] != "FT-EAP":
1058 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1059 params = ft_params2(ssid=ssid, passphrase=passphrase)
1060 params['wpa_key_mgmt'] = "FT-EAP"
1061 params["ieee8021x"] = "1"
1062 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1063 if vlan:
1064 params["dynamic_vlan"] = "1"
35d8c254 1065 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1066 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1067
9c50a6d3
MB		 1068 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1069 eap_identity=identity, conndev=conndev)
1070
1071def test_ap_ft_eap_pull(dev, apdev):
1072 """WPA2-EAP-FT AP (pull PMK)"""
1073 generic_ap_ft_eap_pull(dev, apdev)
1074
1075def test_ap_ft_eap_pull_vlan(dev, apdev):
1076 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1077
f81c1411
JM		 1078def test_ap_ft_eap_pull_wildcard(dev, apdev):
1079 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1080 ssid = "test-ft"
1081 passphrase="12345678"
1082
1083 radius = hostapd.radius_params()
1084 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1085 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1086 params["ieee8021x"] = "1"
1087 params["pmk_r1_push"] = "0"
1088 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1089 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1090 params["ft_psk_generate_local"] = "1"
1091 params["eap_server"] = "0"
35d8c254 1092 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1093 hapd = hostapd.add_ap(apdev[0], params)
1094 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1095 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1096 params["ieee8021x"] = "1"
1097 params["pmk_r1_push"] = "0"
1098 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1099 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1100 params["ft_psk_generate_local"] = "1"
1101 params["eap_server"] = "0"
35d8c254 1102 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1103 hapd1 = hostapd.add_ap(apdev[1], params)
1104
1105 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1106
9fd6804d 1107@remote_compatible
3b808945
JM		 1108def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1109 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1110 ssid = "test-ft"
1111 passphrase="12345678"
1112
1113 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1114 params["ieee80211w"] = "2"
8b8a1864 1115 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1116 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1117 params["ieee80211w"] = "2"
8b8a1864 1118 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1119
a8375c94
JM		 1120 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1121 fail_test=True)
3b808945 1122
9fd6804d 1123@remote_compatible
3b808945
JM		 1124def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1125 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1126 ssid = "test-ft"
1127 passphrase="12345678"
1128
1129 params = ft_params1(ssid=ssid, passphrase=passphrase)
1130 params["pmk_r1_push"] = "0"
8b8a1864 1131 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1132 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1133 params["pmk_r1_push"] = "0"
8b8a1864 1134 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1135
a8375c94
JM		 1136 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1137 fail_test=True)
3b808945 1138
9fd6804d 1139@remote_compatible
ae14a2e2
JM		 1140def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1141 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1142 ssid = "test-ft"
1143 passphrase="12345678"
1144
1145 params = ft_params1(ssid=ssid, passphrase=passphrase)
1146 params["pmk_r1_push"] = "0"
1147 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1148 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1149 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1150 scan_freq="2412")
ae14a2e2
JM		 1151
1152 params = ft_params2(ssid=ssid, passphrase=passphrase)
1153 params["pmk_r1_push"] = "0"
8b8a1864 1154 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1155
1156 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1157 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1158
9fd6804d 1159@remote_compatible
3b808945
JM		 1160def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1161 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1162 ssid = "test-ft"
1163 passphrase="12345678"
1164
1165 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1166 params["ieee80211w"] = "2"
8b8a1864 1167 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1168 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1169 params["ieee80211w"] = "2"
8b8a1864 1170 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1171
a8375c94
JM		 1172 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1173 fail_test=True)
3b808945 1174
9fd6804d 1175@remote_compatible
3b808945
JM		 1176def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1177 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1178 ssid = "test-ft"
1179 passphrase="12345678"
1180
1181 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1182 params["pmk_r1_push"] = "0"
8b8a1864 1183 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1184 params = ft_params2(ssid=ssid, passphrase=passphrase)
1185 params["pmk_r1_push"] = "0"
8b8a1864 1186 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1187
a8375c94
JM		 1188 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1189 fail_test=True)
c6b6e105 1190
150948e6
MB		 1191def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1192 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1193 ssid = "test-ft"
1194 passphrase="12345678"
1195
1196 radius = hostapd.radius_params()
1197 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1198 params["ieee80211w"] = "2"
150948e6
MB		 1199 params['wpa_key_mgmt'] = "FT-EAP"
1200 params["ieee8021x"] = "1"
35d8c254 1201 params = dict(list(radius.items()) + list(params.items()))
b098542c 1202 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1203 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1204 params["ieee80211w"] = "2"
150948e6
MB		 1205 params['wpa_key_mgmt'] = "FT-EAP"
1206 params["ieee8021x"] = "1"
35d8c254 1207 params = dict(list(radius.items()) + list(params.items()))
b098542c 1208 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1209
1210 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1211 fail_test=True, eap=True)
1212
1213def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1214 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1215 ssid = "test-ft"
1216 passphrase="12345678"
1217
1218 radius = hostapd.radius_params()
1219 params = ft_params1(ssid=ssid, passphrase=passphrase)
1220 params["pmk_r1_push"] = "0"
1221 params['wpa_key_mgmt'] = "FT-EAP"
1222 params["ieee8021x"] = "1"
35d8c254 1223 params = dict(list(radius.items()) + list(params.items()))
b098542c 1224 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1225 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1226 params["pmk_r1_push"] = "0"
1227 params['wpa_key_mgmt'] = "FT-EAP"
1228 params["ieee8021x"] = "1"
35d8c254 1229 params = dict(list(radius.items()) + list(params.items()))
b098542c 1230 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1231
1232 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1233 fail_test=True, eap=True)
1234
1235def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1236 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1237 ssid = "test-ft"
1238 passphrase="12345678"
1239
1240 radius = hostapd.radius_params()
1241 params = ft_params1(ssid=ssid, passphrase=passphrase)
1242 params["pmk_r1_push"] = "0"
1243 params["nas_identifier"] = "nas0.w1.fi"
1244 params['wpa_key_mgmt'] = "FT-EAP"
1245 params["ieee8021x"] = "1"
35d8c254 1246 params = dict(list(radius.items()) + list(params.items()))
b098542c 1247 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1248 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1249 eap="GPSK", identity="gpsk user",
1250 password="abcdefghijklmnop0123456789abcdef",
1251 scan_freq="2412")
1252
1253 params = ft_params2(ssid=ssid, passphrase=passphrase)
1254 params["pmk_r1_push"] = "0"
1255 params['wpa_key_mgmt'] = "FT-EAP"
1256 params["ieee8021x"] = "1"
35d8c254 1257 params = dict(list(radius.items()) + list(params.items()))
b098542c 1258 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1259
1260 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1261 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1262
1263def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1264 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1265 ssid = "test-ft"
1266 passphrase="12345678"
