]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: Fix ap_ft_pmf_over_ds
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
cd7f1b9a
JM		 25
26def ft_base_rsn():
27 params = { "wpa": "2",
28 "wpa_key_mgmt": "FT-PSK",
29 "rsn_pairwise": "CCMP" }
30 return params
31
32def ft_base_mixed():
33 params = { "wpa": "3",
34 "wpa_key_mgmt": "WPA-PSK FT-PSK",
35 "wpa_pairwise": "TKIP",
36 "rsn_pairwise": "CCMP" }
37 return params
38
39def ft_params(rsn=True, ssid=None, passphrase=None):
40 if rsn:
41 params = ft_base_rsn()
42 else:
43 params = ft_base_mixed()
44 if ssid:
45 params["ssid"] = ssid
46 if passphrase:
47 params["wpa_passphrase"] = passphrase
48
49 params["mobility_domain"] = "a1b2"
50 params["r0_key_lifetime"] = "10000"
51 params["pmk_r1_push"] = "1"
52 params["reassociation_deadline"] = "1000"
53 return params
54
d0175d6e 55def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 56 params = ft_params(rsn, ssid, passphrase)
57 params['nas_identifier'] = "nas1.w1.fi"
58 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 59 return params
60
942b52a8 61def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 62 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 63 if discovery:
64 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
65 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 else:
67 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
68 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
69 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 70 return params
71
c95dd8e4
JM		 72def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
73 params = ft_params1a(rsn, ssid, passphrase)
74 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
75 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
76 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
77 return params
78
d0175d6e 79def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 80 params = ft_params(rsn, ssid, passphrase)
81 params['nas_identifier'] = "nas2.w1.fi"
82 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 83 return params
84
942b52a8 85def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 86 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 87 if discovery:
88 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
89 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 else:
91 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
92 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
93 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 94 return params
95
c95dd8e4
JM		 96def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
97 params = ft_params2a(rsn, ssid, passphrase)
98 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
99 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
100 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
101 return params
102
3b808945
JM		 103def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
104 params = ft_params(rsn, ssid, passphrase)
105 params['nas_identifier'] = "nas1.w1.fi"
106 params['r1_key_holder'] = "000102030405"
9441a227
MB		 107 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
108 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
109 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 110 return params
111
112def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
113 params = ft_params(rsn, ssid, passphrase)
114 params['nas_identifier'] = "nas2.w1.fi"
115 params['r1_key_holder'] = "000102030406"
9441a227
MB		 116 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
117 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
118 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 119 return params
120
121def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
122 params = ft_params(rsn, ssid, passphrase)
123 params['nas_identifier'] = "nas2.w1.fi"
124 params['r1_key_holder'] = "000102030406"
9441a227
MB		 125 params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
126 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
127 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 128 return params
129
7b741a53
JM		 130def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
131 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 132 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 133 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 134 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5
JM		 135 group_mgmt=None, ocv=None, sae_password=None,
136 sae_password_id=None):
cd7f1b9a 137 logger.info("Connect to first AP")
473e5176
MB		 138
139 copts = {}
140 copts["proto"] = "WPA2"
141 copts["ieee80211w"] = "1"
142 copts["scan_freq"] = "2412"
143 copts["pairwise"] = pairwise_cipher
144 copts["group"] = group_cipher
145 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 146 if group_mgmt:
147 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 148 if ocv:
149 copts["ocv"] = ocv
6f62809b 150 if eap:
55b3cda7 151 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 152 copts["eap"] = "GPSK"
153 copts["identity"] = eap_identity
154 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 155 else:
6f62809b 156 if sae:
473e5176 157 copts["key_mgmt"] = "FT-SAE"
6f62809b 158 else:
473e5176 159 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 160 if passphrase:
161 copts["psk"] = passphrase
162 if sae_password:
163 copts["sae_password"] = sae_password
164 if sae_password_id:
165 copts["sae_password_id"] = sae_password_id
473e5176
MB		 166 if force_initial_conn_to_first_ap:
167 copts["bssid"] = apdev[0]['bssid']
168 dev.connect(ssid, **copts)
169
cd7f1b9a
JM		 170 if dev.get_status_field('bssid') == apdev[0]['bssid']:
171 ap1 = apdev[0]
172 ap2 = apdev[1]
a8375c94
JM		 173 hapd1ap = hapd0
174 hapd2ap = hapd1
cd7f1b9a
JM		 175 else:
176 ap1 = apdev[1]
177 ap2 = apdev[0]
a8375c94
JM		 178 hapd1ap = hapd1
179 hapd2ap = hapd0
fd7205fa 180 if test_connectivity:
9c50a6d3
MB		 181 if conndev:
182 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
183 else:
184 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 185
655bc8bf 186 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 187
188 for i in range(0, roams):
e0382291
MB		 189 # Roaming artificially fast can make data test fail because the key is
190 # set later.
191 time.sleep(0.01)
40602101
JM		 192 logger.info("Roam to the second AP")
193 if over_ds:
194 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
195 else:
196 dev.roam(ap2['bssid'], fail_test=fail_test)
197 if fail_test:
198 return
199 if dev.get_status_field('bssid') != ap2['bssid']:
200 raise Exception("Did not connect to correct AP")
fd7205fa 201 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 202 if conndev:
203 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
204 else:
205 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 206
e0382291
MB		 207 # Roaming artificially fast can make data test fail because the key is
208 # set later.
209 time.sleep(0.01)
40602101
JM		 210 logger.info("Roam back to the first AP")
211 if over_ds:
212 dev.roam_over_ds(ap1['bssid'])
213 else:
214 dev.roam(ap1['bssid'])
215 if dev.get_status_field('bssid') != ap1['bssid']:
216 raise Exception("Did not connect to correct AP")
fd7205fa 217 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 218 if conndev:
219 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
220 else:
221 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 222
223def test_ap_ft(dev, apdev):
224 """WPA2-PSK-FT AP"""
225 ssid = "test-ft"
226 passphrase="12345678"
227
228 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 229 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 230 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 231 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 232
a8375c94 233 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 234 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
235 raise Exception("Scan results missing RSN element info")
cd7f1b9a 236
c95dd8e4
JM		 237def test_ap_ft_old_key(dev, apdev):
238 """WPA2-PSK-FT AP (old key)"""
239 ssid = "test-ft"
240 passphrase="12345678"
241
242 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
243 hapd0 = hostapd.add_ap(apdev[0], params)
244 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
245 hapd1 = hostapd.add_ap(apdev[1], params)
246
247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
248
e4612f84
JM		 249def test_ap_ft_multi_akm(dev, apdev):
250 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
251 ssid = "test-ft"
252 passphrase="12345678"
253
254 params = ft_params1(ssid=ssid, passphrase=passphrase)
255 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
256 hapd0 = hostapd.add_ap(apdev[0], params)
257 params = ft_params2(ssid=ssid, passphrase=passphrase)
258 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
259 hapd1 = hostapd.add_ap(apdev[1], params)
260
261 Wlantest.setup(hapd0)
262 wt = Wlantest()
263 wt.flush()
264 wt.add_passphrase(passphrase)
265
266 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
267 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
268 raise Exception("Scan results missing RSN element info")
269 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
270 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
271 scan_freq="2412")
272
d0175d6e
MB		 273def test_ap_ft_local_key_gen(dev, apdev):
274 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
275 ssid = "test-ft"
276 passphrase="12345678"
277
278 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 279 params['ft_psk_generate_local'] = "1"
8344ba12 280 del params['pmk_r1_push']
b098542c 281 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 282 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 283 params['ft_psk_generate_local'] = "1"
8344ba12 284 del params['pmk_r1_push']
b098542c 285 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
289 raise Exception("Scan results missing RSN element info")
290
473e5176
MB		 291def test_ap_ft_vlan(dev, apdev):
292 """WPA2-PSK-FT AP with VLAN"""
293 ssid = "test-ft"
294 passphrase="12345678"
295
296 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 297 params['dynamic_vlan'] = "1"
298 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 299 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
300
301 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 302 params['dynamic_vlan'] = "1"
303 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 304 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
307 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309
310def test_ap_ft_vlan_disconnected(dev, apdev):
311 """WPA2-PSK-FT AP with VLAN and local key generation"""
312 ssid = "test-ft"
313 passphrase="12345678"
314
315 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 316 params['dynamic_vlan'] = "1"
317 params['accept_mac_file'] = "hostapd.accept"
318 params['ft_psk_generate_local'] = "1"
473e5176
MB		 319 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
320
321 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 322 params['dynamic_vlan'] = "1"
323 params['accept_mac_file'] = "hostapd.accept"
324 params['ft_psk_generate_local'] = "1"
473e5176
MB		 325 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
331def test_ap_ft_vlan_2(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
333 ssid = "test-ft"
334 passphrase="12345678"
335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 342 params['dynamic_vlan'] = "1"
473e5176
MB		 343 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
344
345 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
346 force_initial_conn_to_first_ap=True)
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
40602101
JM		 350def test_ap_ft_many(dev, apdev):
351 """WPA2-PSK-FT AP multiple times"""
352 ssid = "test-ft"
353 passphrase="12345678"
354
355 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 356 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 357 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 358 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 359
a8375c94 360 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 361
473e5176
MB		 362def test_ap_ft_many_vlan(dev, apdev):
363 """WPA2-PSK-FT AP with VLAN multiple times"""
364 ssid = "test-ft"
365 passphrase="12345678"
366
367 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 368 params['dynamic_vlan'] = "1"
369 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 370 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
371
372 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 373 params['dynamic_vlan'] = "1"
374 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 375 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
376
377 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
378 conndev="brvlan1")
379
cd7f1b9a
JM		 380def test_ap_ft_mixed(dev, apdev):
381 """WPA2-PSK-FT mixed-mode AP"""
382 ssid = "test-ft-mixed"
383 passphrase="12345678"
384
385 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 386 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 387 key_mgmt = hapd.get_config()['key_mgmt']
388 vals = key_mgmt.split(' ')
389 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
390 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 391 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 392 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 393
a8375c94 394 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 395
396def test_ap_ft_pmf(dev, apdev):
397 """WPA2-PSK-FT AP with PMF"""
398 ssid = "test-ft"
399 passphrase="12345678"
400
401 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 402 params["ieee80211w"] = "2"
8b8a1864 403 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 404 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 405 params["ieee80211w"] = "2"
