]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
FT: Reject over-the-DS response with MFPC=0 if PMF is required
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
e1923f5b 25from test_suite_b import check_suite_b_192_capa
cd7f1b9a
JM		 26
27def ft_base_rsn():
fab49f61
JM		 28 params = {"wpa": "2",
29 "wpa_key_mgmt": "FT-PSK",
30 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 31 return params
32
33def ft_base_mixed():
fab49f61
JM		 34 params = {"wpa": "3",
35 "wpa_key_mgmt": "WPA-PSK FT-PSK",
36 "wpa_pairwise": "TKIP",
37 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 38 return params
39
40def ft_params(rsn=True, ssid=None, passphrase=None):
41 if rsn:
42 params = ft_base_rsn()
43 else:
44 params = ft_base_mixed()
45 if ssid:
46 params["ssid"] = ssid
47 if passphrase:
48 params["wpa_passphrase"] = passphrase
49
50 params["mobility_domain"] = "a1b2"
51 params["r0_key_lifetime"] = "10000"
52 params["pmk_r1_push"] = "1"
53 params["reassociation_deadline"] = "1000"
54 return params
55
d0175d6e 56def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 57 params = ft_params(rsn, ssid, passphrase)
58 params['nas_identifier'] = "nas1.w1.fi"
59 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 60 return params
61
942b52a8 62def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 63 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 64 if discovery:
65 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
67 else:
fab49f61
JM		 68 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
69 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
942b52a8 70 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 71 return params
72
c95dd8e4
JM		 73def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
74 params = ft_params1a(rsn, ssid, passphrase)
fab49f61
JM		 75 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
76 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 77 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
78 return params
79
d0175d6e 80def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 81 params = ft_params(rsn, ssid, passphrase)
82 params['nas_identifier'] = "nas2.w1.fi"
83 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 84 return params
85
942b52a8 86def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 87 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 88 if discovery:
89 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
91 else:
fab49f61
JM		 92 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
93 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
942b52a8 94 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 95 return params
96
c95dd8e4
JM		 97def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
98 params = ft_params2a(rsn, ssid, passphrase)
fab49f61
JM		 99 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
100 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 101 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
102 return params
103
3b808945
JM		 104def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
105 params = ft_params(rsn, ssid, passphrase)
106 params['nas_identifier'] = "nas1.w1.fi"
107 params['r1_key_holder'] = "000102030405"
fab49f61
JM		 108 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
109 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
9441a227 110 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 111 return params
112
113def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
114 params = ft_params(rsn, ssid, passphrase)
115 params['nas_identifier'] = "nas2.w1.fi"
116 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 117 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
118 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
9441a227 119 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 120 return params
121
122def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
123 params = ft_params(rsn, ssid, passphrase)
124 params['nas_identifier'] = "nas2.w1.fi"
125 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 126 params['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
127 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
9441a227 128 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 129 return params
130
7b741a53
JM		 131def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
132 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 133 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 134 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 135 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5 136 group_mgmt=None, ocv=None, sae_password=None,
659f7954 137 sae_password_id=None, sae_and_psk=False, pmksa_caching=False,
5916637c
JM		 138 roam_with_reassoc=False, also_non_ft=False, only_one_way=False,
139 wait_before_roam=0, return_after_initial=False):
cd7f1b9a 140 logger.info("Connect to first AP")
473e5176
MB		 141
142 copts = {}
143 copts["proto"] = "WPA2"
144 copts["ieee80211w"] = "1"
145 copts["scan_freq"] = "2412"
146 copts["pairwise"] = pairwise_cipher
fab49f61 147 copts["group"] = group_cipher
473e5176 148 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 149 if group_mgmt:
150 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 151 if ocv:
152 copts["ocv"] = ocv
6f62809b 153 if eap:
9ff2b85e
JM		 154 if pmksa_caching:
155 copts["ft_eap_pmksa_caching"] = "1"
659f7954
JM		 156 if also_non_ft:
157 copts["key_mgmt"] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384" if sha384 else "WPA-EAP FT-EAP"
158 else:
159 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 160 copts["eap"] = "GPSK"
161 copts["identity"] = eap_identity
162 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 163 else:
6f62809b 164 if sae:
cdf53910 165 copts["key_mgmt"] = "SAE FT-SAE" if sae_and_psk else "FT-SAE"
6f62809b 166 else:
473e5176 167 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 168 if passphrase:
169 copts["psk"] = passphrase
170 if sae_password:
171 copts["sae_password"] = sae_password
172 if sae_password_id:
173 copts["sae_password_id"] = sae_password_id
473e5176
MB		 174 if force_initial_conn_to_first_ap:
175 copts["bssid"] = apdev[0]['bssid']
659f7954 176 netw = dev.connect(ssid, **copts)
1211031a
JM		 177 if pmksa_caching:
178 dev.request("DISCONNECT")
179 dev.wait_disconnected()
180 dev.request("RECONNECT")
9ff2b85e
JM		 181 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
182 "CTRL-EVENT-DISCONNECTED",
183 "CTRL-EVENT-EAP-STARTED"],
1211031a
JM		 184 timeout=15)
185 if ev is None:
186 raise Exception("Reconnect timed out")
187 if "CTRL-EVENT-DISCONNECTED" in ev:
188 raise Exception("Unexpected disconnection after RECONNECT")
9ff2b85e
JM		 189 if "CTRL-EVENT-EAP-STARTED" in ev:
190 raise Exception("Unexpected EAP start after RECONNECT")
473e5176 191
cd7f1b9a
JM		 192 if dev.get_status_field('bssid') == apdev[0]['bssid']:
193 ap1 = apdev[0]
194 ap2 = apdev[1]
a8375c94
JM		 195 hapd1ap = hapd0
196 hapd2ap = hapd1
cd7f1b9a
JM		 197 else:
198 ap1 = apdev[1]
199 ap2 = apdev[0]
a8375c94
JM		 200 hapd1ap = hapd1
201 hapd2ap = hapd0
fd7205fa 202 if test_connectivity:
938c6e7b 203 hapd1ap.wait_sta()
9c50a6d3
MB		 204 if conndev:
205 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
206 else:
207 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 208
5916637c
JM		 209 if return_after_initial:
210 return ap2['bssid']
211
212 if wait_before_roam:
213 time.sleep(wait_before_roam)
655bc8bf 214 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 215
216 for i in range(0, roams):
e0382291
MB		 217 # Roaming artificially fast can make data test fail because the key is
218 # set later.
219 time.sleep(0.01)
40602101 220 logger.info("Roam to the second AP")
659f7954
JM		 221 if roam_with_reassoc:
222 dev.set_network(netw, "bssid", ap2['bssid'])
223 dev.request("REASSOCIATE")
224 dev.wait_connected()
225 elif over_ds:
40602101
JM		 226 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
227 else:
228 dev.roam(ap2['bssid'], fail_test=fail_test)
229 if fail_test:
230 return
231 if dev.get_status_field('bssid') != ap2['bssid']:
232 raise Exception("Did not connect to correct AP")
fd7205fa 233 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 234 hapd2ap.wait_sta()
9c50a6d3
MB		 235 if conndev:
236 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
237 else:
238 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 239
425e5f97
JM		 240 if only_one_way:
241 return
e0382291
MB		 242 # Roaming artificially fast can make data test fail because the key is
243 # set later.
244 time.sleep(0.01)
40602101 245 logger.info("Roam back to the first AP")
659f7954
JM		 246 if roam_with_reassoc:
247 dev.set_network(netw, "bssid", ap1['bssid'])
248 dev.request("REASSOCIATE")
249 dev.wait_connected()
250 elif over_ds:
40602101
JM		 251 dev.roam_over_ds(ap1['bssid'])
252 else:
253 dev.roam(ap1['bssid'])
254 if dev.get_status_field('bssid') != ap1['bssid']:
255 raise Exception("Did not connect to correct AP")
fd7205fa 256 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 257 hapd1ap.wait_sta()
9c50a6d3
MB		 258 if conndev:
259 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
260 else:
261 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 262
263def test_ap_ft(dev, apdev):
264 """WPA2-PSK-FT AP"""
265 ssid = "test-ft"
fab49f61 266 passphrase = "12345678"
cd7f1b9a
JM		 267
268 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 269 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 270 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 271 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 272
a8375c94 273 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 274 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
275 raise Exception("Scan results missing RSN element info")
cd7f1b9a 276
c95dd8e4
JM		 277def test_ap_ft_old_key(dev, apdev):
278 """WPA2-PSK-FT AP (old key)"""
279 ssid = "test-ft"
fab49f61 280 passphrase = "12345678"
c95dd8e4
JM		 281
282 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
283 hapd0 = hostapd.add_ap(apdev[0], params)
284 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
285 hapd1 = hostapd.add_ap(apdev[1], params)
286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288
e4612f84
JM		 289def test_ap_ft_multi_akm(dev, apdev):
290 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
291 ssid = "test-ft"
fab49f61 292 passphrase = "12345678"
e4612f84
JM		 293
294 params = ft_params1(ssid=ssid, passphrase=passphrase)
295 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
296 hapd0 = hostapd.add_ap(apdev[0], params)
297 params = ft_params2(ssid=ssid, passphrase=passphrase)
298 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
299 hapd1 = hostapd.add_ap(apdev[1], params)
300
301 Wlantest.setup(hapd0)
302 wt = Wlantest()
303 wt.flush()
304 wt.add_passphrase(passphrase)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
307 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
310 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
311 scan_freq="2412")
312
d0175d6e
MB		 313def test_ap_ft_local_key_gen(dev, apdev):
314 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
315 ssid = "test-ft"
fab49f61 316 passphrase = "12345678"
d0175d6e
MB		 317
318 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 319 params['ft_psk_generate_local'] = "1"
8344ba12 320 del params['pmk_r1_push']
b098542c 321 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 322 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 323 params['ft_psk_generate_local'] = "1"
8344ba12 324 del params['pmk_r1_push']
b098542c 325 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
473e5176
MB		 331def test_ap_ft_vlan(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN"""
333 ssid = "test-ft"
fab49f61 334 passphrase = "12345678"
473e5176
MB		 335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 342 params['dynamic_vlan'] = "1"
343 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 344 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
345
346 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
350def test_ap_ft_vlan_disconnected(dev, apdev):
351 """WPA2-PSK-FT AP with VLAN and local key generation"""
352 ssid = "test-ft"
fab49f61 353 passphrase = "12345678"
473e5176
MB		 354
355 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 356 params['dynamic_vlan'] = "1"
357 params['accept_mac_file'] = "hostapd.accept"
358 params['ft_psk_generate_local'] = "1"
473e5176
MB		 359 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
360
361 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 362 params['dynamic_vlan'] = "1"
363 params['accept_mac_file'] = "hostapd.accept"
364 params['ft_psk_generate_local'] = "1"
473e5176
MB		 365 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
366
367 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
368 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
369 raise Exception("Scan results missing RSN element info")
370
371def test_ap_ft_vlan_2(dev, apdev):
372 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
373 ssid = "test-ft"
fab49f61 374 passphrase = "12345678"
473e5176
MB		 375
376 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 377 params['dynamic_vlan'] = "1"
378 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 379 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
380
381 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 382 params['dynamic_vlan'] = "1"
473e5176
MB		 383 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
384
385 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
386 force_initial_conn_to_first_ap=True)
387 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
388 raise Exception("Scan results missing RSN element info")
389
40602101
JM		 390def test_ap_ft_many(dev, apdev):
391 """WPA2-PSK-FT AP multiple times"""
392 ssid = "test-ft"
fab49f61 393 passphrase = "12345678"
40602101
JM		 394
395 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 396 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 397 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 398 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 399
a8375c94 400 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 401
473e5176
MB		 402def test_ap_ft_many_vlan(dev, apdev):
403 """WPA2-PSK-FT AP with VLAN multiple times"""
404 ssid = "test-ft"
fab49f61 405 passphrase = "12345678"
473e5176
MB		 406
407 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 408 params['dynamic_vlan'] = "1"