1267
1268 radius = hostapd.radius_params()
1269 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1270 params["ieee80211w"] = "2"
150948e6
MB		 1271 params['wpa_key_mgmt'] = "FT-EAP"
1272 params["ieee8021x"] = "1"
35d8c254 1273 params = dict(list(radius.items()) + list(params.items()))
b098542c 1274 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1275 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1276 params["ieee80211w"] = "2"
150948e6
MB		 1277 params['wpa_key_mgmt'] = "FT-EAP"
1278 params["ieee8021x"] = "1"
35d8c254 1279 params = dict(list(radius.items()) + list(params.items()))
b098542c 1280 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1281
1282 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1283 fail_test=True, eap=True)
1284
1285def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1286 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1287 ssid = "test-ft"
1288 passphrase="12345678"
1289
1290 radius = hostapd.radius_params()
1291 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1292 params["pmk_r1_push"] = "0"
1293 params['wpa_key_mgmt'] = "FT-EAP"
1294 params["ieee8021x"] = "1"
35d8c254 1295 params = dict(list(radius.items()) + list(params.items()))
b098542c 1296 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1297 params = ft_params2(ssid=ssid, passphrase=passphrase)
1298 params["pmk_r1_push"] = "0"
1299 params['wpa_key_mgmt'] = "FT-EAP"
1300 params["ieee8021x"] = "1"
35d8c254 1301 params = dict(list(radius.items()) + list(params.items()))
b098542c 1302 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1303
1304 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1305 fail_test=True, eap=True)
1306
c6b6e105
JM		 1307def test_ap_ft_gtk_rekey(dev, apdev):
1308 """WPA2-PSK-FT AP and GTK rekey"""
1309 ssid = "test-ft"
1310 passphrase="12345678"
1311
1312 params = ft_params1(ssid=ssid, passphrase=passphrase)
1313 params['wpa_group_rekey'] = '1'
8b8a1864 1314 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1315
1316 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1317 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1318
1319 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1320 if ev is None:
1321 raise Exception("GTK rekey timed out after initial association")
a8375c94 1322 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1323
1324 params = ft_params2(ssid=ssid, passphrase=passphrase)
1325 params['wpa_group_rekey'] = '1'
8b8a1864 1326 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1327
1328 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1329 dev[0].roam(apdev[1]['bssid'])
1330 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1331 raise Exception("Did not connect to correct AP")
a8375c94 1332 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1333
1334 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1335 if ev is None:
1336 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1337 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1338
1339def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1340 """WPA2-PSK-FT and key lifetime in memory"""
1341 ssid = "test-ft"
1342 passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1343 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1344 pmk = binascii.unhexlify(psk)
1345 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1346 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1347 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1348 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1349
1350 pid = find_wpas_process(dev[0])
1351
1352 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1353 scan_freq="2412")
8e416cec
JM		 1354 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1355 # event has been delivered, so verify that wpa_supplicant has returned to
1356 # eloop before reading process memory.
54f2cae2 1357 time.sleep(1)
8e416cec 1358 dev[0].ping()
5b3c40a6
JM		 1359
1360 buf = read_process_memory(pid, pmk)
1361
1362 dev[0].request("DISCONNECT")
1363 dev[0].wait_disconnected()
1364
1365 dev[0].relog()
1366 pmkr0 = None
1367 pmkr1 = None
1368 ptk = None
1369 gtk = None
1370 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1371 for l in f.readlines():
1372 if "FT: PMK-R0 - hexdump" in l:
1373 val = l.strip().split(':')[3].replace(' ', '')
1374 pmkr0 = binascii.unhexlify(val)
1375 if "FT: PMK-R1 - hexdump" in l:
1376 val = l.strip().split(':')[3].replace(' ', '')
1377 pmkr1 = binascii.unhexlify(val)
f918b95b 1378 if "FT: KCK - hexdump" in l:
5b3c40a6 1379 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1380 kck = binascii.unhexlify(val)
1381 if "FT: KEK - hexdump" in l:
1382 val = l.strip().split(':')[3].replace(' ', '')
1383 kek = binascii.unhexlify(val)
1384 if "FT: TK - hexdump" in l:
1385 val = l.strip().split(':')[3].replace(' ', '')
1386 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1387 if "WPA: Group Key - hexdump" in l:
1388 val = l.strip().split(':')[3].replace(' ', '')
1389 gtk = binascii.unhexlify(val)
f918b95b 1390 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1391 raise Exception("Could not find keys from debug log")
1392 if len(gtk) != 16:
1393 raise Exception("Unexpected GTK length")
1394
5b3c40a6
JM		 1395 logger.info("Checking keys in memory while associated")
1396 get_key_locations(buf, pmk, "PMK")
1397 get_key_locations(buf, pmkr0, "PMK-R0")
1398 get_key_locations(buf, pmkr1, "PMK-R1")
1399 if pmk not in buf:
81e787b7 1400 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1401 if pmkr0 not in buf:
81e787b7 1402 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1403 if pmkr1 not in buf:
81e787b7 1404 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1405 if kck not in buf:
1406 raise Exception("KCK not found while associated")
1407 if kek not in buf:
1408 raise Exception("KEK not found while associated")
b74f82a4
JM		 1409 #if tk in buf:
1410 # raise Exception("TK found from memory")
5b3c40a6
JM		 1411
1412 logger.info("Checking keys in memory after disassociation")
1413 buf = read_process_memory(pid, pmk)
1414 get_key_locations(buf, pmk, "PMK")
1415 get_key_locations(buf, pmkr0, "PMK-R0")
1416 get_key_locations(buf, pmkr1, "PMK-R1")
1417
1418 # Note: PMK/PSK is still present in network configuration
1419
1420 fname = os.path.join(params['logdir'],
1421 'ft_psk_key_lifetime_in_memory.memctx-')
1422 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1423 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1424 verify_not_present(buf, kck, fname, "KCK")
1425 verify_not_present(buf, kek, fname, "KEK")
1426 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1427 if gtk in buf:
1428 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1429 verify_not_present(buf, gtk, fname, "GTK")
1430
1431 dev[0].request("REMOVE_NETWORK all")
1432
1433 logger.info("Checking keys in memory after network profile removal")
1434 buf = read_process_memory(pid, pmk)
1435 get_key_locations(buf, pmk, "PMK")
1436 get_key_locations(buf, pmkr0, "PMK-R0")
1437 get_key_locations(buf, pmkr1, "PMK-R1")
1438
1439 verify_not_present(buf, pmk, fname, "PMK")
1440 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1441 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1442 verify_not_present(buf, kck, fname, "KCK")
1443 verify_not_present(buf, kek, fname, "KEK")
1444 verify_not_present(buf, tk, fname, "TK")
1445 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1446
9fd6804d 1447@remote_compatible
664093b5
JM		 1448def test_ap_ft_invalid_resp(dev, apdev):
1449 """WPA2-PSK-FT AP and invalid response IEs"""
1450 ssid = "test-ft"
1451 passphrase="12345678"
1452
1453 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1454 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1455 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1456 scan_freq="2412")
1457
1458 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1459 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1460
1461 tests = [
1462 # Various IEs for test coverage. The last one is FTIE with invalid
1463 # R1KH-ID subelement.
1464 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1465 # FTIE with invalid R0KH-ID subelement (len=0).
1466 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1467 # FTIE with invalid R0KH-ID subelement (len=49).
1468 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1469 # Invalid RSNE.
1470 "020002000000" + "3000",
1471 # Required IEs missing from protected IE count.
1472 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1473 # RIC missing from protected IE count.
1474 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1475 # Protected IE missing.