8b8a1864 406 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 407
a8375c94 408 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 409
ffcaca68
JM		 410def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
411 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
412 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
413
414def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
415 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
416 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
417
418def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
419 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
420 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
421
422def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
423 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
424 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
425
426def run_ap_ft_pmf_bip(dev, apdev, cipher):
427 if cipher not in dev[0].get_capability("group_mgmt"):
428 raise HwsimSkip("Cipher %s not supported" % cipher)
429
430 ssid = "test-ft"
431 passphrase="12345678"
432
433 params = ft_params1(ssid=ssid, passphrase=passphrase)
434 params["ieee80211w"] = "2"
435 params["group_mgmt_cipher"] = cipher
436 hapd0 = hostapd.add_ap(apdev[0], params)
437 params = ft_params2(ssid=ssid, passphrase=passphrase)
438 params["ieee80211w"] = "2"
439 params["group_mgmt_cipher"] = cipher
440 hapd1 = hostapd.add_ap(apdev[1], params)
441
442 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
443 group_mgmt=cipher)
444
e63d8837
MV		 445def test_ap_ft_ocv(dev, apdev):
446 """WPA2-PSK-FT AP with OCV"""
447 ssid = "test-ft"
448 passphrase="12345678"
449
450 params = ft_params1(ssid=ssid, passphrase=passphrase)
451 params["ieee80211w"] = "2"
452 params["ocv"] = "1"
453 try:
454 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 455 except Exception as e:
e63d8837
MV		 456 if "Failed to set hostapd parameter ocv" in str(e):
457 raise HwsimSkip("OCV not supported")
458 raise
459 params = ft_params2(ssid=ssid, passphrase=passphrase)
460 params["ieee80211w"] = "2"
461 params["ocv"] = "1"
462 hapd1 = hostapd.add_ap(apdev[1], params)
463
464 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
465
b553eab1
JM		 466def test_ap_ft_over_ds(dev, apdev):
467 """WPA2-PSK-FT AP over DS"""
468 ssid = "test-ft"
469 passphrase="12345678"
470
471 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 472 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 473 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 474 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 475
a8375c94 476 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
eaf3f9b1
JM		 477 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
478 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
b553eab1 479
02a4ac0f
JM		 480def cleanup_ap_ft_separate_hostapd():
481 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
482 stderr=open('/dev/null', 'w'))
483 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
484 stderr=open('/dev/null', 'w'))
485 subprocess.call(["ip", "link", "del", "veth0"],
486 stderr=open('/dev/null', 'w'))
487 subprocess.call(["ip", "link", "del", "veth1"],
488 stderr=open('/dev/null', 'w'))
489 for ifname in [ 'br0ft', 'br1ft', 'br-ft' ]:
490 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
491 stderr=open('/dev/null', 'w'))
492 subprocess.call(['brctl', 'delbr', ifname],
493 stderr=open('/dev/null', 'w'))
494
495def test_ap_ft_separate_hostapd(dev, apdev, params):
496 """WPA2-PSK-FT AP and separate hostapd process"""
497 try:
498 run_ap_ft_separate_hostapd(dev, apdev, params, False)
499 finally:
500 cleanup_ap_ft_separate_hostapd()
501
502def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
503 """WPA2-PSK-FT AP over DS and separate hostapd process"""
504 try:
505 run_ap_ft_separate_hostapd(dev, apdev, params, True)
506 finally:
507 cleanup_ap_ft_separate_hostapd()
508
509def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
510 ssid = "test-ft"
511 passphrase="12345678"
512 logdir = params['logdir']
513 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
514 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
515 global_ctrl = '/var/run/hostapd-ft'
516 br_ifname = 'br-ft'
517
518 try:
519 subprocess.check_call(['brctl', 'addbr', br_ifname])
520 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
521 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
522
523 subprocess.check_call([ "ip", "link", "add", "veth0", "type", "veth",
524 "peer", "name", "veth0br" ])
525 subprocess.check_call([ "ip", "link", "add", "veth1", "type", "veth",
526 "peer", "name", "veth1br" ])
527 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
528 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
529 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
530 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
531
532 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
533 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
534 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
535 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
536 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
537 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
538 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
539 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
540 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
541 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
542 except subprocess.CalledProcessError:
543 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
544
545 with HWSimRadio() as (radio, iface):
546 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
547 if not os.path.exists(prg):
548 prg = '../../hostapd/hostapd'
549 cmd = [ prg, '-B', '-ddKt',
550 '-P', pidfile, '-f', logfile, '-g', global_ctrl ]
551 subprocess.check_call(cmd)
552
553 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
554 apdev_ft = { 'ifname': iface }
555 apdev2 = [ apdev_ft, apdev[1] ]
556
557 params = ft_params1(ssid=ssid, passphrase=passphrase)
558 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
559 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
560 params['bridge'] = 'br0ft'
561 hapd0 = hostapd.add_ap(apdev2[0], params,
562 global_ctrl_override=global_ctrl)
563 apdev2[0]['bssid'] = hapd0.own_addr()
564 params = ft_params2(ssid=ssid, passphrase=passphrase)
565 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
566 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
567 params['bridge'] = 'br1ft'
568 hapd1 = hostapd.add_ap(apdev2[1], params)
569
570 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
571 over_ds=over_ds, test_connectivity=False)
572
573 hglobal.terminate()
574
575 if os.path.exists(pidfile):
576 with open(pidfile, 'r') as f:
577 pid = int(f.read())
578 f.close()
579 os.kill(pid, signal.SIGTERM)
580
e63d8837
MV		 581def test_ap_ft_over_ds_ocv(dev, apdev):
582 """WPA2-PSK-FT AP over DS"""
583 ssid = "test-ft"
584 passphrase="12345678"
585
586 params = ft_params1(ssid=ssid, passphrase=passphrase)
587 params["ieee80211w"] = "2"
588 params["ocv"] = "1"
589 try:
590 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 591 except Exception as e:
e63d8837
MV		 592 if "Failed to set hostapd parameter ocv" in str(e):
593 raise HwsimSkip("OCV not supported")
594 raise
595 params = ft_params2(ssid=ssid, passphrase=passphrase)
596 params["ieee80211w"] = "2"
597 params["ocv"] = "1"
598 hapd1 = hostapd.add_ap(apdev[1], params)
599
600 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
601 ocv="1")
602
55139acb
JM		 603def test_ap_ft_over_ds_disabled(dev, apdev):
604 """WPA2-PSK-FT AP over DS disabled"""
605 ssid = "test-ft"
606 passphrase="12345678"
607
608 params = ft_params1(ssid=ssid, passphrase=passphrase)
609 params['ft_over_ds'] = '0'
610 hapd0 = hostapd.add_ap(apdev[0], params)
611 params = ft_params2(ssid=ssid, passphrase=passphrase)
612 params['ft_over_ds'] = '0'
613 hapd1 = hostapd.add_ap(apdev[1], params)
614
615 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
616 fail_test=True)
617
473e5176
MB		 618def test_ap_ft_vlan_over_ds(dev, apdev):
619 """WPA2-PSK-FT AP over DS with VLAN"""
620 ssid = "test-ft"
621 passphrase="12345678"
622
623 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 624 params['dynamic_vlan'] = "1"
625 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 626 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
627 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 628 params['dynamic_vlan'] = "1"
629 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 630 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
631
632 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
633 conndev="brvlan1")
634 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
635 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
636
40602101
JM		 637def test_ap_ft_over_ds_many(dev, apdev):
638 """WPA2-PSK-FT AP over DS multiple times"""
639 ssid = "test-ft"
640 passphrase="12345678"
641
642 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 643 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 644 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 645 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 646
a8375c94
JM		 647 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
648 roams=50)
40602101 649
473e5176
MB		 650def test_ap_ft_vlan_over_ds_many(dev, apdev):
651 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
652 ssid = "test-ft"
653 passphrase="12345678"
654
655 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 656 params['dynamic_vlan'] = "1"
657 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 658 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
659 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 660 params['dynamic_vlan'] = "1"
661 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 662 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
663
664 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
665 roams=50, conndev="brvlan1")
666
9fd6804d 667@remote_compatible
c337d07a
JM		 668def test_ap_ft_over_ds_unknown_target(dev, apdev):
669 """WPA2-PSK-FT AP"""
670 ssid = "test-ft"
671 passphrase="12345678"
672
673 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 674 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 675
676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
677 scan_freq="2412")
678 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
679
9fd6804d 680@remote_compatible
211bb7c5
JM		 681def test_ap_ft_over_ds_unexpected(dev, apdev):
682 """WPA2-PSK-FT AP over DS and unexpected response"""
683 ssid = "test-ft"
684 passphrase="12345678"
685
686 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 687 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 688 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 689 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 690
691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
692 scan_freq="2412")
693 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
694 ap1 = apdev[0]
695 ap2 = apdev[1]
696 hapd1ap = hapd0
697 hapd2ap = hapd1
698 else:
699 ap1 = apdev[1]
700 ap2 = apdev[0]
701 hapd1ap = hapd1
702 hapd2ap = hapd0
703
704 addr = dev[0].own_addr()
705 hapd1ap.set("ext_mgmt_frame_handling", "1")
706 logger.info("Foreign STA address")
707 msg = {}
708 msg['fc'] = 13 << 4
709 msg['da'] = addr
710 msg['sa'] = ap1['bssid']
711 msg['bssid'] = ap1['bssid']
712 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
713 hapd1ap.mgmt_tx(msg)
714
715 logger.info("No over-the-DS in progress")
716 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
717 hapd1ap.mgmt_tx(msg)
718
719 logger.info("Non-zero status code")
720 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
721 hapd1ap.mgmt_tx(msg)
722
723 hapd1ap.dump_monitor()
724
725 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
726 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
727 raise Exception("FT_DS failed")
728
729 req = hapd1ap.mgmt_rx()
730
731 logger.info("Foreign Target AP")
732 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
733 hapd1ap.mgmt_tx(msg)
734
735 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
736
737 logger.info("No IEs")
738 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
739 hapd1ap.mgmt_tx(msg)
740
741 logger.info("Invalid IEs (trigger parsing failure)")
742 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
743 hapd1ap.mgmt_tx(msg)
744
745 logger.info("Too short MDIE")
746 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
747 hapd1ap.mgmt_tx(msg)
748
749 logger.info("Mobility domain mismatch")
750 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
751 hapd1ap.mgmt_tx(msg)
752
753 logger.info("No FTIE")
754 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
755 hapd1ap.mgmt_tx(msg)
756
757 logger.info("FTIE SNonce mismatch")
758 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
759 hapd1ap.mgmt_tx(msg)
760
761 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 762 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 763 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
764 hapd1ap.mgmt_tx(msg)
765
766 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 767 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 768 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
769 hapd1ap.mgmt_tx(msg)
770
771 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 772 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 773 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
774 hapd1ap.mgmt_tx(msg)
775
776 logger.info("No RSNE")
7ab74770 777 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 778 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
779 hapd1ap.mgmt_tx(msg)
780
b553eab1
JM		 781def test_ap_ft_pmf_over_ds(dev, apdev):