409 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 410 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
411
412 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 413 params['dynamic_vlan'] = "1"
414 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 415 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
416
417 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
418 conndev="brvlan1")
419
cd7f1b9a
JM		 420def test_ap_ft_mixed(dev, apdev):
421 """WPA2-PSK-FT mixed-mode AP"""
422 ssid = "test-ft-mixed"
fab49f61 423 passphrase = "12345678"
cd7f1b9a
JM		 424
425 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 426 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 427 key_mgmt = hapd.get_config()['key_mgmt']
428 vals = key_mgmt.split(' ')
429 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
430 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 431 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 432 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 433
a8375c94 434 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 435
436def test_ap_ft_pmf(dev, apdev):
437 """WPA2-PSK-FT AP with PMF"""
438 ssid = "test-ft"
fab49f61 439 passphrase = "12345678"
cd7f1b9a
JM		 440
441 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 442 params["ieee80211w"] = "2"
8b8a1864 443 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 444 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 445 params["ieee80211w"] = "2"
8b8a1864 446 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 447
a8375c94 448 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 449
ffcaca68
JM		 450def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
451 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
452 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
453
454def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
455 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
456 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
457
458def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
459 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
460 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
461
462def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
463 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
464 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
465
466def run_ap_ft_pmf_bip(dev, apdev, cipher):
467 if cipher not in dev[0].get_capability("group_mgmt"):
468 raise HwsimSkip("Cipher %s not supported" % cipher)
469
470 ssid = "test-ft"
fab49f61 471 passphrase = "12345678"
ffcaca68
JM		 472
473 params = ft_params1(ssid=ssid, passphrase=passphrase)
474 params["ieee80211w"] = "2"
475 params["group_mgmt_cipher"] = cipher
476 hapd0 = hostapd.add_ap(apdev[0], params)
477 params = ft_params2(ssid=ssid, passphrase=passphrase)
478 params["ieee80211w"] = "2"
479 params["group_mgmt_cipher"] = cipher
480 hapd1 = hostapd.add_ap(apdev[1], params)
481
482 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
483 group_mgmt=cipher)
484
e63d8837
MV		 485def test_ap_ft_ocv(dev, apdev):
486 """WPA2-PSK-FT AP with OCV"""
487 ssid = "test-ft"
fab49f61 488 passphrase = "12345678"
e63d8837
MV		 489
490 params = ft_params1(ssid=ssid, passphrase=passphrase)
491 params["ieee80211w"] = "2"
492 params["ocv"] = "1"
493 try:
494 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 495 except Exception as e:
e63d8837
MV		 496 if "Failed to set hostapd parameter ocv" in str(e):
497 raise HwsimSkip("OCV not supported")
498 raise
499 params = ft_params2(ssid=ssid, passphrase=passphrase)
500 params["ieee80211w"] = "2"
501 params["ocv"] = "1"
502 hapd1 = hostapd.add_ap(apdev[1], params)
503
504 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
505
b553eab1
JM		 506def test_ap_ft_over_ds(dev, apdev):
507 """WPA2-PSK-FT AP over DS"""
508 ssid = "test-ft"
fab49f61 509 passphrase = "12345678"
b553eab1
JM		 510
511 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 512 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 513 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 514 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 515
a8375c94 516 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
fab49f61
JM		 517 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
518 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
b553eab1 519
02a4ac0f
JM		 520def cleanup_ap_ft_separate_hostapd():
521 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
522 stderr=open('/dev/null', 'w'))
523 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
524 stderr=open('/dev/null', 'w'))
525 subprocess.call(["ip", "link", "del", "veth0"],
526 stderr=open('/dev/null', 'w'))
527 subprocess.call(["ip", "link", "del", "veth1"],
528 stderr=open('/dev/null', 'w'))
fab49f61 529 for ifname in ['br0ft', 'br1ft', 'br-ft']:
02a4ac0f
JM		 530 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
531 stderr=open('/dev/null', 'w'))
532 subprocess.call(['brctl', 'delbr', ifname],
533 stderr=open('/dev/null', 'w'))
534
535def test_ap_ft_separate_hostapd(dev, apdev, params):
536 """WPA2-PSK-FT AP and separate hostapd process"""
537 try:
538 run_ap_ft_separate_hostapd(dev, apdev, params, False)
539 finally:
540 cleanup_ap_ft_separate_hostapd()
541
542def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
543 """WPA2-PSK-FT AP over DS and separate hostapd process"""
544 try:
545 run_ap_ft_separate_hostapd(dev, apdev, params, True)
546 finally:
547 cleanup_ap_ft_separate_hostapd()
548
549def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
550 ssid = "test-ft"
fab49f61 551 passphrase = "12345678"
02a4ac0f
JM		 552 logdir = params['logdir']
553 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
554 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
555 global_ctrl = '/var/run/hostapd-ft'
556 br_ifname = 'br-ft'
557
558 try:
559 subprocess.check_call(['brctl', 'addbr', br_ifname])
560 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
561 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
562
fab49f61
JM		 563 subprocess.check_call(["ip", "link", "add", "veth0", "type", "veth",
564 "peer", "name", "veth0br"])
565 subprocess.check_call(["ip", "link", "add", "veth1", "type", "veth",
566 "peer", "name", "veth1br"])
02a4ac0f
JM		 567 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
568 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
569 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
570 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
571
572 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
573 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
574 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
575 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
576 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
577 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
578 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
579 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
580 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
581 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
582 except subprocess.CalledProcessError:
583 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
584
585 with HWSimRadio() as (radio, iface):
586 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
587 if not os.path.exists(prg):
588 prg = '../../hostapd/hostapd'
fab49f61
JM		 589 cmd = [prg, '-B', '-ddKt',
590 '-P', pidfile, '-f', logfile, '-g', global_ctrl]
02a4ac0f
JM		 591 subprocess.check_call(cmd)
592
593 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
fab49f61
JM		 594 apdev_ft = {'ifname': iface}
595 apdev2 = [apdev_ft, apdev[1]]
02a4ac0f
JM		 596
597 params = ft_params1(ssid=ssid, passphrase=passphrase)
598 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
599 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
600 params['bridge'] = 'br0ft'
601 hapd0 = hostapd.add_ap(apdev2[0], params,
602 global_ctrl_override=global_ctrl)
603 apdev2[0]['bssid'] = hapd0.own_addr()
604 params = ft_params2(ssid=ssid, passphrase=passphrase)
605 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
606 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
607 params['bridge'] = 'br1ft'
608 hapd1 = hostapd.add_ap(apdev2[1], params)
609
610 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
611 over_ds=over_ds, test_connectivity=False)
612
613 hglobal.terminate()
614
615 if os.path.exists(pidfile):
616 with open(pidfile, 'r') as f:
617 pid = int(f.read())
618 f.close()
619 os.kill(pid, signal.SIGTERM)
620
e63d8837
MV		 621def test_ap_ft_over_ds_ocv(dev, apdev):
622 """WPA2-PSK-FT AP over DS"""
623 ssid = "test-ft"
fab49f61 624 passphrase = "12345678"
e63d8837
MV		 625
626 params = ft_params1(ssid=ssid, passphrase=passphrase)
627 params["ieee80211w"] = "2"
628 params["ocv"] = "1"
629 try:
630 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 631 except Exception as e:
e63d8837
MV		 632 if "Failed to set hostapd parameter ocv" in str(e):
633 raise HwsimSkip("OCV not supported")
634 raise
635 params = ft_params2(ssid=ssid, passphrase=passphrase)
636 params["ieee80211w"] = "2"
637 params["ocv"] = "1"
638 hapd1 = hostapd.add_ap(apdev[1], params)
639
640 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
641 ocv="1")
642
55139acb
JM		 643def test_ap_ft_over_ds_disabled(dev, apdev):
644 """WPA2-PSK-FT AP over DS disabled"""
645 ssid = "test-ft"
fab49f61 646 passphrase = "12345678"
55139acb
JM		 647
648 params = ft_params1(ssid=ssid, passphrase=passphrase)
649 params['ft_over_ds'] = '0'
650 hapd0 = hostapd.add_ap(apdev[0], params)
651 params = ft_params2(ssid=ssid, passphrase=passphrase)
652 params['ft_over_ds'] = '0'
653 hapd1 = hostapd.add_ap(apdev[1], params)
654
655 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
656 fail_test=True)
657
473e5176
MB		 658def test_ap_ft_vlan_over_ds(dev, apdev):
659 """WPA2-PSK-FT AP over DS with VLAN"""
660 ssid = "test-ft"
fab49f61 661 passphrase = "12345678"
473e5176
MB		 662
663 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 664 params['dynamic_vlan'] = "1"
665 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 666 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
667 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 668 params['dynamic_vlan'] = "1"
669 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 670 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
671
672 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
673 conndev="brvlan1")
fab49f61
JM		 674 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
675 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
473e5176 676
40602101
JM		 677def test_ap_ft_over_ds_many(dev, apdev):
678 """WPA2-PSK-FT AP over DS multiple times"""
679 ssid = "test-ft"
fab49f61 680 passphrase = "12345678"
40602101
JM		 681
682 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 683 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 684 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 685 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 686
a8375c94
JM		 687 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
688 roams=50)
40602101 689
473e5176
MB		 690def test_ap_ft_vlan_over_ds_many(dev, apdev):
691 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
692 ssid = "test-ft"
fab49f61 693 passphrase = "12345678"
473e5176
MB		 694
695 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 696 params['dynamic_vlan'] = "1"
697 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 698 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
699 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 700 params['dynamic_vlan'] = "1"
701 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 702 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
703
704 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
705 roams=50, conndev="brvlan1")
706
9fd6804d 707@remote_compatible
c337d07a
JM		 708def test_ap_ft_over_ds_unknown_target(dev, apdev):
709 """WPA2-PSK-FT AP"""
710 ssid = "test-ft"
fab49f61 711 passphrase = "12345678"
c337d07a
JM		 712
713 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 714 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 715
716 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
717 scan_freq="2412")
718 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
719
9fd6804d 720@remote_compatible
211bb7c5
JM		 721def test_ap_ft_over_ds_unexpected(dev, apdev):
722 """WPA2-PSK-FT AP over DS and unexpected response"""
723 ssid = "test-ft"
fab49f61 724 passphrase = "12345678"
211bb7c5
JM		 725
726 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 727 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 728 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 729 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 730
731 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
732 scan_freq="2412")
733 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
734 ap1 = apdev[0]
735 ap2 = apdev[1]
736 hapd1ap = hapd0
737 hapd2ap = hapd1
738 else:
739 ap1 = apdev[1]
740 ap2 = apdev[0]
741 hapd1ap = hapd1
742 hapd2ap = hapd0
743
744 addr = dev[0].own_addr()
745 hapd1ap.set("ext_mgmt_frame_handling", "1")
746 logger.info("Foreign STA address")
747 msg = {}
748 msg['fc'] = 13 << 4
749 msg['da'] = addr
750 msg['sa'] = ap1['bssid']
751 msg['bssid'] = ap1['bssid']
752 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
753 hapd1ap.mgmt_tx(msg)
754
755 logger.info("No over-the-DS in progress")
756 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
757 hapd1ap.mgmt_tx(msg)
758
759 logger.info("Non-zero status code")
760 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
761 hapd1ap.mgmt_tx(msg)
762
763 hapd1ap.dump_monitor()
764
765 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
766 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
767 raise Exception("FT_DS failed")
768
769 req = hapd1ap.mgmt_rx()
770
771 logger.info("Foreign Target AP")
772 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
773 hapd1ap.mgmt_tx(msg)
774
775 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
776
777 logger.info("No IEs")
778 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
779 hapd1ap.mgmt_tx(msg)
780
781 logger.info("Invalid IEs (trigger parsing failure)")
782 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
783 hapd1ap.mgmt_tx(msg)
784
785 logger.info("Too short MDIE")
786 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
