]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: EAP-TEAP with machine username/password credential
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
e1923f5b 25from test_suite_b import check_suite_b_192_capa
cd7f1b9a
JM		 26
27def ft_base_rsn():
fab49f61
JM		 28 params = {"wpa": "2",
29 "wpa_key_mgmt": "FT-PSK",
30 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 31 return params
32
33def ft_base_mixed():
fab49f61
JM		 34 params = {"wpa": "3",
35 "wpa_key_mgmt": "WPA-PSK FT-PSK",
36 "wpa_pairwise": "TKIP",
37 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 38 return params
39
40def ft_params(rsn=True, ssid=None, passphrase=None):
41 if rsn:
42 params = ft_base_rsn()
43 else:
44 params = ft_base_mixed()
45 if ssid:
46 params["ssid"] = ssid
47 if passphrase:
48 params["wpa_passphrase"] = passphrase
49
50 params["mobility_domain"] = "a1b2"
51 params["r0_key_lifetime"] = "10000"
52 params["pmk_r1_push"] = "1"
53 params["reassociation_deadline"] = "1000"
54 return params
55
d0175d6e 56def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 57 params = ft_params(rsn, ssid, passphrase)
58 params['nas_identifier'] = "nas1.w1.fi"
59 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 60 return params
61
942b52a8 62def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 63 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 64 if discovery:
65 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
67 else:
fab49f61
JM		 68 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
69 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
942b52a8 70 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 71 return params
72
c95dd8e4
JM		 73def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
74 params = ft_params1a(rsn, ssid, passphrase)
fab49f61
JM		 75 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
76 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 77 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
78 return params
79
d0175d6e 80def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 81 params = ft_params(rsn, ssid, passphrase)
82 params['nas_identifier'] = "nas2.w1.fi"
83 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 84 return params
85
942b52a8 86def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 87 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 88 if discovery:
89 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
91 else:
fab49f61
JM		 92 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
93 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
942b52a8 94 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 95 return params
96
c95dd8e4
JM		 97def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
98 params = ft_params2a(rsn, ssid, passphrase)
fab49f61
JM		 99 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
100 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 101 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
102 return params
103
3b808945
JM		 104def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
105 params = ft_params(rsn, ssid, passphrase)
106 params['nas_identifier'] = "nas1.w1.fi"
107 params['r1_key_holder'] = "000102030405"
fab49f61
JM		 108 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
109 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
9441a227 110 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 111 return params
112
113def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
114 params = ft_params(rsn, ssid, passphrase)
115 params['nas_identifier'] = "nas2.w1.fi"
116 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 117 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
118 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
9441a227 119 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 120 return params
121
122def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
123 params = ft_params(rsn, ssid, passphrase)
124 params['nas_identifier'] = "nas2.w1.fi"
125 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 126 params['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
127 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
9441a227 128 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 129 return params
130
7b741a53
JM		 131def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
132 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 133 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 134 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 135 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5 136 group_mgmt=None, ocv=None, sae_password=None,
659f7954 137 sae_password_id=None, sae_and_psk=False, pmksa_caching=False,
5916637c 138 roam_with_reassoc=False, also_non_ft=False, only_one_way=False,
30998360 139 wait_before_roam=0, return_after_initial=False, ieee80211w="1"):
cd7f1b9a 140 logger.info("Connect to first AP")
473e5176
MB		 141
142 copts = {}
143 copts["proto"] = "WPA2"
30998360 144 copts["ieee80211w"] = ieee80211w
473e5176
MB		 145 copts["scan_freq"] = "2412"
146 copts["pairwise"] = pairwise_cipher
fab49f61 147 copts["group"] = group_cipher
473e5176 148 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 149 if group_mgmt:
150 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 151 if ocv:
152 copts["ocv"] = ocv
6f62809b 153 if eap:
9ff2b85e
JM		 154 if pmksa_caching:
155 copts["ft_eap_pmksa_caching"] = "1"
659f7954
JM		 156 if also_non_ft:
157 copts["key_mgmt"] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384" if sha384 else "WPA-EAP FT-EAP"
158 else:
159 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 160 copts["eap"] = "GPSK"
161 copts["identity"] = eap_identity
162 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 163 else:
6f62809b 164 if sae:
cdf53910 165 copts["key_mgmt"] = "SAE FT-SAE" if sae_and_psk else "FT-SAE"
6f62809b 166 else:
473e5176 167 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 168 if passphrase:
169 copts["psk"] = passphrase
170 if sae_password:
171 copts["sae_password"] = sae_password
172 if sae_password_id:
173 copts["sae_password_id"] = sae_password_id
473e5176
MB		 174 if force_initial_conn_to_first_ap:
175 copts["bssid"] = apdev[0]['bssid']
659f7954 176 netw = dev.connect(ssid, **copts)
1211031a
JM		 177 if pmksa_caching:
178 dev.request("DISCONNECT")
179 dev.wait_disconnected()
180 dev.request("RECONNECT")
9ff2b85e
JM		 181 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
182 "CTRL-EVENT-DISCONNECTED",
183 "CTRL-EVENT-EAP-STARTED"],
1211031a
JM		 184 timeout=15)
185 if ev is None:
186 raise Exception("Reconnect timed out")
187 if "CTRL-EVENT-DISCONNECTED" in ev:
188 raise Exception("Unexpected disconnection after RECONNECT")
9ff2b85e
JM		 189 if "CTRL-EVENT-EAP-STARTED" in ev:
190 raise Exception("Unexpected EAP start after RECONNECT")
473e5176 191
cd7f1b9a
JM		 192 if dev.get_status_field('bssid') == apdev[0]['bssid']:
193 ap1 = apdev[0]
194 ap2 = apdev[1]
a8375c94
JM		 195 hapd1ap = hapd0
196 hapd2ap = hapd1
cd7f1b9a
JM		 197 else:
198 ap1 = apdev[1]
199 ap2 = apdev[0]
a8375c94
JM		 200 hapd1ap = hapd1
201 hapd2ap = hapd0
fd7205fa 202 if test_connectivity:
938c6e7b 203 hapd1ap.wait_sta()
9c50a6d3
MB		 204 if conndev:
205 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
206 else:
207 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 208
5916637c
JM		 209 if return_after_initial:
210 return ap2['bssid']
211
212 if wait_before_roam:
213 time.sleep(wait_before_roam)
655bc8bf 214 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 215
216 for i in range(0, roams):
e0382291
MB		 217 # Roaming artificially fast can make data test fail because the key is
218 # set later.
219 time.sleep(0.01)
40602101 220 logger.info("Roam to the second AP")
659f7954
JM		 221 if roam_with_reassoc:
222 dev.set_network(netw, "bssid", ap2['bssid'])
223 dev.request("REASSOCIATE")
224 dev.wait_connected()
225 elif over_ds:
40602101
JM		 226 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
227 else:
228 dev.roam(ap2['bssid'], fail_test=fail_test)
229 if fail_test:
230 return
231 if dev.get_status_field('bssid') != ap2['bssid']:
232 raise Exception("Did not connect to correct AP")
fd7205fa 233 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 234 hapd2ap.wait_sta()
9c50a6d3
MB		 235 if conndev:
236 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
237 else:
238 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 239
425e5f97
JM		 240 if only_one_way:
241 return
e0382291
MB		 242 # Roaming artificially fast can make data test fail because the key is
243 # set later.
244 time.sleep(0.01)
40602101 245 logger.info("Roam back to the first AP")
659f7954
JM		 246 if roam_with_reassoc:
247 dev.set_network(netw, "bssid", ap1['bssid'])
248 dev.request("REASSOCIATE")
249 dev.wait_connected()
250 elif over_ds:
40602101
JM		 251 dev.roam_over_ds(ap1['bssid'])
252 else:
253 dev.roam(ap1['bssid'])
254 if dev.get_status_field('bssid') != ap1['bssid']:
255 raise Exception("Did not connect to correct AP")
fd7205fa 256 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 257 hapd1ap.wait_sta()
9c50a6d3
MB		 258 if conndev:
259 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
260 else:
261 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 262
263def test_ap_ft(dev, apdev):
264 """WPA2-PSK-FT AP"""
265 ssid = "test-ft"
fab49f61 266 passphrase = "12345678"
cd7f1b9a
JM		 267
268 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 269 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 270 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 271 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 272
a8375c94 273 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 274 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
275 raise Exception("Scan results missing RSN element info")
cd7f1b9a 276
c95dd8e4
JM		 277def test_ap_ft_old_key(dev, apdev):
278 """WPA2-PSK-FT AP (old key)"""
279 ssid = "test-ft"
fab49f61 280 passphrase = "12345678"
c95dd8e4
JM		 281
282 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
283 hapd0 = hostapd.add_ap(apdev[0], params)
284 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
285 hapd1 = hostapd.add_ap(apdev[1], params)
286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288
e4612f84
JM		 289def test_ap_ft_multi_akm(dev, apdev):
290 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
291 ssid = "test-ft"
fab49f61 292 passphrase = "12345678"
e4612f84
JM		 293
294 params = ft_params1(ssid=ssid, passphrase=passphrase)
295 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
296 hapd0 = hostapd.add_ap(apdev[0], params)
297 params = ft_params2(ssid=ssid, passphrase=passphrase)
298 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
299 hapd1 = hostapd.add_ap(apdev[1], params)
300
301 Wlantest.setup(hapd0)
302 wt = Wlantest()
303 wt.flush()
304 wt.add_passphrase(passphrase)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
307 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
310 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
311 scan_freq="2412")
312
d0175d6e
MB		 313def test_ap_ft_local_key_gen(dev, apdev):
314 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
315 ssid = "test-ft"
fab49f61 316 passphrase = "12345678"
d0175d6e
MB		 317
318 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 319 params['ft_psk_generate_local'] = "1"
8344ba12 320 del params['pmk_r1_push']
b098542c 321 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 322 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 323 params['ft_psk_generate_local'] = "1"
8344ba12 324 del params['pmk_r1_push']
b098542c 325 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
473e5176
MB		 331def test_ap_ft_vlan(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN"""
333 ssid = "test-ft"
fab49f61 334 passphrase = "12345678"
473e5176
MB		 335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 342 params['dynamic_vlan'] = "1"
343 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 344 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
345
346 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
350def test_ap_ft_vlan_disconnected(dev, apdev):
351 """WPA2-PSK-FT AP with VLAN and local key generation"""
352 ssid = "test-ft"
fab49f61 353 passphrase = "12345678"
473e5176
MB		 354
355 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 356 params['dynamic_vlan'] = "1"
357 params['accept_mac_file'] = "hostapd.accept"
358 params['ft_psk_generate_local'] = "1"
473e5176
MB		 359 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
360
361 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 362 params['dynamic_vlan'] = "1"
363 params['accept_mac_file'] = "hostapd.accept"
364 params['ft_psk_generate_local'] = "1"
473e5176
MB		 365 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
366
367 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
368 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
369 raise Exception("Scan results missing RSN element info")
370
371def test_ap_ft_vlan_2(dev, apdev):
372 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
373 ssid = "test-ft"
fab49f61 374 passphrase = "12345678"
473e5176
MB		 375
376 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 377 params['dynamic_vlan'] = "1"
378 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 379 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
380
381 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 382 params['dynamic_vlan'] = "1"
473e5176
MB		 383 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
384
385 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
386 force_initial_conn_to_first_ap=True)
387 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
388 raise Exception("Scan results missing RSN element info")
389
40602101
JM		 390def test_ap_ft_many(dev, apdev):
391 """WPA2-PSK-FT AP multiple times"""
392 ssid = "test-ft"
fab49f61 393 passphrase = "12345678"
40602101
JM		 394
395 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 396 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 397 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 398 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 399
a8375c94 400 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 401
473e5176
MB		 402def test_ap_ft_many_vlan(dev, apdev):
403 """WPA2-PSK-FT AP with VLAN multiple times"""
404 ssid = "test-ft"
fab49f61 405 passphrase = "12345678"
473e5176
MB		 406
407 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 408 params['dynamic_vlan'] = "1"
409 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 410 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
411
412 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 413 params['dynamic_vlan'] = "1"
414 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 415 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
416
417 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
418 conndev="brvlan1")
419
cd7f1b9a
JM		 420def test_ap_ft_mixed(dev, apdev):
421 """WPA2-PSK-FT mixed-mode AP"""
422 ssid = "test-ft-mixed"
fab49f61 423 passphrase = "12345678"
cd7f1b9a
JM		 424
425 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 426 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 427 key_mgmt = hapd.get_config()['key_mgmt']
428 vals = key_mgmt.split(' ')
429 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
430 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 431 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 432 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 433
a8375c94 434 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 435
436def test_ap_ft_pmf(dev, apdev):
437 """WPA2-PSK-FT AP with PMF"""
30998360
JM		 438 run_ap_ft_pmf(dev, apdev, "1")
439
440def test_ap_ft_pmf_over_ds(dev, apdev):
441 """WPA2-PSK-FT AP with PMF (over DS)"""
442 run_ap_ft_pmf(dev, apdev, "1", over_ds=True)
443
444def test_ap_ft_pmf_required(dev, apdev):