1476 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1477 for t in tests:
1478 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1479 hapd1.set("ext_mgmt_frame_handling", "1")
1480 hapd1.dump_monitor()
1481 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1482 raise Exception("ROAM failed")
1483 auth = None
1484 for i in range(20):
1485 msg = hapd1.mgmt_rx()
1486 if msg['subtype'] == 11:
1487 auth = msg
1488 break
1489 if not auth:
1490 raise Exception("Authentication frame not seen")
1491
1492 resp = {}
1493 resp['fc'] = auth['fc']
1494 resp['da'] = auth['sa']
1495 resp['sa'] = auth['da']
1496 resp['bssid'] = auth['bssid']
1497 resp['payload'] = binascii.unhexlify(t)
1498 hapd1.mgmt_tx(resp)
1499 hapd1.set("ext_mgmt_frame_handling", "0")
1500 dev[0].wait_disconnected()
1501
1502 dev[0].request("RECONNECT")
1503 dev[0].wait_connected()
7b741a53
JM		 1504
1505def test_ap_ft_gcmp_256(dev, apdev):
1506 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1507 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1508 raise HwsimSkip("Cipher GCMP-256 not supported")
1509 ssid = "test-ft"
1510 passphrase="12345678"
1511
1512 params = ft_params1(ssid=ssid, passphrase=passphrase)
1513 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1514 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1515 params = ft_params2(ssid=ssid, passphrase=passphrase)
1516 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1517 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1518
1519 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1520 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1521
63a7683b 1522def setup_ap_ft_oom(dev, apdev):
38934ed1 1523 skip_with_fips(dev[0])
cf671d54
JM		 1524 ssid = "test-ft"
1525 passphrase="12345678"
1526
1527 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1528 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1529 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1530 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1531
1532 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1533 scan_freq="2412")
1534 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1535 dst = apdev[1]['bssid']
1536 else:
1537 dst = apdev[0]['bssid']
1538
1539 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1540
1541 return dst
1542
1543def test_ap_ft_oom(dev, apdev):
1544 """WPA2-PSK-FT and OOM"""
1545 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1546 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1547 dev[0].roam(dst)
63a7683b
JM		 1548
1549def test_ap_ft_oom2(dev, apdev):
1550 """WPA2-PSK-FT and OOM (2)"""
1551 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1552 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1553 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1554
1555def test_ap_ft_oom3(dev, apdev):
1556 """WPA2-PSK-FT and OOM (3)"""
1557 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1558 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1559 dev[0].roam(dst)
34d3eaa8 1560
63a7683b
JM		 1561def test_ap_ft_oom4(dev, apdev):
1562 """WPA2-PSK-FT and OOM (4)"""
1563 ssid = "test-ft"
1564 passphrase="12345678"
1565 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1566 dev[0].request("REMOVE_NETWORK all")
1567 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1568 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1569 scan_freq="2412")
1570
682a79f0
JM		 1571def test_ap_ft_ap_oom(dev, apdev):
1572 """WPA2-PSK-FT and AP OOM"""
1573 ssid = "test-ft"
1574 passphrase="12345678"
1575
1576 params = ft_params1(ssid=ssid, passphrase=passphrase)
1577 hapd0 = hostapd.add_ap(apdev[0], params)
1578 bssid0 = hapd0.own_addr()
1579
1580 dev[0].scan_for_bss(bssid0, freq="2412")
1581 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1582 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1583 scan_freq="2412")
1584
1585 params = ft_params2(ssid=ssid, passphrase=passphrase)
1586 hapd1 = hostapd.add_ap(apdev[1], params)
1587 bssid1 = hapd1.own_addr()
1588 dev[0].scan_for_bss(bssid1, freq="2412")
1589 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1590 dev[0].roam(bssid1)
1591
1592def test_ap_ft_ap_oom2(dev, apdev):
1593 """WPA2-PSK-FT and AP OOM 2"""
1594 ssid = "test-ft"
1595 passphrase="12345678"
1596
1597 params = ft_params1(ssid=ssid, passphrase=passphrase)
1598 hapd0 = hostapd.add_ap(apdev[0], params)
1599 bssid0 = hapd0.own_addr()
1600
1601 dev[0].scan_for_bss(bssid0, freq="2412")
1602 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1603 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1604 scan_freq="2412")
1605
1606 params = ft_params2(ssid=ssid, passphrase=passphrase)
1607 hapd1 = hostapd.add_ap(apdev[1], params)
1608 bssid1 = hapd1.own_addr()
1609 dev[0].scan_for_bss(bssid1, freq="2412")
1610 dev[0].roam(bssid1)
1611 if dev[0].get_status_field('bssid') != bssid1:
1612 raise Exception("Did not roam to AP1")
1613 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1614 dev[0].roam(bssid0)
1615
1616def test_ap_ft_ap_oom3(dev, apdev):
1617 """WPA2-PSK-FT and AP OOM 3"""
1618 ssid = "test-ft"
1619 passphrase="12345678"
1620
1621 params = ft_params1(ssid=ssid, passphrase=passphrase)
1622 hapd0 = hostapd.add_ap(apdev[0], params)
1623 bssid0 = hapd0.own_addr()
1624
1625 dev[0].scan_for_bss(bssid0, freq="2412")
1626 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1627 scan_freq="2412")
1628
1629 params = ft_params2(ssid=ssid, passphrase=passphrase)
1630 hapd1 = hostapd.add_ap(apdev[1], params)
1631 bssid1 = hapd1.own_addr()
1632 dev[0].scan_for_bss(bssid1, freq="2412")
1633 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1634 # This will fail due to not being able to send out PMK-R1 pull request
1635 dev[0].roam(bssid1)
1636
ba88dd65 1637 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1638 # This will fail due to not being able to send out PMK-R1 pull request
1639 dev[0].roam(bssid1)
1640
ba88dd65
MB		 1641 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1642 # This will fail due to not being able to send out PMK-R1 pull request
1643 dev[0].roam(bssid1)
1644
1645def test_ap_ft_ap_oom3b(dev, apdev):
1646 """WPA2-PSK-FT and AP OOM 3b"""
1647 ssid = "test-ft"
1648 passphrase="12345678"
1649
1650 params = ft_params1(ssid=ssid, passphrase=passphrase)
1651 hapd0 = hostapd.add_ap(apdev[0], params)
1652 bssid0 = hapd0.own_addr()
1653
1654 dev[0].scan_for_bss(bssid0, freq="2412")
1655 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1656 scan_freq="2412")
1657
1658 params = ft_params2(ssid=ssid, passphrase=passphrase)
1659 hapd1 = hostapd.add_ap(apdev[1], params)
1660 bssid1 = hapd1.own_addr()
1661 dev[0].scan_for_bss(bssid1, freq="2412")
1662 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1663 # This will fail due to not being able to send out PMK-R1 pull request
1664 dev[0].roam(bssid1)
1665
1666def test_ap_ft_ap_oom4(dev, apdev):
1667 """WPA2-PSK-FT and AP OOM 4"""
1668 ssid = "test-ft"
1669 passphrase="12345678"
1670
1671 params = ft_params1(ssid=ssid, passphrase=passphrase)
1672 hapd0 = hostapd.add_ap(apdev[0], params)
1673 bssid0 = hapd0.own_addr()
1674
1675 dev[0].scan_for_bss(bssid0, freq="2412")
1676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1677 scan_freq="2412")
1678
1679 params = ft_params2(ssid=ssid, passphrase=passphrase)
1680 hapd1 = hostapd.add_ap(apdev[1], params)
1681 bssid1 = hapd1.own_addr()
1682 dev[0].scan_for_bss(bssid1, freq="2412")
1683 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1684 dev[0].roam(bssid1)
1685 if dev[0].get_status_field('bssid') != bssid1:
1686 raise Exception("Did not roam to AP1")
1687
1688 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1689 dev[0].roam(bssid0)
1690 if dev[0].get_status_field('bssid') != bssid0:
