]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FT: Allow CCMP-256 and GCMP-256 as group ciphers
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
ae14a2e2 2# Copyright (c) 2013-2014, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
5b3c40a6
JM		 7import binascii
8import os
cd7f1b9a
JM		 9import time
10import subprocess
11import logging
c9aa4308 12logger = logging.getLogger()
cd7f1b9a
JM		 13
14import hwsim_utils
15import hostapd
81e787b7 16from utils import HwsimSkip
cd7f1b9a 17from wlantest import Wlantest
5b3c40a6 18from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
cd7f1b9a
JM		 19
20def ft_base_rsn():
21 params = { "wpa": "2",
22 "wpa_key_mgmt": "FT-PSK",
23 "rsn_pairwise": "CCMP" }
24 return params
25
26def ft_base_mixed():
27 params = { "wpa": "3",
28 "wpa_key_mgmt": "WPA-PSK FT-PSK",
29 "wpa_pairwise": "TKIP",
30 "rsn_pairwise": "CCMP" }
31 return params
32
33def ft_params(rsn=True, ssid=None, passphrase=None):
34 if rsn:
35 params = ft_base_rsn()
36 else:
37 params = ft_base_mixed()
38 if ssid:
39 params["ssid"] = ssid
40 if passphrase:
41 params["wpa_passphrase"] = passphrase
42
43 params["mobility_domain"] = "a1b2"
44 params["r0_key_lifetime"] = "10000"
45 params["pmk_r1_push"] = "1"
46 params["reassociation_deadline"] = "1000"
47 return params
48
49def ft_params1(rsn=True, ssid=None, passphrase=None):
50 params = ft_params(rsn, ssid, passphrase)
51 params['nas_identifier'] = "nas1.w1.fi"
52 params['r1_key_holder'] = "000102030405"
53 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
54 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
55 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
56 return params
57
58def ft_params2(rsn=True, ssid=None, passphrase=None):
59 params = ft_params(rsn, ssid, passphrase)
60 params['nas_identifier'] = "nas2.w1.fi"
61 params['r1_key_holder'] = "000102030406"
62 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
63 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
64 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
65 return params
66
3b808945
JM		 67def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
68 params = ft_params(rsn, ssid, passphrase)
69 params['nas_identifier'] = "nas1.w1.fi"
70 params['r1_key_holder'] = "000102030405"
71 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
72 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
73 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
74 return params
75
76def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
77 params = ft_params(rsn, ssid, passphrase)
78 params['nas_identifier'] = "nas2.w1.fi"
79 params['r1_key_holder'] = "000102030406"
80 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1",
81 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2" ]
82 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3"
83 return params
84
85def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
86 params = ft_params(rsn, ssid, passphrase)
87 params['nas_identifier'] = "nas2.w1.fi"
88 params['r1_key_holder'] = "000102030406"
89 params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
90 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
91 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
92 return params
93
a8375c94 94def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False, sae=False, eap=False, fail_test=False, roams=1):
cd7f1b9a 95 logger.info("Connect to first AP")
6f62809b
JM		 96 if eap:
97 dev.connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2f816c21
JM		 98 eap="GPSK", identity="gpsk user",
99 password="abcdefghijklmnop0123456789abcdef",
100 scan_freq="2412")
6e658cc4 101 else:
6f62809b
JM		 102 if sae:
103 key_mgmt="FT-SAE"
104 else:
105 key_mgmt="FT-PSK"
106 dev.connect(ssid, psk=passphrase, key_mgmt=key_mgmt, proto="WPA2",
2f816c21 107 ieee80211w="1", scan_freq="2412")
cd7f1b9a
JM		 108 if dev.get_status_field('bssid') == apdev[0]['bssid']:
109 ap1 = apdev[0]
110 ap2 = apdev[1]
a8375c94
JM		 111 hapd1ap = hapd0
112 hapd2ap = hapd1
cd7f1b9a
JM		 113 else:
114 ap1 = apdev[1]
115 ap2 = apdev[0]
a8375c94
JM		 116 hapd1ap = hapd1
117 hapd2ap = hapd0
118 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 119
655bc8bf 120 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 121
122 for i in range(0, roams):
123 logger.info("Roam to the second AP")
124 if over_ds:
125 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
126 else:
127 dev.roam(ap2['bssid'], fail_test=fail_test)
128 if fail_test:
129 return
130 if dev.get_status_field('bssid') != ap2['bssid']:
131 raise Exception("Did not connect to correct AP")