787 hapd1ap.mgmt_tx(msg)
788
789 logger.info("Mobility domain mismatch")
790 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
791 hapd1ap.mgmt_tx(msg)
792
793 logger.info("No FTIE")
794 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
795 hapd1ap.mgmt_tx(msg)
796
797 logger.info("FTIE SNonce mismatch")
798 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
799 hapd1ap.mgmt_tx(msg)
800
801 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 802 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 803 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
804 hapd1ap.mgmt_tx(msg)
805
806 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 807 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 808 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
809 hapd1ap.mgmt_tx(msg)
810
811 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 812 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 813 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
814 hapd1ap.mgmt_tx(msg)
815
816 logger.info("No RSNE")
7ab74770 817 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 818 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
819 hapd1ap.mgmt_tx(msg)
820
b553eab1
JM		 821def test_ap_ft_pmf_over_ds(dev, apdev):
822 """WPA2-PSK-FT AP over DS with PMF"""
0c481b78 823 run_ap_ft_pmf_bip_over_ds(dev, apdev, None)
46b8ea21 824
ffcaca68
JM		 825def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
826 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
827 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
828
829def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
830 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
831 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
832
833def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
834 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
835 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
836
837def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
838 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
839 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
840
841def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
0c481b78 842 if cipher and cipher not in dev[0].get_capability("group_mgmt"):
ffcaca68
JM		 843 raise HwsimSkip("Cipher %s not supported" % cipher)
844
845 ssid = "test-ft"
fab49f61 846 passphrase = "12345678"
ffcaca68
JM		 847
848 params = ft_params1(ssid=ssid, passphrase=passphrase)
849 params["ieee80211w"] = "2"
0c481b78
JM		 850 if cipher:
851 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 852 hapd0 = hostapd.add_ap(apdev[0], params)
853 params = ft_params2(ssid=ssid, passphrase=passphrase)
854 params["ieee80211w"] = "2"
0c481b78
JM		 855 if cipher:
856 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 857 hapd1 = hostapd.add_ap(apdev[1], params)
858
0defc42a
JM		 859 Wlantest.setup(hapd0)
860 wt = Wlantest()
861 wt.flush()
862 wt.add_passphrase(passphrase)
863
ffcaca68
JM		 864 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
865 group_mgmt=cipher)
6e658cc4 866
aaba98d3
JM		 867def test_ap_ft_over_ds_pull(dev, apdev):
868 """WPA2-PSK-FT AP over DS (pull PMK)"""
869 ssid = "test-ft"
fab49f61 870 passphrase = "12345678"
aaba98d3
JM		 871
872 params = ft_params1(ssid=ssid, passphrase=passphrase)
873 params["pmk_r1_push"] = "0"
8b8a1864 874 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 875 params = ft_params2(ssid=ssid, passphrase=passphrase)
876 params["pmk_r1_push"] = "0"
8b8a1864 877 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 878
a8375c94 879 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 880
c95dd8e4
JM		 881def test_ap_ft_over_ds_pull_old_key(dev, apdev):
882 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
883 ssid = "test-ft"
fab49f61 884 passphrase = "12345678"
c95dd8e4
JM		 885
886 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
887 params["pmk_r1_push"] = "0"
888 hapd0 = hostapd.add_ap(apdev[0], params)
889 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
890 params["pmk_r1_push"] = "0"
891 hapd1 = hostapd.add_ap(apdev[1], params)
892
893 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
894
473e5176
MB		 895def test_ap_ft_over_ds_pull_vlan(dev, apdev):
896 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
897 ssid = "test-ft"
fab49f61 898 passphrase = "12345678"
473e5176
MB		 899
900 params = ft_params1(ssid=ssid, passphrase=passphrase)
901 params["pmk_r1_push"] = "0"
58be42b2
JM		 902 params['dynamic_vlan'] = "1"
903 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 904 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
905 params = ft_params2(ssid=ssid, passphrase=passphrase)
906 params["pmk_r1_push"] = "0"
58be42b2
JM		 907 params['dynamic_vlan'] = "1"
908 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 909 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
910
911 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
912 conndev="brvlan1")
913
425e5f97
JM		 914def start_ft_sae(dev, apdev, wpa_ptk_rekey=None):
915 if "SAE" not in dev.get_capability("auth_alg"):
b9749b6a 916 raise HwsimSkip("SAE not supported")
6e658cc4 917 ssid = "test-ft"
fab49f61 918 passphrase = "12345678"
6e658cc4
JM		 919
920 params = ft_params1(ssid=ssid, passphrase=passphrase)
921 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 922 if wpa_ptk_rekey:
923 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 924 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 925 params = ft_params2(ssid=ssid, passphrase=passphrase)
926 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 927 if wpa_ptk_rekey:
928 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
929 hapd1 = hostapd.add_ap(apdev[1], params)
930 key_mgmt = hapd1.get_config()['key_mgmt']
65038313
JM		 931 if key_mgmt.split(' ')[0] != "FT-SAE":
932 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 933
425e5f97
JM		 934 dev.request("SET sae_groups ")
935 return hapd0, hapd1
936
937def test_ap_ft_sae(dev, apdev):
938 """WPA2-PSK-FT-SAE AP"""
939 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
940 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True)
941
942def test_ap_ft_sae_ptk_rekey0(dev, apdev):
943 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
944 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
945 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
946 ptk_rekey="1", roams=0)
947 check_ptk_rekey(dev[0], hapd0, hapd1)
948
949def test_ap_ft_sae_ptk_rekey1(dev, apdev):
950 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
951 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
952 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
953 ptk_rekey="1", only_one_way=True)
954 check_ptk_rekey(dev[0], hapd0, hapd1)
955
956def test_ap_ft_sae_ptk_rekey_ap(dev, apdev):
957 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by AP"""
958 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
959 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
960 only_one_way=True)
961 check_ptk_rekey(dev[0], hapd0, hapd1)
6e658cc4
JM		 962
963def test_ap_ft_sae_over_ds(dev, apdev):
964 """WPA2-PSK-FT-SAE AP over DS"""
425e5f97
JM		 965 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
966 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
a8375c94 967 over_ds=True)
6f62809b 968
425e5f97
JM		 969def test_ap_ft_sae_over_ds_ptk_rekey0(dev, apdev):
970 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
971 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
972 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
973 over_ds=True, ptk_rekey="1", roams=0)
974 check_ptk_rekey(dev[0], hapd0, hapd1)
975
976def test_ap_ft_sae_over_ds_ptk_rekey1(dev, apdev):
977 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
978 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
979 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
980 over_ds=True, ptk_rekey="1", only_one_way=True)
981 check_ptk_rekey(dev[0], hapd0, hapd1)
982
983def test_ap_ft_sae_over_ds_ptk_rekey_ap(dev, apdev):
984 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by AP"""
985 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
986 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
987 over_ds=True, only_one_way=True)
988 check_ptk_rekey(dev[0], hapd0, hapd1)
989
3d5b88b5
JM		 990def test_ap_ft_sae_pw_id(dev, apdev):
991 """FT-SAE with Password Identifier"""
992 if "SAE" not in dev[0].get_capability("auth_alg"):
993 raise HwsimSkip("SAE not supported")
994 ssid = "test-ft"
995
996 params = ft_params1(ssid=ssid)
997 params["ieee80211w"] = "2"
998 params['wpa_key_mgmt'] = "FT-SAE"
999 params['sae_password'] = 'secret|id=pwid'
1000 hapd0 = hostapd.add_ap(apdev[0], params)
1001 params = ft_params2(ssid=ssid)
1002 params["ieee80211w"] = "2"
1003 params['wpa_key_mgmt'] = "FT-SAE"
1004 params['sae_password'] = 'secret|id=pwid'
1005 hapd = hostapd.add_ap(apdev[1], params)
1006
1007 dev[0].request("SET sae_groups ")
1008 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
1009 sae_password="secret", sae_password_id="pwid")
1010
cdf53910
JM		 1011def test_ap_ft_sae_with_both_akms(dev, apdev):
1012 """SAE + FT-SAE configuration"""
1013 if "SAE" not in dev[0].get_capability("auth_alg"):
1014 raise HwsimSkip("SAE not supported")
1015 ssid = "test-ft"
1016 passphrase = "12345678"
1017
1018 params = ft_params1(ssid=ssid, passphrase=passphrase)
1019 params['wpa_key_mgmt'] = "FT-SAE SAE"
1020 hapd0 = hostapd.add_ap(apdev[0], params)
1021 params = ft_params2(ssid=ssid, passphrase=passphrase)
1022 params['wpa_key_mgmt'] = "FT-SAE SAE"
1023 hapd = hostapd.add_ap(apdev[1], params)
1024 key_mgmt = hapd.get_config()['key_mgmt']
1025 if key_mgmt.split(' ')[0] != "FT-SAE":
1026 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1027
1028 dev[0].request("SET sae_groups ")
1029 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1030 sae_and_psk=True)
1031
1211031a
JM		 1032def test_ap_ft_sae_pmksa_caching(dev, apdev):
1033 """WPA2-FT-SAE AP and PMKSA caching for initial mobility domain association"""
1034 if "SAE" not in dev[0].get_capability("auth_alg"):
1035 raise HwsimSkip("SAE not supported")
1036 ssid = "test-ft"
1037 passphrase = "12345678"
1038
1039 params = ft_params1(ssid=ssid, passphrase=passphrase)
1040 params['wpa_key_mgmt'] = "FT-SAE"
1041 hapd0 = hostapd.add_ap(apdev[0], params)
1042 params = ft_params2(ssid=ssid, passphrase=passphrase)
1043 params['wpa_key_mgmt'] = "FT-SAE"
1044 hapd = hostapd.add_ap(apdev[1], params)
1045 key_mgmt = hapd.get_config()['key_mgmt']
1046 if key_mgmt.split(' ')[0] != "FT-SAE":
1047 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1048
1049 dev[0].request("SET sae_groups ")
1050 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1051 pmksa_caching=True)
1052
d269740a 1053def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
425e5f97
JM		 1054 discovery=False, roams=1, wpa_ptk_rekey=0,
1055 only_one_way=False):
6f62809b 1056 ssid = "test-ft"
fab49f61 1057 passphrase = "12345678"
9c50a6d3 1058 if vlan:
fab49f61
JM		 1059 identity = "gpsk-vlan1"
1060 conndev = "brvlan1"
d269740a 1061 elif cui:
fab49f61
JM		 1062 identity = "gpsk-cui"
1063 conndev = False
9c50a6d3 1064 else:
fab49f61
JM		 1065 identity = "gpsk user"
1066 conndev = False
6f62809b
JM		 1067
1068 radius = hostapd.radius_params()
942b52a8 1069 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1070 params['wpa_key_mgmt'] = "FT-EAP"
1071 params["ieee8021x"] = "1"
9c50a6d3
MB		 1072 if vlan:
1073 params["dynamic_vlan"] = "1"
35d8c254 1074 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1075 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 1076 key_mgmt = hapd.get_config()['key_mgmt']
1077 if key_mgmt.split(' ')[0] != "FT-EAP":
1078 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 1079 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1080 params['wpa_key_mgmt'] = "FT-EAP"
1081 params["ieee8021x"] = "1"
9c50a6d3
MB		 1082 if vlan:
1083 params["dynamic_vlan"] = "1"
425e5f97
JM		 1084 if wpa_ptk_rekey:
1085 params["wpa_ptk_rekey"] = str(wpa_ptk_rekey)
35d8c254 1086 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1087 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 1088
942b52a8 1089 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3 1090 over_ds=over_ds, roams=roams, eap_identity=identity,
425e5f97 1091 conndev=conndev, only_one_way=only_one_way)
91bc6c36
JM		 1092 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
1093 raise Exception("Scan results missing RSN element info")
fab49f61
JM		 1094 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
1095 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
425e5f97
JM		 1096 if only_one_way:
1097 return
aaba98d3 1098
4013d688
JM		 1099 # Verify EAPOL reauthentication after FT protocol
1100 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1101 ap = hapd
1102 else:
1103 ap = hapd1
1104 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
1105 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
1106 if ev is None:
1107 raise Exception("EAP authentication did not start")
1108 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
1109 if ev is None:
1110 raise Exception("EAP authentication did not succeed")
1111 time.sleep(0.1)
9c50a6d3
MB		 1112 if conndev:
1113 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
1114 else:
1115 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 1116
942b52a8
MB		 1117def test_ap_ft_eap(dev, apdev):
1118 """WPA2-EAP-FT AP"""
1119 generic_ap_ft_eap(dev, apdev)
1120
d269740a
MB		 1121def test_ap_ft_eap_cui(dev, apdev):
1122 """WPA2-EAP-FT AP with CUI"""
1123 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
1124
9c50a6d3
MB		 1125def test_ap_ft_eap_vlan(dev, apdev):
1126 """WPA2-EAP-FT AP with VLAN"""
1127 generic_ap_ft_eap(dev, apdev, vlan=True)
1128
1129def test_ap_ft_eap_vlan_multi(dev, apdev):
1130 """WPA2-EAP-FT AP with VLAN"""
1131 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1132
942b52a8
MB		 1133def test_ap_ft_eap_over_ds(dev, apdev):
1134 """WPA2-EAP-FT AP using over-the-DS"""
1135 generic_ap_ft_eap(dev, apdev, over_ds=True)
1136
1137def test_ap_ft_eap_dis(dev, apdev):
1138 """WPA2-EAP-FT AP with AP discovery"""
1139 generic_ap_ft_eap(dev, apdev, discovery=True)
1140
1141def test_ap_ft_eap_dis_over_ds(dev, apdev):
1142 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1143 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1144