445 """WPA2-PSK-FT AP with PMF required on STA"""
446 run_ap_ft_pmf(dev, apdev, "2")
447
448def test_ap_ft_pmf_required_over_ds(dev, apdev):
449 """WPA2-PSK-FT AP with PMF required on STA (over DS)"""
450 run_ap_ft_pmf(dev, apdev, "2", over_ds=True)
451
452def run_ap_ft_pmf(dev, apdev, ieee80211w, over_ds=False):
cd7f1b9a 453 ssid = "test-ft"
fab49f61 454 passphrase = "12345678"
cd7f1b9a
JM		 455
456 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 457 params["ieee80211w"] = "2"
8b8a1864 458 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 459 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 460 params["ieee80211w"] = "2"
8b8a1864 461 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 462
30998360
JM		 463 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
464 ieee80211w=ieee80211w, over_ds=over_ds)
465
466def test_ap_ft_pmf_required_mismatch(dev, apdev):
467 """WPA2-PSK-FT AP with PMF required on STA but AP2 not enabling PMF"""
468 run_ap_ft_pmf_required_mismatch(dev, apdev)
469
470def test_ap_ft_pmf_required_mismatch_over_ds(dev, apdev):
471 """WPA2-PSK-FT AP with PMF required on STA but AP2 not enabling PMF (over DS)"""
472 run_ap_ft_pmf_required_mismatch(dev, apdev, over_ds=True)
473
474def run_ap_ft_pmf_required_mismatch(dev, apdev, over_ds=False):
475 ssid = "test-ft"
476 passphrase = "12345678"
477
478 params = ft_params1(ssid=ssid, passphrase=passphrase)
479 params["ieee80211w"] = "2"
480 hapd0 = hostapd.add_ap(apdev[0], params)
481 params = ft_params2(ssid=ssid, passphrase=passphrase)
482 params["ieee80211w"] = "0"
483 hapd1 = hostapd.add_ap(apdev[1], params)
484
485 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ieee80211w="2",
486 force_initial_conn_to_first_ap=True, fail_test=True,
487 over_ds=over_ds)
b553eab1 488
ffcaca68
JM		 489def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
490 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
491 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
492
493def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
494 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
495 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
496
497def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
498 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
499 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
500
501def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
502 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
503 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
504
505def run_ap_ft_pmf_bip(dev, apdev, cipher):
506 if cipher not in dev[0].get_capability("group_mgmt"):
507 raise HwsimSkip("Cipher %s not supported" % cipher)
508
509 ssid = "test-ft"
fab49f61 510 passphrase = "12345678"
ffcaca68
JM		 511
512 params = ft_params1(ssid=ssid, passphrase=passphrase)
513 params["ieee80211w"] = "2"
514 params["group_mgmt_cipher"] = cipher
515 hapd0 = hostapd.add_ap(apdev[0], params)
516 params = ft_params2(ssid=ssid, passphrase=passphrase)
517 params["ieee80211w"] = "2"
518 params["group_mgmt_cipher"] = cipher
519 hapd1 = hostapd.add_ap(apdev[1], params)
520
521 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
522 group_mgmt=cipher)
523
e63d8837
MV		 524def test_ap_ft_ocv(dev, apdev):
525 """WPA2-PSK-FT AP with OCV"""
526 ssid = "test-ft"
fab49f61 527 passphrase = "12345678"
e63d8837
MV		 528
529 params = ft_params1(ssid=ssid, passphrase=passphrase)
530 params["ieee80211w"] = "2"
531 params["ocv"] = "1"
532 try:
533 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 534 except Exception as e:
e63d8837
MV		 535 if "Failed to set hostapd parameter ocv" in str(e):
536 raise HwsimSkip("OCV not supported")
537 raise
538 params = ft_params2(ssid=ssid, passphrase=passphrase)
539 params["ieee80211w"] = "2"
540 params["ocv"] = "1"
541 hapd1 = hostapd.add_ap(apdev[1], params)
542
543 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
544
b553eab1
JM		 545def test_ap_ft_over_ds(dev, apdev):
546 """WPA2-PSK-FT AP over DS"""
547 ssid = "test-ft"
fab49f61 548 passphrase = "12345678"
b553eab1
JM		 549
550 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 551 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 552 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 553 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 554
a8375c94 555 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
fab49f61
JM		 556 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
557 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
b553eab1 558
02a4ac0f
JM		 559def cleanup_ap_ft_separate_hostapd():
560 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
561 stderr=open('/dev/null', 'w'))
562 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
563 stderr=open('/dev/null', 'w'))
564 subprocess.call(["ip", "link", "del", "veth0"],
565 stderr=open('/dev/null', 'w'))
566 subprocess.call(["ip", "link", "del", "veth1"],
567 stderr=open('/dev/null', 'w'))
fab49f61 568 for ifname in ['br0ft', 'br1ft', 'br-ft']:
02a4ac0f
JM		 569 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
570 stderr=open('/dev/null', 'w'))
571 subprocess.call(['brctl', 'delbr', ifname],
572 stderr=open('/dev/null', 'w'))
573
574def test_ap_ft_separate_hostapd(dev, apdev, params):
575 """WPA2-PSK-FT AP and separate hostapd process"""
576 try:
577 run_ap_ft_separate_hostapd(dev, apdev, params, False)
578 finally:
579 cleanup_ap_ft_separate_hostapd()
580
581def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
582 """WPA2-PSK-FT AP over DS and separate hostapd process"""
583 try:
584 run_ap_ft_separate_hostapd(dev, apdev, params, True)
585 finally:
586 cleanup_ap_ft_separate_hostapd()
587
588def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
589 ssid = "test-ft"
fab49f61 590 passphrase = "12345678"
02a4ac0f
JM		 591 logdir = params['logdir']
592 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
593 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
594 global_ctrl = '/var/run/hostapd-ft'
595 br_ifname = 'br-ft'
596
597 try:
598 subprocess.check_call(['brctl', 'addbr', br_ifname])
599 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
600 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
601
fab49f61
JM		 602 subprocess.check_call(["ip", "link", "add", "veth0", "type", "veth",
603 "peer", "name", "veth0br"])
604 subprocess.check_call(["ip", "link", "add", "veth1", "type", "veth",
605 "peer", "name", "veth1br"])
02a4ac0f
JM		 606 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
607 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
608 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
609 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
610
611 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
612 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
613 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
614 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
615 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
616 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
617 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
618 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
619 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
620 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
621 except subprocess.CalledProcessError:
622 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
623
624 with HWSimRadio() as (radio, iface):
625 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
626 if not os.path.exists(prg):
627 prg = '../../hostapd/hostapd'
fab49f61
JM		 628 cmd = [prg, '-B', '-ddKt',
629 '-P', pidfile, '-f', logfile, '-g', global_ctrl]
02a4ac0f
JM		 630 subprocess.check_call(cmd)
631
632 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
fab49f61
JM		 633 apdev_ft = {'ifname': iface}
634 apdev2 = [apdev_ft, apdev[1]]
02a4ac0f
JM		 635
636 params = ft_params1(ssid=ssid, passphrase=passphrase)
637 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
638 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
639 params['bridge'] = 'br0ft'
640 hapd0 = hostapd.add_ap(apdev2[0], params,
641 global_ctrl_override=global_ctrl)
642 apdev2[0]['bssid'] = hapd0.own_addr()
643 params = ft_params2(ssid=ssid, passphrase=passphrase)
644 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
645 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
646 params['bridge'] = 'br1ft'
647 hapd1 = hostapd.add_ap(apdev2[1], params)
648
649 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
650 over_ds=over_ds, test_connectivity=False)
651
652 hglobal.terminate()
653
654 if os.path.exists(pidfile):
655 with open(pidfile, 'r') as f:
656 pid = int(f.read())
657 f.close()
658 os.kill(pid, signal.SIGTERM)
659
e63d8837
MV		 660def test_ap_ft_over_ds_ocv(dev, apdev):
661 """WPA2-PSK-FT AP over DS"""
662 ssid = "test-ft"
fab49f61 663 passphrase = "12345678"
e63d8837
MV		 664
665 params = ft_params1(ssid=ssid, passphrase=passphrase)
666 params["ieee80211w"] = "2"
667 params["ocv"] = "1"
668 try:
669 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 670 except Exception as e:
e63d8837
MV		 671 if "Failed to set hostapd parameter ocv" in str(e):
672 raise HwsimSkip("OCV not supported")
673 raise
674 params = ft_params2(ssid=ssid, passphrase=passphrase)
675 params["ieee80211w"] = "2"
676 params["ocv"] = "1"
677 hapd1 = hostapd.add_ap(apdev[1], params)
678
679 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
680 ocv="1")
681
55139acb
JM		 682def test_ap_ft_over_ds_disabled(dev, apdev):
683 """WPA2-PSK-FT AP over DS disabled"""
684 ssid = "test-ft"
fab49f61 685 passphrase = "12345678"
55139acb
JM		 686
687 params = ft_params1(ssid=ssid, passphrase=passphrase)
688 params['ft_over_ds'] = '0'
689 hapd0 = hostapd.add_ap(apdev[0], params)
690 params = ft_params2(ssid=ssid, passphrase=passphrase)
691 params['ft_over_ds'] = '0'
692 hapd1 = hostapd.add_ap(apdev[1], params)
693
694 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
695 fail_test=True)
696
473e5176
MB		 697def test_ap_ft_vlan_over_ds(dev, apdev):
698 """WPA2-PSK-FT AP over DS with VLAN"""
699 ssid = "test-ft"
fab49f61 700 passphrase = "12345678"
473e5176
MB		 701
702 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 703 params['dynamic_vlan'] = "1"
704 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 705 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
706 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 707 params['dynamic_vlan'] = "1"
708 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 709 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
710
711 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
712 conndev="brvlan1")
fab49f61
JM		 713 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
714 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
473e5176 715
40602101
JM		 716def test_ap_ft_over_ds_many(dev, apdev):
717 """WPA2-PSK-FT AP over DS multiple times"""
718 ssid = "test-ft"
fab49f61 719 passphrase = "12345678"
40602101
JM		 720
721 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 722 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 723 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 724 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 725
a8375c94
JM		 726 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
727 roams=50)
40602101 728
473e5176
MB		 729def test_ap_ft_vlan_over_ds_many(dev, apdev):
730 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
731 ssid = "test-ft"
fab49f61 732 passphrase = "12345678"
473e5176
MB		 733
734 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 735 params['dynamic_vlan'] = "1"
736 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 737 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
738 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 739 params['dynamic_vlan'] = "1"
740 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 741 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
742
743 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
744 roams=50, conndev="brvlan1")
745
9fd6804d 746@remote_compatible
c337d07a
JM		 747def test_ap_ft_over_ds_unknown_target(dev, apdev):
748 """WPA2-PSK-FT AP"""
749 ssid = "test-ft"
fab49f61 750 passphrase = "12345678"
c337d07a
JM		 751
752 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 753 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 754
755 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
756 scan_freq="2412")
757 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
758
9fd6804d 759@remote_compatible
211bb7c5
JM		 760def test_ap_ft_over_ds_unexpected(dev, apdev):
761 """WPA2-PSK-FT AP over DS and unexpected response"""
762 ssid = "test-ft"
fab49f61 763 passphrase = "12345678"
211bb7c5
JM		 764
765 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 766 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 767 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 768 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 769
770 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
771 scan_freq="2412")
772 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
773 ap1 = apdev[0]
774 ap2 = apdev[1]
775 hapd1ap = hapd0
776 hapd2ap = hapd1
777 else:
778 ap1 = apdev[1]
779 ap2 = apdev[0]
780 hapd1ap = hapd1
781 hapd2ap = hapd0
782
783 addr = dev[0].own_addr()
784 hapd1ap.set("ext_mgmt_frame_handling", "1")
785 logger.info("Foreign STA address")
786 msg = {}
787 msg['fc'] = 13 << 4
788 msg['da'] = addr
789 msg['sa'] = ap1['bssid']
790 msg['bssid'] = ap1['bssid']
791 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
792 hapd1ap.mgmt_tx(msg)
793
794 logger.info("No over-the-DS in progress")
795 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
796 hapd1ap.mgmt_tx(msg)
797
798 logger.info("Non-zero status code")
799 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
800 hapd1ap.mgmt_tx(msg)
801
802 hapd1ap.dump_monitor()
803
804 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
805 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
806 raise Exception("FT_DS failed")
807
808 req = hapd1ap.mgmt_rx()
809
810 logger.info("Foreign Target AP")
811 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
812 hapd1ap.mgmt_tx(msg)
813
814 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
815
816 logger.info("No IEs")
817 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
818 hapd1ap.mgmt_tx(msg)
819
820 logger.info("Invalid IEs (trigger parsing failure)")
821 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
822 hapd1ap.mgmt_tx(msg)
823
824 logger.info("Too short MDIE")
825 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
826 hapd1ap.mgmt_tx(msg)
827
828 logger.info("Mobility domain mismatch")
829 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
830 hapd1ap.mgmt_tx(msg)
831
832 logger.info("No FTIE")
833 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
834 hapd1ap.mgmt_tx(msg)
835
836 logger.info("FTIE SNonce mismatch")
837 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
838 hapd1ap.mgmt_tx(msg)
839
840 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 841 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 842 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
843 hapd1ap.mgmt_tx(msg)
844
845 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 846 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 847 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
848 hapd1ap.mgmt_tx(msg)
849
850 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 851 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 852 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
853 hapd1ap.mgmt_tx(msg)
854
855 logger.info("No RSNE")
7ab74770 856 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 857 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
858 hapd1ap.mgmt_tx(msg)
859
b553eab1
JM		 860def test_ap_ft_pmf_over_ds(dev, apdev):
861 """WPA2-PSK-FT AP over DS with PMF"""