132 if i == 0 or i == roams - 1:
a8375c94 133 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101
JM		 134
135 logger.info("Roam back to the first AP")
136 if over_ds:
137 dev.roam_over_ds(ap1['bssid'])
138 else:
139 dev.roam(ap1['bssid'])
140 if dev.get_status_field('bssid') != ap1['bssid']:
141 raise Exception("Did not connect to correct AP")
142 if i == 0 or i == roams - 1:
a8375c94 143 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 144
145def test_ap_ft(dev, apdev):
146 """WPA2-PSK-FT AP"""
147 ssid = "test-ft"
148 passphrase="12345678"
149
150 params = ft_params1(ssid=ssid, passphrase=passphrase)
a8375c94 151 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
cd7f1b9a 152 params = ft_params2(ssid=ssid, passphrase=passphrase)
a8375c94 153 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
cd7f1b9a 154
a8375c94 155 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 156 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
157 raise Exception("Scan results missing RSN element info")
cd7f1b9a 158
40602101
JM		 159def test_ap_ft_many(dev, apdev):
160 """WPA2-PSK-FT AP multiple times"""
161 ssid = "test-ft"
162 passphrase="12345678"
163
164 params = ft_params1(ssid=ssid, passphrase=passphrase)
a8375c94 165 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
40602101 166 params = ft_params2(ssid=ssid, passphrase=passphrase)
a8375c94 167 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
40602101 168
a8375c94 169 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 170
cd7f1b9a
JM		 171def test_ap_ft_mixed(dev, apdev):
172 """WPA2-PSK-FT mixed-mode AP"""
173 ssid = "test-ft-mixed"
174 passphrase="12345678"
175
176 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
65038313
JM		 177 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
178 key_mgmt = hapd.get_config()['key_mgmt']
179 vals = key_mgmt.split(' ')
180 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
181 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 182 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
a8375c94 183 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
cd7f1b9a 184
a8375c94 185 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 186
187def test_ap_ft_pmf(dev, apdev):
188 """WPA2-PSK-FT AP with PMF"""
189 ssid = "test-ft"
190 passphrase="12345678"
191
192 params = ft_params1(ssid=ssid, passphrase=passphrase)
193 params["ieee80211w"] = "2";
a8375c94 194 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
cd7f1b9a
JM		 195 params = ft_params2(ssid=ssid, passphrase=passphrase)
196 params["ieee80211w"] = "2";
a8375c94 197 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
cd7f1b9a 198
a8375c94 199 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1
JM		 200
201def test_ap_ft_over_ds(dev, apdev):
202 """WPA2-PSK-FT AP over DS"""
203 ssid = "test-ft"
204 passphrase="12345678"
205
206 params = ft_params1(ssid=ssid, passphrase=passphrase)
a8375c94 207 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
b553eab1 208 params = ft_params2(ssid=ssid, passphrase=passphrase)
a8375c94 209 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
b553eab1 210
a8375c94 211 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
eaf3f9b1
JM		 212 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
213 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
b553eab1 214
40602101
JM		 215def test_ap_ft_over_ds_many(dev, apdev):
216 """WPA2-PSK-FT AP over DS multiple times"""
217 ssid = "test-ft"
218 passphrase="12345678"
219
220 params = ft_params1(ssid=ssid, passphrase=passphrase)
a8375c94 221 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
40602101 222 params = ft_params2(ssid=ssid, passphrase=passphrase)
a8375c94 223 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
40602101 224
a8375c94
JM		 225 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
226 roams=50)
40602101 227
c337d07a
JM		 228def test_ap_ft_over_ds_unknown_target(dev, apdev):
229 """WPA2-PSK-FT AP"""
230 ssid = "test-ft"
231 passphrase="12345678"
232
233 params = ft_params1(ssid=ssid, passphrase=passphrase)
234 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
235
236 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
237 scan_freq="2412")
238 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
239
211bb7c5
JM		 240def test_ap_ft_over_ds_unexpected(dev, apdev):
241 """WPA2-PSK-FT AP over DS and unexpected response"""
242 ssid = "test-ft"
243 passphrase="12345678"
244
245 params = ft_params1(ssid=ssid, passphrase=passphrase)
246 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
247 params = ft_params2(ssid=ssid, passphrase=passphrase)