1691 raise Exception("Did not roam to AP0")
1692
1693 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1694 dev[0].roam(bssid1)
1695 if dev[0].get_status_field('bssid') != bssid1:
1696 raise Exception("Did not roam to AP1")
1697
1698def test_ap_ft_ap_oom5(dev, apdev):
1699 """WPA2-PSK-FT and AP OOM 5"""
1700 ssid = "test-ft"
1701 passphrase="12345678"
1702
1703 params = ft_params1(ssid=ssid, passphrase=passphrase)
1704 hapd0 = hostapd.add_ap(apdev[0], params)
1705 bssid0 = hapd0.own_addr()
1706
1707 dev[0].scan_for_bss(bssid0, freq="2412")
1708 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1709 scan_freq="2412")
1710
1711 params = ft_params2(ssid=ssid, passphrase=passphrase)
1712 hapd1 = hostapd.add_ap(apdev[1], params)
1713 bssid1 = hapd1.own_addr()
1714 dev[0].scan_for_bss(bssid1, freq="2412")
1715 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1716 # This will fail to roam
1717 dev[0].roam(bssid1)
1718
1719 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1720 # This will fail to roam
1721 dev[0].roam(bssid1)
1722
1723 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1724 # This will fail to roam
1725 dev[0].roam(bssid1)
1726
1727 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1728 # This will fail to roam
1729 dev[0].roam(bssid1)
1730
1731 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1732 # This will fail to roam
1733 dev[0].roam(bssid1)
1734
1735def test_ap_ft_ap_oom6(dev, apdev):
1736 """WPA2-PSK-FT and AP OOM 6"""
1737 ssid = "test-ft"
1738 passphrase="12345678"
1739
1740 params = ft_params1(ssid=ssid, passphrase=passphrase)
1741 hapd0 = hostapd.add_ap(apdev[0], params)
1742 bssid0 = hapd0.own_addr()
1743
1744 dev[0].scan_for_bss(bssid0, freq="2412")
1745 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1746 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1747 scan_freq="2412")
1748 dev[0].request("REMOVE_NETWORK all")
1749 dev[0].wait_disconnected()
1750 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1751 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1752 scan_freq="2412")
1753 dev[0].request("REMOVE_NETWORK all")
1754 dev[0].wait_disconnected()
1755 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1756 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1757 scan_freq="2412")
1758
c5262648
JM		 1759def test_ap_ft_ap_oom7a(dev, apdev):
1760 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0
JM		 1761 ssid = "test-ft"
1762 passphrase="12345678"
1763
1764 params = ft_params1(ssid=ssid, passphrase=passphrase)
1765 params["ieee80211w"] = "2"
1766 hapd0 = hostapd.add_ap(apdev[0], params)
1767 bssid0 = hapd0.own_addr()
1768
1769 dev[0].scan_for_bss(bssid0, freq="2412")
1770 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1771 ieee80211w="2", scan_freq="2412")
1772
1773 params = ft_params2(ssid=ssid, passphrase=passphrase)
1774 params["ieee80211w"] = "2"
1775 hapd1 = hostapd.add_ap(apdev[1], params)
1776 bssid1 = hapd1.own_addr()
1777 dev[0].scan_for_bss(bssid1, freq="2412")
1778 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1779 # This will fail to roam
1780 dev[0].roam(bssid1)
c5262648
JM		 1781
1782def test_ap_ft_ap_oom7b(dev, apdev):
1783 """WPA2-PSK-FT and AP OOM 7b"""
1784 ssid = "test-ft"
1785 passphrase="12345678"
1786
1787 params = ft_params1(ssid=ssid, passphrase=passphrase)
1788 params["ieee80211w"] = "2"
1789 hapd0 = hostapd.add_ap(apdev[0], params)
1790 bssid0 = hapd0.own_addr()
1791
1792 dev[0].scan_for_bss(bssid0, freq="2412")
1793 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1794 ieee80211w="2", scan_freq="2412")
1795
1796 params = ft_params2(ssid=ssid, passphrase=passphrase)
1797 params["ieee80211w"] = "2"
1798 hapd1 = hostapd.add_ap(apdev[1], params)
1799 bssid1 = hapd1.own_addr()
1800 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1801 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1802 # This will fail to roam
1803 dev[0].roam(bssid1)
c5262648
JM		 1804
1805def test_ap_ft_ap_oom7c(dev, apdev):
1806 """WPA2-PSK-FT and AP OOM 7c"""
1807 ssid = "test-ft"
1808 passphrase="12345678"
1809
1810 params = ft_params1(ssid=ssid, passphrase=passphrase)
1811 params["ieee80211w"] = "2"
1812 hapd0 = hostapd.add_ap(apdev[0], params)
1813 bssid0 = hapd0.own_addr()
1814
1815 dev[0].scan_for_bss(bssid0, freq="2412")
1816 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1817 ieee80211w="2", scan_freq="2412")
1818
1819 params = ft_params2(ssid=ssid, passphrase=passphrase)
1820 params["ieee80211w"] = "2"
1821 hapd1 = hostapd.add_ap(apdev[1], params)
1822 bssid1 = hapd1.own_addr()
1823 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1824 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1825 # This will fail to roam
1826 dev[0].roam(bssid1)
c5262648
JM		 1827
1828def test_ap_ft_ap_oom7d(dev, apdev):
1829 """WPA2-PSK-FT and AP OOM 7d"""
1830 ssid = "test-ft"
1831 passphrase="12345678"
1832
1833 params = ft_params1(ssid=ssid, passphrase=passphrase)
1834 params["ieee80211w"] = "2"
1835 hapd0 = hostapd.add_ap(apdev[0], params)
1836 bssid0 = hapd0.own_addr()
1837
1838 dev[0].scan_for_bss(bssid0, freq="2412")
1839 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1840 ieee80211w="2", scan_freq="2412")
1841
1842 params = ft_params2(ssid=ssid, passphrase=passphrase)
1843 params["ieee80211w"] = "2"
1844 hapd1 = hostapd.add_ap(apdev[1], params)
1845 bssid1 = hapd1.own_addr()
1846 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1847 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1848 # This will fail to roam
1849 dev[0].roam(bssid1)
1850
1851def test_ap_ft_ap_oom8(dev, apdev):
1852 """WPA2-PSK-FT and AP OOM 8"""
1853 ssid = "test-ft"
1854 passphrase="12345678"
1855
1856 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1857 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1858 hapd0 = hostapd.add_ap(apdev[0], params)
1859 bssid0 = hapd0.own_addr()
1860
1861 dev[0].scan_for_bss(bssid0, freq="2412")
1862 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1863 scan_freq="2412")
1864
1865 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 1866 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1867 hapd1 = hostapd.add_ap(apdev[1], params)
1868 bssid1 = hapd1.own_addr()
1869 dev[0].scan_for_bss(bssid1, freq="2412")
1870 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1871 # This will fail to roam
1872 dev[0].roam(bssid1)
1873 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1874 # This will fail to roam
1875 dev[0].roam(bssid1)
1876
1877def test_ap_ft_ap_oom9(dev, apdev):
1878 """WPA2-PSK-FT and AP OOM 9"""
1879 ssid = "test-ft"
1880 passphrase="12345678"
1881
1882 params = ft_params1(ssid=ssid, passphrase=passphrase)
1883 hapd0 = hostapd.add_ap(apdev[0], params)
1884 bssid0 = hapd0.own_addr()
1885
1886 dev[0].scan_for_bss(bssid0, freq="2412")
1887 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1888 scan_freq="2412")
1889
1890 params = ft_params2(ssid=ssid, passphrase=passphrase)
1891 hapd1 = hostapd.add_ap(apdev[1], params)
1892 bssid1 = hapd1.own_addr()
1893 dev[0].scan_for_bss(bssid1, freq="2412")
1894
1895 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1896 # This will fail to roam
1897 if "OK" not in dev[0].request("FT_DS " + bssid1):
1898 raise Exception("FT_DS failed")
1899 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1900
1901 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1902 # This will fail to roam
1903 if "OK" not in dev[0].request("FT_DS " + bssid1):
1904 raise Exception("FT_DS failed")
1905 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1906
1907 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1908 # This will fail to roam
1909 if "OK" not in dev[0].request("FT_DS " + bssid1):