0c481b78 862 run_ap_ft_pmf_bip_over_ds(dev, apdev, None)
46b8ea21 863
ffcaca68
JM		 864def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
865 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
866 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
867
868def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
869 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
870 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
871
872def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
873 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
874 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
875
876def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
877 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
878 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
879
880def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
0c481b78 881 if cipher and cipher not in dev[0].get_capability("group_mgmt"):
ffcaca68
JM		 882 raise HwsimSkip("Cipher %s not supported" % cipher)
883
884 ssid = "test-ft"
fab49f61 885 passphrase = "12345678"
ffcaca68
JM		 886
887 params = ft_params1(ssid=ssid, passphrase=passphrase)
888 params["ieee80211w"] = "2"
0c481b78
JM		 889 if cipher:
890 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 891 hapd0 = hostapd.add_ap(apdev[0], params)
892 params = ft_params2(ssid=ssid, passphrase=passphrase)
893 params["ieee80211w"] = "2"
0c481b78
JM		 894 if cipher:
895 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 896 hapd1 = hostapd.add_ap(apdev[1], params)
897
0defc42a
JM		 898 Wlantest.setup(hapd0)
899 wt = Wlantest()
900 wt.flush()
901 wt.add_passphrase(passphrase)
902
ffcaca68
JM		 903 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
904 group_mgmt=cipher)
6e658cc4 905
aaba98d3
JM		 906def test_ap_ft_over_ds_pull(dev, apdev):
907 """WPA2-PSK-FT AP over DS (pull PMK)"""
908 ssid = "test-ft"
fab49f61 909 passphrase = "12345678"
aaba98d3
JM		 910
911 params = ft_params1(ssid=ssid, passphrase=passphrase)
912 params["pmk_r1_push"] = "0"
8b8a1864 913 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 914 params = ft_params2(ssid=ssid, passphrase=passphrase)
915 params["pmk_r1_push"] = "0"
8b8a1864 916 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 917
a8375c94 918 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 919
c95dd8e4
JM		 920def test_ap_ft_over_ds_pull_old_key(dev, apdev):
921 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
922 ssid = "test-ft"
fab49f61 923 passphrase = "12345678"
c95dd8e4
JM		 924
925 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
926 params["pmk_r1_push"] = "0"
927 hapd0 = hostapd.add_ap(apdev[0], params)
928 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
929 params["pmk_r1_push"] = "0"
930 hapd1 = hostapd.add_ap(apdev[1], params)
931
932 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
933
473e5176
MB		 934def test_ap_ft_over_ds_pull_vlan(dev, apdev):
935 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
936 ssid = "test-ft"
fab49f61 937 passphrase = "12345678"
473e5176
MB		 938
939 params = ft_params1(ssid=ssid, passphrase=passphrase)
940 params["pmk_r1_push"] = "0"
58be42b2
JM		 941 params['dynamic_vlan'] = "1"
942 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 943 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
944 params = ft_params2(ssid=ssid, passphrase=passphrase)
945 params["pmk_r1_push"] = "0"
58be42b2
JM		 946 params['dynamic_vlan'] = "1"
947 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 948 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
949
950 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
951 conndev="brvlan1")
952
425e5f97
JM		 953def start_ft_sae(dev, apdev, wpa_ptk_rekey=None):
954 if "SAE" not in dev.get_capability("auth_alg"):
b9749b6a 955 raise HwsimSkip("SAE not supported")
6e658cc4 956 ssid = "test-ft"
fab49f61 957 passphrase = "12345678"
6e658cc4
JM		 958
959 params = ft_params1(ssid=ssid, passphrase=passphrase)
960 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 961 if wpa_ptk_rekey:
962 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 963 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 964 params = ft_params2(ssid=ssid, passphrase=passphrase)
965 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 966 if wpa_ptk_rekey:
967 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
968 hapd1 = hostapd.add_ap(apdev[1], params)
969 key_mgmt = hapd1.get_config()['key_mgmt']
65038313
JM		 970 if key_mgmt.split(' ')[0] != "FT-SAE":
971 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 972
425e5f97
JM		 973 dev.request("SET sae_groups ")
974 return hapd0, hapd1
975
976def test_ap_ft_sae(dev, apdev):
977 """WPA2-PSK-FT-SAE AP"""
978 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
979 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True)
980
981def test_ap_ft_sae_ptk_rekey0(dev, apdev):
982 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
983 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
984 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
985 ptk_rekey="1", roams=0)
986 check_ptk_rekey(dev[0], hapd0, hapd1)
987
988def test_ap_ft_sae_ptk_rekey1(dev, apdev):
989 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
990 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
991 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
992 ptk_rekey="1", only_one_way=True)
993 check_ptk_rekey(dev[0], hapd0, hapd1)
994
995def test_ap_ft_sae_ptk_rekey_ap(dev, apdev):
996 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by AP"""
997 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
998 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
999 only_one_way=True)
1000 check_ptk_rekey(dev[0], hapd0, hapd1)
6e658cc4
JM		 1001
1002def test_ap_ft_sae_over_ds(dev, apdev):
1003 """WPA2-PSK-FT-SAE AP over DS"""
425e5f97
JM		 1004 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
1005 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
a8375c94 1006 over_ds=True)
6f62809b 1007
425e5f97
JM		 1008def test_ap_ft_sae_over_ds_ptk_rekey0(dev, apdev):
1009 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
1010 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
1011 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
1012 over_ds=True, ptk_rekey="1", roams=0)
1013 check_ptk_rekey(dev[0], hapd0, hapd1)
1014
1015def test_ap_ft_sae_over_ds_ptk_rekey1(dev, apdev):
1016 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
1017 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
1018 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
1019 over_ds=True, ptk_rekey="1", only_one_way=True)
1020 check_ptk_rekey(dev[0], hapd0, hapd1)
1021
1022def test_ap_ft_sae_over_ds_ptk_rekey_ap(dev, apdev):
1023 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by AP"""
1024 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
1025 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
1026 over_ds=True, only_one_way=True)
1027 check_ptk_rekey(dev[0], hapd0, hapd1)
1028
3d5b88b5
JM		 1029def test_ap_ft_sae_pw_id(dev, apdev):
1030 """FT-SAE with Password Identifier"""
1031 if "SAE" not in dev[0].get_capability("auth_alg"):
1032 raise HwsimSkip("SAE not supported")
1033 ssid = "test-ft"
1034
1035 params = ft_params1(ssid=ssid)
1036 params["ieee80211w"] = "2"
1037 params['wpa_key_mgmt'] = "FT-SAE"
1038 params['sae_password'] = 'secret|id=pwid'
1039 hapd0 = hostapd.add_ap(apdev[0], params)
1040 params = ft_params2(ssid=ssid)
1041 params["ieee80211w"] = "2"
1042 params['wpa_key_mgmt'] = "FT-SAE"
1043 params['sae_password'] = 'secret|id=pwid'
1044 hapd = hostapd.add_ap(apdev[1], params)
1045
1046 dev[0].request("SET sae_groups ")
1047 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
1048 sae_password="secret", sae_password_id="pwid")
1049
cdf53910
JM		 1050def test_ap_ft_sae_with_both_akms(dev, apdev):
1051 """SAE + FT-SAE configuration"""
1052 if "SAE" not in dev[0].get_capability("auth_alg"):
1053 raise HwsimSkip("SAE not supported")
1054 ssid = "test-ft"
1055 passphrase = "12345678"
1056
1057 params = ft_params1(ssid=ssid, passphrase=passphrase)
1058 params['wpa_key_mgmt'] = "FT-SAE SAE"
1059 hapd0 = hostapd.add_ap(apdev[0], params)
1060 params = ft_params2(ssid=ssid, passphrase=passphrase)
1061 params['wpa_key_mgmt'] = "FT-SAE SAE"
1062 hapd = hostapd.add_ap(apdev[1], params)
1063 key_mgmt = hapd.get_config()['key_mgmt']
1064 if key_mgmt.split(' ')[0] != "FT-SAE":
1065 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1066
1067 dev[0].request("SET sae_groups ")
1068 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1069 sae_and_psk=True)
1070
1211031a
JM		 1071def test_ap_ft_sae_pmksa_caching(dev, apdev):
1072 """WPA2-FT-SAE AP and PMKSA caching for initial mobility domain association"""
1073 if "SAE" not in dev[0].get_capability("auth_alg"):
1074 raise HwsimSkip("SAE not supported")
1075 ssid = "test-ft"
1076 passphrase = "12345678"
1077
1078 params = ft_params1(ssid=ssid, passphrase=passphrase)
1079 params['wpa_key_mgmt'] = "FT-SAE"
1080 hapd0 = hostapd.add_ap(apdev[0], params)
1081 params = ft_params2(ssid=ssid, passphrase=passphrase)
1082 params['wpa_key_mgmt'] = "FT-SAE"
1083 hapd = hostapd.add_ap(apdev[1], params)
1084 key_mgmt = hapd.get_config()['key_mgmt']
1085 if key_mgmt.split(' ')[0] != "FT-SAE":
1086 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1087
1088 dev[0].request("SET sae_groups ")
1089 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1090 pmksa_caching=True)
1091
d269740a 1092def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
425e5f97
JM		 1093 discovery=False, roams=1, wpa_ptk_rekey=0,
1094 only_one_way=False):
6f62809b 1095 ssid = "test-ft"
fab49f61 1096 passphrase = "12345678"
9c50a6d3 1097 if vlan:
fab49f61
JM		 1098 identity = "gpsk-vlan1"
1099 conndev = "brvlan1"
d269740a 1100 elif cui:
fab49f61
JM		 1101 identity = "gpsk-cui"
1102 conndev = False
9c50a6d3 1103 else:
fab49f61
JM		 1104 identity = "gpsk user"
1105 conndev = False
6f62809b
JM		 1106
1107 radius = hostapd.radius_params()
942b52a8 1108 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1109 params['wpa_key_mgmt'] = "FT-EAP"
1110 params["ieee8021x"] = "1"
9c50a6d3
MB		 1111 if vlan:
1112 params["dynamic_vlan"] = "1"
35d8c254 1113 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1114 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 1115 key_mgmt = hapd.get_config()['key_mgmt']
1116 if key_mgmt.split(' ')[0] != "FT-EAP":
1117 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 1118 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1119 params['wpa_key_mgmt'] = "FT-EAP"
1120 params["ieee8021x"] = "1"
9c50a6d3
MB		 1121 if vlan:
1122 params["dynamic_vlan"] = "1"
425e5f97
JM		 1123 if wpa_ptk_rekey:
1124 params["wpa_ptk_rekey"] = str(wpa_ptk_rekey)
35d8c254 1125 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1126 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 1127
942b52a8 1128 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3 1129 over_ds=over_ds, roams=roams, eap_identity=identity,
425e5f97 1130 conndev=conndev, only_one_way=only_one_way)
91bc6c36
JM		 1131 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
1132 raise Exception("Scan results missing RSN element info")
fab49f61
JM		 1133 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
1134 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
425e5f97
JM		 1135 if only_one_way:
1136 return
aaba98d3 1137
4013d688
JM		 1138 # Verify EAPOL reauthentication after FT protocol
1139 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1140 ap = hapd
1141 else:
1142 ap = hapd1
1143 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
1144 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
1145 if ev is None:
1146 raise Exception("EAP authentication did not start")
1147 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
1148 if ev is None:
1149 raise Exception("EAP authentication did not succeed")
1150 time.sleep(0.1)
9c50a6d3
MB		 1151 if conndev:
1152 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
1153 else:
1154 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 1155
942b52a8
MB		 1156def test_ap_ft_eap(dev, apdev):
1157 """WPA2-EAP-FT AP"""
1158 generic_ap_ft_eap(dev, apdev)
1159
d269740a
MB		 1160def test_ap_ft_eap_cui(dev, apdev):
1161 """WPA2-EAP-FT AP with CUI"""
1162 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
1163
9c50a6d3
MB		 1164def test_ap_ft_eap_vlan(dev, apdev):
1165 """WPA2-EAP-FT AP with VLAN"""
1166 generic_ap_ft_eap(dev, apdev, vlan=True)
1167
1168def test_ap_ft_eap_vlan_multi(dev, apdev):
1169 """WPA2-EAP-FT AP with VLAN"""
1170 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1171
942b52a8
MB		 1172def test_ap_ft_eap_over_ds(dev, apdev):
1173 """WPA2-EAP-FT AP using over-the-DS"""
1174 generic_ap_ft_eap(dev, apdev, over_ds=True)
1175
1176def test_ap_ft_eap_dis(dev, apdev):
1177 """WPA2-EAP-FT AP with AP discovery"""
1178 generic_ap_ft_eap(dev, apdev, discovery=True)
1179
1180def test_ap_ft_eap_dis_over_ds(dev, apdev):
1181 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1182 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1183
9c50a6d3
MB		 1184def test_ap_ft_eap_vlan(dev, apdev):
1185 """WPA2-EAP-FT AP with VLAN"""
1186 generic_ap_ft_eap(dev, apdev, vlan=True)
1187
1188def test_ap_ft_eap_vlan_multi(dev, apdev):
1189 """WPA2-EAP-FT AP with VLAN"""
1190 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1191
1192def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1193 """WPA2-EAP-FT AP with VLAN + over_ds"""
1194 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1195
1196def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1197 """WPA2-EAP-FT AP with VLAN + over_ds"""
1198 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1199
1200def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1201 """WPA2-EAP-FT AP (pull PMK)"""
1202 ssid = "test-ft"
fab49f61 1203 passphrase = "12345678"
9c50a6d3 1204 if vlan:
fab49f61
JM		 1205 identity = "gpsk-vlan1"
1206 conndev = "brvlan1"
9c50a6d3 1207 else:
fab49f61
JM		 1208 identity = "gpsk user"
1209 conndev = False
aaba98d3
JM		 1210
1211 radius = hostapd.radius_params()
1212 params = ft_params1(ssid=ssid, passphrase=passphrase)
1213 params['wpa_key_mgmt'] = "FT-EAP"
1214 params["ieee8021x"] = "1"
1215 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1216 if vlan:
1217 params["dynamic_vlan"] = "1"
35d8c254 1218 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1219 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1220 key_mgmt = hapd.get_config()['key_mgmt']
1221 if key_mgmt.split(' ')[0] != "FT-EAP":
1222 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1223 params = ft_params2(ssid=ssid, passphrase=passphrase)
1224 params['wpa_key_mgmt'] = "FT-EAP"
1225 params["ieee8021x"] = "1"
1226 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1227 if vlan:
1228 params["dynamic_vlan"] = "1"
35d8c254 1229 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1230 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1231
9c50a6d3
MB		 1232 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1233 eap_identity=identity, conndev=conndev)
1234
1235def test_ap_ft_eap_pull(dev, apdev):
1236 """WPA2-EAP-FT AP (pull PMK)"""
1237 generic_ap_ft_eap_pull(dev, apdev)
1238
1239def test_ap_ft_eap_pull_vlan(dev, apdev):
1240 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1241
f81c1411
JM		 1242def test_ap_ft_eap_pull_wildcard(dev, apdev):
1243 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1244 ssid = "test-ft"
fab49f61 1245 passphrase = "12345678"
f81c1411
JM		 1246
1247 radius = hostapd.radius_params()
1248 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1249 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1250 params["ieee8021x"] = "1"
1251 params["pmk_r1_push"] = "0"
1252 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1253 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1254 params["ft_psk_generate_local"] = "1"