248 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
249
250 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
251 scan_freq="2412")
252 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
253 ap1 = apdev[0]
254 ap2 = apdev[1]
255 hapd1ap = hapd0
256 hapd2ap = hapd1
257 else:
258 ap1 = apdev[1]
259 ap2 = apdev[0]
260 hapd1ap = hapd1
261 hapd2ap = hapd0
262
263 addr = dev[0].own_addr()
264 hapd1ap.set("ext_mgmt_frame_handling", "1")
265 logger.info("Foreign STA address")
266 msg = {}
267 msg['fc'] = 13 << 4
268 msg['da'] = addr
269 msg['sa'] = ap1['bssid']
270 msg['bssid'] = ap1['bssid']
271 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
272 hapd1ap.mgmt_tx(msg)
273
274 logger.info("No over-the-DS in progress")
275 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
276 hapd1ap.mgmt_tx(msg)
277
278 logger.info("Non-zero status code")
279 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
280 hapd1ap.mgmt_tx(msg)
281
282 hapd1ap.dump_monitor()
283
284 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
285 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
286 raise Exception("FT_DS failed")
287
288 req = hapd1ap.mgmt_rx()
289
290 logger.info("Foreign Target AP")
291 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
292 hapd1ap.mgmt_tx(msg)
293
294 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
295
296 logger.info("No IEs")
297 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
298 hapd1ap.mgmt_tx(msg)
299
300 logger.info("Invalid IEs (trigger parsing failure)")
301 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
302 hapd1ap.mgmt_tx(msg)
303
304 logger.info("Too short MDIE")
305 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
306 hapd1ap.mgmt_tx(msg)
307
308 logger.info("Mobility domain mismatch")
309 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
310 hapd1ap.mgmt_tx(msg)
311
312 logger.info("No FTIE")
313 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
314 hapd1ap.mgmt_tx(msg)
315
316 logger.info("FTIE SNonce mismatch")
317 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
318 hapd1ap.mgmt_tx(msg)
319
320 logger.info("No R0KH-ID subelem in FTIE")
321 snonce = binascii.hexlify(req['payload'][111:111+32])
322 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
323 hapd1ap.mgmt_tx(msg)
324
325 logger.info("No R0KH-ID subelem mismatch in FTIE")
326 snonce = binascii.hexlify(req['payload'][111:111+32])
327 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
328 hapd1ap.mgmt_tx(msg)
329
330 logger.info("No R1KH-ID subelem in FTIE")
331 r0khid = binascii.hexlify(req['payload'][145:145+10])
332 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
333 hapd1ap.mgmt_tx(msg)
334
335 logger.info("No RSNE")
336 r0khid = binascii.hexlify(req['payload'][145:145+10])
337 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
338 hapd1ap.mgmt_tx(msg)
339
b553eab1
JM		 340def test_ap_ft_pmf_over_ds(dev, apdev):
341 """WPA2-PSK-FT AP over DS with PMF"""
342 ssid = "test-ft"
343 passphrase="12345678"
344
345 params = ft_params1(ssid=ssid, passphrase=passphrase)
346 params["ieee80211w"] = "2";
a8375c94 347 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
b553eab1
JM		 348 params = ft_params2(ssid=ssid, passphrase=passphrase)
349 params["ieee80211w"] = "2";
a8375c94 350 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
b553eab1 351
a8375c94 352 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
6e658cc4 353
aaba98d3
JM		 354def test_ap_ft_over_ds_pull(dev, apdev):
355 """WPA2-PSK-FT AP over DS (pull PMK)"""
356 ssid = "test-ft"
357 passphrase="12345678"
358
359 params = ft_params1(ssid=ssid, passphrase=passphrase)
360 params["pmk_r1_push"] = "0"
a8375c94 361 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
aaba98d3
JM		 362 params = ft_params2(ssid=ssid, passphrase=passphrase)
363 params["pmk_r1_push"] = "0"
a8375c94 364 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
aaba98d3 365
a8375c94 366 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 367
6e658cc4
JM		 368def test_ap_ft_sae(dev, apdev):
369 """WPA2-PSK-FT-SAE AP"""
b9749b6a
JM		 370 if "SAE" not in dev[0].get_capability("auth_alg"):
371 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 372 ssid = "test-ft"
373 passphrase="12345678"
374
375 params = ft_params1(ssid=ssid, passphrase=passphrase)
376 params['wpa_key_mgmt'] = "FT-SAE"
a8375c94 377 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
6e658cc4
JM		 378 params = ft_params2(ssid=ssid, passphrase=passphrase)
379 params['wpa_key_mgmt'] = "FT-SAE"
65038313