782 """WPA2-PSK-FT AP over DS with PMF"""
783 ssid = "test-ft"
784 passphrase="12345678"
785
786 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 787 params["ieee80211w"] = "2"
8b8a1864 788 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 789 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 790 params["ieee80211w"] = "2"
8b8a1864 791 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 792
46b8ea21
JM		 793 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
794
ffcaca68
JM		 795def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
796 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
797 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
798
799def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
800 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
801 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
802
803def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
804 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
805 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
806
807def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
808 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
809 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
810
811def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
812 if cipher not in dev[0].get_capability("group_mgmt"):
813 raise HwsimSkip("Cipher %s not supported" % cipher)
814
815 ssid = "test-ft"
816 passphrase="12345678"
817
818 params = ft_params1(ssid=ssid, passphrase=passphrase)
819 params["ieee80211w"] = "2"
820 params["group_mgmt_cipher"] = cipher
821 hapd0 = hostapd.add_ap(apdev[0], params)
822 params = ft_params2(ssid=ssid, passphrase=passphrase)
823 params["ieee80211w"] = "2"
824 params["group_mgmt_cipher"] = cipher
825 hapd1 = hostapd.add_ap(apdev[1], params)
826
827 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
828 group_mgmt=cipher)
6e658cc4 829
aaba98d3
JM		 830def test_ap_ft_over_ds_pull(dev, apdev):
831 """WPA2-PSK-FT AP over DS (pull PMK)"""
832 ssid = "test-ft"
833 passphrase="12345678"
834
835 params = ft_params1(ssid=ssid, passphrase=passphrase)
836 params["pmk_r1_push"] = "0"
8b8a1864 837 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 838 params = ft_params2(ssid=ssid, passphrase=passphrase)
839 params["pmk_r1_push"] = "0"
8b8a1864 840 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 841
a8375c94 842 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 843
c95dd8e4
JM		 844def test_ap_ft_over_ds_pull_old_key(dev, apdev):
845 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
846 ssid = "test-ft"
847 passphrase="12345678"
848
849 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
850 params["pmk_r1_push"] = "0"
851 hapd0 = hostapd.add_ap(apdev[0], params)
852 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
853 params["pmk_r1_push"] = "0"
854 hapd1 = hostapd.add_ap(apdev[1], params)
855
856 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
857
473e5176
MB		 858def test_ap_ft_over_ds_pull_vlan(dev, apdev):
859 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
860 ssid = "test-ft"
861 passphrase="12345678"
862
863 params = ft_params1(ssid=ssid, passphrase=passphrase)
864 params["pmk_r1_push"] = "0"
58be42b2
JM		 865 params['dynamic_vlan'] = "1"
866 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 867 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
868 params = ft_params2(ssid=ssid, passphrase=passphrase)
869 params["pmk_r1_push"] = "0"
58be42b2
JM		 870 params['dynamic_vlan'] = "1"
871 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 872 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
873
874 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
875 conndev="brvlan1")
876
6e658cc4
JM		 877def test_ap_ft_sae(dev, apdev):
878 """WPA2-PSK-FT-SAE AP"""
b9749b6a
JM		 879 if "SAE" not in dev[0].get_capability("auth_alg"):
880 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 881 ssid = "test-ft"
882 passphrase="12345678"
883
884 params = ft_params1(ssid=ssid, passphrase=passphrase)
885 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 886 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 887 params = ft_params2(ssid=ssid, passphrase=passphrase)
888 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 889 hapd = hostapd.add_ap(apdev[1], params)
65038313
JM		 890 key_mgmt = hapd.get_config()['key_mgmt']
891 if key_mgmt.split(' ')[0] != "FT-SAE":
892 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 893
17ffdf39 894 dev[0].request("SET sae_groups ")
a8375c94 895 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
6e658cc4
JM		 896
897def test_ap_ft_sae_over_ds(dev, apdev):
898 """WPA2-PSK-FT-SAE AP over DS"""
b9749b6a
JM		 899 if "SAE" not in dev[0].get_capability("auth_alg"):
900 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 901 ssid = "test-ft"
902 passphrase="12345678"
903
904 params = ft_params1(ssid=ssid, passphrase=passphrase)
905 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 906 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 907 params = ft_params2(ssid=ssid, passphrase=passphrase)
908 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 909 hapd1 = hostapd.add_ap(apdev[1], params)
6e658cc4 910
17ffdf39 911 dev[0].request("SET sae_groups ")
a8375c94
JM		 912 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
913 over_ds=True)
6f62809b 914
3d5b88b5
JM		 915def test_ap_ft_sae_pw_id(dev, apdev):
916 """FT-SAE with Password Identifier"""
917 if "SAE" not in dev[0].get_capability("auth_alg"):
918 raise HwsimSkip("SAE not supported")
919 ssid = "test-ft"
920
921 params = ft_params1(ssid=ssid)
922 params["ieee80211w"] = "2"
923 params['wpa_key_mgmt'] = "FT-SAE"
924 params['sae_password'] = 'secret|id=pwid'
925 hapd0 = hostapd.add_ap(apdev[0], params)
926 params = ft_params2(ssid=ssid)
927 params["ieee80211w"] = "2"
928 params['wpa_key_mgmt'] = "FT-SAE"
929 params['sae_password'] = 'secret|id=pwid'
930 hapd = hostapd.add_ap(apdev[1], params)
931
932 dev[0].request("SET sae_groups ")
933 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
934 sae_password="secret", sae_password_id="pwid")
935
d269740a
MB		 936def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
937 discovery=False, roams=1):
6f62809b
JM		 938 ssid = "test-ft"
939 passphrase="12345678"
9c50a6d3
MB		 940 if vlan:
941 identity="gpsk-vlan1"
942 conndev="brvlan1"
d269740a
MB		 943 elif cui:
944 identity="gpsk-cui"
945 conndev=False
9c50a6d3
MB		 946 else:
947 identity="gpsk user"
948 conndev=False
6f62809b
JM		 949
950 radius = hostapd.radius_params()
942b52a8 951 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 952 params['wpa_key_mgmt'] = "FT-EAP"
953 params["ieee8021x"] = "1"
9c50a6d3
MB		 954 if vlan:
955 params["dynamic_vlan"] = "1"
35d8c254 956 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 957 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 958 key_mgmt = hapd.get_config()['key_mgmt']
959 if key_mgmt.split(' ')[0] != "FT-EAP":
960 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 961 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 962 params['wpa_key_mgmt'] = "FT-EAP"
963 params["ieee8021x"] = "1"
9c50a6d3
MB		 964 if vlan:
965 params["dynamic_vlan"] = "1"
35d8c254 966 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 967 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 968
942b52a8 969 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3
MB		 970 over_ds=over_ds, roams=roams, eap_identity=identity,
971 conndev=conndev)
91bc6c36
JM		 972 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
973 raise Exception("Scan results missing RSN element info")
eaf3f9b1
JM		 974 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
975 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
aaba98d3 976
4013d688
JM		 977 # Verify EAPOL reauthentication after FT protocol
978 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
979 ap = hapd
980 else:
981 ap = hapd1
982 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
983 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
984 if ev is None:
985 raise Exception("EAP authentication did not start")
986 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
987 if ev is None:
988 raise Exception("EAP authentication did not succeed")
989 time.sleep(0.1)
9c50a6d3
MB		 990 if conndev:
991 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
992 else:
993 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 994
942b52a8
MB		 995def test_ap_ft_eap(dev, apdev):
996 """WPA2-EAP-FT AP"""
997 generic_ap_ft_eap(dev, apdev)
998
d269740a
MB		 999def test_ap_ft_eap_cui(dev, apdev):
1000 """WPA2-EAP-FT AP with CUI"""
1001 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
1002
9c50a6d3
MB		 1003def test_ap_ft_eap_vlan(dev, apdev):
1004 """WPA2-EAP-FT AP with VLAN"""
1005 generic_ap_ft_eap(dev, apdev, vlan=True)
1006
1007def test_ap_ft_eap_vlan_multi(dev, apdev):
1008 """WPA2-EAP-FT AP with VLAN"""
1009 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1010
942b52a8
MB		 1011def test_ap_ft_eap_over_ds(dev, apdev):
1012 """WPA2-EAP-FT AP using over-the-DS"""
1013 generic_ap_ft_eap(dev, apdev, over_ds=True)
1014
1015def test_ap_ft_eap_dis(dev, apdev):
1016 """WPA2-EAP-FT AP with AP discovery"""
1017 generic_ap_ft_eap(dev, apdev, discovery=True)
1018
1019def test_ap_ft_eap_dis_over_ds(dev, apdev):
1020 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1021 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1022
9c50a6d3
MB		 1023def test_ap_ft_eap_vlan(dev, apdev):
1024 """WPA2-EAP-FT AP with VLAN"""
1025 generic_ap_ft_eap(dev, apdev, vlan=True)
1026
1027def test_ap_ft_eap_vlan_multi(dev, apdev):
1028 """WPA2-EAP-FT AP with VLAN"""
1029 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1030
1031def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1032 """WPA2-EAP-FT AP with VLAN + over_ds"""
1033 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1034
1035def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1036 """WPA2-EAP-FT AP with VLAN + over_ds"""
1037 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1038
1039def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1040 """WPA2-EAP-FT AP (pull PMK)"""
1041 ssid = "test-ft"
1042 passphrase="12345678"
9c50a6d3
MB		 1043 if vlan:
1044 identity="gpsk-vlan1"
1045 conndev="brvlan1"
1046 else:
1047 identity="gpsk user"
1048 conndev=False
aaba98d3
JM		 1049
1050 radius = hostapd.radius_params()
1051 params = ft_params1(ssid=ssid, passphrase=passphrase)
1052 params['wpa_key_mgmt'] = "FT-EAP"
1053 params["ieee8021x"] = "1"
1054 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1055 if vlan:
1056 params["dynamic_vlan"] = "1"
35d8c254 1057 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1058 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1059 key_mgmt = hapd.get_config()['key_mgmt']
1060 if key_mgmt.split(' ')[0] != "FT-EAP":
1061 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1062 params = ft_params2(ssid=ssid, passphrase=passphrase)
1063 params['wpa_key_mgmt'] = "FT-EAP"
1064 params["ieee8021x"] = "1"
1065 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1066 if vlan:
1067 params["dynamic_vlan"] = "1"
35d8c254 1068 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1069 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1070
9c50a6d3
MB		 1071 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1072 eap_identity=identity, conndev=conndev)
1073
1074def test_ap_ft_eap_pull(dev, apdev):
1075 """WPA2-EAP-FT AP (pull PMK)"""
1076 generic_ap_ft_eap_pull(dev, apdev)
1077
1078def test_ap_ft_eap_pull_vlan(dev, apdev):
1079 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1080
f81c1411
JM		 1081def test_ap_ft_eap_pull_wildcard(dev, apdev):
1082 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1083 ssid = "test-ft"
1084 passphrase="12345678"
1085
1086 radius = hostapd.radius_params()
1087 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1088 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1089 params["ieee8021x"] = "1"
1090 params["pmk_r1_push"] = "0"
1091 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1092 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1093 params["ft_psk_generate_local"] = "1"
1094 params["eap_server"] = "0"
35d8c254 1095 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1096 hapd = hostapd.add_ap(apdev[0], params)
1097 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1098 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1099 params["ieee8021x"] = "1"
1100 params["pmk_r1_push"] = "0"
1101 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1102 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1103 params["ft_psk_generate_local"] = "1"
1104 params["eap_server"] = "0"
35d8c254 1105 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1106 hapd1 = hostapd.add_ap(apdev[1], params)
1107
1108 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1109
9fd6804d 1110@remote_compatible
3b808945
JM		 1111def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1112 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1113 ssid = "test-ft"
1114 passphrase="12345678"
1115
1116 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1117 params["ieee80211w"] = "2"
8b8a1864 1118 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1119 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1120 params["ieee80211w"] = "2"
8b8a1864 1121 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1122
a8375c94
JM		 1123 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1124 fail_test=True)
3b808945 1125
9fd6804d 1126@remote_compatible
3b808945
JM		 1127def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1128 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1129 ssid = "test-ft"
1130 passphrase="12345678"