1910 raise Exception("FT_DS failed")
1911 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1912
1913def test_ap_ft_ap_oom10(dev, apdev):
1914 """WPA2-PSK-FT and AP OOM 10"""
1915 ssid = "test-ft"
1916 passphrase="12345678"
1917
1918 params = ft_params1(ssid=ssid, passphrase=passphrase)
1919 hapd0 = hostapd.add_ap(apdev[0], params)
1920 bssid0 = hapd0.own_addr()
1921
1922 dev[0].scan_for_bss(bssid0, freq="2412")
1923 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1924 scan_freq="2412")
1925
1926 params = ft_params2(ssid=ssid, passphrase=passphrase)
1927 hapd1 = hostapd.add_ap(apdev[1], params)
1928 bssid1 = hapd1.own_addr()
1929 dev[0].scan_for_bss(bssid1, freq="2412")
1930
9441a227 1931 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1932 # This will fail to roam
1933 if "OK" not in dev[0].request("FT_DS " + bssid1):
1934 raise Exception("FT_DS failed")
1935 wait_fail_trigger(hapd0, "GET_FAIL")
1936
1937 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1938 # This will fail to roam
1939 if "OK" not in dev[0].request("FT_DS " + bssid1):
1940 raise Exception("FT_DS failed")
1941 wait_fail_trigger(hapd0, "GET_FAIL")
1942
9441a227 1943 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1944 # This will fail to roam
1945 if "OK" not in dev[0].request("FT_DS " + bssid1):
1946 raise Exception("FT_DS failed")
1947 wait_fail_trigger(hapd0, "GET_FAIL")
1948
9441a227 1949 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 1950 # This will fail to roam
1951 if "OK" not in dev[0].request("FT_DS " + bssid1):
1952 raise Exception("FT_DS failed")
1953 wait_fail_trigger(hapd1, "GET_FAIL")
1954
1955def test_ap_ft_ap_oom11(dev, apdev):
1956 """WPA2-PSK-FT and AP OOM 11"""
1957 ssid = "test-ft"
1958 passphrase="12345678"
1959
1960 params = ft_params1(ssid=ssid, passphrase=passphrase)
1961 hapd0 = hostapd.add_ap(apdev[0], params)
1962 bssid0 = hapd0.own_addr()
1963
1964 dev[0].scan_for_bss(bssid0, freq="2412")
1965 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1966 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1967 scan_freq="2412")
1968 wait_fail_trigger(hapd0, "GET_FAIL")
1969
1970 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 1971 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 1972 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1973 scan_freq="2412")
1974 wait_fail_trigger(hapd0, "GET_FAIL")
1975
a04e6f3d
JM		 1976def test_ap_ft_over_ds_proto_ap(dev, apdev):
1977 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1978 ssid = "test-ft"
1979 passphrase="12345678"
1980
1981 params = ft_params1(ssid=ssid, passphrase=passphrase)
1982 hapd0 = hostapd.add_ap(apdev[0], params)
1983 bssid0 = hapd0.own_addr()
1984 _bssid0 = bssid0.replace(':', '')
1985 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1986 scan_freq="2412")
1987 addr = dev[0].own_addr()
1988 _addr = addr.replace(':', '')
1989
1990 params = ft_params2(ssid=ssid, passphrase=passphrase)
1991 hapd1 = hostapd.add_ap(apdev[1], params)
1992 bssid1 = hapd1.own_addr()
1993 _bssid1 = bssid1.replace(':', '')
1994
1995 hapd0.set("ext_mgmt_frame_handling", "1")
1996 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1997 valid = "0601" + _addr + _bssid1
1998 tests = [ "0601",
1999 "0601" + _addr,
2000 "0601" + _addr + _bssid0,
2001 "0601" + _addr + "ffffffffffff",
2002 "0601" + _bssid0 + _bssid0,
2003 valid,
2004 valid + "01",
2005 valid + "3700",
2006 valid + "3600",
2007 valid + "3603ffffff",
2008 valid + "3603a1b2ff",
2009 valid + "3603a1b2ff" + "3700",
2010 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2011 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2012 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2013 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2014 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2015 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2016 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2017 valid + "0001" ]
2018 for t in tests:
2019 hapd0.dump_monitor()
2020 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2021 raise Exception("MGMT_RX_PROCESS failed")
2022
2023 hapd0.set("ext_mgmt_frame_handling", "0")
2024
34d3eaa8
JM		 2025def test_ap_ft_over_ds_proto(dev, apdev):
2026 """WPA2-PSK-FT AP over DS protocol testing"""
2027 ssid = "test-ft"
2028 passphrase="12345678"
2029
2030 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2031 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2032 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2033 scan_freq="2412")
2034
2035 # FT Action Response while no FT-over-DS in progress
2036 msg = {}
2037 msg['fc'] = 13 << 4
2038 msg['da'] = dev[0].own_addr()
2039 msg['sa'] = apdev[0]['bssid']
2040 msg['bssid'] = apdev[0]['bssid']
2041 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2042 hapd0.mgmt_tx(msg)
2043
2044 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2045 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2046 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2047 hapd0.set("ext_mgmt_frame_handling", "1")
2048 hapd0.dump_monitor()
2049 dev[0].request("FT_DS " + apdev[1]['bssid'])
2050 for i in range(0, 10):
2051 req = hapd0.mgmt_rx()
2052 if req is None:
2053 raise Exception("MGMT RX wait timed out")
2054 if req['subtype'] == 13:
2055 break
2056 req = None
2057 if not req:
2058 raise Exception("FT Action frame not received")
2059
2060 # FT Action Response for unexpected Target AP
2061 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2062 hapd0.mgmt_tx(msg)
2063
2064 # FT Action Response without MDIE
2065 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2066 hapd0.mgmt_tx(msg)
2067
2068 # FT Action Response without FTIE
2069 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2070 hapd0.mgmt_tx(msg)
2071
2072 # FT Action Response with FTIE SNonce mismatch
2073 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2074 hapd0.mgmt_tx(msg)
6f3815c0 2075
9fd6804d 2076@remote_compatible
6f3815c0
JM		 2077def test_ap_ft_rrb(dev, apdev):
2078 """WPA2-PSK-FT RRB protocol testing"""
2079 ssid = "test-ft"
2080 passphrase="12345678"
2081
2082 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2083 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2084
2085 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2086 scan_freq="2412")
2087
2088 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
2089 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
15dfcb69 2090 proto = b'\x89\x0d'
6f3815c0
JM		 2091 ehdr = _dst_ll + _src_ll + proto
2092
2093 # Too short RRB frame
15dfcb69 2094 pkt = ehdr + b'\x01'
7ab74770 2095 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2096 raise Exception("DATA_TEST_FRAME failed")
2097
2098 # RRB discarded frame wikth unrecognized type
15dfcb69 2099 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2100 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2101 raise Exception("DATA_TEST_FRAME failed")
2102
2103 # RRB frame too short for action frame
15dfcb69 2104 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2105 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2106 raise Exception("DATA_TEST_FRAME failed")
2107
2108 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2109 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2110 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2111 raise Exception("DATA_TEST_FRAME failed")
2112
2113 # Unexpected Action frame category
15dfcb69 2114 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2115 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2116 raise Exception("DATA_TEST_FRAME failed")
2117
2118 # Unexpected Action in RRB Request
15dfcb69 2119 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2120 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2121 raise Exception("DATA_TEST_FRAME failed")