JM		 380 hapd = hostapd.add_ap(apdev[1]['ifname'], params)
381 key_mgmt = hapd.get_config()['key_mgmt']
382 if key_mgmt.split(' ')[0] != "FT-SAE":
383 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 384
17ffdf39 385 dev[0].request("SET sae_groups ")
a8375c94 386 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
6e658cc4
JM		 387
388def test_ap_ft_sae_over_ds(dev, apdev):
389 """WPA2-PSK-FT-SAE AP over DS"""
b9749b6a
JM		 390 if "SAE" not in dev[0].get_capability("auth_alg"):
391 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 392 ssid = "test-ft"
393 passphrase="12345678"
394
395 params = ft_params1(ssid=ssid, passphrase=passphrase)
396 params['wpa_key_mgmt'] = "FT-SAE"
a8375c94 397 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
6e658cc4
JM		 398 params = ft_params2(ssid=ssid, passphrase=passphrase)
399 params['wpa_key_mgmt'] = "FT-SAE"
a8375c94 400 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
6e658cc4 401
17ffdf39 402 dev[0].request("SET sae_groups ")
a8375c94
JM		 403 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
404 over_ds=True)
6f62809b
JM		 405
406def test_ap_ft_eap(dev, apdev):
407 """WPA2-EAP-FT AP"""
408 ssid = "test-ft"
409 passphrase="12345678"
410
411 radius = hostapd.radius_params()
412 params = ft_params1(ssid=ssid, passphrase=passphrase)
413 params['wpa_key_mgmt'] = "FT-EAP"
414 params["ieee8021x"] = "1"
415 params = dict(radius.items() + params.items())
65038313
JM		 416 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
417 key_mgmt = hapd.get_config()['key_mgmt']
418 if key_mgmt.split(' ')[0] != "FT-EAP":
419 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6f62809b
JM		 420 params = ft_params2(ssid=ssid, passphrase=passphrase)
421 params['wpa_key_mgmt'] = "FT-EAP"
422 params["ieee8021x"] = "1"
423 params = dict(radius.items() + params.items())
a8375c94 424 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
6f62809b 425
a8375c94 426 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
91bc6c36
JM		 427 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
428 raise Exception("Scan results missing RSN element info")
eaf3f9b1
JM		 429 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
430 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
aaba98d3
JM		 431
432def test_ap_ft_eap_pull(dev, apdev):
433 """WPA2-EAP-FT AP (pull PMK)"""
434 ssid = "test-ft"
435 passphrase="12345678"
436
437 radius = hostapd.radius_params()
438 params = ft_params1(ssid=ssid, passphrase=passphrase)
439 params['wpa_key_mgmt'] = "FT-EAP"
440 params["ieee8021x"] = "1"
441 params["pmk_r1_push"] = "0"
442 params = dict(radius.items() + params.items())
443 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
444 key_mgmt = hapd.get_config()['key_mgmt']
445 if key_mgmt.split(' ')[0] != "FT-EAP":
446 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
447 params = ft_params2(ssid=ssid, passphrase=passphrase)
448 params['wpa_key_mgmt'] = "FT-EAP"
449 params["ieee8021x"] = "1"
450 params["pmk_r1_push"] = "0"
451 params = dict(radius.items() + params.items())
a8375c94 452 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
aaba98d3 453
a8375c94 454 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
3b808945
JM		 455
456def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
457 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
458 ssid = "test-ft"
459 passphrase="12345678"
460
461 params = ft_params1(ssid=ssid, passphrase=passphrase)
462 params["ieee80211w"] = "2";
a8375c94 463 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
3b808945
JM		 464 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
465 params["ieee80211w"] = "2";
a8375c94 466 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
3b808945 467
a8375c94
JM		 468 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
469 fail_test=True)
3b808945
JM		 470
471def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
472 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
473 ssid = "test-ft"
474 passphrase="12345678"
475
476 params = ft_params1(ssid=ssid, passphrase=passphrase)
477 params["pmk_r1_push"] = "0"
a8375c94 478 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
3b808945
JM		 479 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
480 params["pmk_r1_push"] = "0"
a8375c94 481 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
3b808945 482
a8375c94
JM		 483 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
484 fail_test=True)
3b808945 485
ae14a2e2
JM		 486def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
487 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
488 ssid = "test-ft"