1255 params["eap_server"] = "0"
c6ab7b55
JM		 1256 params["rkh_pos_timeout"] = "100"
1257 params["rkh_neg_timeout"] = "50"
1258 params["rkh_pull_timeout"] = "1234"
1259 params["rkh_pull_retries"] = "10"
35d8c254 1260 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1261 hapd = hostapd.add_ap(apdev[0], params)
1262 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1263 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1264 params["ieee8021x"] = "1"
1265 params["pmk_r1_push"] = "0"
1266 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1267 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1268 params["ft_psk_generate_local"] = "1"
1269 params["eap_server"] = "0"
35d8c254 1270 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1271 hapd1 = hostapd.add_ap(apdev[1], params)
1272
1273 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1274
9fd6804d 1275@remote_compatible
3b808945
JM		 1276def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1277 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1278 ssid = "test-ft"
fab49f61 1279 passphrase = "12345678"
3b808945
JM		 1280
1281 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1282 params["ieee80211w"] = "2"
8b8a1864 1283 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1284 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1285 params["ieee80211w"] = "2"
8b8a1864 1286 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1287
a8375c94
JM		 1288 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1289 fail_test=True)
3b808945 1290
9fd6804d 1291@remote_compatible
3b808945
JM		 1292def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1293 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1294 ssid = "test-ft"
fab49f61 1295 passphrase = "12345678"
3b808945
JM		 1296
1297 params = ft_params1(ssid=ssid, passphrase=passphrase)
1298 params["pmk_r1_push"] = "0"
8b8a1864 1299 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1300 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1301 params["pmk_r1_push"] = "0"
8b8a1864 1302 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1303
a8375c94
JM		 1304 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1305 fail_test=True)
3b808945 1306
9fd6804d 1307@remote_compatible
ae14a2e2
JM		 1308def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1309 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1310 ssid = "test-ft"
fab49f61 1311 passphrase = "12345678"
ae14a2e2
JM		 1312
1313 params = ft_params1(ssid=ssid, passphrase=passphrase)
1314 params["pmk_r1_push"] = "0"
1315 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1316 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1317 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1318 scan_freq="2412")
ae14a2e2
JM		 1319
1320 params = ft_params2(ssid=ssid, passphrase=passphrase)
1321 params["pmk_r1_push"] = "0"
8b8a1864 1322 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1323
1324 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1325 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1326
9fd6804d 1327@remote_compatible
3b808945
JM		 1328def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1329 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1330 ssid = "test-ft"
fab49f61 1331 passphrase = "12345678"
3b808945
JM		 1332
1333 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1334 params["ieee80211w"] = "2"
8b8a1864 1335 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1336 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1337 params["ieee80211w"] = "2"
8b8a1864 1338 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1339
a8375c94
JM		 1340 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1341 fail_test=True)
3b808945 1342
9fd6804d 1343@remote_compatible
3b808945
JM		 1344def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1345 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1346 ssid = "test-ft"
fab49f61 1347 passphrase = "12345678"
3b808945
JM		 1348
1349 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1350 params["pmk_r1_push"] = "0"
8b8a1864 1351 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1352 params = ft_params2(ssid=ssid, passphrase=passphrase)
1353 params["pmk_r1_push"] = "0"
8b8a1864 1354 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1355
a8375c94
JM		 1356 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1357 fail_test=True)
c6b6e105 1358
150948e6
MB		 1359def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1360 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1361 ssid = "test-ft"
fab49f61 1362 passphrase = "12345678"
150948e6
MB		 1363
1364 radius = hostapd.radius_params()
1365 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1366 params["ieee80211w"] = "2"
150948e6
MB		 1367 params['wpa_key_mgmt'] = "FT-EAP"
1368 params["ieee8021x"] = "1"
35d8c254 1369 params = dict(list(radius.items()) + list(params.items()))
b098542c 1370 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1371 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1372 params["ieee80211w"] = "2"
150948e6
MB		 1373 params['wpa_key_mgmt'] = "FT-EAP"
1374 params["ieee8021x"] = "1"
35d8c254 1375 params = dict(list(radius.items()) + list(params.items()))
b098542c 1376 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1377
1378 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1379 fail_test=True, eap=True)
1380
1381def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1382 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1383 ssid = "test-ft"
fab49f61 1384 passphrase = "12345678"
150948e6
MB		 1385
1386 radius = hostapd.radius_params()
1387 params = ft_params1(ssid=ssid, passphrase=passphrase)
1388 params["pmk_r1_push"] = "0"
1389 params['wpa_key_mgmt'] = "FT-EAP"
1390 params["ieee8021x"] = "1"
35d8c254 1391 params = dict(list(radius.items()) + list(params.items()))
b098542c 1392 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1393 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1394 params["pmk_r1_push"] = "0"
1395 params['wpa_key_mgmt'] = "FT-EAP"
1396 params["ieee8021x"] = "1"
35d8c254 1397 params = dict(list(radius.items()) + list(params.items()))
b098542c 1398 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1399
1400 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1401 fail_test=True, eap=True)
1402
1403def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1404 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1405 ssid = "test-ft"
fab49f61 1406 passphrase = "12345678"
150948e6
MB		 1407
1408 radius = hostapd.radius_params()
1409 params = ft_params1(ssid=ssid, passphrase=passphrase)
1410 params["pmk_r1_push"] = "0"
1411 params["nas_identifier"] = "nas0.w1.fi"
1412 params['wpa_key_mgmt'] = "FT-EAP"
1413 params["ieee8021x"] = "1"
35d8c254 1414 params = dict(list(radius.items()) + list(params.items()))
b098542c 1415 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1416 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1417 eap="GPSK", identity="gpsk user",
1418 password="abcdefghijklmnop0123456789abcdef",
1419 scan_freq="2412")
1420
1421 params = ft_params2(ssid=ssid, passphrase=passphrase)
1422 params["pmk_r1_push"] = "0"
1423 params['wpa_key_mgmt'] = "FT-EAP"
1424 params["ieee8021x"] = "1"
35d8c254 1425 params = dict(list(radius.items()) + list(params.items()))
b098542c 1426 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1427
1428 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1429 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1430
1431def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1432 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1433 ssid = "test-ft"
fab49f61 1434 passphrase = "12345678"
150948e6
MB		 1435
1436 radius = hostapd.radius_params()
1437 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1438 params["ieee80211w"] = "2"
150948e6
MB		 1439 params['wpa_key_mgmt'] = "FT-EAP"
1440 params["ieee8021x"] = "1"
35d8c254 1441 params = dict(list(radius.items()) + list(params.items()))
b098542c 1442 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1443 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1444 params["ieee80211w"] = "2"
150948e6
MB		 1445 params['wpa_key_mgmt'] = "FT-EAP"
1446 params["ieee8021x"] = "1"
35d8c254 1447 params = dict(list(radius.items()) + list(params.items()))
b098542c 1448 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1449
1450 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1451 fail_test=True, eap=True)
1452
1453def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1454 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1455 ssid = "test-ft"
fab49f61 1456 passphrase = "12345678"
150948e6
MB		 1457
1458 radius = hostapd.radius_params()
1459 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1460 params["pmk_r1_push"] = "0"
1461 params['wpa_key_mgmt'] = "FT-EAP"
1462 params["ieee8021x"] = "1"
35d8c254 1463 params = dict(list(radius.items()) + list(params.items()))
b098542c 1464 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1465 params = ft_params2(ssid=ssid, passphrase=passphrase)
1466 params["pmk_r1_push"] = "0"
1467 params['wpa_key_mgmt'] = "FT-EAP"
1468 params["ieee8021x"] = "1"
35d8c254 1469 params = dict(list(radius.items()) + list(params.items()))
b098542c 1470 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1471
1472 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1473 fail_test=True, eap=True)
1474
c6b6e105
JM		 1475def test_ap_ft_gtk_rekey(dev, apdev):
1476 """WPA2-PSK-FT AP and GTK rekey"""
1477 ssid = "test-ft"
fab49f61 1478 passphrase = "12345678"
c6b6e105
JM		 1479
1480 params = ft_params1(ssid=ssid, passphrase=passphrase)
1481 params['wpa_group_rekey'] = '1'
8b8a1864 1482 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1483
1484 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1485 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1486
1487 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1488 if ev is None:
1489 raise Exception("GTK rekey timed out after initial association")
a8375c94 1490 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1491
1492 params = ft_params2(ssid=ssid, passphrase=passphrase)
1493 params['wpa_group_rekey'] = '1'
8b8a1864 1494 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1495
1496 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1497 dev[0].roam(apdev[1]['bssid'])
1498 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1499 raise Exception("Did not connect to correct AP")
a8375c94 1500 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1501
1502 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1503 if ev is None:
1504 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1505 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1506
1507def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1508 """WPA2-PSK-FT and key lifetime in memory"""
1509 ssid = "test-ft"
fab49f61 1510 passphrase = "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
5b3c40a6
JM		 1511 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1512 pmk = binascii.unhexlify(psk)
1513 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1514 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1515 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1516 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1517
1518 pid = find_wpas_process(dev[0])
1519
1520 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1521 scan_freq="2412")
8e416cec
JM		 1522 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1523 # event has been delivered, so verify that wpa_supplicant has returned to
1524 # eloop before reading process memory.
54f2cae2 1525 time.sleep(1)
8e416cec 1526 dev[0].ping()
5b3c40a6
JM		 1527
1528 buf = read_process_memory(pid, pmk)
1529
1530 dev[0].request("DISCONNECT")
1531 dev[0].wait_disconnected()
1532
1533 dev[0].relog()
1534 pmkr0 = None
1535 pmkr1 = None
1536 ptk = None
1537 gtk = None
1538 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1539 for l in f.readlines():
1540 if "FT: PMK-R0 - hexdump" in l:
1541 val = l.strip().split(':')[3].replace(' ', '')
1542 pmkr0 = binascii.unhexlify(val)
1543 if "FT: PMK-R1 - hexdump" in l:
1544 val = l.strip().split(':')[3].replace(' ', '')
1545 pmkr1 = binascii.unhexlify(val)
f918b95b 1546 if "FT: KCK - hexdump" in l:
5b3c40a6 1547 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1548 kck = binascii.unhexlify(val)
1549 if "FT: KEK - hexdump" in l:
1550 val = l.strip().split(':')[3].replace(' ', '')
1551 kek = binascii.unhexlify(val)
1552 if "FT: TK - hexdump" in l:
1553 val = l.strip().split(':')[3].replace(' ', '')
1554 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1555 if "WPA: Group Key - hexdump" in l:
1556 val = l.strip().split(':')[3].replace(' ', '')
1557 gtk = binascii.unhexlify(val)
f918b95b 1558 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1559 raise Exception("Could not find keys from debug log")
1560 if len(gtk) != 16:
1561 raise Exception("Unexpected GTK length")
1562
5b3c40a6
JM		 1563 logger.info("Checking keys in memory while associated")
1564 get_key_locations(buf, pmk, "PMK")
1565 get_key_locations(buf, pmkr0, "PMK-R0")
1566 get_key_locations(buf, pmkr1, "PMK-R1")
1567 if pmk not in buf:
81e787b7 1568 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1569 if pmkr0 not in buf:
81e787b7 1570 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1571 if pmkr1 not in buf:
81e787b7 1572 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1573 if kck not in buf:
1574 raise Exception("KCK not found while associated")
1575 if kek not in buf:
1576 raise Exception("KEK not found while associated")
b74f82a4
JM		 1577 #if tk in buf:
1578 # raise Exception("TK found from memory")
5b3c40a6
JM		 1579
1580 logger.info("Checking keys in memory after disassociation")
1581 buf = read_process_memory(pid, pmk)
1582 get_key_locations(buf, pmk, "PMK")
1583 get_key_locations(buf, pmkr0, "PMK-R0")
1584 get_key_locations(buf, pmkr1, "PMK-R1")
1585
1586 # Note: PMK/PSK is still present in network configuration
1587
1588 fname = os.path.join(params['logdir'],
1589 'ft_psk_key_lifetime_in_memory.memctx-')
1590 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1591 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1592 verify_not_present(buf, kck, fname, "KCK")
1593 verify_not_present(buf, kek, fname, "KEK")
1594 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1595 if gtk in buf:
1596 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1597 verify_not_present(buf, gtk, fname, "GTK")
1598
1599 dev[0].request("REMOVE_NETWORK all")
1600
1601 logger.info("Checking keys in memory after network profile removal")
1602 buf = read_process_memory(pid, pmk)
1603 get_key_locations(buf, pmk, "PMK")
1604 get_key_locations(buf, pmkr0, "PMK-R0")
1605 get_key_locations(buf, pmkr1, "PMK-R1")
1606
1607 verify_not_present(buf, pmk, fname, "PMK")
1608 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1609 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1610 verify_not_present(buf, kck, fname, "KCK")
1611 verify_not_present(buf, kek, fname, "KEK")
1612 verify_not_present(buf, tk, fname, "TK")
1613 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1614
9fd6804d 1615@remote_compatible
664093b5
JM		 1616def test_ap_ft_invalid_resp(dev, apdev):
1617 """WPA2-PSK-FT AP and invalid response IEs"""
1618 ssid = "test-ft"
fab49f61 1619 passphrase = "12345678"
664093b5
JM		 1620
1621 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1622 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1623 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1624 scan_freq="2412")
1625
1626 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1627 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1628
1629 tests = [
1630 # Various IEs for test coverage. The last one is FTIE with invalid
1631 # R1KH-ID subelement.