1131
1132 params = ft_params1(ssid=ssid, passphrase=passphrase)
1133 params["pmk_r1_push"] = "0"
8b8a1864 1134 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1135 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1136 params["pmk_r1_push"] = "0"
8b8a1864 1137 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1138
a8375c94
JM		 1139 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1140 fail_test=True)
3b808945 1141
9fd6804d 1142@remote_compatible
ae14a2e2
JM		 1143def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1144 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1145 ssid = "test-ft"
1146 passphrase="12345678"
1147
1148 params = ft_params1(ssid=ssid, passphrase=passphrase)
1149 params["pmk_r1_push"] = "0"
1150 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1151 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1152 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1153 scan_freq="2412")
ae14a2e2
JM		 1154
1155 params = ft_params2(ssid=ssid, passphrase=passphrase)
1156 params["pmk_r1_push"] = "0"
8b8a1864 1157 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1158
1159 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1160 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1161
9fd6804d 1162@remote_compatible
3b808945
JM		 1163def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1164 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1165 ssid = "test-ft"
1166 passphrase="12345678"
1167
1168 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1169 params["ieee80211w"] = "2"
8b8a1864 1170 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1171 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1172 params["ieee80211w"] = "2"
8b8a1864 1173 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1174
a8375c94
JM		 1175 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1176 fail_test=True)
3b808945 1177
9fd6804d 1178@remote_compatible
3b808945
JM		 1179def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1180 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1181 ssid = "test-ft"
1182 passphrase="12345678"
1183
1184 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1185 params["pmk_r1_push"] = "0"
8b8a1864 1186 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1187 params = ft_params2(ssid=ssid, passphrase=passphrase)
1188 params["pmk_r1_push"] = "0"
8b8a1864 1189 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1190
a8375c94
JM		 1191 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1192 fail_test=True)
c6b6e105 1193
150948e6
MB		 1194def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1195 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1196 ssid = "test-ft"
1197 passphrase="12345678"
1198
1199 radius = hostapd.radius_params()
1200 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1201 params["ieee80211w"] = "2"
150948e6
MB		 1202 params['wpa_key_mgmt'] = "FT-EAP"
1203 params["ieee8021x"] = "1"
35d8c254 1204 params = dict(list(radius.items()) + list(params.items()))
b098542c 1205 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1206 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1207 params["ieee80211w"] = "2"
150948e6
MB		 1208 params['wpa_key_mgmt'] = "FT-EAP"
1209 params["ieee8021x"] = "1"
35d8c254 1210 params = dict(list(radius.items()) + list(params.items()))
b098542c 1211 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1212
1213 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1214 fail_test=True, eap=True)
1215
1216def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1217 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1218 ssid = "test-ft"
1219 passphrase="12345678"
1220
1221 radius = hostapd.radius_params()
1222 params = ft_params1(ssid=ssid, passphrase=passphrase)
1223 params["pmk_r1_push"] = "0"
1224 params['wpa_key_mgmt'] = "FT-EAP"
1225 params["ieee8021x"] = "1"
35d8c254 1226 params = dict(list(radius.items()) + list(params.items()))
b098542c 1227 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1228 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1229 params["pmk_r1_push"] = "0"
1230 params['wpa_key_mgmt'] = "FT-EAP"
1231 params["ieee8021x"] = "1"
35d8c254 1232 params = dict(list(radius.items()) + list(params.items()))
b098542c 1233 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1234
1235 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1236 fail_test=True, eap=True)
1237
1238def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1239 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1240 ssid = "test-ft"
1241 passphrase="12345678"
1242
1243 radius = hostapd.radius_params()
1244 params = ft_params1(ssid=ssid, passphrase=passphrase)
1245 params["pmk_r1_push"] = "0"
1246 params["nas_identifier"] = "nas0.w1.fi"
1247 params['wpa_key_mgmt'] = "FT-EAP"
1248 params["ieee8021x"] = "1"
35d8c254 1249 params = dict(list(radius.items()) + list(params.items()))
b098542c 1250 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1251 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1252 eap="GPSK", identity="gpsk user",
1253 password="abcdefghijklmnop0123456789abcdef",
1254 scan_freq="2412")
1255
1256 params = ft_params2(ssid=ssid, passphrase=passphrase)
1257 params["pmk_r1_push"] = "0"
1258 params['wpa_key_mgmt'] = "FT-EAP"
1259 params["ieee8021x"] = "1"
35d8c254 1260 params = dict(list(radius.items()) + list(params.items()))
b098542c 1261 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1262
1263 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1264 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1265
1266def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1267 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1268 ssid = "test-ft"
1269 passphrase="12345678"
1270
1271 radius = hostapd.radius_params()
1272 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1273 params["ieee80211w"] = "2"
150948e6
MB		 1274 params['wpa_key_mgmt'] = "FT-EAP"
1275 params["ieee8021x"] = "1"
35d8c254 1276 params = dict(list(radius.items()) + list(params.items()))
b098542c 1277 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1278 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1279 params["ieee80211w"] = "2"
150948e6
MB		 1280 params['wpa_key_mgmt'] = "FT-EAP"
1281 params["ieee8021x"] = "1"
35d8c254 1282 params = dict(list(radius.items()) + list(params.items()))
b098542c 1283 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1284
1285 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1286 fail_test=True, eap=True)
1287
1288def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1289 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1290 ssid = "test-ft"
1291 passphrase="12345678"
1292
1293 radius = hostapd.radius_params()
1294 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1295 params["pmk_r1_push"] = "0"
1296 params['wpa_key_mgmt'] = "FT-EAP"
1297 params["ieee8021x"] = "1"
35d8c254 1298 params = dict(list(radius.items()) + list(params.items()))
b098542c 1299 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1300 params = ft_params2(ssid=ssid, passphrase=passphrase)
1301 params["pmk_r1_push"] = "0"
1302 params['wpa_key_mgmt'] = "FT-EAP"
1303 params["ieee8021x"] = "1"
35d8c254 1304 params = dict(list(radius.items()) + list(params.items()))
b098542c 1305 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1306
1307 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1308 fail_test=True, eap=True)
1309
c6b6e105
JM		 1310def test_ap_ft_gtk_rekey(dev, apdev):
1311 """WPA2-PSK-FT AP and GTK rekey"""
1312 ssid = "test-ft"
1313 passphrase="12345678"
1314
1315 params = ft_params1(ssid=ssid, passphrase=passphrase)
1316 params['wpa_group_rekey'] = '1'
8b8a1864 1317 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1318
1319 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1320 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1321
1322 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1323 if ev is None:
1324 raise Exception("GTK rekey timed out after initial association")
a8375c94 1325 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1326
1327 params = ft_params2(ssid=ssid, passphrase=passphrase)
1328 params['wpa_group_rekey'] = '1'
8b8a1864 1329 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1330
1331 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1332 dev[0].roam(apdev[1]['bssid'])
1333 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1334 raise Exception("Did not connect to correct AP")
a8375c94 1335 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1336
1337 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1338 if ev is None:
1339 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1340 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1341
1342def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1343 """WPA2-PSK-FT and key lifetime in memory"""
1344 ssid = "test-ft"
1345 passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1346 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1347 pmk = binascii.unhexlify(psk)
1348 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1349 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1350 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1351 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1352
1353 pid = find_wpas_process(dev[0])
1354
1355 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1356 scan_freq="2412")
8e416cec
JM		 1357 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1358 # event has been delivered, so verify that wpa_supplicant has returned to
1359 # eloop before reading process memory.
54f2cae2 1360 time.sleep(1)
8e416cec 1361 dev[0].ping()
5b3c40a6
JM		 1362
1363 buf = read_process_memory(pid, pmk)
1364
1365 dev[0].request("DISCONNECT")
1366 dev[0].wait_disconnected()
1367
1368 dev[0].relog()
1369 pmkr0 = None
1370 pmkr1 = None
1371 ptk = None
1372 gtk = None
1373 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1374 for l in f.readlines():
1375 if "FT: PMK-R0 - hexdump" in l:
1376 val = l.strip().split(':')[3].replace(' ', '')
1377 pmkr0 = binascii.unhexlify(val)
1378 if "FT: PMK-R1 - hexdump" in l:
1379 val = l.strip().split(':')[3].replace(' ', '')
1380 pmkr1 = binascii.unhexlify(val)
f918b95b 1381 if "FT: KCK - hexdump" in l:
5b3c40a6 1382 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1383 kck = binascii.unhexlify(val)
1384 if "FT: KEK - hexdump" in l:
1385 val = l.strip().split(':')[3].replace(' ', '')
1386 kek = binascii.unhexlify(val)
1387 if "FT: TK - hexdump" in l:
1388 val = l.strip().split(':')[3].replace(' ', '')
1389 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1390 if "WPA: Group Key - hexdump" in l:
1391 val = l.strip().split(':')[3].replace(' ', '')
1392 gtk = binascii.unhexlify(val)
f918b95b 1393 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1394 raise Exception("Could not find keys from debug log")
1395 if len(gtk) != 16:
1396 raise Exception("Unexpected GTK length")
1397
5b3c40a6
JM		 1398 logger.info("Checking keys in memory while associated")
1399 get_key_locations(buf, pmk, "PMK")
1400 get_key_locations(buf, pmkr0, "PMK-R0")
1401 get_key_locations(buf, pmkr1, "PMK-R1")
1402 if pmk not in buf:
81e787b7 1403 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1404 if pmkr0 not in buf:
81e787b7 1405 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1406 if pmkr1 not in buf:
81e787b7 1407 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1408 if kck not in buf:
1409 raise Exception("KCK not found while associated")
1410 if kek not in buf:
1411 raise Exception("KEK not found while associated")
b74f82a4
JM		 1412 #if tk in buf:
1413 # raise Exception("TK found from memory")
5b3c40a6
JM		 1414
1415 logger.info("Checking keys in memory after disassociation")
1416 buf = read_process_memory(pid, pmk)
1417 get_key_locations(buf, pmk, "PMK")
1418 get_key_locations(buf, pmkr0, "PMK-R0")
1419 get_key_locations(buf, pmkr1, "PMK-R1")
1420
1421 # Note: PMK/PSK is still present in network configuration
1422
1423 fname = os.path.join(params['logdir'],
1424 'ft_psk_key_lifetime_in_memory.memctx-')
1425 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1426 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1427 verify_not_present(buf, kck, fname, "KCK")
1428 verify_not_present(buf, kek, fname, "KEK")
1429 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1430 if gtk in buf:
1431 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1432 verify_not_present(buf, gtk, fname, "GTK")
1433
1434 dev[0].request("REMOVE_NETWORK all")
1435
1436 logger.info("Checking keys in memory after network profile removal")
1437 buf = read_process_memory(pid, pmk)
1438 get_key_locations(buf, pmk, "PMK")
1439 get_key_locations(buf, pmkr0, "PMK-R0")
1440 get_key_locations(buf, pmkr1, "PMK-R1")
1441
1442 verify_not_present(buf, pmk, fname, "PMK")
1443 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1444 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1445 verify_not_present(buf, kck, fname, "KCK")
1446 verify_not_present(buf, kek, fname, "KEK")
1447 verify_not_present(buf, tk, fname, "TK")
1448 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1449
9fd6804d 1450@remote_compatible
664093b5
JM		 1451def test_ap_ft_invalid_resp(dev, apdev):
1452 """WPA2-PSK-FT AP and invalid response IEs"""
1453 ssid = "test-ft"
1454 passphrase="12345678"
1455
1456 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1457 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1458 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1459 scan_freq="2412")
1460
1461 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1462 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1463
1464 tests = [
1465 # Various IEs for test coverage. The last one is FTIE with invalid
1466 # R1KH-ID subelement.