9c50a6d3
MB		 1145def test_ap_ft_eap_vlan(dev, apdev):
1146 """WPA2-EAP-FT AP with VLAN"""
1147 generic_ap_ft_eap(dev, apdev, vlan=True)
1148
1149def test_ap_ft_eap_vlan_multi(dev, apdev):
1150 """WPA2-EAP-FT AP with VLAN"""
1151 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1152
1153def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1154 """WPA2-EAP-FT AP with VLAN + over_ds"""
1155 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1156
1157def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1158 """WPA2-EAP-FT AP with VLAN + over_ds"""
1159 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1160
1161def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1162 """WPA2-EAP-FT AP (pull PMK)"""
1163 ssid = "test-ft"
fab49f61 1164 passphrase = "12345678"
9c50a6d3 1165 if vlan:
fab49f61
JM		 1166 identity = "gpsk-vlan1"
1167 conndev = "brvlan1"
9c50a6d3 1168 else:
fab49f61
JM		 1169 identity = "gpsk user"
1170 conndev = False
aaba98d3
JM		 1171
1172 radius = hostapd.radius_params()
1173 params = ft_params1(ssid=ssid, passphrase=passphrase)
1174 params['wpa_key_mgmt'] = "FT-EAP"
1175 params["ieee8021x"] = "1"
1176 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1177 if vlan:
1178 params["dynamic_vlan"] = "1"
35d8c254 1179 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1180 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1181 key_mgmt = hapd.get_config()['key_mgmt']
1182 if key_mgmt.split(' ')[0] != "FT-EAP":
1183 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1184 params = ft_params2(ssid=ssid, passphrase=passphrase)
1185 params['wpa_key_mgmt'] = "FT-EAP"
1186 params["ieee8021x"] = "1"
1187 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1188 if vlan:
1189 params["dynamic_vlan"] = "1"
35d8c254 1190 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1191 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1192
9c50a6d3
MB		 1193 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1194 eap_identity=identity, conndev=conndev)
1195
1196def test_ap_ft_eap_pull(dev, apdev):
1197 """WPA2-EAP-FT AP (pull PMK)"""
1198 generic_ap_ft_eap_pull(dev, apdev)
1199
1200def test_ap_ft_eap_pull_vlan(dev, apdev):
1201 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1202
f81c1411
JM		 1203def test_ap_ft_eap_pull_wildcard(dev, apdev):
1204 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1205 ssid = "test-ft"
fab49f61 1206 passphrase = "12345678"
f81c1411
JM		 1207
1208 radius = hostapd.radius_params()
1209 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1210 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1211 params["ieee8021x"] = "1"
1212 params["pmk_r1_push"] = "0"
1213 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1214 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1215 params["ft_psk_generate_local"] = "1"
1216 params["eap_server"] = "0"
c6ab7b55
JM		 1217 params["rkh_pos_timeout"] = "100"
1218 params["rkh_neg_timeout"] = "50"
1219 params["rkh_pull_timeout"] = "1234"
1220 params["rkh_pull_retries"] = "10"
35d8c254 1221 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1222 hapd = hostapd.add_ap(apdev[0], params)
1223 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1224 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1225 params["ieee8021x"] = "1"
1226 params["pmk_r1_push"] = "0"
1227 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1228 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1229 params["ft_psk_generate_local"] = "1"
1230 params["eap_server"] = "0"
35d8c254 1231 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1232 hapd1 = hostapd.add_ap(apdev[1], params)
1233
1234 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1235
9fd6804d 1236@remote_compatible
3b808945
JM		 1237def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1238 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1239 ssid = "test-ft"
fab49f61 1240 passphrase = "12345678"
3b808945
JM		 1241
1242 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1243 params["ieee80211w"] = "2"
8b8a1864 1244 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1245 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1246 params["ieee80211w"] = "2"
8b8a1864 1247 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1248
a8375c94
JM		 1249 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1250 fail_test=True)
3b808945 1251
9fd6804d 1252@remote_compatible
3b808945
JM		 1253def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1254 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1255 ssid = "test-ft"
fab49f61 1256 passphrase = "12345678"
3b808945
JM		 1257
1258 params = ft_params1(ssid=ssid, passphrase=passphrase)
1259 params["pmk_r1_push"] = "0"
8b8a1864 1260 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1261 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1262 params["pmk_r1_push"] = "0"
8b8a1864 1263 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1264
a8375c94
JM		 1265 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1266 fail_test=True)
3b808945 1267
9fd6804d 1268@remote_compatible
ae14a2e2
JM		 1269def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1270 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1271 ssid = "test-ft"
fab49f61 1272 passphrase = "12345678"
ae14a2e2
JM		 1273
1274 params = ft_params1(ssid=ssid, passphrase=passphrase)
1275 params["pmk_r1_push"] = "0"
1276 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1277 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1278 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1279 scan_freq="2412")
ae14a2e2
JM		 1280
1281 params = ft_params2(ssid=ssid, passphrase=passphrase)
1282 params["pmk_r1_push"] = "0"
8b8a1864 1283 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1284
1285 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1286 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1287
9fd6804d 1288@remote_compatible
3b808945
JM		 1289def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1290 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1291 ssid = "test-ft"
fab49f61 1292 passphrase = "12345678"
3b808945
JM		 1293
1294 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1295 params["ieee80211w"] = "2"
8b8a1864 1296 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1297 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1298 params["ieee80211w"] = "2"
8b8a1864 1299 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1300
a8375c94
JM		 1301 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1302 fail_test=True)
3b808945 1303
9fd6804d 1304@remote_compatible
3b808945
JM		 1305def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1306 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1307 ssid = "test-ft"
fab49f61 1308 passphrase = "12345678"
3b808945
JM		 1309
1310 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1311 params["pmk_r1_push"] = "0"
8b8a1864 1312 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1313 params = ft_params2(ssid=ssid, passphrase=passphrase)
1314 params["pmk_r1_push"] = "0"
8b8a1864 1315 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1316
a8375c94
JM		 1317 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1318 fail_test=True)
c6b6e105 1319
150948e6
MB		 1320def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1321 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1322 ssid = "test-ft"
fab49f61 1323 passphrase = "12345678"
150948e6
MB		 1324
1325 radius = hostapd.radius_params()
1326 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1327 params["ieee80211w"] = "2"
150948e6
MB		 1328 params['wpa_key_mgmt'] = "FT-EAP"
1329 params["ieee8021x"] = "1"
35d8c254 1330 params = dict(list(radius.items()) + list(params.items()))
b098542c 1331 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1332 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1333 params["ieee80211w"] = "2"
150948e6
MB		 1334 params['wpa_key_mgmt'] = "FT-EAP"
1335 params["ieee8021x"] = "1"
35d8c254 1336 params = dict(list(radius.items()) + list(params.items()))
b098542c 1337 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1338
1339 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1340 fail_test=True, eap=True)
1341
1342def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1343 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1344 ssid = "test-ft"
fab49f61 1345 passphrase = "12345678"
150948e6
MB		 1346
1347 radius = hostapd.radius_params()
1348 params = ft_params1(ssid=ssid, passphrase=passphrase)
1349 params["pmk_r1_push"] = "0"
1350 params['wpa_key_mgmt'] = "FT-EAP"
1351 params["ieee8021x"] = "1"
35d8c254 1352 params = dict(list(radius.items()) + list(params.items()))
b098542c 1353 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1354 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1355 params["pmk_r1_push"] = "0"
1356 params['wpa_key_mgmt'] = "FT-EAP"
1357 params["ieee8021x"] = "1"
35d8c254 1358 params = dict(list(radius.items()) + list(params.items()))
b098542c 1359 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1360
1361 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1362 fail_test=True, eap=True)
1363
1364def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1365 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1366 ssid = "test-ft"
fab49f61 1367 passphrase = "12345678"
150948e6
MB		 1368
1369 radius = hostapd.radius_params()
1370 params = ft_params1(ssid=ssid, passphrase=passphrase)
1371 params["pmk_r1_push"] = "0"
1372 params["nas_identifier"] = "nas0.w1.fi"
1373 params['wpa_key_mgmt'] = "FT-EAP"
1374 params["ieee8021x"] = "1"
35d8c254 1375 params = dict(list(radius.items()) + list(params.items()))
b098542c 1376 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1377 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1378 eap="GPSK", identity="gpsk user",
1379 password="abcdefghijklmnop0123456789abcdef",
1380 scan_freq="2412")
1381
1382 params = ft_params2(ssid=ssid, passphrase=passphrase)
1383 params["pmk_r1_push"] = "0"
1384 params['wpa_key_mgmt'] = "FT-EAP"
1385 params["ieee8021x"] = "1"
35d8c254 1386 params = dict(list(radius.items()) + list(params.items()))
b098542c 1387 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1388
1389 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1390 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1391
1392def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1393 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1394 ssid = "test-ft"
fab49f61 1395 passphrase = "12345678"
150948e6
MB		 1396
1397 radius = hostapd.radius_params()
1398 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1399 params["ieee80211w"] = "2"
150948e6
MB		 1400 params['wpa_key_mgmt'] = "FT-EAP"
1401 params["ieee8021x"] = "1"
35d8c254 1402 params = dict(list(radius.items()) + list(params.items()))
b098542c 1403 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1404 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1405 params["ieee80211w"] = "2"
150948e6
MB		 1406 params['wpa_key_mgmt'] = "FT-EAP"
1407 params["ieee8021x"] = "1"
35d8c254 1408 params = dict(list(radius.items()) + list(params.items()))
b098542c 1409 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1410
1411 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1412 fail_test=True, eap=True)
1413
1414def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1415 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1416 ssid = "test-ft"
fab49f61 1417 passphrase = "12345678"
150948e6
MB		 1418
1419 radius = hostapd.radius_params()
1420 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1421 params["pmk_r1_push"] = "0"
1422 params['wpa_key_mgmt'] = "FT-EAP"
1423 params["ieee8021x"] = "1"
35d8c254 1424 params = dict(list(radius.items()) + list(params.items()))
b098542c 1425 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1426 params = ft_params2(ssid=ssid, passphrase=passphrase)
1427 params["pmk_r1_push"] = "0"
1428 params['wpa_key_mgmt'] = "FT-EAP"
1429 params["ieee8021x"] = "1"
35d8c254 1430 params = dict(list(radius.items()) + list(params.items()))
b098542c 1431 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1432
1433 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1434 fail_test=True, eap=True)
1435
c6b6e105
JM		 1436def test_ap_ft_gtk_rekey(dev, apdev):
1437 """WPA2-PSK-FT AP and GTK rekey"""
1438 ssid = "test-ft"
fab49f61 1439 passphrase = "12345678"
c6b6e105
JM		 1440
1441 params = ft_params1(ssid=ssid, passphrase=passphrase)
1442 params['wpa_group_rekey'] = '1'
8b8a1864 1443 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1444
1445 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1446 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1447
1448 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1449 if ev is None:
1450 raise Exception("GTK rekey timed out after initial association")
a8375c94 1451 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1452
1453 params = ft_params2(ssid=ssid, passphrase=passphrase)
1454 params['wpa_group_rekey'] = '1'
8b8a1864 1455 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1456
1457 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1458 dev[0].roam(apdev[1]['bssid'])
1459 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1460 raise Exception("Did not connect to correct AP")
a8375c94 1461 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1462
1463 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1464 if ev is None:
1465 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1466 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1467
1468def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1469 """WPA2-PSK-FT and key lifetime in memory"""
1470 ssid = "test-ft"
fab49f61 1471 passphrase = "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
5b3c40a6
JM		 1472 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1473 pmk = binascii.unhexlify(psk)
1474 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1475 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1476 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1477 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1478
1479 pid = find_wpas_process(dev[0])
1480
1481 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1482 scan_freq="2412")
8e416cec
JM		 1483 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1484 # event has been delivered, so verify that wpa_supplicant has returned to
1485 # eloop before reading process memory.