1632 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1633 # FTIE with invalid R0KH-ID subelement (len=0).
1634 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1635 # FTIE with invalid R0KH-ID subelement (len=49).
1636 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1637 # Invalid RSNE.
1638 "020002000000" + "3000",
1639 # Required IEs missing from protected IE count.
1640 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1641 # RIC missing from protected IE count.
1642 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1643 # Protected IE missing.
fab49f61 1644 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
664093b5
JM		 1645 for t in tests:
1646 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1647 hapd1.set("ext_mgmt_frame_handling", "1")
1648 hapd1.dump_monitor()
1649 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1650 raise Exception("ROAM failed")
1651 auth = None
1652 for i in range(20):
1653 msg = hapd1.mgmt_rx()
1654 if msg['subtype'] == 11:
1655 auth = msg
1656 break
1657 if not auth:
1658 raise Exception("Authentication frame not seen")
1659
1660 resp = {}
1661 resp['fc'] = auth['fc']
1662 resp['da'] = auth['sa']
1663 resp['sa'] = auth['da']
1664 resp['bssid'] = auth['bssid']
1665 resp['payload'] = binascii.unhexlify(t)
1666 hapd1.mgmt_tx(resp)
1667 hapd1.set("ext_mgmt_frame_handling", "0")
1668 dev[0].wait_disconnected()
1669
1670 dev[0].request("RECONNECT")
1671 dev[0].wait_connected()
7b741a53
JM		 1672
1673def test_ap_ft_gcmp_256(dev, apdev):
1674 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1675 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1676 raise HwsimSkip("Cipher GCMP-256 not supported")
1677 ssid = "test-ft"
fab49f61 1678 passphrase = "12345678"
7b741a53
JM		 1679
1680 params = ft_params1(ssid=ssid, passphrase=passphrase)
1681 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1682 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1683 params = ft_params2(ssid=ssid, passphrase=passphrase)
1684 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1685 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1686
1687 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1688 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1689
63a7683b 1690def setup_ap_ft_oom(dev, apdev):
38934ed1 1691 skip_with_fips(dev[0])
cf671d54 1692 ssid = "test-ft"
fab49f61 1693 passphrase = "12345678"
cf671d54
JM		 1694
1695 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1696 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1697 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1698 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1699
1700 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1701 scan_freq="2412")
1702 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1703 dst = apdev[1]['bssid']
1704 else:
1705 dst = apdev[0]['bssid']
1706
1707 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1708
1709 return dst
1710
1711def test_ap_ft_oom(dev, apdev):
1712 """WPA2-PSK-FT and OOM"""
1713 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1714 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1715 dev[0].roam(dst)
63a7683b
JM		 1716
1717def test_ap_ft_oom2(dev, apdev):
1718 """WPA2-PSK-FT and OOM (2)"""
1719 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1720 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1721 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1722
1723def test_ap_ft_oom3(dev, apdev):
1724 """WPA2-PSK-FT and OOM (3)"""
1725 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1726 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1727 dev[0].roam(dst)
34d3eaa8 1728
63a7683b
JM		 1729def test_ap_ft_oom4(dev, apdev):
1730 """WPA2-PSK-FT and OOM (4)"""
1731 ssid = "test-ft"
fab49f61 1732 passphrase = "12345678"
63a7683b 1733 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1734 dev[0].request("REMOVE_NETWORK all")
1735 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1736 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1737 scan_freq="2412")
1738
682a79f0
JM		 1739def test_ap_ft_ap_oom(dev, apdev):
1740 """WPA2-PSK-FT and AP OOM"""
1741 ssid = "test-ft"
fab49f61 1742 passphrase = "12345678"
682a79f0
JM		 1743
1744 params = ft_params1(ssid=ssid, passphrase=passphrase)
1745 hapd0 = hostapd.add_ap(apdev[0], params)
1746 bssid0 = hapd0.own_addr()
1747
1748 dev[0].scan_for_bss(bssid0, freq="2412")
1749 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1750 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1751 scan_freq="2412")
1752
1753 params = ft_params2(ssid=ssid, passphrase=passphrase)
1754 hapd1 = hostapd.add_ap(apdev[1], params)
1755 bssid1 = hapd1.own_addr()
1756 dev[0].scan_for_bss(bssid1, freq="2412")
1757 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1758 dev[0].roam(bssid1)
1759
1760def test_ap_ft_ap_oom2(dev, apdev):
1761 """WPA2-PSK-FT and AP OOM 2"""
1762 ssid = "test-ft"
fab49f61 1763 passphrase = "12345678"
682a79f0
JM		 1764
1765 params = ft_params1(ssid=ssid, passphrase=passphrase)
1766 hapd0 = hostapd.add_ap(apdev[0], params)
1767 bssid0 = hapd0.own_addr()
1768
1769 dev[0].scan_for_bss(bssid0, freq="2412")
1770 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1771 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1772 scan_freq="2412")
1773
1774 params = ft_params2(ssid=ssid, passphrase=passphrase)
1775 hapd1 = hostapd.add_ap(apdev[1], params)
1776 bssid1 = hapd1.own_addr()
1777 dev[0].scan_for_bss(bssid1, freq="2412")
1778 dev[0].roam(bssid1)
1779 if dev[0].get_status_field('bssid') != bssid1:
1780 raise Exception("Did not roam to AP1")
1781 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1782 dev[0].roam(bssid0)
1783
1784def test_ap_ft_ap_oom3(dev, apdev):
1785 """WPA2-PSK-FT and AP OOM 3"""
1786 ssid = "test-ft"
fab49f61 1787 passphrase = "12345678"
682a79f0
JM		 1788
1789 params = ft_params1(ssid=ssid, passphrase=passphrase)
1790 hapd0 = hostapd.add_ap(apdev[0], params)
1791 bssid0 = hapd0.own_addr()
1792
1793 dev[0].scan_for_bss(bssid0, freq="2412")
1794 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1795 scan_freq="2412")
1796
1797 params = ft_params2(ssid=ssid, passphrase=passphrase)
1798 hapd1 = hostapd.add_ap(apdev[1], params)
1799 bssid1 = hapd1.own_addr()
1800 dev[0].scan_for_bss(bssid1, freq="2412")
1801 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1802 # This will fail due to not being able to send out PMK-R1 pull request
1803 dev[0].roam(bssid1)
1804
ba88dd65 1805 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1806 # This will fail due to not being able to send out PMK-R1 pull request
1807 dev[0].roam(bssid1)
1808
ba88dd65
MB		 1809 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1810 # This will fail due to not being able to send out PMK-R1 pull request
1811 dev[0].roam(bssid1)
1812
1813def test_ap_ft_ap_oom3b(dev, apdev):
1814 """WPA2-PSK-FT and AP OOM 3b"""
1815 ssid = "test-ft"
fab49f61 1816 passphrase = "12345678"
ba88dd65
MB		 1817
1818 params = ft_params1(ssid=ssid, passphrase=passphrase)
1819 hapd0 = hostapd.add_ap(apdev[0], params)
1820 bssid0 = hapd0.own_addr()
1821
1822 dev[0].scan_for_bss(bssid0, freq="2412")
1823 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1824 scan_freq="2412")
1825
1826 params = ft_params2(ssid=ssid, passphrase=passphrase)
1827 hapd1 = hostapd.add_ap(apdev[1], params)
1828 bssid1 = hapd1.own_addr()
1829 dev[0].scan_for_bss(bssid1, freq="2412")
1830 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1831 # This will fail due to not being able to send out PMK-R1 pull request
1832 dev[0].roam(bssid1)
1833
1834def test_ap_ft_ap_oom4(dev, apdev):
1835 """WPA2-PSK-FT and AP OOM 4"""
1836 ssid = "test-ft"
fab49f61 1837 passphrase = "12345678"
682a79f0
JM		 1838
1839 params = ft_params1(ssid=ssid, passphrase=passphrase)
1840 hapd0 = hostapd.add_ap(apdev[0], params)
1841 bssid0 = hapd0.own_addr()
1842
1843 dev[0].scan_for_bss(bssid0, freq="2412")
1844 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1845 scan_freq="2412")
1846
1847 params = ft_params2(ssid=ssid, passphrase=passphrase)
1848 hapd1 = hostapd.add_ap(apdev[1], params)
1849 bssid1 = hapd1.own_addr()
1850 dev[0].scan_for_bss(bssid1, freq="2412")
1851 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1852 dev[0].roam(bssid1)
1853 if dev[0].get_status_field('bssid') != bssid1:
1854 raise Exception("Did not roam to AP1")
1855
1856 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1857 dev[0].roam(bssid0)
1858 if dev[0].get_status_field('bssid') != bssid0:
1859 raise Exception("Did not roam to AP0")
1860
1861 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1862 dev[0].roam(bssid1)
1863 if dev[0].get_status_field('bssid') != bssid1:
1864 raise Exception("Did not roam to AP1")
1865
1866def test_ap_ft_ap_oom5(dev, apdev):
1867 """WPA2-PSK-FT and AP OOM 5"""
1868 ssid = "test-ft"
fab49f61 1869 passphrase = "12345678"
682a79f0
JM		 1870
1871 params = ft_params1(ssid=ssid, passphrase=passphrase)
1872 hapd0 = hostapd.add_ap(apdev[0], params)
1873 bssid0 = hapd0.own_addr()
1874
1875 dev[0].scan_for_bss(bssid0, freq="2412")
1876 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1877 scan_freq="2412")
1878
1879 params = ft_params2(ssid=ssid, passphrase=passphrase)
1880 hapd1 = hostapd.add_ap(apdev[1], params)
1881 bssid1 = hapd1.own_addr()
1882 dev[0].scan_for_bss(bssid1, freq="2412")
1883 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1884 # This will fail to roam
1885 dev[0].roam(bssid1)
1886
1887 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1888 # This will fail to roam
1889 dev[0].roam(bssid1)
1890
1891 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1892 # This will fail to roam
1893 dev[0].roam(bssid1)
1894
1895 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1896 # This will fail to roam
1897 dev[0].roam(bssid1)
1898
1899 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1900 # This will fail to roam
1901 dev[0].roam(bssid1)
1902
1903def test_ap_ft_ap_oom6(dev, apdev):
1904 """WPA2-PSK-FT and AP OOM 6"""
1905 ssid = "test-ft"
fab49f61 1906 passphrase = "12345678"
682a79f0
JM		 1907
1908 params = ft_params1(ssid=ssid, passphrase=passphrase)
1909 hapd0 = hostapd.add_ap(apdev[0], params)
1910 bssid0 = hapd0.own_addr()
1911
1912 dev[0].scan_for_bss(bssid0, freq="2412")
1913 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1914 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1915 scan_freq="2412")
1916 dev[0].request("REMOVE_NETWORK all")
1917 dev[0].wait_disconnected()
1918 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1919 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1920 scan_freq="2412")
1921 dev[0].request("REMOVE_NETWORK all")
1922 dev[0].wait_disconnected()
1923 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1924 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1925 scan_freq="2412")
1926
c5262648
JM		 1927def test_ap_ft_ap_oom7a(dev, apdev):
1928 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0 1929 ssid = "test-ft"
fab49f61 1930 passphrase = "12345678"
682a79f0
JM		 1931
1932 params = ft_params1(ssid=ssid, passphrase=passphrase)
1933 params["ieee80211w"] = "2"
1934 hapd0 = hostapd.add_ap(apdev[0], params)
1935 bssid0 = hapd0.own_addr()
1936
1937 dev[0].scan_for_bss(bssid0, freq="2412")
1938 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1939 ieee80211w="2", scan_freq="2412")
1940
1941 params = ft_params2(ssid=ssid, passphrase=passphrase)
1942 params["ieee80211w"] = "2"
1943 hapd1 = hostapd.add_ap(apdev[1], params)
1944 bssid1 = hapd1.own_addr()
1945 dev[0].scan_for_bss(bssid1, freq="2412")
1946 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1947 # This will fail to roam
1948 dev[0].roam(bssid1)
c5262648
JM		 1949
1950def test_ap_ft_ap_oom7b(dev, apdev):
1951 """WPA2-PSK-FT and AP OOM 7b"""
1952 ssid = "test-ft"
fab49f61 1953 passphrase = "12345678"
c5262648
JM		 1954
1955 params = ft_params1(ssid=ssid, passphrase=passphrase)
1956 params["ieee80211w"] = "2"
1957 hapd0 = hostapd.add_ap(apdev[0], params)
1958 bssid0 = hapd0.own_addr()
1959
1960 dev[0].scan_for_bss(bssid0, freq="2412")
1961 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1962 ieee80211w="2", scan_freq="2412")
1963
1964 params = ft_params2(ssid=ssid, passphrase=passphrase)
1965 params["ieee80211w"] = "2"
1966 hapd1 = hostapd.add_ap(apdev[1], params)
1967 bssid1 = hapd1.own_addr()
1968 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1969 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1970 # This will fail to roam
1971 dev[0].roam(bssid1)
c5262648
JM		 1972
1973def test_ap_ft_ap_oom7c(dev, apdev):
1974 """WPA2-PSK-FT and AP OOM 7c"""
1975 ssid = "test-ft"
fab49f61 1976 passphrase = "12345678"
c5262648
JM		 1977
1978 params = ft_params1(ssid=ssid, passphrase=passphrase)
1979 params["ieee80211w"] = "2"
1980 hapd0 = hostapd.add_ap(apdev[0], params)
1981 bssid0 = hapd0.own_addr()
1982
1983 dev[0].scan_for_bss(bssid0, freq="2412")
1984 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1985 ieee80211w="2", scan_freq="2412")
1986
1987 params = ft_params2(ssid=ssid, passphrase=passphrase)
1988 params["ieee80211w"] = "2"
1989 hapd1 = hostapd.add_ap(apdev[1], params)
1990 bssid1 = hapd1.own_addr()
1991 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1992 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1993 # This will fail to roam
1994 dev[0].roam(bssid1)
c5262648
JM		 1995
1996def test_ap_ft_ap_oom7d(dev, apdev):
1997 """WPA2-PSK-FT and AP OOM 7d"""
1998 ssid = "test-ft"
fab49f61 1999 passphrase = "12345678"
c5262648
JM		 2000
2001 params = ft_params1(ssid=ssid, passphrase=passphrase)
2002 params["ieee80211w"] = "2"
2003 hapd0 = hostapd.add_ap(apdev[0], params)
2004 bssid0 = hapd0.own_addr()
2005
2006 dev[0].scan_for_bss(bssid0, freq="2412")
2007 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2008 ieee80211w="2", scan_freq="2412")
2009
2010 params = ft_params2(ssid=ssid, passphrase=passphrase)
2011 params["ieee80211w"] = "2"
2012 hapd1 = hostapd.add_ap(apdev[1], params)
2013 bssid1 = hapd1.own_addr()
2014 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 2015 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
2016 # This will fail to roam
2017 dev[0].roam(bssid1)
2018
2019def test_ap_ft_ap_oom8(dev, apdev):