1467 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1468 # FTIE with invalid R0KH-ID subelement (len=0).
1469 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1470 # FTIE with invalid R0KH-ID subelement (len=49).
1471 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1472 # Invalid RSNE.
1473 "020002000000" + "3000",
1474 # Required IEs missing from protected IE count.
1475 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1476 # RIC missing from protected IE count.
1477 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1478 # Protected IE missing.
1479 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1480 for t in tests:
1481 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1482 hapd1.set("ext_mgmt_frame_handling", "1")
1483 hapd1.dump_monitor()
1484 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1485 raise Exception("ROAM failed")
1486 auth = None
1487 for i in range(20):
1488 msg = hapd1.mgmt_rx()
1489 if msg['subtype'] == 11:
1490 auth = msg
1491 break
1492 if not auth:
1493 raise Exception("Authentication frame not seen")
1494
1495 resp = {}
1496 resp['fc'] = auth['fc']
1497 resp['da'] = auth['sa']
1498 resp['sa'] = auth['da']
1499 resp['bssid'] = auth['bssid']
1500 resp['payload'] = binascii.unhexlify(t)
1501 hapd1.mgmt_tx(resp)
1502 hapd1.set("ext_mgmt_frame_handling", "0")
1503 dev[0].wait_disconnected()
1504
1505 dev[0].request("RECONNECT")
1506 dev[0].wait_connected()
7b741a53
JM		 1507
1508def test_ap_ft_gcmp_256(dev, apdev):
1509 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1510 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1511 raise HwsimSkip("Cipher GCMP-256 not supported")
1512 ssid = "test-ft"
1513 passphrase="12345678"
1514
1515 params = ft_params1(ssid=ssid, passphrase=passphrase)
1516 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1517 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1518 params = ft_params2(ssid=ssid, passphrase=passphrase)
1519 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1520 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1521
1522 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1523 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1524
63a7683b 1525def setup_ap_ft_oom(dev, apdev):
38934ed1 1526 skip_with_fips(dev[0])
cf671d54
JM		 1527 ssid = "test-ft"
1528 passphrase="12345678"
1529
1530 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1531 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1532 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1533 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1534
1535 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1536 scan_freq="2412")
1537 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1538 dst = apdev[1]['bssid']
1539 else:
1540 dst = apdev[0]['bssid']
1541
1542 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1543
1544 return dst
1545
1546def test_ap_ft_oom(dev, apdev):
1547 """WPA2-PSK-FT and OOM"""
1548 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1549 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1550 dev[0].roam(dst)
63a7683b
JM		 1551
1552def test_ap_ft_oom2(dev, apdev):
1553 """WPA2-PSK-FT and OOM (2)"""
1554 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1555 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1556 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1557
1558def test_ap_ft_oom3(dev, apdev):
1559 """WPA2-PSK-FT and OOM (3)"""
1560 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1561 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1562 dev[0].roam(dst)
34d3eaa8 1563
63a7683b
JM		 1564def test_ap_ft_oom4(dev, apdev):
1565 """WPA2-PSK-FT and OOM (4)"""
1566 ssid = "test-ft"
1567 passphrase="12345678"
1568 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1569 dev[0].request("REMOVE_NETWORK all")
1570 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1571 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1572 scan_freq="2412")
1573
682a79f0
JM		 1574def test_ap_ft_ap_oom(dev, apdev):
1575 """WPA2-PSK-FT and AP OOM"""
1576 ssid = "test-ft"
1577 passphrase="12345678"
1578
1579 params = ft_params1(ssid=ssid, passphrase=passphrase)
1580 hapd0 = hostapd.add_ap(apdev[0], params)
1581 bssid0 = hapd0.own_addr()
1582
1583 dev[0].scan_for_bss(bssid0, freq="2412")
1584 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1585 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1586 scan_freq="2412")
1587
1588 params = ft_params2(ssid=ssid, passphrase=passphrase)
1589 hapd1 = hostapd.add_ap(apdev[1], params)
1590 bssid1 = hapd1.own_addr()
1591 dev[0].scan_for_bss(bssid1, freq="2412")
1592 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1593 dev[0].roam(bssid1)
1594
1595def test_ap_ft_ap_oom2(dev, apdev):
1596 """WPA2-PSK-FT and AP OOM 2"""
1597 ssid = "test-ft"
1598 passphrase="12345678"
1599
1600 params = ft_params1(ssid=ssid, passphrase=passphrase)
1601 hapd0 = hostapd.add_ap(apdev[0], params)
1602 bssid0 = hapd0.own_addr()
1603
1604 dev[0].scan_for_bss(bssid0, freq="2412")
1605 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1606 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1607 scan_freq="2412")
1608
1609 params = ft_params2(ssid=ssid, passphrase=passphrase)
1610 hapd1 = hostapd.add_ap(apdev[1], params)
1611 bssid1 = hapd1.own_addr()
1612 dev[0].scan_for_bss(bssid1, freq="2412")
1613 dev[0].roam(bssid1)
1614 if dev[0].get_status_field('bssid') != bssid1:
1615 raise Exception("Did not roam to AP1")
1616 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1617 dev[0].roam(bssid0)
1618
1619def test_ap_ft_ap_oom3(dev, apdev):
1620 """WPA2-PSK-FT and AP OOM 3"""
1621 ssid = "test-ft"
1622 passphrase="12345678"
1623
1624 params = ft_params1(ssid=ssid, passphrase=passphrase)
1625 hapd0 = hostapd.add_ap(apdev[0], params)
1626 bssid0 = hapd0.own_addr()
1627
1628 dev[0].scan_for_bss(bssid0, freq="2412")
1629 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1630 scan_freq="2412")
1631
1632 params = ft_params2(ssid=ssid, passphrase=passphrase)
1633 hapd1 = hostapd.add_ap(apdev[1], params)
1634 bssid1 = hapd1.own_addr()
1635 dev[0].scan_for_bss(bssid1, freq="2412")
1636 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1637 # This will fail due to not being able to send out PMK-R1 pull request
1638 dev[0].roam(bssid1)
1639
ba88dd65 1640 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1641 # This will fail due to not being able to send out PMK-R1 pull request
1642 dev[0].roam(bssid1)
1643
ba88dd65
MB		 1644 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1645 # This will fail due to not being able to send out PMK-R1 pull request
1646 dev[0].roam(bssid1)
1647
1648def test_ap_ft_ap_oom3b(dev, apdev):
1649 """WPA2-PSK-FT and AP OOM 3b"""
1650 ssid = "test-ft"
1651 passphrase="12345678"
1652
1653 params = ft_params1(ssid=ssid, passphrase=passphrase)
1654 hapd0 = hostapd.add_ap(apdev[0], params)
1655 bssid0 = hapd0.own_addr()
1656
1657 dev[0].scan_for_bss(bssid0, freq="2412")
1658 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1659 scan_freq="2412")
1660
1661 params = ft_params2(ssid=ssid, passphrase=passphrase)
1662 hapd1 = hostapd.add_ap(apdev[1], params)
1663 bssid1 = hapd1.own_addr()
1664 dev[0].scan_for_bss(bssid1, freq="2412")
1665 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1666 # This will fail due to not being able to send out PMK-R1 pull request
1667 dev[0].roam(bssid1)
1668
1669def test_ap_ft_ap_oom4(dev, apdev):
1670 """WPA2-PSK-FT and AP OOM 4"""
1671 ssid = "test-ft"
1672 passphrase="12345678"
1673
1674 params = ft_params1(ssid=ssid, passphrase=passphrase)
1675 hapd0 = hostapd.add_ap(apdev[0], params)
1676 bssid0 = hapd0.own_addr()
1677
1678 dev[0].scan_for_bss(bssid0, freq="2412")
1679 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1680 scan_freq="2412")
1681
1682 params = ft_params2(ssid=ssid, passphrase=passphrase)
1683 hapd1 = hostapd.add_ap(apdev[1], params)
1684 bssid1 = hapd1.own_addr()
1685 dev[0].scan_for_bss(bssid1, freq="2412")
1686 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1687 dev[0].roam(bssid1)
1688 if dev[0].get_status_field('bssid') != bssid1:
1689 raise Exception("Did not roam to AP1")
1690
1691 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1692 dev[0].roam(bssid0)
1693 if dev[0].get_status_field('bssid') != bssid0:
1694 raise Exception("Did not roam to AP0")
1695
1696 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1697 dev[0].roam(bssid1)
1698 if dev[0].get_status_field('bssid') != bssid1:
1699 raise Exception("Did not roam to AP1")
1700
1701def test_ap_ft_ap_oom5(dev, apdev):
1702 """WPA2-PSK-FT and AP OOM 5"""
1703 ssid = "test-ft"
1704 passphrase="12345678"
1705
1706 params = ft_params1(ssid=ssid, passphrase=passphrase)
1707 hapd0 = hostapd.add_ap(apdev[0], params)
1708 bssid0 = hapd0.own_addr()
1709
1710 dev[0].scan_for_bss(bssid0, freq="2412")
1711 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1712 scan_freq="2412")
1713
1714 params = ft_params2(ssid=ssid, passphrase=passphrase)
1715 hapd1 = hostapd.add_ap(apdev[1], params)
1716 bssid1 = hapd1.own_addr()
1717 dev[0].scan_for_bss(bssid1, freq="2412")
1718 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1719 # This will fail to roam
1720 dev[0].roam(bssid1)
1721
1722 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1723 # This will fail to roam
1724 dev[0].roam(bssid1)
1725
1726 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1727 # This will fail to roam
1728 dev[0].roam(bssid1)
1729
1730 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1731 # This will fail to roam
1732 dev[0].roam(bssid1)
1733
1734 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1735 # This will fail to roam
1736 dev[0].roam(bssid1)
1737
1738def test_ap_ft_ap_oom6(dev, apdev):
1739 """WPA2-PSK-FT and AP OOM 6"""
1740 ssid = "test-ft"
1741 passphrase="12345678"
1742
1743 params = ft_params1(ssid=ssid, passphrase=passphrase)
1744 hapd0 = hostapd.add_ap(apdev[0], params)
1745 bssid0 = hapd0.own_addr()
1746
1747 dev[0].scan_for_bss(bssid0, freq="2412")
1748 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1749 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1750 scan_freq="2412")
1751 dev[0].request("REMOVE_NETWORK all")
1752 dev[0].wait_disconnected()
1753 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1754 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1755 scan_freq="2412")
1756 dev[0].request("REMOVE_NETWORK all")
1757 dev[0].wait_disconnected()
1758 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1759 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1760 scan_freq="2412")
1761
c5262648
JM		 1762def test_ap_ft_ap_oom7a(dev, apdev):
1763 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0