489 passphrase="12345678"
490
491 params = ft_params1(ssid=ssid, passphrase=passphrase)
492 params["pmk_r1_push"] = "0"
493 params["nas_identifier"] = "nas0.w1.fi"
494 hostapd.add_ap(apdev[0]['ifname'], params)
2f816c21
JM		 495 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
496 scan_freq="2412")
ae14a2e2
JM		 497
498 params = ft_params2(ssid=ssid, passphrase=passphrase)
499 params["pmk_r1_push"] = "0"
500 hostapd.add_ap(apdev[1]['ifname'], params)
501
502 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
503 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
504
3b808945
JM		 505def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
506 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
507 ssid = "test-ft"
508 passphrase="12345678"
509
510 params = ft_params1(ssid=ssid, passphrase=passphrase)
511 params["ieee80211w"] = "2";
a8375c94 512 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
3b808945
JM		 513 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
514 params["ieee80211w"] = "2";
a8375c94 515 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
3b808945 516
a8375c94
JM		 517 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
518 fail_test=True)
3b808945
JM		 519
520def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
521 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
522 ssid = "test-ft"
523 passphrase="12345678"
524
525 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
526 params["pmk_r1_push"] = "0"
a8375c94 527 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
3b808945
JM		 528 params = ft_params2(ssid=ssid, passphrase=passphrase)
529 params["pmk_r1_push"] = "0"
a8375c94 530 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
3b808945 531
a8375c94
JM		 532 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
533 fail_test=True)
c6b6e105
JM		 534
535def test_ap_ft_gtk_rekey(dev, apdev):
536 """WPA2-PSK-FT AP and GTK rekey"""
537 ssid = "test-ft"
538 passphrase="12345678"
539
540 params = ft_params1(ssid=ssid, passphrase=passphrase)
541 params['wpa_group_rekey'] = '1'
a8375c94 542 hapd = hostapd.add_ap(apdev[0]['ifname'], params)
c6b6e105
JM		 543
544 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 545 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 546
547 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
548 if ev is None:
549 raise Exception("GTK rekey timed out after initial association")
a8375c94 550 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 551
552 params = ft_params2(ssid=ssid, passphrase=passphrase)
553 params['wpa_group_rekey'] = '1'
a8375c94 554 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
c6b6e105
JM		 555
556 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
557 dev[0].roam(apdev[1]['bssid'])
558 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
559 raise Exception("Did not connect to correct AP")
a8375c94 560 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 561
562 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
563 if ev is None:
564 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 565 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 566
567def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
568 """WPA2-PSK-FT and key lifetime in memory"""
569 ssid = "test-ft"
570 passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
571 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
572 pmk = binascii.unhexlify(psk)
573 p = ft_params1(ssid=ssid, passphrase=passphrase)
574 hapd0 = hostapd.add_ap(apdev[0]['ifname'], p)
575 p = ft_params2(ssid=ssid, passphrase=passphrase)
576 hapd1 = hostapd.add_ap(apdev[1]['ifname'], p)
577
578 pid = find_wpas_process(dev[0])
579
580 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
581 scan_freq="2412")
54f2cae2 582 time.sleep(1)
5b3c40a6
JM		 583
584 buf = read_process_memory(pid, pmk)
585
586 dev[0].request("DISCONNECT")
587 dev[0].wait_disconnected()
588
589 dev[0].relog()
590 pmkr0 = None
591 pmkr1 = None
592 ptk = None
593 gtk = None
594 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
595 for l in f.readlines():
596 if "FT: PMK-R0 - hexdump" in l:
597 val = l.strip().split(':')[3].replace(' ', '')
598 pmkr0 = binascii.unhexlify(val)
599 if "FT: PMK-R1 - hexdump" in l:
600 val = l.strip().split(':')[3].replace(' ', '')
601 pmkr1 = binascii.unhexlify(val)
f918b95b 602 if "FT: KCK - hexdump" in l:
5b3c40a6 603 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 604 kck = binascii.unhexlify(val)
605 if "FT: KEK - hexdump" in l:
606 val = l.strip().split(':')[3].replace(' ', '')
607 kek = binascii.unhexlify(val)