2020 """WPA2-PSK-FT and AP OOM 8"""
2021 ssid = "test-ft"
fab49f61 2022 passphrase = "12345678"
682a79f0
JM		 2023
2024 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2025 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 2026 hapd0 = hostapd.add_ap(apdev[0], params)
2027 bssid0 = hapd0.own_addr()
2028
2029 dev[0].scan_for_bss(bssid0, freq="2412")
2030 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2031 scan_freq="2412")
2032
2033 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2034 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 2035 hapd1 = hostapd.add_ap(apdev[1], params)
2036 bssid1 = hapd1.own_addr()
2037 dev[0].scan_for_bss(bssid1, freq="2412")
2038 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
2039 # This will fail to roam
2040 dev[0].roam(bssid1)
2041 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
2042 # This will fail to roam
2043 dev[0].roam(bssid1)
2044
2045def test_ap_ft_ap_oom9(dev, apdev):
2046 """WPA2-PSK-FT and AP OOM 9"""
2047 ssid = "test-ft"
fab49f61 2048 passphrase = "12345678"
682a79f0
JM		 2049
2050 params = ft_params1(ssid=ssid, passphrase=passphrase)
2051 hapd0 = hostapd.add_ap(apdev[0], params)
2052 bssid0 = hapd0.own_addr()
2053
2054 dev[0].scan_for_bss(bssid0, freq="2412")
2055 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2056 scan_freq="2412")
2057
2058 params = ft_params2(ssid=ssid, passphrase=passphrase)
2059 hapd1 = hostapd.add_ap(apdev[1], params)
2060 bssid1 = hapd1.own_addr()
2061 dev[0].scan_for_bss(bssid1, freq="2412")
2062
2063 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
2064 # This will fail to roam
2065 if "OK" not in dev[0].request("FT_DS " + bssid1):
2066 raise Exception("FT_DS failed")
2067 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
2068
2069 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
2070 # This will fail to roam
2071 if "OK" not in dev[0].request("FT_DS " + bssid1):
2072 raise Exception("FT_DS failed")
2073 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2074
2075 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
2076 # This will fail to roam
2077 if "OK" not in dev[0].request("FT_DS " + bssid1):
2078 raise Exception("FT_DS failed")
2079 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2080
2081def test_ap_ft_ap_oom10(dev, apdev):
2082 """WPA2-PSK-FT and AP OOM 10"""
2083 ssid = "test-ft"
fab49f61 2084 passphrase = "12345678"
682a79f0
JM		 2085
2086 params = ft_params1(ssid=ssid, passphrase=passphrase)
2087 hapd0 = hostapd.add_ap(apdev[0], params)
2088 bssid0 = hapd0.own_addr()
2089
2090 dev[0].scan_for_bss(bssid0, freq="2412")
2091 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2092 scan_freq="2412")
2093
2094 params = ft_params2(ssid=ssid, passphrase=passphrase)
2095 hapd1 = hostapd.add_ap(apdev[1], params)
2096 bssid1 = hapd1.own_addr()
2097 dev[0].scan_for_bss(bssid1, freq="2412")
2098
9441a227 2099 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2100 # This will fail to roam
2101 if "OK" not in dev[0].request("FT_DS " + bssid1):
2102 raise Exception("FT_DS failed")
2103 wait_fail_trigger(hapd0, "GET_FAIL")
2104
2105 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
2106 # This will fail to roam
2107 if "OK" not in dev[0].request("FT_DS " + bssid1):
2108 raise Exception("FT_DS failed")
2109 wait_fail_trigger(hapd0, "GET_FAIL")
2110
9441a227 2111 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2112 # This will fail to roam
2113 if "OK" not in dev[0].request("FT_DS " + bssid1):
2114 raise Exception("FT_DS failed")
2115 wait_fail_trigger(hapd0, "GET_FAIL")
2116
9441a227 2117 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 2118 # This will fail to roam
2119 if "OK" not in dev[0].request("FT_DS " + bssid1):
2120 raise Exception("FT_DS failed")
2121 wait_fail_trigger(hapd1, "GET_FAIL")
2122
2123def test_ap_ft_ap_oom11(dev, apdev):
2124 """WPA2-PSK-FT and AP OOM 11"""
2125 ssid = "test-ft"
fab49f61 2126 passphrase = "12345678"
682a79f0
JM		 2127
2128 params = ft_params1(ssid=ssid, passphrase=passphrase)
2129 hapd0 = hostapd.add_ap(apdev[0], params)
2130 bssid0 = hapd0.own_addr()
2131
2132 dev[0].scan_for_bss(bssid0, freq="2412")
2133 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
2134 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2135 scan_freq="2412")
2136 wait_fail_trigger(hapd0, "GET_FAIL")
2137
2138 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 2139 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 2140 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2141 scan_freq="2412")
2142 wait_fail_trigger(hapd0, "GET_FAIL")
2143
a04e6f3d
JM		 2144def test_ap_ft_over_ds_proto_ap(dev, apdev):
2145 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
2146 ssid = "test-ft"
fab49f61 2147 passphrase = "12345678"
a04e6f3d
JM		 2148
2149 params = ft_params1(ssid=ssid, passphrase=passphrase)
2150 hapd0 = hostapd.add_ap(apdev[0], params)
2151 bssid0 = hapd0.own_addr()
2152 _bssid0 = bssid0.replace(':', '')
2153 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2154 scan_freq="2412")
2155 addr = dev[0].own_addr()
2156 _addr = addr.replace(':', '')
2157
2158 params = ft_params2(ssid=ssid, passphrase=passphrase)
2159 hapd1 = hostapd.add_ap(apdev[1], params)
2160 bssid1 = hapd1.own_addr()
2161 _bssid1 = bssid1.replace(':', '')
2162
2163 hapd0.set("ext_mgmt_frame_handling", "1")
2164 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
2165 valid = "0601" + _addr + _bssid1
fab49f61
JM		 2166 tests = ["0601",
2167 "0601" + _addr,
2168 "0601" + _addr + _bssid0,
2169 "0601" + _addr + "ffffffffffff",
2170 "0601" + _bssid0 + _bssid0,
2171 valid,
2172 valid + "01",
2173 valid + "3700",
2174 valid + "3600",
2175 valid + "3603ffffff",
2176 valid + "3603a1b2ff",
2177 valid + "3603a1b2ff" + "3700",
2178 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2179 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2180 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2181 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2182 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2183 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2184 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2185 valid + "0001"]
a04e6f3d
JM		 2186 for t in tests:
2187 hapd0.dump_monitor()
2188 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2189 raise Exception("MGMT_RX_PROCESS failed")
2190
2191 hapd0.set("ext_mgmt_frame_handling", "0")
2192
34d3eaa8
JM		 2193def test_ap_ft_over_ds_proto(dev, apdev):
2194 """WPA2-PSK-FT AP over DS protocol testing"""
2195 ssid = "test-ft"
fab49f61 2196 passphrase = "12345678"
34d3eaa8
JM		 2197
2198 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2199 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2200 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2201 scan_freq="2412")
2202
2203 # FT Action Response while no FT-over-DS in progress
2204 msg = {}
2205 msg['fc'] = 13 << 4
2206 msg['da'] = dev[0].own_addr()
2207 msg['sa'] = apdev[0]['bssid']
2208 msg['bssid'] = apdev[0]['bssid']
2209 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2210 hapd0.mgmt_tx(msg)
2211
2212 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2213 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2214 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2215 hapd0.set("ext_mgmt_frame_handling", "1")
2216 hapd0.dump_monitor()
2217 dev[0].request("FT_DS " + apdev[1]['bssid'])
2218 for i in range(0, 10):
2219 req = hapd0.mgmt_rx()
2220 if req is None:
2221 raise Exception("MGMT RX wait timed out")
2222 if req['subtype'] == 13:
2223 break
2224 req = None
2225 if not req:
2226 raise Exception("FT Action frame not received")
2227
2228 # FT Action Response for unexpected Target AP
2229 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2230 hapd0.mgmt_tx(msg)
2231
2232 # FT Action Response without MDIE
2233 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2234 hapd0.mgmt_tx(msg)
2235
2236 # FT Action Response without FTIE
2237 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2238 hapd0.mgmt_tx(msg)
2239
2240 # FT Action Response with FTIE SNonce mismatch
2241 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2242 hapd0.mgmt_tx(msg)
6f3815c0 2243
9fd6804d 2244@remote_compatible
6f3815c0
JM		 2245def test_ap_ft_rrb(dev, apdev):
2246 """WPA2-PSK-FT RRB protocol testing"""
2247 ssid = "test-ft"
fab49f61 2248 passphrase = "12345678"
6f3815c0
JM		 2249
2250 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2251 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2252
2253 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2254 scan_freq="2412")
2255
fab49f61
JM		 2256 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':', ''))
2257 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':', ''))
15dfcb69 2258 proto = b'\x89\x0d'
6f3815c0
JM		 2259 ehdr = _dst_ll + _src_ll + proto
2260
2261 # Too short RRB frame
15dfcb69 2262 pkt = ehdr + b'\x01'
7ab74770 2263 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2264 raise Exception("DATA_TEST_FRAME failed")
2265
2266 # RRB discarded frame wikth unrecognized type
15dfcb69 2267 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2268 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2269 raise Exception("DATA_TEST_FRAME failed")
2270
2271 # RRB frame too short for action frame
15dfcb69 2272 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2273 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2274 raise Exception("DATA_TEST_FRAME failed")
2275
2276 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2277 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2278 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2279 raise Exception("DATA_TEST_FRAME failed")
2280
2281 # Unexpected Action frame category
15dfcb69 2282 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2283 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2284 raise Exception("DATA_TEST_FRAME failed")
2285
2286 # Unexpected Action in RRB Request
15dfcb69 2287 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2288 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2289 raise Exception("DATA_TEST_FRAME failed")
2290
2291 # Target AP address in RRB Request does not match with own address
15dfcb69 2292 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2293 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2294 raise Exception("DATA_TEST_FRAME failed")
2295
2296 # Not enough room for status code in RRB Response
15dfcb69 2297 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2298 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2299 raise Exception("DATA_TEST_FRAME failed")
2300
2301 # RRB discarded frame with unknown packet_type
15dfcb69 2302 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2303 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2304 raise Exception("DATA_TEST_FRAME failed")
2305
2306 # RRB Response with non-zero status code; no STA match
15dfcb69 2307 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2308 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2309 raise Exception("DATA_TEST_FRAME failed")
2310
2311 # RRB Response with zero status code and extra data; STA match
15dfcb69 2312 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2313 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2314 raise Exception("DATA_TEST_FRAME failed")
2315
2316 # Too short PMK-R1 pull
15dfcb69 2317 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2318 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2319 raise Exception("DATA_TEST_FRAME failed")
2320
2321 # Too short PMK-R1 resp
15dfcb69 2322 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2323 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2324 raise Exception("DATA_TEST_FRAME failed")
2325
2326 # Too short PMK-R1 push
15dfcb69 2327 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2328 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2329 raise Exception("DATA_TEST_FRAME failed")
2330
2331 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2332 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2333 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2334 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2335
9fd6804d 2336@remote_compatible
ecafa0cf
JM		 2337def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2338 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2339 bssid = apdev[0]['bssid']
2340 ssid = "test-ft"
fab49f61 2341 passphrase = "12345678"
ecafa0cf
JM		 2342
2343 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2344 params["ieee80211w"] = "1"
ecafa0cf
JM		 2345 # This is the RSN element used normally by hostapd
2346 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2347 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2348 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2349 ieee80211w="1", scan_freq="2412",
2350 pairwise="CCMP", group="CCMP")
2351
fab49f61
JM		 2352 tests = [('PMKIDCount field included',
2353 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2354 ('Extra IE before RSNE',
2355 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2356 ('PMKIDCount and Group Management Cipher suite fields included',
2357 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2358 ('Extra octet after defined fields (future extensibility)',
2359 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2360 ('No RSN Capabilities field (PMF disabled in practice)',
2361 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2362 for txt, ie in tests:
ecafa0cf
JM		 2363 dev[0].request("DISCONNECT")
2364 dev[0].wait_disconnected()
2365 logger.info(txt)
2366 hapd.disable()
2367 hapd.set('own_ie_override', ie)
2368 hapd.enable()
2369 dev[0].request("BSS_FLUSH 0")
2370 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2371 dev[0].select_network(id, freq=2412)
2372 dev[0].wait_connected()
2373
2374 dev[0].request("DISCONNECT")
2375 dev[0].wait_disconnected()
2376
2377 logger.info('Invalid RSNE causing internal hostapd error')
2378 hapd.disable()
2379 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2380 hapd.enable()
2381 dev[0].request("BSS_FLUSH 0")
2382 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2383 dev[0].select_network(id, freq=2412)
2384 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2385 # complete.