54f2cae2 1486 time.sleep(1)
8e416cec 1487 dev[0].ping()
5b3c40a6
JM		 1488
1489 buf = read_process_memory(pid, pmk)
1490
1491 dev[0].request("DISCONNECT")
1492 dev[0].wait_disconnected()
1493
1494 dev[0].relog()
1495 pmkr0 = None
1496 pmkr1 = None
1497 ptk = None
1498 gtk = None
1499 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1500 for l in f.readlines():
1501 if "FT: PMK-R0 - hexdump" in l:
1502 val = l.strip().split(':')[3].replace(' ', '')
1503 pmkr0 = binascii.unhexlify(val)
1504 if "FT: PMK-R1 - hexdump" in l:
1505 val = l.strip().split(':')[3].replace(' ', '')
1506 pmkr1 = binascii.unhexlify(val)
f918b95b 1507 if "FT: KCK - hexdump" in l:
5b3c40a6 1508 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1509 kck = binascii.unhexlify(val)
1510 if "FT: KEK - hexdump" in l:
1511 val = l.strip().split(':')[3].replace(' ', '')
1512 kek = binascii.unhexlify(val)
1513 if "FT: TK - hexdump" in l:
1514 val = l.strip().split(':')[3].replace(' ', '')
1515 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1516 if "WPA: Group Key - hexdump" in l:
1517 val = l.strip().split(':')[3].replace(' ', '')
1518 gtk = binascii.unhexlify(val)
f918b95b 1519 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1520 raise Exception("Could not find keys from debug log")
1521 if len(gtk) != 16:
1522 raise Exception("Unexpected GTK length")
1523
5b3c40a6
JM		 1524 logger.info("Checking keys in memory while associated")
1525 get_key_locations(buf, pmk, "PMK")
1526 get_key_locations(buf, pmkr0, "PMK-R0")
1527 get_key_locations(buf, pmkr1, "PMK-R1")
1528 if pmk not in buf:
81e787b7 1529 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1530 if pmkr0 not in buf:
81e787b7 1531 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1532 if pmkr1 not in buf:
81e787b7 1533 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1534 if kck not in buf:
1535 raise Exception("KCK not found while associated")
1536 if kek not in buf:
1537 raise Exception("KEK not found while associated")
b74f82a4
JM		 1538 #if tk in buf:
1539 # raise Exception("TK found from memory")
5b3c40a6
JM		 1540
1541 logger.info("Checking keys in memory after disassociation")
1542 buf = read_process_memory(pid, pmk)
1543 get_key_locations(buf, pmk, "PMK")
1544 get_key_locations(buf, pmkr0, "PMK-R0")
1545 get_key_locations(buf, pmkr1, "PMK-R1")
1546
1547 # Note: PMK/PSK is still present in network configuration
1548
1549 fname = os.path.join(params['logdir'],
1550 'ft_psk_key_lifetime_in_memory.memctx-')
1551 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1552 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1553 verify_not_present(buf, kck, fname, "KCK")
1554 verify_not_present(buf, kek, fname, "KEK")
1555 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1556 if gtk in buf:
1557 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1558 verify_not_present(buf, gtk, fname, "GTK")
1559
1560 dev[0].request("REMOVE_NETWORK all")
1561
1562 logger.info("Checking keys in memory after network profile removal")
1563 buf = read_process_memory(pid, pmk)
1564 get_key_locations(buf, pmk, "PMK")
1565 get_key_locations(buf, pmkr0, "PMK-R0")
1566 get_key_locations(buf, pmkr1, "PMK-R1")
1567
1568 verify_not_present(buf, pmk, fname, "PMK")
1569 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1570 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1571 verify_not_present(buf, kck, fname, "KCK")
1572 verify_not_present(buf, kek, fname, "KEK")
1573 verify_not_present(buf, tk, fname, "TK")
1574 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1575
9fd6804d 1576@remote_compatible
664093b5
JM		 1577def test_ap_ft_invalid_resp(dev, apdev):
1578 """WPA2-PSK-FT AP and invalid response IEs"""
1579 ssid = "test-ft"
fab49f61 1580 passphrase = "12345678"
664093b5
JM		 1581
1582 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1583 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1584 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1585 scan_freq="2412")
1586
1587 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1588 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1589
1590 tests = [
1591 # Various IEs for test coverage. The last one is FTIE with invalid
1592 # R1KH-ID subelement.
1593 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1594 # FTIE with invalid R0KH-ID subelement (len=0).
1595 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1596 # FTIE with invalid R0KH-ID subelement (len=49).
1597 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1598 # Invalid RSNE.
1599 "020002000000" + "3000",
1600 # Required IEs missing from protected IE count.
1601 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1602 # RIC missing from protected IE count.
1603 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1604 # Protected IE missing.
fab49f61 1605 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
664093b5
JM		 1606 for t in tests:
1607 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1608 hapd1.set("ext_mgmt_frame_handling", "1")
1609 hapd1.dump_monitor()
1610 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1611 raise Exception("ROAM failed")
1612 auth = None
1613 for i in range(20):
1614 msg = hapd1.mgmt_rx()
1615 if msg['subtype'] == 11:
1616 auth = msg
1617 break
1618 if not auth:
1619 raise Exception("Authentication frame not seen")
1620
1621 resp = {}
1622 resp['fc'] = auth['fc']
1623 resp['da'] = auth['sa']
1624 resp['sa'] = auth['da']
1625 resp['bssid'] = auth['bssid']
1626 resp['payload'] = binascii.unhexlify(t)
1627 hapd1.mgmt_tx(resp)
1628 hapd1.set("ext_mgmt_frame_handling", "0")
1629 dev[0].wait_disconnected()
1630
1631 dev[0].request("RECONNECT")
1632 dev[0].wait_connected()
7b741a53
JM		 1633
1634def test_ap_ft_gcmp_256(dev, apdev):
1635 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1636 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1637 raise HwsimSkip("Cipher GCMP-256 not supported")
1638 ssid = "test-ft"
fab49f61 1639 passphrase = "12345678"
7b741a53
JM		 1640
1641 params = ft_params1(ssid=ssid, passphrase=passphrase)
1642 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1643 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1644 params = ft_params2(ssid=ssid, passphrase=passphrase)
1645 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1646 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1647
1648 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1649 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1650
63a7683b 1651def setup_ap_ft_oom(dev, apdev):
38934ed1 1652 skip_with_fips(dev[0])
cf671d54 1653 ssid = "test-ft"
fab49f61 1654 passphrase = "12345678"
cf671d54
JM		 1655
1656 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1657 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1658 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1659 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1660
1661 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1662 scan_freq="2412")
1663 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1664 dst = apdev[1]['bssid']
1665 else:
1666 dst = apdev[0]['bssid']
1667
1668 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1669
1670 return dst
1671
1672def test_ap_ft_oom(dev, apdev):
1673 """WPA2-PSK-FT and OOM"""
1674 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1675 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1676 dev[0].roam(dst)
63a7683b
JM		 1677
1678def test_ap_ft_oom2(dev, apdev):
1679 """WPA2-PSK-FT and OOM (2)"""
1680 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1681 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1682 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1683
1684def test_ap_ft_oom3(dev, apdev):
1685 """WPA2-PSK-FT and OOM (3)"""
1686 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1687 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1688 dev[0].roam(dst)
34d3eaa8 1689
63a7683b
JM		 1690def test_ap_ft_oom4(dev, apdev):
1691 """WPA2-PSK-FT and OOM (4)"""
1692 ssid = "test-ft"
fab49f61 1693 passphrase = "12345678"
63a7683b 1694 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1695 dev[0].request("REMOVE_NETWORK all")
1696 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1697 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1698 scan_freq="2412")
1699
682a79f0
JM		 1700def test_ap_ft_ap_oom(dev, apdev):
1701 """WPA2-PSK-FT and AP OOM"""
1702 ssid = "test-ft"
fab49f61 1703 passphrase = "12345678"
682a79f0
JM		 1704
1705 params = ft_params1(ssid=ssid, passphrase=passphrase)
1706 hapd0 = hostapd.add_ap(apdev[0], params)
1707 bssid0 = hapd0.own_addr()
1708
1709 dev[0].scan_for_bss(bssid0, freq="2412")
1710 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1711 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1712 scan_freq="2412")
1713
1714 params = ft_params2(ssid=ssid, passphrase=passphrase)
1715 hapd1 = hostapd.add_ap(apdev[1], params)
1716 bssid1 = hapd1.own_addr()
1717 dev[0].scan_for_bss(bssid1, freq="2412")
1718 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1719 dev[0].roam(bssid1)
1720
1721def test_ap_ft_ap_oom2(dev, apdev):
1722 """WPA2-PSK-FT and AP OOM 2"""
1723 ssid = "test-ft"
fab49f61 1724 passphrase = "12345678"
682a79f0
JM		 1725
1726 params = ft_params1(ssid=ssid, passphrase=passphrase)
1727 hapd0 = hostapd.add_ap(apdev[0], params)
1728 bssid0 = hapd0.own_addr()
1729
1730 dev[0].scan_for_bss(bssid0, freq="2412")
1731 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1732 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1733 scan_freq="2412")
1734
1735 params = ft_params2(ssid=ssid, passphrase=passphrase)
1736 hapd1 = hostapd.add_ap(apdev[1], params)
1737 bssid1 = hapd1.own_addr()
1738 dev[0].scan_for_bss(bssid1, freq="2412")
1739 dev[0].roam(bssid1)
1740 if dev[0].get_status_field('bssid') != bssid1:
1741 raise Exception("Did not roam to AP1")
1742 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1743 dev[0].roam(bssid0)
1744
1745def test_ap_ft_ap_oom3(dev, apdev):
1746 """WPA2-PSK-FT and AP OOM 3"""
1747 ssid = "test-ft"
fab49f61 1748 passphrase = "12345678"
682a79f0
JM		 1749
1750 params = ft_params1(ssid=ssid, passphrase=passphrase)
1751 hapd0 = hostapd.add_ap(apdev[0], params)
1752 bssid0 = hapd0.own_addr()
1753
1754 dev[0].scan_for_bss(bssid0, freq="2412")
1755 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1756 scan_freq="2412")
1757
1758 params = ft_params2(ssid=ssid, passphrase=passphrase)
1759 hapd1 = hostapd.add_ap(apdev[1], params)
1760 bssid1 = hapd1.own_addr()
1761 dev[0].scan_for_bss(bssid1, freq="2412")
1762 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1763 # This will fail due to not being able to send out PMK-R1 pull request
1764 dev[0].roam(bssid1)
1765
ba88dd65 1766 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1767 # This will fail due to not being able to send out PMK-R1 pull request
1768 dev[0].roam(bssid1)
1769
ba88dd65
MB		 1770 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1771 # This will fail due to not being able to send out PMK-R1 pull request
1772 dev[0].roam(bssid1)
1773
1774def test_ap_ft_ap_oom3b(dev, apdev):
1775 """WPA2-PSK-FT and AP OOM 3b"""
1776 ssid = "test-ft"
fab49f61 1777 passphrase = "12345678"
ba88dd65
MB		 1778
1779 params = ft_params1(ssid=ssid, passphrase=passphrase)
1780 hapd0 = hostapd.add_ap(apdev[0], params)
1781 bssid0 = hapd0.own_addr()
1782
1783 dev[0].scan_for_bss(bssid0, freq="2412")
1784 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1785 scan_freq="2412")
1786
1787 params = ft_params2(ssid=ssid, passphrase=passphrase)
1788 hapd1 = hostapd.add_ap(apdev[1], params)
1789 bssid1 = hapd1.own_addr()
1790 dev[0].scan_for_bss(bssid1, freq="2412")
1791 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1792 # This will fail due to not being able to send out PMK-R1 pull request
1793 dev[0].roam(bssid1)
1794
1795def test_ap_ft_ap_oom4(dev, apdev):
1796 """WPA2-PSK-FT and AP OOM 4"""
1797 ssid = "test-ft"
fab49f61 1798 passphrase = "12345678"
682a79f0
JM		 1799
1800 params = ft_params1(ssid=ssid, passphrase=passphrase)
1801 hapd0 = hostapd.add_ap(apdev[0], params)
1802 bssid0 = hapd0.own_addr()
1803
1804 dev[0].scan_for_bss(bssid0, freq="2412")
1805 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1806 scan_freq="2412")
1807
1808 params = ft_params2(ssid=ssid, passphrase=passphrase)
1809 hapd1 = hostapd.add_ap(apdev[1], params)
1810 bssid1 = hapd1.own_addr()