2122
2123 # Target AP address in RRB Request does not match with own address
15dfcb69 2124 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2125 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2126 raise Exception("DATA_TEST_FRAME failed")
2127
2128 # Not enough room for status code in RRB Response
15dfcb69 2129 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2130 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2131 raise Exception("DATA_TEST_FRAME failed")
2132
2133 # RRB discarded frame with unknown packet_type
15dfcb69 2134 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2135 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2136 raise Exception("DATA_TEST_FRAME failed")
2137
2138 # RRB Response with non-zero status code; no STA match
15dfcb69 2139 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2140 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2141 raise Exception("DATA_TEST_FRAME failed")
2142
2143 # RRB Response with zero status code and extra data; STA match
15dfcb69 2144 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2145 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2146 raise Exception("DATA_TEST_FRAME failed")
2147
2148 # Too short PMK-R1 pull
15dfcb69 2149 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2150 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2151 raise Exception("DATA_TEST_FRAME failed")
2152
2153 # Too short PMK-R1 resp
15dfcb69 2154 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2155 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2156 raise Exception("DATA_TEST_FRAME failed")
2157
2158 # Too short PMK-R1 push
15dfcb69 2159 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2160 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2161 raise Exception("DATA_TEST_FRAME failed")
2162
2163 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2164 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2165 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2166 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2167
9fd6804d 2168@remote_compatible
ecafa0cf
JM		 2169def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2170 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2171 bssid = apdev[0]['bssid']
2172 ssid = "test-ft"
2173 passphrase="12345678"
2174
2175 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2176 params["ieee80211w"] = "1"
ecafa0cf
JM		 2177 # This is the RSN element used normally by hostapd
2178 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2179 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2180 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2181 ieee80211w="1", scan_freq="2412",
2182 pairwise="CCMP", group="CCMP")
2183
2184 tests = [ ('PMKIDCount field included',
2185 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2186 ('Extra IE before RSNE',
2187 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2188 ('PMKIDCount and Group Management Cipher suite fields included',
2189 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2190 ('Extra octet after defined fields (future extensibility)',
2191 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2192 ('No RSN Capabilities field (PMF disabled in practice)',
2193 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2194 for txt,ie in tests:
2195 dev[0].request("DISCONNECT")
2196 dev[0].wait_disconnected()
2197 logger.info(txt)
2198 hapd.disable()
2199 hapd.set('own_ie_override', ie)
2200 hapd.enable()
2201 dev[0].request("BSS_FLUSH 0")
2202 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2203 dev[0].select_network(id, freq=2412)
2204 dev[0].wait_connected()
2205
2206 dev[0].request("DISCONNECT")
2207 dev[0].wait_disconnected()
2208
2209 logger.info('Invalid RSNE causing internal hostapd error')
2210 hapd.disable()
2211 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2212 hapd.enable()
2213 dev[0].request("BSS_FLUSH 0")
2214 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2215 dev[0].select_network(id, freq=2412)
2216 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2217 # complete.
2218 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2219 if ev is not None:
2220 raise Exception("Unexpected connection")
2221 dev[0].request("DISCONNECT")
2222
2223 logger.info('Unexpected PMKID causing internal hostapd error')
2224 hapd.disable()
2225 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2226 hapd.enable()
2227 dev[0].request("BSS_FLUSH 0")
2228 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2229 dev[0].select_network(id, freq=2412)
2230 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2231 # complete.
2232 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2233 if ev is not None:
2234 raise Exception("Unexpected connection")
2235 dev[0].request("DISCONNECT")
1025603b
JM		 2236
2237def test_ap_ft_ptk_rekey(dev, apdev):
2238 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2239 ssid = "test-ft"
2240 passphrase="12345678"
2241
2242 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2243 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2244 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2245 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2246
2247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2248
2249 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2250 "WPA: Key negotiation completed"], timeout=5)
2251 if ev is None:
2252 raise Exception("No event received after roam")
2253 if "CTRL-EVENT-DISCONNECTED" in ev:
2254 raise Exception("Unexpected disconnection after roam")
2255
2256 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2257 hapd = hapd0
2258 else:
2259 hapd = hapd1
2260 hwsim_utils.test_connectivity(dev[0], hapd)
2261
2262def test_ap_ft_ptk_rekey_ap(dev, apdev):
2263 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2264 ssid = "test-ft"
2265 passphrase="12345678"
2266
2267 params = ft_params1(ssid=ssid, passphrase=passphrase)
2268 params['wpa_ptk_rekey'] = '2'
8b8a1864 2269 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b
JM		 2270 params = ft_params2(ssid=ssid, passphrase=passphrase)
2271 params['wpa_ptk_rekey'] = '2'
8b8a1864 2272 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2273
2274 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2275
2276 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2277 "WPA: Key negotiation completed"], timeout=5)
2278 if ev is None:
2279 raise Exception("No event received after roam")
2280 if "CTRL-EVENT-DISCONNECTED" in ev:
2281 raise Exception("Unexpected disconnection after roam")
2282
2283 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2284 hapd = hapd0
2285 else:
2286 hapd = hapd1
2287 hwsim_utils.test_connectivity(dev[0], hapd)
186ca473
MB		 2288
2289def test_ap_ft_internal_rrb_check(dev, apdev):
2290 """RRB internal delivery only to WPA enabled BSS"""
2291 ssid = "test-ft"
2292 passphrase="12345678"
2293
2294 radius = hostapd.radius_params()
2295 params = ft_params1(ssid=ssid, passphrase=passphrase)
2296 params['wpa_key_mgmt'] = "FT-EAP"
2297 params["ieee8021x"] = "1"
35d8c254 2298 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2299 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2300 key_mgmt = hapd.get_config()['key_mgmt']
2301 if key_mgmt.split(' ')[0] != "FT-EAP":
2302 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2303
8b8a1864 2304 hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
186ca473
MB		 2305
2306 # Connect to WPA enabled AP
2307 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2308 eap="GPSK", identity="gpsk user",
2309 password="abcdefghijklmnop0123456789abcdef",
2310 scan_freq="2412")
2311
2312 # Try over_ds roaming to non-WPA-enabled AP.