2386 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2387 if ev is not None:
2388 raise Exception("Unexpected connection")
2389 dev[0].request("DISCONNECT")
2390
2391 logger.info('Unexpected PMKID causing internal hostapd error')
2392 hapd.disable()
2393 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2394 hapd.enable()
2395 dev[0].request("BSS_FLUSH 0")
2396 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2397 dev[0].select_network(id, freq=2412)
2398 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2399 # complete.
2400 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2401 if ev is not None:
2402 raise Exception("Unexpected connection")
2403 dev[0].request("DISCONNECT")
1025603b 2404
425e5f97 2405def start_ft(apdev, wpa_ptk_rekey=None):
1025603b 2406 ssid = "test-ft"
fab49f61 2407 passphrase = "12345678"
1025603b
JM		 2408
2409 params = ft_params1(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2410 if wpa_ptk_rekey:
2411 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2412 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2413 params = ft_params2(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2414 if wpa_ptk_rekey:
2415 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2416 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b 2417
425e5f97 2418 return hapd0, hapd1
1025603b 2419
425e5f97
JM		 2420def check_ptk_rekey(dev, hapd0=None, hapd1=None):
2421 ev = dev.wait_event(["CTRL-EVENT-DISCONNECTED",
2422 "WPA: Key negotiation completed"], timeout=5)
1025603b
JM		 2423 if ev is None:
2424 raise Exception("No event received after roam")
2425 if "CTRL-EVENT-DISCONNECTED" in ev:
2426 raise Exception("Unexpected disconnection after roam")
2427
425e5f97
JM		 2428 if not hapd0 or not hapd1:
2429 return
2430 if dev.get_status_field('bssid') == hapd0.own_addr():
1025603b
JM		 2431 hapd = hapd0
2432 else:
2433 hapd = hapd1
d22f0902 2434 time.sleep(0.1)
425e5f97 2435 hwsim_utils.test_connectivity(dev, hapd)
1025603b 2436
425e5f97
JM		 2437def test_ap_ft_ptk_rekey(dev, apdev):
2438 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2439 hapd0, hapd1 = start_ft(apdev)
2440 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1")
2441 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2442
425e5f97
JM		 2443def test_ap_ft_ptk_rekey2(dev, apdev):
2444 """WPA2-PSK-FT PTK rekeying triggered by station after one roam"""
2445 hapd0, hapd1 = start_ft(apdev)
2446 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1",
2447 only_one_way=True)
2448 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2449
425e5f97
JM		 2450def test_ap_ft_ptk_rekey_ap(dev, apdev):
2451 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2452 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2453 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678")
2454 check_ptk_rekey(dev[0], hapd0, hapd1)
2455
2456def test_ap_ft_ptk_rekey_ap2(dev, apdev):
2457 """WPA2-PSK-FT PTK rekeying triggered by AP after one roam"""
2458 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2459 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678",
2460 only_one_way=True)
2461 check_ptk_rekey(dev[0], hapd0, hapd1)
2462
2463def test_ap_ft_eap_ptk_rekey_ap(dev, apdev):
2464 """WPA2-EAP-FT PTK rekeying triggered by AP"""
2465 generic_ap_ft_eap(dev, apdev, only_one_way=True, wpa_ptk_rekey=2)
2466 check_ptk_rekey(dev[0])
186ca473
MB		 2467
2468def test_ap_ft_internal_rrb_check(dev, apdev):
2469 """RRB internal delivery only to WPA enabled BSS"""
2470 ssid = "test-ft"
fab49f61 2471 passphrase = "12345678"
186ca473
MB		 2472
2473 radius = hostapd.radius_params()
2474 params = ft_params1(ssid=ssid, passphrase=passphrase)
2475 params['wpa_key_mgmt'] = "FT-EAP"
2476 params["ieee8021x"] = "1"
35d8c254 2477 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2478 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2479 key_mgmt = hapd.get_config()['key_mgmt']
2480 if key_mgmt.split(' ')[0] != "FT-EAP":
2481 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2482
fab49f61 2483 hapd1 = hostapd.add_ap(apdev[1], {"ssid": ssid})
186ca473
MB		 2484
2485 # Connect to WPA enabled AP
2486 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2487 eap="GPSK", identity="gpsk user",
2488 password="abcdefghijklmnop0123456789abcdef",
2489 scan_freq="2412")
2490
2491 # Try over_ds roaming to non-WPA-enabled AP.
2492 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2493 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2494
2495def test_ap_ft_extra_ie(dev, apdev):
2496 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2497 ssid = "test-ft"
fab49f61 2498 passphrase = "12345678"
c85fcff2
JM		 2499
2500 params = ft_params1(ssid=ssid, passphrase=passphrase)
2501 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2502 hapd0 = hostapd.add_ap(apdev[0], params)
2503 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2504 scan_freq="2412")
2505 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2506 scan_freq="2412")
2507 try:
2508 # Add Mobility Domain element to test AP validation code.
2509 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2510 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2511 scan_freq="2412", wait_connect=False)
2512 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2513 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2514 if ev is None:
2515 raise Exception("No connection result")
2516 if "CTRL-EVENT-CONNECTED" in ev:
2517 raise Exception("Non-FT association accepted with MDE")
2518 if "status_code=43" not in ev:
2519 raise Exception("Unexpected status code: " + ev)
2520 dev[0].request("DISCONNECT")
2521 finally:
2522 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2523
2524def test_ap_ft_ric(dev, apdev):
2525 """WPA2-PSK-FT AP and RIC"""
2526 ssid = "test-ft"
fab49f61 2527 passphrase = "12345678"
fd7205fa
JM		 2528
2529 params = ft_params1(ssid=ssid, passphrase=passphrase)
2530 hapd0 = hostapd.add_ap(apdev[0], params)
2531 params = ft_params2(ssid=ssid, passphrase=passphrase)
2532 hapd1 = hostapd.add_ap(apdev[1], params)
2533
2534 dev[0].set("ric_ies", "")
2535 dev[0].set("ric_ies", '""')
2536 if "FAIL" not in dev[0].request("SET ric_ies q"):
2537 raise Exception("Invalid ric_ies value accepted")
2538
fab49f61
JM		 2539 tests = ["3900",
2540 "3900ff04eeeeeeee",
2541 "390400000000",
2542 "390400000000" + "390400000000",
2543 "390400000000" + "dd050050f20202",
2544 "390400000000" + "dd3d0050f2020201" + 55*"00",
2545 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2546 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
fd7205fa
JM		 2547 for t in tests:
2548 dev[0].set("ric_ies", t)
2549 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2550 test_connectivity=False)
2551 dev[0].request("REMOVE_NETWORK all")
2552 dev[0].wait_disconnected()
2553 dev[0].dump_monitor()
c8942286
JM		 2554
2555def ie_hex(ies, id):
7ab74770 2556 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2557
2558def test_ap_ft_reassoc_proto(dev, apdev):
2559 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2560 ssid = "test-ft"
fab49f61 2561 passphrase = "12345678"
c8942286
JM		 2562
2563 params = ft_params1(ssid=ssid, passphrase=passphrase)
2564 hapd0 = hostapd.add_ap(apdev[0], params)
2565 params = ft_params2(ssid=ssid, passphrase=passphrase)
2566 hapd1 = hostapd.add_ap(apdev[1], params)
2567
2568 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2569 ieee80211w="1", scan_freq="2412")
2570 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2571 hapd1ap = hapd0
2572 hapd2ap = hapd1
2573 else:
2574 hapd1ap = hapd1
2575 hapd2ap = hapd0
2576
2577 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2578 hapd2ap.set("ext_mgmt_frame_handling", "1")
2579 dev[0].request("ROAM " + hapd2ap.own_addr())
2580
2581 while True:
2582 req = hapd2ap.mgmt_rx()
7ab74770 2583 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2584 if req['subtype'] == 11:
2585 break
2586
2587 while True:
2588 req = hapd2ap.mgmt_rx()
2589 if req['subtype'] == 2:
2590 break
7ab74770 2591 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2592
2593 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2594 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2595 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2596 # First elements: SSID, Supported Rates, Extended Supported Rates
2597 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2598
2599 rsne = ie_hex(ies, 48)
2600 mde = ie_hex(ies, 54)
2601 fte = ie_hex(ies, 55)
fab49f61 2602 tests = []
c8942286 2603 # RSN: Trying to use FT, but MDIE not included
fab49f61 2604 tests += [rsne]
c8942286 2605 # RSN: Attempted to use unknown MDIE
fab49f61 2606 tests += [rsne + "3603000000"]
c8942286 2607 # Invalid RSN pairwise cipher
fab49f61 2608 tests += ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
c8942286 2609 # FT: No PMKID in RSNIE
fab49f61 2610 tests += ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54)]
c8942286 2611 # FT: Invalid FTIE
fab49f61 2612 tests += [rsne + mde]
c8942286
JM		 2613 # FT: RIC IE(s) in the frame, but not included in protected IE count
2614 # FT: Failed to parse FT IEs
fab49f61 2615 tests += [rsne + mde + fte + "3900"]
c8942286 2616 # FT: SNonce mismatch in FTIE
fab49f61 2617 tests += [rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00"]
c8942286 2618 # FT: ANonce mismatch in FTIE
fab49f61 2619 tests += [rsne + mde + fte[0:40] + 32*"00" + fte[104:]]
c8942286 2620 # FT: No R0KH-ID subelem in FTIE
fab49f61 2621 tests += [rsne + mde + "3752" + fte[4:168]]
c8942286 2622 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
fab49f61 2623 tests += [rsne + mde + "3755" + fte[4:168] + "0301ff"]
c8942286 2624 # FT: No R1KH-ID subelem in FTIE
fab49f61 2625 tests += [rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode()]
c8942286 2626 # FT: Unknown R1KH-ID used in ReassocReq
fab49f61 2627 tests += [rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000"]
c8942286 2628 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
fab49f61 2629 tests += [rsne[:-32] + 16*"00" + mde + fte]
c8942286 2630 # Invalid MIC in FTIE
fab49f61 2631 tests += [rsne + mde + fte[0:8] + 16*"00" + fte[40:]]
c8942286
JM		 2632 for t in tests:
2633 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2634
2635def test_ap_ft_reassoc_local_fail(dev, apdev):
2636 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2637 ssid = "test-ft"
fab49f61 2638 passphrase = "12345678"
c8942286
JM		 2639
2640 params = ft_params1(ssid=ssid, passphrase=passphrase)
2641 hapd0 = hostapd.add_ap(apdev[0], params)
2642 params = ft_params2(ssid=ssid, passphrase=passphrase)
2643 hapd1 = hostapd.add_ap(apdev[1], params)
2644
2645 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2646 ieee80211w="1", scan_freq="2412")
2647 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2648 hapd1ap = hapd0
2649 hapd2ap = hapd1
2650 else:
2651 hapd1ap = hapd1
2652 hapd2ap = hapd0
2653
2654 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2655 # FT: Failed to calculate MIC
2656 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2657 dev[0].request("ROAM " + hapd2ap.own_addr())
2658 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2659 dev[0].request("DISCONNECT")
2660 if ev is None:
2661 raise Exception("Association reject not seen")
d7f0bef9
JM		 2662
2663def test_ap_ft_reassoc_replay(dev, apdev, params):
2664 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2665 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2666 ssid = "test-ft"
fab49f61 2667 passphrase = "12345678"
d7f0bef9
JM		 2668
2669 params = ft_params1(ssid=ssid, passphrase=passphrase)
2670 hapd0 = hostapd.add_ap(apdev[0], params)
2671 params = ft_params2(ssid=ssid, passphrase=passphrase)
2672 hapd1 = hostapd.add_ap(apdev[1], params)
2673
2674 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2675 scan_freq="2412")
2676 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2677 hapd1ap = hapd0
2678 hapd2ap = hapd1
2679 else:
2680 hapd1ap = hapd1
2681 hapd2ap = hapd0
2682
2683 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2684 hapd2ap.set("ext_mgmt_frame_handling", "1")
2685 dev[0].dump_monitor()