JM		 1764 ssid = "test-ft"
1765 passphrase="12345678"
1766
1767 params = ft_params1(ssid=ssid, passphrase=passphrase)
1768 params["ieee80211w"] = "2"
1769 hapd0 = hostapd.add_ap(apdev[0], params)
1770 bssid0 = hapd0.own_addr()
1771
1772 dev[0].scan_for_bss(bssid0, freq="2412")
1773 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1774 ieee80211w="2", scan_freq="2412")
1775
1776 params = ft_params2(ssid=ssid, passphrase=passphrase)
1777 params["ieee80211w"] = "2"
1778 hapd1 = hostapd.add_ap(apdev[1], params)
1779 bssid1 = hapd1.own_addr()
1780 dev[0].scan_for_bss(bssid1, freq="2412")
1781 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1782 # This will fail to roam
1783 dev[0].roam(bssid1)
c5262648
JM		 1784
1785def test_ap_ft_ap_oom7b(dev, apdev):
1786 """WPA2-PSK-FT and AP OOM 7b"""
1787 ssid = "test-ft"
1788 passphrase="12345678"
1789
1790 params = ft_params1(ssid=ssid, passphrase=passphrase)
1791 params["ieee80211w"] = "2"
1792 hapd0 = hostapd.add_ap(apdev[0], params)
1793 bssid0 = hapd0.own_addr()
1794
1795 dev[0].scan_for_bss(bssid0, freq="2412")
1796 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1797 ieee80211w="2", scan_freq="2412")
1798
1799 params = ft_params2(ssid=ssid, passphrase=passphrase)
1800 params["ieee80211w"] = "2"
1801 hapd1 = hostapd.add_ap(apdev[1], params)
1802 bssid1 = hapd1.own_addr()
1803 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1804 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1805 # This will fail to roam
1806 dev[0].roam(bssid1)
c5262648
JM		 1807
1808def test_ap_ft_ap_oom7c(dev, apdev):
1809 """WPA2-PSK-FT and AP OOM 7c"""
1810 ssid = "test-ft"
1811 passphrase="12345678"
1812
1813 params = ft_params1(ssid=ssid, passphrase=passphrase)
1814 params["ieee80211w"] = "2"
1815 hapd0 = hostapd.add_ap(apdev[0], params)
1816 bssid0 = hapd0.own_addr()
1817
1818 dev[0].scan_for_bss(bssid0, freq="2412")
1819 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1820 ieee80211w="2", scan_freq="2412")
1821
1822 params = ft_params2(ssid=ssid, passphrase=passphrase)
1823 params["ieee80211w"] = "2"
1824 hapd1 = hostapd.add_ap(apdev[1], params)
1825 bssid1 = hapd1.own_addr()
1826 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1827 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1828 # This will fail to roam
1829 dev[0].roam(bssid1)
c5262648
JM		 1830
1831def test_ap_ft_ap_oom7d(dev, apdev):
1832 """WPA2-PSK-FT and AP OOM 7d"""
1833 ssid = "test-ft"
1834 passphrase="12345678"
1835
1836 params = ft_params1(ssid=ssid, passphrase=passphrase)
1837 params["ieee80211w"] = "2"
1838 hapd0 = hostapd.add_ap(apdev[0], params)
1839 bssid0 = hapd0.own_addr()
1840
1841 dev[0].scan_for_bss(bssid0, freq="2412")
1842 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1843 ieee80211w="2", scan_freq="2412")
1844
1845 params = ft_params2(ssid=ssid, passphrase=passphrase)
1846 params["ieee80211w"] = "2"
1847 hapd1 = hostapd.add_ap(apdev[1], params)
1848 bssid1 = hapd1.own_addr()
1849 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1850 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1851 # This will fail to roam
1852 dev[0].roam(bssid1)
1853
1854def test_ap_ft_ap_oom8(dev, apdev):
1855 """WPA2-PSK-FT and AP OOM 8"""
1856 ssid = "test-ft"
1857 passphrase="12345678"
1858
1859 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1860 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1861 hapd0 = hostapd.add_ap(apdev[0], params)
1862 bssid0 = hapd0.own_addr()
1863
1864 dev[0].scan_for_bss(bssid0, freq="2412")
1865 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1866 scan_freq="2412")
1867
1868 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 1869 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1870 hapd1 = hostapd.add_ap(apdev[1], params)
1871 bssid1 = hapd1.own_addr()
1872 dev[0].scan_for_bss(bssid1, freq="2412")
1873 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1874 # This will fail to roam
1875 dev[0].roam(bssid1)
1876 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1877 # This will fail to roam
1878 dev[0].roam(bssid1)
1879
1880def test_ap_ft_ap_oom9(dev, apdev):
1881 """WPA2-PSK-FT and AP OOM 9"""
1882 ssid = "test-ft"
1883 passphrase="12345678"
1884
1885 params = ft_params1(ssid=ssid, passphrase=passphrase)
1886 hapd0 = hostapd.add_ap(apdev[0], params)
1887 bssid0 = hapd0.own_addr()
1888
1889 dev[0].scan_for_bss(bssid0, freq="2412")
1890 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1891 scan_freq="2412")
1892
1893 params = ft_params2(ssid=ssid, passphrase=passphrase)
1894 hapd1 = hostapd.add_ap(apdev[1], params)
1895 bssid1 = hapd1.own_addr()
1896 dev[0].scan_for_bss(bssid1, freq="2412")
1897
1898 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1899 # This will fail to roam
1900 if "OK" not in dev[0].request("FT_DS " + bssid1):
1901 raise Exception("FT_DS failed")
1902 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1903
1904 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1905 # This will fail to roam
1906 if "OK" not in dev[0].request("FT_DS " + bssid1):
1907 raise Exception("FT_DS failed")
1908 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1909
1910 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1911 # This will fail to roam
1912 if "OK" not in dev[0].request("FT_DS " + bssid1):
1913 raise Exception("FT_DS failed")
1914 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1915
1916def test_ap_ft_ap_oom10(dev, apdev):
1917 """WPA2-PSK-FT and AP OOM 10"""
1918 ssid = "test-ft"
1919 passphrase="12345678"
1920
1921 params = ft_params1(ssid=ssid, passphrase=passphrase)
1922 hapd0 = hostapd.add_ap(apdev[0], params)
1923 bssid0 = hapd0.own_addr()
1924
1925 dev[0].scan_for_bss(bssid0, freq="2412")
1926 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1927 scan_freq="2412")
1928
1929 params = ft_params2(ssid=ssid, passphrase=passphrase)
1930 hapd1 = hostapd.add_ap(apdev[1], params)
1931 bssid1 = hapd1.own_addr()
1932 dev[0].scan_for_bss(bssid1, freq="2412")
1933
9441a227 1934 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1935 # This will fail to roam
1936 if "OK" not in dev[0].request("FT_DS " + bssid1):
1937 raise Exception("FT_DS failed")
1938 wait_fail_trigger(hapd0, "GET_FAIL")
1939
1940 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1941 # This will fail to roam
1942 if "OK" not in dev[0].request("FT_DS " + bssid1):
1943 raise Exception("FT_DS failed")
1944 wait_fail_trigger(hapd0, "GET_FAIL")
1945
9441a227 1946 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1947 # This will fail to roam
1948 if "OK" not in dev[0].request("FT_DS " + bssid1):
1949 raise Exception("FT_DS failed")
1950 wait_fail_trigger(hapd0, "GET_FAIL")
1951
9441a227 1952 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 1953 # This will fail to roam
1954 if "OK" not in dev[0].request("FT_DS " + bssid1):
1955 raise Exception("FT_DS failed")
1956 wait_fail_trigger(hapd1, "GET_FAIL")
1957
1958def test_ap_ft_ap_oom11(dev, apdev):
1959 """WPA2-PSK-FT and AP OOM 11"""
1960 ssid = "test-ft"
1961 passphrase="12345678"
1962
1963 params = ft_params1(ssid=ssid, passphrase=passphrase)
1964 hapd0 = hostapd.add_ap(apdev[0], params)
1965 bssid0 = hapd0.own_addr()
1966
1967 dev[0].scan_for_bss(bssid0, freq="2412")
1968 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1969 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1970 scan_freq="2412")
1971 wait_fail_trigger(hapd0, "GET_FAIL")
1972
1973 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 1974 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 1975 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1976 scan_freq="2412")
1977 wait_fail_trigger(hapd0, "GET_FAIL")
1978
a04e6f3d
JM		 1979def test_ap_ft_over_ds_proto_ap(dev, apdev):
1980 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1981 ssid = "test-ft"
1982 passphrase="12345678"
1983
1984 params = ft_params1(ssid=ssid, passphrase=passphrase)
1985 hapd0 = hostapd.add_ap(apdev[0], params)
1986 bssid0 = hapd0.own_addr()
1987 _bssid0 = bssid0.replace(':', '')
1988 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1989 scan_freq="2412")
1990 addr = dev[0].own_addr()
1991 _addr = addr.replace(':', '')
1992
1993 params = ft_params2(ssid=ssid, passphrase=passphrase)
1994 hapd1 = hostapd.add_ap(apdev[1], params)
1995 bssid1 = hapd1.own_addr()
1996 _bssid1 = bssid1.replace(':', '')
1997
1998 hapd0.set("ext_mgmt_frame_handling", "1")
1999 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
2000 valid = "0601" + _addr + _bssid1
2001 tests = [ "0601",
2002 "0601" + _addr,
2003 "0601" + _addr + _bssid0,
2004 "0601" + _addr + "ffffffffffff",
2005 "0601" + _bssid0 + _bssid0,
2006 valid,
2007 valid + "01",
2008 valid + "3700",
2009 valid + "3600",
2010 valid + "3603ffffff",
2011 valid + "3603a1b2ff",
2012 valid + "3603a1b2ff" + "3700",
2013 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2014 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2015 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2016 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2017 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2018 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2019 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2020 valid + "0001" ]
2021 for t in tests:
2022 hapd0.dump_monitor()
2023 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2024 raise Exception("MGMT_RX_PROCESS failed")
2025
2026 hapd0.set("ext_mgmt_frame_handling", "0")
2027
34d3eaa8
JM		 2028def test_ap_ft_over_ds_proto(dev, apdev):
2029 """WPA2-PSK-FT AP over DS protocol testing"""
2030 ssid = "test-ft"
2031 passphrase="12345678"
2032
2033 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2034 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2035 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2036 scan_freq="2412")
2037
2038 # FT Action Response while no FT-over-DS in progress
2039 msg = {}
2040 msg['fc'] = 13 << 4
2041 msg['da'] = dev[0].own_addr()
2042 msg['sa'] = apdev[0]['bssid']
2043 msg['bssid'] = apdev[0]['bssid']
2044 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2045 hapd0.mgmt_tx(msg)
2046
2047 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2048 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2049 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2050 hapd0.set("ext_mgmt_frame_handling", "1")
2051 hapd0.dump_monitor()
2052 dev[0].request("FT_DS " + apdev[1]['bssid'])
2053 for i in range(0, 10):
2054 req = hapd0.mgmt_rx()
2055 if req is None:
2056 raise Exception("MGMT RX wait timed out")
2057 if req['subtype'] == 13:
2058 break
2059 req = None
2060 if not req:
2061 raise Exception("FT Action frame not received")
2062
2063 # FT Action Response for unexpected Target AP