2313 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2314 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2315
2316def test_ap_ft_extra_ie(dev, apdev):
2317 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2318 ssid = "test-ft"
2319 passphrase="12345678"
2320
2321 params = ft_params1(ssid=ssid, passphrase=passphrase)
2322 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2323 hapd0 = hostapd.add_ap(apdev[0], params)
2324 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2325 scan_freq="2412")
2326 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2327 scan_freq="2412")
2328 try:
2329 # Add Mobility Domain element to test AP validation code.
2330 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2331 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2332 scan_freq="2412", wait_connect=False)
2333 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2334 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2335 if ev is None:
2336 raise Exception("No connection result")
2337 if "CTRL-EVENT-CONNECTED" in ev:
2338 raise Exception("Non-FT association accepted with MDE")
2339 if "status_code=43" not in ev:
2340 raise Exception("Unexpected status code: " + ev)
2341 dev[0].request("DISCONNECT")
2342 finally:
2343 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2344
2345def test_ap_ft_ric(dev, apdev):
2346 """WPA2-PSK-FT AP and RIC"""
2347 ssid = "test-ft"
2348 passphrase="12345678"
2349
2350 params = ft_params1(ssid=ssid, passphrase=passphrase)
2351 hapd0 = hostapd.add_ap(apdev[0], params)
2352 params = ft_params2(ssid=ssid, passphrase=passphrase)
2353 hapd1 = hostapd.add_ap(apdev[1], params)
2354
2355 dev[0].set("ric_ies", "")
2356 dev[0].set("ric_ies", '""')
2357 if "FAIL" not in dev[0].request("SET ric_ies q"):
2358 raise Exception("Invalid ric_ies value accepted")
2359
2360 tests = [ "3900",
2361 "3900ff04eeeeeeee",
2362 "390400000000",
2363 "390400000000" + "390400000000",
2364 "390400000000" + "dd050050f20202",
2365 "390400000000" + "dd3d0050f2020201" + 55*"00",
2366 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2367 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2368 for t in tests:
2369 dev[0].set("ric_ies", t)
2370 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2371 test_connectivity=False)
2372 dev[0].request("REMOVE_NETWORK all")
2373 dev[0].wait_disconnected()
2374 dev[0].dump_monitor()
c8942286
JM		 2375
2376def ie_hex(ies, id):
7ab74770 2377 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2378
2379def test_ap_ft_reassoc_proto(dev, apdev):
2380 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2381 ssid = "test-ft"
2382 passphrase="12345678"
2383
2384 params = ft_params1(ssid=ssid, passphrase=passphrase)
2385 hapd0 = hostapd.add_ap(apdev[0], params)
2386 params = ft_params2(ssid=ssid, passphrase=passphrase)
2387 hapd1 = hostapd.add_ap(apdev[1], params)
2388
2389 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2390 ieee80211w="1", scan_freq="2412")
2391 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2392 hapd1ap = hapd0
2393 hapd2ap = hapd1
2394 else:
2395 hapd1ap = hapd1
2396 hapd2ap = hapd0
2397
2398 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2399 hapd2ap.set("ext_mgmt_frame_handling", "1")
2400 dev[0].request("ROAM " + hapd2ap.own_addr())
2401
2402 while True:
2403 req = hapd2ap.mgmt_rx()
7ab74770 2404 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2405 if req['subtype'] == 11:
2406 break
2407
2408 while True:
2409 req = hapd2ap.mgmt_rx()
2410 if req['subtype'] == 2:
2411 break
7ab74770 2412 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2413
2414 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2415 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2416 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2417 # First elements: SSID, Supported Rates, Extended Supported Rates
2418 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2419
2420 rsne = ie_hex(ies, 48)
2421 mde = ie_hex(ies, 54)
2422 fte = ie_hex(ies, 55)
2423 tests = [ ]
2424 # RSN: Trying to use FT, but MDIE not included
2425 tests += [ rsne ]
2426 # RSN: Attempted to use unknown MDIE
2427 tests += [ rsne + "3603000000" ]
2428 # Invalid RSN pairwise cipher
2429 tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2430 # FT: No PMKID in RSNIE
2431 tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2432 # FT: Invalid FTIE
2433 tests += [ rsne + mde ]
2434 # FT: RIC IE(s) in the frame, but not included in protected IE count
2435 # FT: Failed to parse FT IEs
2436 tests += [ rsne + mde + fte + "3900" ]
2437 # FT: SNonce mismatch in FTIE
2438 tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2439 # FT: ANonce mismatch in FTIE
2440 tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2441 # FT: No R0KH-ID subelem in FTIE
2442 tests += [ rsne + mde + "3752" + fte[4:168] ]
2443 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2444 tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2445 # FT: No R1KH-ID subelem in FTIE
54c58f29 2446 tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() ]
c8942286 2447 # FT: Unknown R1KH-ID used in ReassocReq
54c58f29 2448 tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000" ]
c8942286
JM		 2449 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2450 tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2451 # Invalid MIC in FTIE
2452 tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2453 for t in tests:
2454 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2455
2456def test_ap_ft_reassoc_local_fail(dev, apdev):
2457 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2458 ssid = "test-ft"
2459 passphrase="12345678"
2460
2461 params = ft_params1(ssid=ssid, passphrase=passphrase)
2462 hapd0 = hostapd.add_ap(apdev[0], params)
2463 params = ft_params2(ssid=ssid, passphrase=passphrase)
2464 hapd1 = hostapd.add_ap(apdev[1], params)
2465
2466 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2467 ieee80211w="1", scan_freq="2412")
2468 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2469 hapd1ap = hapd0
2470 hapd2ap = hapd1
2471 else:
2472 hapd1ap = hapd1
2473 hapd2ap = hapd0
2474
2475 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2476 # FT: Failed to calculate MIC
2477 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2478 dev[0].request("ROAM " + hapd2ap.own_addr())
2479 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2480 dev[0].request("DISCONNECT")
2481 if ev is None:
2482 raise Exception("Association reject not seen")
d7f0bef9
JM		 2483
2484def test_ap_ft_reassoc_replay(dev, apdev, params):
2485 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2486 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2487 ssid = "test-ft"
2488 passphrase="12345678"
2489
2490 params = ft_params1(ssid=ssid, passphrase=passphrase)
2491 hapd0 = hostapd.add_ap(apdev[0], params)
2492 params = ft_params2(ssid=ssid, passphrase=passphrase)
2493 hapd1 = hostapd.add_ap(apdev[1], params)
2494
2495 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2496 scan_freq="2412")
2497 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2498 hapd1ap = hapd0
2499 hapd2ap = hapd1
2500 else:
2501 hapd1ap = hapd1
2502 hapd2ap = hapd0
2503
2504 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2505 hapd2ap.set("ext_mgmt_frame_handling", "1")
2506 dev[0].dump_monitor()