2686 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2687 raise Exception("ROAM failed")
2688
2689 reassocreq = None
2690 count = 0
2691 while count < 100:
2692 req = hapd2ap.mgmt_rx()
2693 count += 1
2694 hapd2ap.dump_monitor()
7ab74770 2695 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2696 if req['subtype'] == 2:
2697 reassocreq = req
2698 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2699 if ev is None:
2700 raise Exception("No TX status seen")
2701 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2702 if "OK" not in hapd2ap.request(cmd):
2703 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2704 break
2705 hapd2ap.set("ext_mgmt_frame_handling", "0")
2706 if reassocreq is None:
2707 raise Exception("No Reassociation Request frame seen")
2708 dev[0].wait_connected()
2709 dev[0].dump_monitor()
2710 hapd2ap.dump_monitor()
2711
2712 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2713
2714 logger.info("Replay the last Reassociation Request frame")
2715 hapd2ap.dump_monitor()
2716 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2717 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2718 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2719 if ev is None:
2720 raise Exception("No TX status seen")
2721 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2722 if "OK" not in hapd2ap.request(cmd):
2723 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2724 hapd2ap.set("ext_mgmt_frame_handling", "0")
2725
2726 try:
2727 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2728 ok = True
2729 except:
2730 ok = False
2731
2732 ap = hapd2ap.own_addr()
2733 sta = dev[0].own_addr()
2734 filt = "wlan.fc.type == 2 && " + \
2735 "wlan.da == " + sta + " && " + \
2736 "wlan.sa == " + ap
fab49f61 2737 fields = ["wlan.ccmp.extiv"]
d7f0bef9
JM		 2738 res = run_tshark(capfile, filt, fields)
2739 vals = res.splitlines()
2740 logger.info("CCMP PN: " + str(vals))
2741 if len(vals) < 2:
2742 raise Exception("Could not find all CCMP protected frames from capture")
2743 if len(set(vals)) < len(vals):
2744 raise Exception("Duplicate CCMP PN used")
2745
2746 if not ok:
2747 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2748
2749def test_ap_ft_psk_file(dev, apdev):
2750 """WPA2-PSK-FT AP with PSK from a file"""
2751 ssid = "test-ft"
fab49f61 2752 passphrase = "12345678"
0dc3c5f2
JM		 2753
2754 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2755 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2756 hapd = hostapd.add_ap(apdev[0], params)
2757
2758 dev[1].connect(ssid, psk="very secret",
2759 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2760 scan_freq="2412", wait_connect=False)
2761 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2762 ieee80211w="1", scan_freq="2412")
2763 dev[0].request("REMOVE_NETWORK all")
2764 dev[0].wait_disconnected()
2765 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2766 ieee80211w="1", scan_freq="2412")
2767 dev[0].request("REMOVE_NETWORK all")
2768 dev[0].wait_disconnected()
2769 dev[0].connect(ssid, psk="secret passphrase",
2770 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2771 scan_freq="2412")
2772 dev[2].connect(ssid, psk="another passphrase for all STAs",
2773 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2774 scan_freq="2412")
2775 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2776 if ev is None:
2777 raise Exception("Timed out while waiting for failure report")
2778 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2779
2780def test_ap_ft_eap_ap_config_change(dev, apdev):
2781 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2782 ssid = "test-ft"
fab49f61 2783 passphrase = "12345678"
62566bc2
JM		 2784 bssid = apdev[0]['bssid']
2785
2786 radius = hostapd.radius_params()
2787 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2788 params['wpa_key_mgmt'] = "WPA-EAP"
2789 params["ieee8021x"] = "1"
2790 params["pmk_r1_push"] = "0"
2791 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2792 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2793 params["eap_server"] = "0"
35d8c254 2794 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2795 hapd = hostapd.add_ap(apdev[0], params)
2796
2797 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2798 eap="GPSK", identity="gpsk user",
2799 password="abcdefghijklmnop0123456789abcdef",
2800 scan_freq="2412")
2801 dev[0].request("DISCONNECT")
2802 dev[0].wait_disconnected()
2803 dev[0].dump_monitor()
2804
2805 hapd.disable()
2806 hapd.set('wpa_key_mgmt', "FT-EAP")
2807 hapd.enable()
2808
2809 dev[0].request("BSS_FLUSH 0")
2810 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2811
2812 dev[0].request("RECONNECT")
2813 dev[0].wait_connected()
55b3cda7
JM		 2814
2815def test_ap_ft_eap_sha384(dev, apdev):
2816 """WPA2-EAP-FT with SHA384"""
2817 ssid = "test-ft"
fab49f61 2818 passphrase = "12345678"
55b3cda7
JM		 2819
2820 radius = hostapd.radius_params()
2821 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2822 params["ieee80211w"] = "2"
55b3cda7
JM		 2823 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2824 params["ieee8021x"] = "1"
35d8c254 2825 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2826 hapd0 = hostapd.add_ap(apdev[0], params)
2827 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2828 params["ieee80211w"] = "2"
55b3cda7
JM		 2829 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2830 params["ieee8021x"] = "1"
35d8c254 2831 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2832 hapd1 = hostapd.add_ap(apdev[1], params)
2833
2834 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2835 sha384=True)
2836
659f7954
JM		 2837def test_ap_ft_eap_sha384_reassoc(dev, apdev):
2838 """WPA2-EAP-FT with SHA384 using REASSOCIATE"""
e1923f5b 2839 check_suite_b_192_capa(dev)
659f7954
JM		 2840 ssid = "test-ft"
2841 passphrase = "12345678"
2842
2843 radius = hostapd.radius_params()
2844 params = ft_params1(ssid=ssid, passphrase=passphrase)
2845 params["ieee80211w"] = "2"
2846 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2847 params["ieee8021x"] = "1"
2848 params = dict(list(radius.items()) + list(params.items()))
2849 hapd0 = hostapd.add_ap(apdev[0], params)
2850 params = ft_params2(ssid=ssid, passphrase=passphrase)
2851 params["ieee80211w"] = "2"
2852 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2853 params["ieee8021x"] = "1"
2854 params = dict(list(radius.items()) + list(params.items()))
2855 hapd1 = hostapd.add_ap(apdev[1], params)
2856
2857 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2858 sha384=True, also_non_ft=True, roam_with_reassoc=True)
2859
55b3cda7
JM		 2860def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2861 """WPA2-EAP-FT with SHA384 over DS"""
2862 ssid = "test-ft"
fab49f61 2863 passphrase = "12345678"
55b3cda7
JM		 2864
2865 radius = hostapd.radius_params()
2866 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2867 params["ieee80211w"] = "2"
55b3cda7
JM		 2868 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2869 params["ieee8021x"] = "1"
35d8c254 2870 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2871 hapd0 = hostapd.add_ap(apdev[0], params)
2872 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2873 params["ieee80211w"] = "2"
55b3cda7
JM		 2874 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2875 params["ieee8021x"] = "1"
35d8c254 2876 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2877 hapd1 = hostapd.add_ap(apdev[1], params)
2878
2879 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2880 eap=True, sha384=True)
392aba4e
JM		 2881
2882def test_ap_ft_roam_rrm(dev, apdev):
2883 """WPA2-PSK-FT AP and radio measurement request"""
2884 ssid = "test-ft"
fab49f61 2885 passphrase = "12345678"
392aba4e
JM		 2886
2887 params = ft_params1(ssid=ssid, passphrase=passphrase)
2888 params["rrm_beacon_report"] = "1"
2889 hapd0 = hostapd.add_ap(apdev[0], params)
2890 bssid0 = hapd0.own_addr()
2891
2892 addr = dev[0].own_addr()
2893 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2894 scan_freq="2412")
2895 check_beacon_req(hapd0, addr, 1)
2896
2897 params = ft_params2(ssid=ssid, passphrase=passphrase)
2898 params["rrm_beacon_report"] = "1"
2899 hapd1 = hostapd.add_ap(apdev[1], params)
2900 bssid1 = hapd1.own_addr()
2901
2902 dev[0].scan_for_bss(bssid1, freq=2412)
2903 dev[0].roam(bssid1)
2904 check_beacon_req(hapd1, addr, 2)
2905
2906 dev[0].scan_for_bss(bssid0, freq=2412)
2907 dev[0].roam(bssid0)
2908 check_beacon_req(hapd0, addr, 3)
9ff2b85e
JM		 2909
2910def test_ap_ft_pmksa_caching(dev, apdev):
2911 """FT-EAP and PMKSA caching for initial mobility domain association"""
2912 ssid = "test-ft"
2913 identity = "gpsk user"
2914
2915 radius = hostapd.radius_params()
2916 params = ft_params1(ssid=ssid)
2917 params['wpa_key_mgmt'] = "FT-EAP"
2918 params["ieee8021x"] = "1"
2919 params["mobility_domain"] = "c3d4"
2920 params = dict(list(radius.items()) + list(params.items()))
2921 hapd = hostapd.add_ap(apdev[0], params)
2922
2923 params = ft_params2(ssid=ssid)
2924 params['wpa_key_mgmt'] = "FT-EAP"
2925 params["ieee8021x"] = "1"
2926 params["mobility_domain"] = "c3d4"
2927 params = dict(list(radius.items()) + list(params.items()))
2928 hapd1 = hostapd.add_ap(apdev[1], params)
2929
2930 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2931 eap_identity=identity, pmksa_caching=True)
2932
2933def test_ap_ft_pmksa_caching_sha384(dev, apdev):
2934 """FT-EAP-SHA384 and PMKSA caching for initial mobility domain association"""
2935 ssid = "test-ft"
2936 identity = "gpsk user"
2937
2938 radius = hostapd.radius_params()
2939 params = ft_params1(ssid=ssid)
2940 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2941 params["ieee8021x"] = "1"
2942 params["mobility_domain"] = "c3d4"
2943 params = dict(list(radius.items()) + list(params.items()))
2944 hapd = hostapd.add_ap(apdev[0], params)
2945
2946 params = ft_params2(ssid=ssid)
2947 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2948 params["ieee8021x"] = "1"
2949 params["mobility_domain"] = "c3d4"
2950 params = dict(list(radius.items()) + list(params.items()))
2951 hapd1 = hostapd.add_ap(apdev[1], params)
2952
2953 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2954 eap_identity=identity, pmksa_caching=True, sha384=True)
5916637c
JM		 2955
2956def test_ap_ft_r1_key_expiration(dev, apdev):
2957 """WPA2-PSK-FT and PMK-R1 expiration"""
2958 ssid = "test-ft"
2959 passphrase = "12345678"
2960
2961 params = ft_params1(ssid=ssid, passphrase=passphrase)
2962 params['r1_max_key_lifetime'] = "2"
2963 hapd0 = hostapd.add_ap(apdev[0], params)
2964 params = ft_params2(ssid=ssid, passphrase=passphrase)
2965 params['r1_max_key_lifetime'] = "2"
2966 hapd1 = hostapd.add_ap(apdev[1], params)
2967
2968 # This succeeds, but results in having to run another PMK-R1 pull before the
2969 # second AP can complete FT protocol.
2970 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, wait_before_roam=4)
2971
2972def test_ap_ft_r0_key_expiration(dev, apdev):
2973 """WPA2-PSK-FT and PMK-R0 expiration"""
2974 ssid = "test-ft"
2975 passphrase = "12345678"
2976
2977 params = ft_params1(ssid=ssid, passphrase=passphrase)
2978 params['ft_r0_key_lifetime'] = "2"
2979 hapd0 = hostapd.add_ap(apdev[0], params)
2980 params = ft_params2(ssid=ssid, passphrase=passphrase)
2981 params['ft_r0_key_lifetime'] = "2"
2982 hapd1 = hostapd.add_ap(apdev[1], params)
2983
2984 bssid2 = run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2985 return_after_initial=True)
2986 time.sleep(4)
2987 dev[0].scan_for_bss(bssid2, freq="2412")
2988 if "OK" not in dev[0].request("ROAM " + bssid2):
2989 raise Exception("ROAM failed")
2990 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2991 "CTRL-EVENT-AUTH-REJECT",
2992 "CTRL-EVENT-ASSOC-REJECT"], timeout=5)
2993 dev[0].request("DISCONNECT")
2994 if ev is None or "CTRL-EVENT-AUTH-REJECT" not in ev:
2995 raise Exception("FT protocol failure not reported")
2996 if "status_code=53" not in ev:
2997 raise Exception("Unexpected status in FT protocol failure: " + ev)
2998
2999 # Generate a new PMK-R0
3000 dev[0].dump_monitor()
3001 dev[0].request("RECONNECT")
3002 dev[0].wait_connected()
Unnamed repository; edit this file 'description' to name the repository.