2064 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2065 hapd0.mgmt_tx(msg)
2066
2067 # FT Action Response without MDIE
2068 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2069 hapd0.mgmt_tx(msg)
2070
2071 # FT Action Response without FTIE
2072 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2073 hapd0.mgmt_tx(msg)
2074
2075 # FT Action Response with FTIE SNonce mismatch
2076 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2077 hapd0.mgmt_tx(msg)
6f3815c0 2078
9fd6804d 2079@remote_compatible
6f3815c0
JM		 2080def test_ap_ft_rrb(dev, apdev):
2081 """WPA2-PSK-FT RRB protocol testing"""
2082 ssid = "test-ft"
2083 passphrase="12345678"
2084
2085 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2086 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2087
2088 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2089 scan_freq="2412")
2090
2091 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
2092 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
15dfcb69 2093 proto = b'\x89\x0d'
6f3815c0
JM		 2094 ehdr = _dst_ll + _src_ll + proto
2095
2096 # Too short RRB frame
15dfcb69 2097 pkt = ehdr + b'\x01'
7ab74770 2098 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2099 raise Exception("DATA_TEST_FRAME failed")
2100
2101 # RRB discarded frame wikth unrecognized type
15dfcb69 2102 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2103 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2104 raise Exception("DATA_TEST_FRAME failed")
2105
2106 # RRB frame too short for action frame
15dfcb69 2107 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2108 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2109 raise Exception("DATA_TEST_FRAME failed")
2110
2111 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2112 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2113 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2114 raise Exception("DATA_TEST_FRAME failed")
2115
2116 # Unexpected Action frame category
15dfcb69 2117 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2118 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2119 raise Exception("DATA_TEST_FRAME failed")
2120
2121 # Unexpected Action in RRB Request
15dfcb69 2122 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2123 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2124 raise Exception("DATA_TEST_FRAME failed")
2125
2126 # Target AP address in RRB Request does not match with own address
15dfcb69 2127 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2128 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2129 raise Exception("DATA_TEST_FRAME failed")
2130
2131 # Not enough room for status code in RRB Response
15dfcb69 2132 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2133 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2134 raise Exception("DATA_TEST_FRAME failed")
2135
2136 # RRB discarded frame with unknown packet_type
15dfcb69 2137 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2138 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2139 raise Exception("DATA_TEST_FRAME failed")
2140
2141 # RRB Response with non-zero status code; no STA match
15dfcb69 2142 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2143 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2144 raise Exception("DATA_TEST_FRAME failed")
2145
2146 # RRB Response with zero status code and extra data; STA match
15dfcb69 2147 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2148 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2149 raise Exception("DATA_TEST_FRAME failed")
2150
2151 # Too short PMK-R1 pull
15dfcb69 2152 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2153 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2154 raise Exception("DATA_TEST_FRAME failed")
2155
2156 # Too short PMK-R1 resp
15dfcb69 2157 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2158 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2159 raise Exception("DATA_TEST_FRAME failed")
2160
2161 # Too short PMK-R1 push
15dfcb69 2162 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2163 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2164 raise Exception("DATA_TEST_FRAME failed")
2165
2166 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2167 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2168 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2169 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2170
9fd6804d 2171@remote_compatible
ecafa0cf
JM		 2172def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2173 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2174 bssid = apdev[0]['bssid']
2175 ssid = "test-ft"
2176 passphrase="12345678"
2177
2178 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2179 params["ieee80211w"] = "1"
ecafa0cf
JM		 2180 # This is the RSN element used normally by hostapd
2181 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2182 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2183 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2184 ieee80211w="1", scan_freq="2412",
2185 pairwise="CCMP", group="CCMP")
2186
2187 tests = [ ('PMKIDCount field included',
2188 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2189 ('Extra IE before RSNE',
2190 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2191 ('PMKIDCount and Group Management Cipher suite fields included',
2192 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2193 ('Extra octet after defined fields (future extensibility)',
2194 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2195 ('No RSN Capabilities field (PMF disabled in practice)',
2196 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2197 for txt,ie in tests:
2198 dev[0].request("DISCONNECT")
2199 dev[0].wait_disconnected()
2200 logger.info(txt)
2201 hapd.disable()
2202 hapd.set('own_ie_override', ie)
2203 hapd.enable()
2204 dev[0].request("BSS_FLUSH 0")
2205 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2206 dev[0].select_network(id, freq=2412)
2207 dev[0].wait_connected()
2208
2209 dev[0].request("DISCONNECT")
2210 dev[0].wait_disconnected()
2211
2212 logger.info('Invalid RSNE causing internal hostapd error')
2213 hapd.disable()
2214 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2215 hapd.enable()
2216 dev[0].request("BSS_FLUSH 0")
2217 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2218 dev[0].select_network(id, freq=2412)
2219 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2220 # complete.
2221 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2222 if ev is not None:
2223 raise Exception("Unexpected connection")
2224 dev[0].request("DISCONNECT")
2225
2226 logger.info('Unexpected PMKID causing internal hostapd error')
2227 hapd.disable()
2228 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2229 hapd.enable()
2230 dev[0].request("BSS_FLUSH 0")
2231 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2232 dev[0].select_network(id, freq=2412)
2233 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2234 # complete.
2235 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2236 if ev is not None:
2237 raise Exception("Unexpected connection")
2238 dev[0].request("DISCONNECT")
1025603b
JM		 2239
2240def test_ap_ft_ptk_rekey(dev, apdev):
2241 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2242 ssid = "test-ft"
2243 passphrase="12345678"
2244
2245 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2246 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2247 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2248 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2249
2250 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2251
2252 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2253 "WPA: Key negotiation completed"], timeout=5)
2254 if ev is None:
2255 raise Exception("No event received after roam")
2256 if "CTRL-EVENT-DISCONNECTED" in ev:
2257 raise Exception("Unexpected disconnection after roam")
2258
2259 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2260 hapd = hapd0
2261 else:
2262 hapd = hapd1
2263 hwsim_utils.test_connectivity(dev[0], hapd)
2264
2265def test_ap_ft_ptk_rekey_ap(dev, apdev):
2266 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2267 ssid = "test-ft"
2268 passphrase="12345678"
2269
2270 params = ft_params1(ssid=ssid, passphrase=passphrase)
2271 params['wpa_ptk_rekey'] = '2'
8b8a1864 2272 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b
JM		 2273 params = ft_params2(ssid=ssid, passphrase=passphrase)
2274 params['wpa_ptk_rekey'] = '2'
8b8a1864 2275 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2276
2277 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2278
2279 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2280 "WPA: Key negotiation completed"], timeout=5)
2281 if ev is None:
2282 raise Exception("No event received after roam")
2283 if "CTRL-EVENT-DISCONNECTED" in ev:
2284 raise Exception("Unexpected disconnection after roam")
2285
2286 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2287 hapd = hapd0
2288 else:
2289 hapd = hapd1
2290 hwsim_utils.test_connectivity(dev[0], hapd)
186ca473
MB		 2291
2292def test_ap_ft_internal_rrb_check(dev, apdev):
2293 """RRB internal delivery only to WPA enabled BSS"""
2294 ssid = "test-ft"
2295 passphrase="12345678"
2296
2297 radius = hostapd.radius_params()
2298 params = ft_params1(ssid=ssid, passphrase=passphrase)
2299 params['wpa_key_mgmt'] = "FT-EAP"
2300 params["ieee8021x"] = "1"
35d8c254 2301 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2302 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2303 key_mgmt = hapd.get_config()['key_mgmt']
2304 if key_mgmt.split(' ')[0] != "FT-EAP":
2305 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2306
8b8a1864 2307 hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
186ca473
MB		 2308
2309 # Connect to WPA enabled AP
2310 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2311 eap="GPSK", identity="gpsk user",
2312 password="abcdefghijklmnop0123456789abcdef",
2313 scan_freq="2412")
2314
2315 # Try over_ds roaming to non-WPA-enabled AP.
2316 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2317 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2318
2319def test_ap_ft_extra_ie(dev, apdev):
2320 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2321 ssid = "test-ft"
2322 passphrase="12345678"
2323
2324 params = ft_params1(ssid=ssid, passphrase=passphrase)
2325 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2326 hapd0 = hostapd.add_ap(apdev[0], params)
2327 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2328 scan_freq="2412")
2329 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2330 scan_freq="2412")
2331 try:
2332 # Add Mobility Domain element to test AP validation code.