2507 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2508 raise Exception("ROAM failed")
2509
2510 reassocreq = None
2511 count = 0
2512 while count < 100:
2513 req = hapd2ap.mgmt_rx()
2514 count += 1
2515 hapd2ap.dump_monitor()
7ab74770 2516 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2517 if req['subtype'] == 2:
2518 reassocreq = req
2519 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2520 if ev is None:
2521 raise Exception("No TX status seen")
2522 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2523 if "OK" not in hapd2ap.request(cmd):
2524 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2525 break
2526 hapd2ap.set("ext_mgmt_frame_handling", "0")
2527 if reassocreq is None:
2528 raise Exception("No Reassociation Request frame seen")
2529 dev[0].wait_connected()
2530 dev[0].dump_monitor()
2531 hapd2ap.dump_monitor()
2532
2533 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2534
2535 logger.info("Replay the last Reassociation Request frame")
2536 hapd2ap.dump_monitor()
2537 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2538 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2539 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2540 if ev is None:
2541 raise Exception("No TX status seen")
2542 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2543 if "OK" not in hapd2ap.request(cmd):
2544 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2545 hapd2ap.set("ext_mgmt_frame_handling", "0")
2546
2547 try:
2548 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2549 ok = True
2550 except:
2551 ok = False
2552
2553 ap = hapd2ap.own_addr()
2554 sta = dev[0].own_addr()
2555 filt = "wlan.fc.type == 2 && " + \
2556 "wlan.da == " + sta + " && " + \
2557 "wlan.sa == " + ap
2558 fields = [ "wlan.ccmp.extiv" ]
2559 res = run_tshark(capfile, filt, fields)
2560 vals = res.splitlines()
2561 logger.info("CCMP PN: " + str(vals))
2562 if len(vals) < 2:
2563 raise Exception("Could not find all CCMP protected frames from capture")
2564 if len(set(vals)) < len(vals):
2565 raise Exception("Duplicate CCMP PN used")
2566
2567 if not ok:
2568 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2569
2570def test_ap_ft_psk_file(dev, apdev):
2571 """WPA2-PSK-FT AP with PSK from a file"""
2572 ssid = "test-ft"
2573 passphrase="12345678"
2574
2575 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2576 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2577 hapd = hostapd.add_ap(apdev[0], params)
2578
2579 dev[1].connect(ssid, psk="very secret",
2580 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2581 scan_freq="2412", wait_connect=False)
2582 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2583 ieee80211w="1", scan_freq="2412")
2584 dev[0].request("REMOVE_NETWORK all")
2585 dev[0].wait_disconnected()
2586 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2587 ieee80211w="1", scan_freq="2412")
2588 dev[0].request("REMOVE_NETWORK all")
2589 dev[0].wait_disconnected()
2590 dev[0].connect(ssid, psk="secret passphrase",
2591 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2592 scan_freq="2412")
2593 dev[2].connect(ssid, psk="another passphrase for all STAs",
2594 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2595 scan_freq="2412")
2596 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2597 if ev is None:
2598 raise Exception("Timed out while waiting for failure report")
2599 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2600
2601def test_ap_ft_eap_ap_config_change(dev, apdev):
2602 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2603 ssid = "test-ft"
2604 passphrase="12345678"
2605 bssid = apdev[0]['bssid']
2606
2607 radius = hostapd.radius_params()
2608 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2609 params['wpa_key_mgmt'] = "WPA-EAP"
2610 params["ieee8021x"] = "1"
2611 params["pmk_r1_push"] = "0"
2612 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2613 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2614 params["eap_server"] = "0"
35d8c254 2615 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2616 hapd = hostapd.add_ap(apdev[0], params)
2617
2618 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2619 eap="GPSK", identity="gpsk user",
2620 password="abcdefghijklmnop0123456789abcdef",
2621 scan_freq="2412")
2622 dev[0].request("DISCONNECT")
2623 dev[0].wait_disconnected()
2624 dev[0].dump_monitor()
2625
2626 hapd.disable()
2627 hapd.set('wpa_key_mgmt', "FT-EAP")
2628 hapd.enable()
2629
2630 dev[0].request("BSS_FLUSH 0")
2631 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2632
2633 dev[0].request("RECONNECT")
2634 dev[0].wait_connected()
55b3cda7
JM		 2635
2636def test_ap_ft_eap_sha384(dev, apdev):
2637 """WPA2-EAP-FT with SHA384"""
2638 ssid = "test-ft"
2639 passphrase="12345678"
2640
2641 radius = hostapd.radius_params()
2642 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2643 params["ieee80211w"] = "2"
55b3cda7
JM		 2644 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2645 params["ieee8021x"] = "1"
35d8c254 2646 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2647 hapd0 = hostapd.add_ap(apdev[0], params)
2648 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2649 params["ieee80211w"] = "2"
55b3cda7
JM		 2650 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2651 params["ieee8021x"] = "1"
35d8c254 2652 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2653 hapd1 = hostapd.add_ap(apdev[1], params)
2654
2655 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2656 sha384=True)
2657
2658def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2659 """WPA2-EAP-FT with SHA384 over DS"""
2660 ssid = "test-ft"
2661 passphrase="12345678"
2662
2663 radius = hostapd.radius_params()
2664 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2665 params["ieee80211w"] = "2"
55b3cda7
JM		 2666 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2667 params["ieee8021x"] = "1"
35d8c254 2668 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2669 hapd0 = hostapd.add_ap(apdev[0], params)
2670 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2671 params["ieee80211w"] = "2"
55b3cda7
JM		 2672 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2673 params["ieee8021x"] = "1"
35d8c254 2674 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2675 hapd1 = hostapd.add_ap(apdev[1], params)
2676
2677 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2678 eap=True, sha384=True)
392aba4e
JM		 2679
2680def test_ap_ft_roam_rrm(dev, apdev):
2681 """WPA2-PSK-FT AP and radio measurement request"""
2682 ssid = "test-ft"
2683 passphrase="12345678"
2684
2685 params = ft_params1(ssid=ssid, passphrase=passphrase)
2686 params["rrm_beacon_report"] = "1"
2687 hapd0 = hostapd.add_ap(apdev[0], params)
2688 bssid0 = hapd0.own_addr()
2689
2690 addr = dev[0].own_addr()
2691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2692 scan_freq="2412")
2693 check_beacon_req(hapd0, addr, 1)
2694
2695 params = ft_params2(ssid=ssid, passphrase=passphrase)
2696 params["rrm_beacon_report"] = "1"
2697 hapd1 = hostapd.add_ap(apdev[1], params)
2698 bssid1 = hapd1.own_addr()
2699
2700 dev[0].scan_for_bss(bssid1, freq=2412)
2701 dev[0].roam(bssid1)
2702 check_beacon_req(hapd1, addr, 2)
2703
2704 dev[0].scan_for_bss(bssid0, freq=2412)
2705 dev[0].roam(bssid0)
2706 check_beacon_req(hapd0, addr, 3)
Unnamed repository; edit this file 'description' to name the repository.