608 if "FT: TK - hexdump" in l:
609 val = l.strip().split(':')[3].replace(' ', '')
610 tk = binascii.unhexlify(val)
5b3c40a6
JM		 611 if "WPA: Group Key - hexdump" in l:
612 val = l.strip().split(':')[3].replace(' ', '')
613 gtk = binascii.unhexlify(val)
f918b95b 614 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 615 raise Exception("Could not find keys from debug log")
616 if len(gtk) != 16:
617 raise Exception("Unexpected GTK length")
618
5b3c40a6
JM		 619 logger.info("Checking keys in memory while associated")
620 get_key_locations(buf, pmk, "PMK")
621 get_key_locations(buf, pmkr0, "PMK-R0")
622 get_key_locations(buf, pmkr1, "PMK-R1")
623 if pmk not in buf:
81e787b7 624 raise HwsimSkip("PMK not found while associated")
5b3c40a6 625 if pmkr0 not in buf:
81e787b7 626 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 627 if pmkr1 not in buf:
81e787b7 628 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 629 if kck not in buf:
630 raise Exception("KCK not found while associated")
631 if kek not in buf:
632 raise Exception("KEK not found while associated")
633 if tk in buf:
634 raise Exception("TK found from memory")
635 if gtk in buf:
636 raise Exception("GTK found from memory")
637
638 logger.info("Checking keys in memory after disassociation")
639 buf = read_process_memory(pid, pmk)
640 get_key_locations(buf, pmk, "PMK")
641 get_key_locations(buf, pmkr0, "PMK-R0")
642 get_key_locations(buf, pmkr1, "PMK-R1")
643
644 # Note: PMK/PSK is still present in network configuration
645
646 fname = os.path.join(params['logdir'],
647 'ft_psk_key_lifetime_in_memory.memctx-')
648 verify_not_present(buf, pmkr0, fname, "PMK-R0")
649 verify_not_present(buf, pmkr1, fname, "PMK-R1")
650 verify_not_present(buf, kck, fname, "KCK")
651 verify_not_present(buf, kek, fname, "KEK")
652 verify_not_present(buf, tk, fname, "TK")
653 verify_not_present(buf, gtk, fname, "GTK")
654
655 dev[0].request("REMOVE_NETWORK all")
656
657 logger.info("Checking keys in memory after network profile removal")
658 buf = read_process_memory(pid, pmk)
659 get_key_locations(buf, pmk, "PMK")
660 get_key_locations(buf, pmkr0, "PMK-R0")
661 get_key_locations(buf, pmkr1, "PMK-R1")
662
663 verify_not_present(buf, pmk, fname, "PMK")
664 verify_not_present(buf, pmkr0, fname, "PMK-R0")
665 verify_not_present(buf, pmkr1, fname, "PMK-R1")
666 verify_not_present(buf, kck, fname, "KCK")
667 verify_not_present(buf, kek, fname, "KEK")
668 verify_not_present(buf, tk, fname, "TK")
669 verify_not_present(buf, gtk, fname, "GTK")
664093b5
JM		 670
671def test_ap_ft_invalid_resp(dev, apdev):
672 """WPA2-PSK-FT AP and invalid response IEs"""
673 ssid = "test-ft"
674 passphrase="12345678"
675
676 params = ft_params1(ssid=ssid, passphrase=passphrase)
677 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
678 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
679 scan_freq="2412")
680
681 params = ft_params2(ssid=ssid, passphrase=passphrase)
682 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
683
684 tests = [
685 # Various IEs for test coverage. The last one is FTIE with invalid
686 # R1KH-ID subelement.
687 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
688 # FTIE with invalid R0KH-ID subelement (len=0).
689 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
690 # FTIE with invalid R0KH-ID subelement (len=49).
691 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
692 # Invalid RSNE.
693 "020002000000" + "3000",
694 # Required IEs missing from protected IE count.
695 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
696 # RIC missing from protected IE count.
697 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
698 # Protected IE missing.
699 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
700 for t in tests:
701 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
702 hapd1.set("ext_mgmt_frame_handling", "1")
703 hapd1.dump_monitor()
704 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
705 raise Exception("ROAM failed")
706 auth = None
707 for i in range(20):
708 msg = hapd1.mgmt_rx()
709 if msg['subtype'] == 11:
710 auth = msg
711 break
712 if not auth:
713 raise Exception("Authentication frame not seen")
714
715 resp = {}
716 resp['fc'] = auth['fc']
717 resp['da'] = auth['sa']
718 resp['sa'] = auth['da']
719 resp['bssid'] = auth['bssid']
720 resp['payload'] = binascii.unhexlify(t)
721 hapd1.mgmt_tx(resp)
722 hapd1.set("ext_mgmt_frame_handling", "0")
723 dev[0].wait_disconnected()
724
725 dev[0].request("RECONNECT")
726 dev[0].wait_connected()
Unnamed repository; edit this file 'description' to name the repository.