1811 dev[0].scan_for_bss(bssid1, freq="2412")
1812 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1813 dev[0].roam(bssid1)
1814 if dev[0].get_status_field('bssid') != bssid1:
1815 raise Exception("Did not roam to AP1")
1816
1817 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1818 dev[0].roam(bssid0)
1819 if dev[0].get_status_field('bssid') != bssid0:
1820 raise Exception("Did not roam to AP0")
1821
1822 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1823 dev[0].roam(bssid1)
1824 if dev[0].get_status_field('bssid') != bssid1:
1825 raise Exception("Did not roam to AP1")
1826
1827def test_ap_ft_ap_oom5(dev, apdev):
1828 """WPA2-PSK-FT and AP OOM 5"""
1829 ssid = "test-ft"
fab49f61 1830 passphrase = "12345678"
682a79f0
JM		 1831
1832 params = ft_params1(ssid=ssid, passphrase=passphrase)
1833 hapd0 = hostapd.add_ap(apdev[0], params)
1834 bssid0 = hapd0.own_addr()
1835
1836 dev[0].scan_for_bss(bssid0, freq="2412")
1837 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1838 scan_freq="2412")
1839
1840 params = ft_params2(ssid=ssid, passphrase=passphrase)
1841 hapd1 = hostapd.add_ap(apdev[1], params)
1842 bssid1 = hapd1.own_addr()
1843 dev[0].scan_for_bss(bssid1, freq="2412")
1844 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1845 # This will fail to roam
1846 dev[0].roam(bssid1)
1847
1848 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1849 # This will fail to roam
1850 dev[0].roam(bssid1)
1851
1852 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1853 # This will fail to roam
1854 dev[0].roam(bssid1)
1855
1856 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1857 # This will fail to roam
1858 dev[0].roam(bssid1)
1859
1860 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1861 # This will fail to roam
1862 dev[0].roam(bssid1)
1863
1864def test_ap_ft_ap_oom6(dev, apdev):
1865 """WPA2-PSK-FT and AP OOM 6"""
1866 ssid = "test-ft"
fab49f61 1867 passphrase = "12345678"
682a79f0
JM		 1868
1869 params = ft_params1(ssid=ssid, passphrase=passphrase)
1870 hapd0 = hostapd.add_ap(apdev[0], params)
1871 bssid0 = hapd0.own_addr()
1872
1873 dev[0].scan_for_bss(bssid0, freq="2412")
1874 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1875 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1876 scan_freq="2412")
1877 dev[0].request("REMOVE_NETWORK all")
1878 dev[0].wait_disconnected()
1879 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1880 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1881 scan_freq="2412")
1882 dev[0].request("REMOVE_NETWORK all")
1883 dev[0].wait_disconnected()
1884 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1885 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1886 scan_freq="2412")
1887
c5262648
JM		 1888def test_ap_ft_ap_oom7a(dev, apdev):
1889 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0 1890 ssid = "test-ft"
fab49f61 1891 passphrase = "12345678"
682a79f0
JM		 1892
1893 params = ft_params1(ssid=ssid, passphrase=passphrase)
1894 params["ieee80211w"] = "2"
1895 hapd0 = hostapd.add_ap(apdev[0], params)
1896 bssid0 = hapd0.own_addr()
1897
1898 dev[0].scan_for_bss(bssid0, freq="2412")
1899 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1900 ieee80211w="2", scan_freq="2412")
1901
1902 params = ft_params2(ssid=ssid, passphrase=passphrase)
1903 params["ieee80211w"] = "2"
1904 hapd1 = hostapd.add_ap(apdev[1], params)
1905 bssid1 = hapd1.own_addr()
1906 dev[0].scan_for_bss(bssid1, freq="2412")
1907 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1908 # This will fail to roam
1909 dev[0].roam(bssid1)
c5262648
JM		 1910
1911def test_ap_ft_ap_oom7b(dev, apdev):
1912 """WPA2-PSK-FT and AP OOM 7b"""
1913 ssid = "test-ft"
fab49f61 1914 passphrase = "12345678"
c5262648
JM		 1915
1916 params = ft_params1(ssid=ssid, passphrase=passphrase)
1917 params["ieee80211w"] = "2"
1918 hapd0 = hostapd.add_ap(apdev[0], params)
1919 bssid0 = hapd0.own_addr()
1920
1921 dev[0].scan_for_bss(bssid0, freq="2412")
1922 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1923 ieee80211w="2", scan_freq="2412")
1924
1925 params = ft_params2(ssid=ssid, passphrase=passphrase)
1926 params["ieee80211w"] = "2"
1927 hapd1 = hostapd.add_ap(apdev[1], params)
1928 bssid1 = hapd1.own_addr()
1929 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1930 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1931 # This will fail to roam
1932 dev[0].roam(bssid1)
c5262648
JM		 1933
1934def test_ap_ft_ap_oom7c(dev, apdev):
1935 """WPA2-PSK-FT and AP OOM 7c"""
1936 ssid = "test-ft"
fab49f61 1937 passphrase = "12345678"
c5262648
JM		 1938
1939 params = ft_params1(ssid=ssid, passphrase=passphrase)
1940 params["ieee80211w"] = "2"
1941 hapd0 = hostapd.add_ap(apdev[0], params)
1942 bssid0 = hapd0.own_addr()
1943
1944 dev[0].scan_for_bss(bssid0, freq="2412")
1945 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1946 ieee80211w="2", scan_freq="2412")
1947
1948 params = ft_params2(ssid=ssid, passphrase=passphrase)
1949 params["ieee80211w"] = "2"
1950 hapd1 = hostapd.add_ap(apdev[1], params)
1951 bssid1 = hapd1.own_addr()
1952 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1953 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1954 # This will fail to roam
1955 dev[0].roam(bssid1)
c5262648
JM		 1956
1957def test_ap_ft_ap_oom7d(dev, apdev):
1958 """WPA2-PSK-FT and AP OOM 7d"""
1959 ssid = "test-ft"
fab49f61 1960 passphrase = "12345678"
c5262648
JM		 1961
1962 params = ft_params1(ssid=ssid, passphrase=passphrase)
1963 params["ieee80211w"] = "2"
1964 hapd0 = hostapd.add_ap(apdev[0], params)
1965 bssid0 = hapd0.own_addr()
1966
1967 dev[0].scan_for_bss(bssid0, freq="2412")
1968 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1969 ieee80211w="2", scan_freq="2412")
1970
1971 params = ft_params2(ssid=ssid, passphrase=passphrase)
1972 params["ieee80211w"] = "2"
1973 hapd1 = hostapd.add_ap(apdev[1], params)
1974 bssid1 = hapd1.own_addr()
1975 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1976 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1977 # This will fail to roam
1978 dev[0].roam(bssid1)
1979
1980def test_ap_ft_ap_oom8(dev, apdev):
1981 """WPA2-PSK-FT and AP OOM 8"""
1982 ssid = "test-ft"
fab49f61 1983 passphrase = "12345678"
682a79f0
JM		 1984
1985 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1986 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1987 hapd0 = hostapd.add_ap(apdev[0], params)
1988 bssid0 = hapd0.own_addr()
1989
1990 dev[0].scan_for_bss(bssid0, freq="2412")
1991 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1992 scan_freq="2412")
1993
1994 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 1995 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1996 hapd1 = hostapd.add_ap(apdev[1], params)
1997 bssid1 = hapd1.own_addr()
1998 dev[0].scan_for_bss(bssid1, freq="2412")
1999 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
2000 # This will fail to roam
2001 dev[0].roam(bssid1)
2002 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
2003 # This will fail to roam
2004 dev[0].roam(bssid1)
2005
2006def test_ap_ft_ap_oom9(dev, apdev):
2007 """WPA2-PSK-FT and AP OOM 9"""
2008 ssid = "test-ft"
fab49f61 2009 passphrase = "12345678"
682a79f0
JM		 2010
2011 params = ft_params1(ssid=ssid, passphrase=passphrase)
2012 hapd0 = hostapd.add_ap(apdev[0], params)
2013 bssid0 = hapd0.own_addr()
2014
2015 dev[0].scan_for_bss(bssid0, freq="2412")
2016 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2017 scan_freq="2412")
2018
2019 params = ft_params2(ssid=ssid, passphrase=passphrase)
2020 hapd1 = hostapd.add_ap(apdev[1], params)
2021 bssid1 = hapd1.own_addr()
2022 dev[0].scan_for_bss(bssid1, freq="2412")
2023
2024 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
2025 # This will fail to roam
2026 if "OK" not in dev[0].request("FT_DS " + bssid1):
2027 raise Exception("FT_DS failed")
2028 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
2029
2030 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
2031 # This will fail to roam
2032 if "OK" not in dev[0].request("FT_DS " + bssid1):
2033 raise Exception("FT_DS failed")
2034 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2035
2036 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
2037 # This will fail to roam
2038 if "OK" not in dev[0].request("FT_DS " + bssid1):
2039 raise Exception("FT_DS failed")
2040 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2041
2042def test_ap_ft_ap_oom10(dev, apdev):
2043 """WPA2-PSK-FT and AP OOM 10"""
2044 ssid = "test-ft"
fab49f61 2045 passphrase = "12345678"
682a79f0
JM		 2046
2047 params = ft_params1(ssid=ssid, passphrase=passphrase)
2048 hapd0 = hostapd.add_ap(apdev[0], params)
2049 bssid0 = hapd0.own_addr()
2050
2051 dev[0].scan_for_bss(bssid0, freq="2412")
2052 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2053 scan_freq="2412")
2054
2055 params = ft_params2(ssid=ssid, passphrase=passphrase)
2056 hapd1 = hostapd.add_ap(apdev[1], params)
2057 bssid1 = hapd1.own_addr()
2058 dev[0].scan_for_bss(bssid1, freq="2412")
2059
9441a227 2060 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2061 # This will fail to roam
2062 if "OK" not in dev[0].request("FT_DS " + bssid1):
2063 raise Exception("FT_DS failed")
2064 wait_fail_trigger(hapd0, "GET_FAIL")
2065
2066 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
2067 # This will fail to roam
2068 if "OK" not in dev[0].request("FT_DS " + bssid1):
2069 raise Exception("FT_DS failed")
2070 wait_fail_trigger(hapd0, "GET_FAIL")
2071
9441a227 2072 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2073 # This will fail to roam
2074 if "OK" not in dev[0].request("FT_DS " + bssid1):
2075 raise Exception("FT_DS failed")
2076 wait_fail_trigger(hapd0, "GET_FAIL")
2077
9441a227 2078 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 2079 # This will fail to roam
2080 if "OK" not in dev[0].request("FT_DS " + bssid1):
2081 raise Exception("FT_DS failed")
2082 wait_fail_trigger(hapd1, "GET_FAIL")
2083
2084def test_ap_ft_ap_oom11(dev, apdev):
2085 """WPA2-PSK-FT and AP OOM 11"""
2086 ssid = "test-ft"
fab49f61 2087 passphrase = "12345678"
682a79f0
JM		 2088
2089 params = ft_params1(ssid=ssid, passphrase=passphrase)
2090 hapd0 = hostapd.add_ap(apdev[0], params)
2091 bssid0 = hapd0.own_addr()
2092
2093 dev[0].scan_for_bss(bssid0, freq="2412")
2094 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
2095 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2096 scan_freq="2412")
2097 wait_fail_trigger(hapd0, "GET_FAIL")
2098
2099 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 2100 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 2101 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2102 scan_freq="2412")
2103 wait_fail_trigger(hapd0, "GET_FAIL")
2104
a04e6f3d
JM		 2105def test_ap_ft_over_ds_proto_ap(dev, apdev):
2106 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
2107 ssid = "test-ft"
fab49f61 2108 passphrase = "12345678"
a04e6f3d
JM		 2109
2110 params = ft_params1(ssid=ssid, passphrase=passphrase)
2111 hapd0 = hostapd.add_ap(apdev[0], params)
2112 bssid0 = hapd0.own_addr()
2113 _bssid0 = bssid0.replace(':', '')
2114 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2115 scan_freq="2412")
2116 addr = dev[0].own_addr()
2117 _addr = addr.replace(':', '')
2118
2119 params = ft_params2(ssid=ssid, passphrase=passphrase)
2120 hapd1 = hostapd.add_ap(apdev[1], params)
2121 bssid1 = hapd1.own_addr()
2122 _bssid1 = bssid1.replace(':', '')
2123
2124 hapd0.set("ext_mgmt_frame_handling", "1")
2125 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
2126 valid = "0601" + _addr + _bssid1
fab49f61
JM		 2127 tests = ["0601",
2128 "0601" + _addr,
2129 "0601" + _addr + _bssid0,
2130 "0601" + _addr + "ffffffffffff",
2131 "0601" + _bssid0 + _bssid0,
2132 valid,
2133 valid + "01",
2134 valid + "3700",
2135 valid + "3600",
2136 valid + "3603ffffff",
2137 valid + "3603a1b2ff",
2138 valid + "3603a1b2ff" + "3700",
2139 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2140 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2141 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2142 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2143 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2144 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2145 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2146 valid + "0001"]
a04e6f3d
JM		 2147 for t in tests:
2148 hapd0.dump_monitor()