2333 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2334 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2335 scan_freq="2412", wait_connect=False)
2336 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2337 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2338 if ev is None:
2339 raise Exception("No connection result")
2340 if "CTRL-EVENT-CONNECTED" in ev:
2341 raise Exception("Non-FT association accepted with MDE")
2342 if "status_code=43" not in ev:
2343 raise Exception("Unexpected status code: " + ev)
2344 dev[0].request("DISCONNECT")
2345 finally:
2346 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2347
2348def test_ap_ft_ric(dev, apdev):
2349 """WPA2-PSK-FT AP and RIC"""
2350 ssid = "test-ft"
2351 passphrase="12345678"
2352
2353 params = ft_params1(ssid=ssid, passphrase=passphrase)
2354 hapd0 = hostapd.add_ap(apdev[0], params)
2355 params = ft_params2(ssid=ssid, passphrase=passphrase)
2356 hapd1 = hostapd.add_ap(apdev[1], params)
2357
2358 dev[0].set("ric_ies", "")
2359 dev[0].set("ric_ies", '""')
2360 if "FAIL" not in dev[0].request("SET ric_ies q"):
2361 raise Exception("Invalid ric_ies value accepted")
2362
2363 tests = [ "3900",
2364 "3900ff04eeeeeeee",
2365 "390400000000",
2366 "390400000000" + "390400000000",
2367 "390400000000" + "dd050050f20202",
2368 "390400000000" + "dd3d0050f2020201" + 55*"00",
2369 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2370 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2371 for t in tests:
2372 dev[0].set("ric_ies", t)
2373 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2374 test_connectivity=False)
2375 dev[0].request("REMOVE_NETWORK all")
2376 dev[0].wait_disconnected()
2377 dev[0].dump_monitor()
c8942286
JM		 2378
2379def ie_hex(ies, id):
7ab74770 2380 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2381
2382def test_ap_ft_reassoc_proto(dev, apdev):
2383 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2384 ssid = "test-ft"
2385 passphrase="12345678"
2386
2387 params = ft_params1(ssid=ssid, passphrase=passphrase)
2388 hapd0 = hostapd.add_ap(apdev[0], params)
2389 params = ft_params2(ssid=ssid, passphrase=passphrase)
2390 hapd1 = hostapd.add_ap(apdev[1], params)
2391
2392 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2393 ieee80211w="1", scan_freq="2412")
2394 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2395 hapd1ap = hapd0
2396 hapd2ap = hapd1
2397 else:
2398 hapd1ap = hapd1
2399 hapd2ap = hapd0
2400
2401 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2402 hapd2ap.set("ext_mgmt_frame_handling", "1")
2403 dev[0].request("ROAM " + hapd2ap.own_addr())
2404
2405 while True:
2406 req = hapd2ap.mgmt_rx()
7ab74770 2407 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2408 if req['subtype'] == 11:
2409 break
2410
2411 while True:
2412 req = hapd2ap.mgmt_rx()
2413 if req['subtype'] == 2:
2414 break
7ab74770 2415 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2416
2417 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2418 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2419 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2420 # First elements: SSID, Supported Rates, Extended Supported Rates
2421 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2422
2423 rsne = ie_hex(ies, 48)
2424 mde = ie_hex(ies, 54)
2425 fte = ie_hex(ies, 55)
2426 tests = [ ]
2427 # RSN: Trying to use FT, but MDIE not included
2428 tests += [ rsne ]
2429 # RSN: Attempted to use unknown MDIE
2430 tests += [ rsne + "3603000000" ]
2431 # Invalid RSN pairwise cipher
2432 tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2433 # FT: No PMKID in RSNIE
2434 tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2435 # FT: Invalid FTIE
2436 tests += [ rsne + mde ]
2437 # FT: RIC IE(s) in the frame, but not included in protected IE count
2438 # FT: Failed to parse FT IEs
2439 tests += [ rsne + mde + fte + "3900" ]
2440 # FT: SNonce mismatch in FTIE
2441 tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2442 # FT: ANonce mismatch in FTIE
2443 tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2444 # FT: No R0KH-ID subelem in FTIE
2445 tests += [ rsne + mde + "3752" + fte[4:168] ]
2446 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2447 tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2448 # FT: No R1KH-ID subelem in FTIE
54c58f29 2449 tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() ]
c8942286 2450 # FT: Unknown R1KH-ID used in ReassocReq
54c58f29 2451 tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000" ]
c8942286
JM		 2452 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2453 tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2454 # Invalid MIC in FTIE
2455 tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2456 for t in tests:
2457 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2458
2459def test_ap_ft_reassoc_local_fail(dev, apdev):
2460 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2461 ssid = "test-ft"
2462 passphrase="12345678"
2463
2464 params = ft_params1(ssid=ssid, passphrase=passphrase)
2465 hapd0 = hostapd.add_ap(apdev[0], params)
2466 params = ft_params2(ssid=ssid, passphrase=passphrase)
2467 hapd1 = hostapd.add_ap(apdev[1], params)
2468
2469 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2470 ieee80211w="1", scan_freq="2412")
2471 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2472 hapd1ap = hapd0
2473 hapd2ap = hapd1
2474 else:
2475 hapd1ap = hapd1
2476 hapd2ap = hapd0
2477
2478 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2479 # FT: Failed to calculate MIC
2480 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2481 dev[0].request("ROAM " + hapd2ap.own_addr())
2482 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2483 dev[0].request("DISCONNECT")
2484 if ev is None:
2485 raise Exception("Association reject not seen")
d7f0bef9
JM		 2486
2487def test_ap_ft_reassoc_replay(dev, apdev, params):
2488 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2489 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2490 ssid = "test-ft"
2491 passphrase="12345678"
2492
2493 params = ft_params1(ssid=ssid, passphrase=passphrase)
2494 hapd0 = hostapd.add_ap(apdev[0], params)
2495 params = ft_params2(ssid=ssid, passphrase=passphrase)
2496 hapd1 = hostapd.add_ap(apdev[1], params)
2497
2498 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2499 scan_freq="2412")
2500 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2501 hapd1ap = hapd0
2502 hapd2ap = hapd1
2503 else:
2504 hapd1ap = hapd1
2505 hapd2ap = hapd0
2506
2507 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2508 hapd2ap.set("ext_mgmt_frame_handling", "1")
2509 dev[0].dump_monitor()
2510 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2511 raise Exception("ROAM failed")
2512
2513 reassocreq = None
2514 count = 0
2515 while count < 100:
2516 req = hapd2ap.mgmt_rx()
2517 count += 1
2518 hapd2ap.dump_monitor()
7ab74770 2519 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2520 if req['subtype'] == 2:
2521 reassocreq = req
2522 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2523 if ev is None:
2524 raise Exception("No TX status seen")
2525 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2526 if "OK" not in hapd2ap.request(cmd):
2527 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2528 break
2529 hapd2ap.set("ext_mgmt_frame_handling", "0")
2530 if reassocreq is None:
2531 raise Exception("No Reassociation Request frame seen")
2532 dev[0].wait_connected()
2533 dev[0].dump_monitor()
2534 hapd2ap.dump_monitor()
2535
2536 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2537
2538 logger.info("Replay the last Reassociation Request frame")
2539 hapd2ap.dump_monitor()
2540 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2541 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2542 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2543 if ev is None:
2544 raise Exception("No TX status seen")
2545 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2546 if "OK" not in hapd2ap.request(cmd):
2547 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2548 hapd2ap.set("ext_mgmt_frame_handling", "0")
2549
2550 try:
2551 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2552 ok = True
2553 except:
2554 ok = False
2555
2556 ap = hapd2ap.own_addr()
2557 sta = dev[0].own_addr()
2558 filt = "wlan.fc.type == 2 && " + \
2559 "wlan.da == " + sta + " && " + \
2560 "wlan.sa == " + ap
2561 fields = [ "wlan.ccmp.extiv" ]
2562 res = run_tshark(capfile, filt, fields)
2563 vals = res.splitlines()
2564 logger.info("CCMP PN: " + str(vals))
2565 if len(vals) < 2:
2566 raise Exception("Could not find all CCMP protected frames from capture")
2567 if len(set(vals)) < len(vals):
2568 raise Exception("Duplicate CCMP PN used")
2569
2570 if not ok:
2571 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2572
2573def test_ap_ft_psk_file(dev, apdev):
2574 """WPA2-PSK-FT AP with PSK from a file"""
2575 ssid = "test-ft"
2576 passphrase="12345678"
2577
2578 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2579 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2580 hapd = hostapd.add_ap(apdev[0], params)
2581
2582 dev[1].connect(ssid, psk="very secret",
2583 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2584 scan_freq="2412", wait_connect=False)
2585 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2586 ieee80211w="1", scan_freq="2412")
2587 dev[0].request("REMOVE_NETWORK all")
2588 dev[0].wait_disconnected()
2589 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2590 ieee80211w="1", scan_freq="2412")
2591 dev[0].request("REMOVE_NETWORK all")
2592 dev[0].wait_disconnected()
2593 dev[0].connect(ssid, psk="secret passphrase",
2594 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2595 scan_freq="2412")
2596 dev[2].connect(ssid, psk="another passphrase for all STAs",
2597 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2598 scan_freq="2412")
2599 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2600 if ev is None:
2601 raise Exception("Timed out while waiting for failure report")
2602 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2603
2604def test_ap_ft_eap_ap_config_change(dev, apdev):
2605 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2606 ssid = "test-ft"
2607 passphrase="12345678"
2608 bssid = apdev[0]['bssid']
2609
2610 radius = hostapd.radius_params()
2611 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2612 params['wpa_key_mgmt'] = "WPA-EAP"
2613 params["ieee8021x"] = "1"
2614 params["pmk_r1_push"] = "0"
2615 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2616 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2617 params["eap_server"] = "0"
35d8c254 2618 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2619 hapd = hostapd.add_ap(apdev[0], params)
2620
2621 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2622 eap="GPSK", identity="gpsk user",
2623 password="abcdefghijklmnop0123456789abcdef",
2624 scan_freq="2412")
2625 dev[0].request("DISCONNECT")
2626 dev[0].wait_disconnected()
2627 dev[0].dump_monitor()
2628
2629 hapd.disable()
2630 hapd.set('wpa_key_mgmt', "FT-EAP")
2631 hapd.enable()
2632
2633 dev[0].request("BSS_FLUSH 0")
2634 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2635
2636 dev[0].request("RECONNECT")
2637 dev[0].wait_connected()
55b3cda7
JM		 2638
2639def test_ap_ft_eap_sha384(dev, apdev):
2640 """WPA2-EAP-FT with SHA384"""
2641 ssid = "test-ft"
2642 passphrase="12345678"
2643
2644 radius = hostapd.radius_params()
2645 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2646 params["ieee80211w"] = "2"
55b3cda7
JM		 2647 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2648 params["ieee8021x"] = "1"
35d8c254 2649 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2650 hapd0 = hostapd.add_ap(apdev[0], params)
2651 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2652 params["ieee80211w"] = "2"
55b3cda7
JM		 2653 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2654 params["ieee8021x"] = "1"
35d8c254 2655 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2656 hapd1 = hostapd.add_ap(apdev[1], params)
2657
2658 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2659 sha384=True)
2660
2661def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2662 """WPA2-EAP-FT with SHA384 over DS"""
2663 ssid = "test-ft"
2664 passphrase="12345678"
2665
2666 radius = hostapd.radius_params()
2667 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2668 params["ieee80211w"] = "2"
55b3cda7
JM		 2669 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2670 params["ieee8021x"] = "1"
35d8c254 2671 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2672 hapd0 = hostapd.add_ap(apdev[0], params)
2673 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2674 params["ieee80211w"] = "2"
55b3cda7
JM		 2675 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2676 params["ieee8021x"] = "1"
35d8c254 2677 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2678 hapd1 = hostapd.add_ap(apdev[1], params)
2679
2680 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2681 eap=True, sha384=True)
392aba4e
JM		 2682
2683def test_ap_ft_roam_rrm(dev, apdev):
2684 """WPA2-PSK-FT AP and radio measurement request"""
2685 ssid = "test-ft"
2686 passphrase="12345678"
2687
2688 params = ft_params1(ssid=ssid, passphrase=passphrase)
2689 params["rrm_beacon_report"] = "1"
2690 hapd0 = hostapd.add_ap(apdev[0], params)
2691 bssid0 = hapd0.own_addr()
2692
2693 addr = dev[0].own_addr()
2694 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2695 scan_freq="2412")
2696 check_beacon_req(hapd0, addr, 1)
2697
2698 params = ft_params2(ssid=ssid, passphrase=passphrase)
2699 params["rrm_beacon_report"] = "1"
2700 hapd1 = hostapd.add_ap(apdev[1], params)
2701 bssid1 = hapd1.own_addr()
2702
2703 dev[0].scan_for_bss(bssid1, freq=2412)
2704 dev[0].roam(bssid1)
2705 check_beacon_req(hapd1, addr, 2)
2706
2707 dev[0].scan_for_bss(bssid0, freq=2412)
2708 dev[0].roam(bssid0)
2709 check_beacon_req(hapd0, addr, 3)
Unnamed repository; edit this file 'description' to name the repository.