2149 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2150 raise Exception("MGMT_RX_PROCESS failed")
2151
2152 hapd0.set("ext_mgmt_frame_handling", "0")
2153
34d3eaa8
JM		 2154def test_ap_ft_over_ds_proto(dev, apdev):
2155 """WPA2-PSK-FT AP over DS protocol testing"""
2156 ssid = "test-ft"
fab49f61 2157 passphrase = "12345678"
34d3eaa8
JM		 2158
2159 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2160 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2161 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2162 scan_freq="2412")
2163
2164 # FT Action Response while no FT-over-DS in progress
2165 msg = {}
2166 msg['fc'] = 13 << 4
2167 msg['da'] = dev[0].own_addr()
2168 msg['sa'] = apdev[0]['bssid']
2169 msg['bssid'] = apdev[0]['bssid']
2170 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2171 hapd0.mgmt_tx(msg)
2172
2173 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2174 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2175 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2176 hapd0.set("ext_mgmt_frame_handling", "1")
2177 hapd0.dump_monitor()
2178 dev[0].request("FT_DS " + apdev[1]['bssid'])
2179 for i in range(0, 10):
2180 req = hapd0.mgmt_rx()
2181 if req is None:
2182 raise Exception("MGMT RX wait timed out")
2183 if req['subtype'] == 13:
2184 break
2185 req = None
2186 if not req:
2187 raise Exception("FT Action frame not received")
2188
2189 # FT Action Response for unexpected Target AP
2190 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2191 hapd0.mgmt_tx(msg)
2192
2193 # FT Action Response without MDIE
2194 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2195 hapd0.mgmt_tx(msg)
2196
2197 # FT Action Response without FTIE
2198 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2199 hapd0.mgmt_tx(msg)
2200
2201 # FT Action Response with FTIE SNonce mismatch
2202 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2203 hapd0.mgmt_tx(msg)
6f3815c0 2204
9fd6804d 2205@remote_compatible
6f3815c0
JM		 2206def test_ap_ft_rrb(dev, apdev):
2207 """WPA2-PSK-FT RRB protocol testing"""
2208 ssid = "test-ft"
fab49f61 2209 passphrase = "12345678"
6f3815c0
JM		 2210
2211 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2212 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2213
2214 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2215 scan_freq="2412")
2216
fab49f61
JM		 2217 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':', ''))
2218 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':', ''))
15dfcb69 2219 proto = b'\x89\x0d'
6f3815c0
JM		 2220 ehdr = _dst_ll + _src_ll + proto
2221
2222 # Too short RRB frame
15dfcb69 2223 pkt = ehdr + b'\x01'
7ab74770 2224 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2225 raise Exception("DATA_TEST_FRAME failed")
2226
2227 # RRB discarded frame wikth unrecognized type
15dfcb69 2228 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2229 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2230 raise Exception("DATA_TEST_FRAME failed")
2231
2232 # RRB frame too short for action frame
15dfcb69 2233 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2234 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2235 raise Exception("DATA_TEST_FRAME failed")
2236
2237 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2238 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2239 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2240 raise Exception("DATA_TEST_FRAME failed")
2241
2242 # Unexpected Action frame category
15dfcb69 2243 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2244 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2245 raise Exception("DATA_TEST_FRAME failed")
2246
2247 # Unexpected Action in RRB Request
15dfcb69 2248 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2249 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2250 raise Exception("DATA_TEST_FRAME failed")
2251
2252 # Target AP address in RRB Request does not match with own address
15dfcb69 2253 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2254 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2255 raise Exception("DATA_TEST_FRAME failed")
2256
2257 # Not enough room for status code in RRB Response
15dfcb69 2258 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2259 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2260 raise Exception("DATA_TEST_FRAME failed")
2261
2262 # RRB discarded frame with unknown packet_type
15dfcb69 2263 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2264 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2265 raise Exception("DATA_TEST_FRAME failed")
2266
2267 # RRB Response with non-zero status code; no STA match
15dfcb69 2268 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2269 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2270 raise Exception("DATA_TEST_FRAME failed")
2271
2272 # RRB Response with zero status code and extra data; STA match
15dfcb69 2273 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2274 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2275 raise Exception("DATA_TEST_FRAME failed")
2276
2277 # Too short PMK-R1 pull
15dfcb69 2278 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2279 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2280 raise Exception("DATA_TEST_FRAME failed")
2281
2282 # Too short PMK-R1 resp
15dfcb69 2283 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2284 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2285 raise Exception("DATA_TEST_FRAME failed")
2286
2287 # Too short PMK-R1 push
15dfcb69 2288 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2289 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2290 raise Exception("DATA_TEST_FRAME failed")
2291
2292 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2293 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2294 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2295 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2296
9fd6804d 2297@remote_compatible
ecafa0cf
JM		 2298def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2299 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2300 bssid = apdev[0]['bssid']
2301 ssid = "test-ft"
fab49f61 2302 passphrase = "12345678"
ecafa0cf
JM		 2303
2304 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2305 params["ieee80211w"] = "1"
ecafa0cf
JM		 2306 # This is the RSN element used normally by hostapd
2307 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2308 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2309 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2310 ieee80211w="1", scan_freq="2412",
2311 pairwise="CCMP", group="CCMP")
2312
fab49f61
JM		 2313 tests = [('PMKIDCount field included',
2314 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2315 ('Extra IE before RSNE',
2316 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2317 ('PMKIDCount and Group Management Cipher suite fields included',
2318 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2319 ('Extra octet after defined fields (future extensibility)',
2320 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2321 ('No RSN Capabilities field (PMF disabled in practice)',
2322 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2323 for txt, ie in tests:
ecafa0cf
JM		 2324 dev[0].request("DISCONNECT")
2325 dev[0].wait_disconnected()
2326 logger.info(txt)
2327 hapd.disable()
2328 hapd.set('own_ie_override', ie)
2329 hapd.enable()
2330 dev[0].request("BSS_FLUSH 0")
2331 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2332 dev[0].select_network(id, freq=2412)
2333 dev[0].wait_connected()
2334
2335 dev[0].request("DISCONNECT")
2336 dev[0].wait_disconnected()
2337
2338 logger.info('Invalid RSNE causing internal hostapd error')
2339 hapd.disable()
2340 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2341 hapd.enable()
2342 dev[0].request("BSS_FLUSH 0")
2343 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2344 dev[0].select_network(id, freq=2412)
2345 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2346 # complete.
2347 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2348 if ev is not None:
2349 raise Exception("Unexpected connection")
2350 dev[0].request("DISCONNECT")
2351
2352 logger.info('Unexpected PMKID causing internal hostapd error')
2353 hapd.disable()
2354 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2355 hapd.enable()
2356 dev[0].request("BSS_FLUSH 0")
2357 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2358 dev[0].select_network(id, freq=2412)
2359 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2360 # complete.
2361 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2362 if ev is not None:
2363 raise Exception("Unexpected connection")
2364 dev[0].request("DISCONNECT")
1025603b 2365
425e5f97 2366def start_ft(apdev, wpa_ptk_rekey=None):
1025603b 2367 ssid = "test-ft"
fab49f61 2368 passphrase = "12345678"
1025603b
JM		 2369
2370 params = ft_params1(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2371 if wpa_ptk_rekey:
2372 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2373 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2374 params = ft_params2(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2375 if wpa_ptk_rekey:
2376 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2377 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b 2378
425e5f97 2379 return hapd0, hapd1
1025603b 2380
425e5f97
JM		 2381def check_ptk_rekey(dev, hapd0=None, hapd1=None):
2382 ev = dev.wait_event(["CTRL-EVENT-DISCONNECTED",
2383 "WPA: Key negotiation completed"], timeout=5)
1025603b
JM		 2384 if ev is None:
2385 raise Exception("No event received after roam")
2386 if "CTRL-EVENT-DISCONNECTED" in ev:
2387 raise Exception("Unexpected disconnection after roam")
2388
425e5f97
JM		 2389 if not hapd0 or not hapd1:
2390 return
2391 if dev.get_status_field('bssid') == hapd0.own_addr():
1025603b
JM		 2392 hapd = hapd0
2393 else:
2394 hapd = hapd1
d22f0902 2395 time.sleep(0.1)
425e5f97 2396 hwsim_utils.test_connectivity(dev, hapd)
1025603b 2397
425e5f97
JM		 2398def test_ap_ft_ptk_rekey(dev, apdev):
2399 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2400 hapd0, hapd1 = start_ft(apdev)
2401 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1")
2402 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2403
425e5f97
JM		 2404def test_ap_ft_ptk_rekey2(dev, apdev):
2405 """WPA2-PSK-FT PTK rekeying triggered by station after one roam"""
2406 hapd0, hapd1 = start_ft(apdev)
2407 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1",
2408 only_one_way=True)
2409 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2410
425e5f97
JM		 2411def test_ap_ft_ptk_rekey_ap(dev, apdev):
2412 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2413 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2414 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678")
2415 check_ptk_rekey(dev[0], hapd0, hapd1)
2416
2417def test_ap_ft_ptk_rekey_ap2(dev, apdev):
2418 """WPA2-PSK-FT PTK rekeying triggered by AP after one roam"""
2419 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2420 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678",
2421 only_one_way=True)
2422 check_ptk_rekey(dev[0], hapd0, hapd1)
2423
2424def test_ap_ft_eap_ptk_rekey_ap(dev, apdev):
2425 """WPA2-EAP-FT PTK rekeying triggered by AP"""
2426 generic_ap_ft_eap(dev, apdev, only_one_way=True, wpa_ptk_rekey=2)
2427 check_ptk_rekey(dev[0])
186ca473
MB		 2428
2429def test_ap_ft_internal_rrb_check(dev, apdev):
2430 """RRB internal delivery only to WPA enabled BSS"""
2431 ssid = "test-ft"
fab49f61 2432 passphrase = "12345678"
186ca473
MB		 2433
2434 radius = hostapd.radius_params()
2435 params = ft_params1(ssid=ssid, passphrase=passphrase)
2436 params['wpa_key_mgmt'] = "FT-EAP"
2437 params["ieee8021x"] = "1"
35d8c254 2438 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2439 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2440 key_mgmt = hapd.get_config()['key_mgmt']
2441 if key_mgmt.split(' ')[0] != "FT-EAP":
2442 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2443
fab49f61 2444 hapd1 = hostapd.add_ap(apdev[1], {"ssid": ssid})
186ca473
MB		 2445
2446 # Connect to WPA enabled AP
2447 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2448 eap="GPSK", identity="gpsk user",
2449 password="abcdefghijklmnop0123456789abcdef",
2450 scan_freq="2412")
2451
2452 # Try over_ds roaming to non-WPA-enabled AP.
2453 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2454 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2455
2456def test_ap_ft_extra_ie(dev, apdev):
2457 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2458 ssid = "test-ft"
fab49f61 2459 passphrase = "12345678"
c85fcff2
JM		 2460
2461 params = ft_params1(ssid=ssid, passphrase=passphrase)
2462 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2463 hapd0 = hostapd.add_ap(apdev[0], params)
2464 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2465 scan_freq="2412")
2466 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2467 scan_freq="2412")
2468 try:
2469 # Add Mobility Domain element to test AP validation code.
2470 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2471 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2472 scan_freq="2412", wait_connect=False)
2473 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2474 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2475 if ev is None:
2476 raise Exception("No connection result")
2477 if "CTRL-EVENT-CONNECTED" in ev:
2478 raise Exception("Non-FT association accepted with MDE")
2479 if "status_code=43" not in ev:
2480 raise Exception("Unexpected status code: " + ev)
2481 dev[0].request("DISCONNECT")
2482 finally:
2483 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2484
2485def test_ap_ft_ric(dev, apdev):
2486 """WPA2-PSK-FT AP and RIC"""
2487 ssid = "test-ft"
fab49f61 2488 passphrase = "12345678"
fd7205fa
JM		 2489
2490 params = ft_params1(ssid=ssid, passphrase=passphrase)
2491 hapd0 = hostapd.add_ap(apdev[0], params)
2492 params = ft_params2(ssid=ssid, passphrase=passphrase)
2493 hapd1 = hostapd.add_ap(apdev[1], params)
2494
2495 dev[0].set("ric_ies", "")
2496 dev[0].set("ric_ies", '""')
2497 if "FAIL" not in dev[0].request("SET ric_ies q"):
2498 raise Exception("Invalid ric_ies value accepted")
2499
fab49f61
JM		 2500 tests = ["3900",
2501 "3900ff04eeeeeeee",
2502 "390400000000",
2503 "390400000000" + "390400000000",
2504 "390400000000" + "dd050050f20202",
2505 "390400000000" + "dd3d0050f2020201" + 55*"00",
2506 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2507 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
fd7205fa
JM		 2508 for t in tests:
2509 dev[0].set("ric_ies", t)
2510 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2511 test_connectivity=False)
2512 dev[0].request("REMOVE_NETWORK all")
2513 dev[0].wait_disconnected()
2514 dev[0].dump_monitor()
c8942286
JM		 2515
2516def ie_hex(ies, id):
7ab74770 2517 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2518
2519def test_ap_ft_reassoc_proto(dev, apdev):
2520 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2521 ssid = "test-ft"
fab49f61 2522 passphrase = "12345678"
c8942286
JM		 2523
2524 params = ft_params1(ssid=ssid, passphrase=passphrase)
2525 hapd0 = hostapd.add_ap(apdev[0], params)
2526 params = ft_params2(ssid=ssid, passphrase=passphrase)
2527 hapd1 = hostapd.add_ap(apdev[1], params)
2528
2529 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2530 ieee80211w="1", scan_freq="2412")
2531 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2532 hapd1ap = hapd0
2533 hapd2ap = hapd1
2534 else:
2535 hapd1ap = hapd1
2536 hapd2ap = hapd0
2537
2538 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2539 hapd2ap.set("ext_mgmt_frame_handling", "1")
2540 dev[0].request("ROAM " + hapd2ap.own_addr())
2541
2542 while True:
2543 req = hapd2ap.mgmt_rx()
7ab74770 2544 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2545 if req['subtype'] == 11:
2546 break
2547
2548 while True:
2549 req = hapd2ap.mgmt_rx()
2550 if req['subtype'] == 2:
2551 break
7ab74770 2552 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2553
2554 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2555 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2556 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2557 # First elements: SSID, Supported Rates, Extended Supported Rates
2558 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2559
2560 rsne = ie_hex(ies, 48)
2561 mde = ie_hex(ies, 54)
2562 fte = ie_hex(ies, 55)
fab49f61 2563 tests = []
c8942286 2564 # RSN: Trying to use FT, but MDIE not included
fab49f61 2565 tests += [rsne]
c8942286 2566 # RSN: Attempted to use unknown MDIE
fab49f61 2567 tests += [rsne + "3603000000"]
c8942286 2568 # Invalid RSN pairwise cipher
fab49f61 2569 tests += ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
c8942286 2570 # FT: No PMKID in RSNIE
fab49f61 2571 tests += ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54)]
c8942286 2572 # FT: Invalid FTIE
fab49f61 2573 tests += [rsne + mde]
c8942286
JM		 2574 # FT: RIC IE(s) in the frame, but not included in protected IE count
2575 # FT: Failed to parse FT IEs
fab49f61 2576 tests += [rsne + mde + fte + "3900"]
c8942286 2577 # FT: SNonce mismatch in FTIE
fab49f61 2578 tests += [rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00"]
c8942286 2579 # FT: ANonce mismatch in FTIE
fab49f61 2580 tests += [rsne + mde + fte[0:40] + 32*"00" + fte[104:]]
c8942286 2581 # FT: No R0KH-ID subelem in FTIE
fab49f61 2582 tests += [rsne + mde + "3752" + fte[4:168]]
c8942286 2583 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
fab49f61 2584 tests += [rsne + mde + "3755" + fte[4:168] + "0301ff"]
c8942286 2585 # FT: No R1KH-ID subelem in FTIE
fab49f61 2586 tests += [rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode()]
c8942286 2587 # FT: Unknown R1KH-ID used in ReassocReq
fab49f61 2588 tests += [rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000"]
c8942286 2589 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
fab49f61 2590 tests += [rsne[:-32] + 16*"00" + mde + fte]
c8942286 2591 # Invalid MIC in FTIE
fab49f61 2592 tests += [rsne + mde + fte[0:8] + 16*"00" + fte[40:]]
c8942286
JM		 2593 for t in tests:
2594 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2595
2596def test_ap_ft_reassoc_local_fail(dev, apdev):
2597 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2598 ssid = "test-ft"
fab49f61 2599 passphrase = "12345678"
c8942286
JM		 2600
2601 params = ft_params1(ssid=ssid, passphrase=passphrase)
2602 hapd0 = hostapd.add_ap(apdev[0], params)
2603 params = ft_params2(ssid=ssid, passphrase=passphrase)
2604 hapd1 = hostapd.add_ap(apdev[1], params)
2605
2606 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2607 ieee80211w="1", scan_freq="2412")
2608 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2609 hapd1ap = hapd0
2610 hapd2ap = hapd1
2611 else:
2612 hapd1ap = hapd1
2613 hapd2ap = hapd0
2614
2615 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2616 # FT: Failed to calculate MIC
2617 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2618 dev[0].request("ROAM " + hapd2ap.own_addr())
2619 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2620 dev[0].request("DISCONNECT")
2621 if ev is None:
2622 raise Exception("Association reject not seen")
d7f0bef9
JM		 2623
2624def test_ap_ft_reassoc_replay(dev, apdev, params):
2625 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2626 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2627 ssid = "test-ft"
fab49f61 2628 passphrase = "12345678"
d7f0bef9
JM		 2629
2630 params = ft_params1(ssid=ssid, passphrase=passphrase)
2631 hapd0 = hostapd.add_ap(apdev[0], params)
2632 params = ft_params2(ssid=ssid, passphrase=passphrase)
2633 hapd1 = hostapd.add_ap(apdev[1], params)
2634
2635 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2636 scan_freq="2412")
2637 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2638 hapd1ap = hapd0
2639 hapd2ap = hapd1
2640 else:
2641 hapd1ap = hapd1
2642 hapd2ap = hapd0
2643
2644 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2645 hapd2ap.set("ext_mgmt_frame_handling", "1")
2646 dev[0].dump_monitor()
2647 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2648 raise Exception("ROAM failed")
2649
2650 reassocreq = None
2651 count = 0
2652 while count < 100:
2653 req = hapd2ap.mgmt_rx()
2654 count += 1
2655 hapd2ap.dump_monitor()
7ab74770 2656 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2657 if req['subtype'] == 2:
2658 reassocreq = req
2659 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2660 if ev is None:
2661 raise Exception("No TX status seen")
2662 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2663 if "OK" not in hapd2ap.request(cmd):
2664 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2665 break
2666 hapd2ap.set("ext_mgmt_frame_handling", "0")
2667 if reassocreq is None:
2668 raise Exception("No Reassociation Request frame seen")
2669 dev[0].wait_connected()
2670 dev[0].dump_monitor()
2671 hapd2ap.dump_monitor()
2672
2673 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2674
2675 logger.info("Replay the last Reassociation Request frame")
2676 hapd2ap.dump_monitor()
2677 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2678 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2679 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2680 if ev is None:
2681 raise Exception("No TX status seen")
2682 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2683 if "OK" not in hapd2ap.request(cmd):
2684 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2685 hapd2ap.set("ext_mgmt_frame_handling", "0")
2686
2687 try:
2688 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2689 ok = True
2690 except:
2691 ok = False
2692
2693 ap = hapd2ap.own_addr()
2694 sta = dev[0].own_addr()
2695 filt = "wlan.fc.type == 2 && " + \
2696 "wlan.da == " + sta + " && " + \
2697 "wlan.sa == " + ap
fab49f61 2698 fields = ["wlan.ccmp.extiv"]
d7f0bef9
JM		 2699 res = run_tshark(capfile, filt, fields)
2700 vals = res.splitlines()
2701 logger.info("CCMP PN: " + str(vals))
2702 if len(vals) < 2:
2703 raise Exception("Could not find all CCMP protected frames from capture")
2704 if len(set(vals)) < len(vals):
2705 raise Exception("Duplicate CCMP PN used")
2706
2707 if not ok:
2708 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2709
2710def test_ap_ft_psk_file(dev, apdev):
2711 """WPA2-PSK-FT AP with PSK from a file"""
2712 ssid = "test-ft"
fab49f61 2713 passphrase = "12345678"
0dc3c5f2
JM		 2714
2715 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2716 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2717 hapd = hostapd.add_ap(apdev[0], params)
2718
2719 dev[1].connect(ssid, psk="very secret",
2720 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2721 scan_freq="2412", wait_connect=False)
2722 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2723 ieee80211w="1", scan_freq="2412")
2724 dev[0].request("REMOVE_NETWORK all")
2725 dev[0].wait_disconnected()
2726 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2727 ieee80211w="1", scan_freq="2412")
2728 dev[0].request("REMOVE_NETWORK all")
2729 dev[0].wait_disconnected()
2730 dev[0].connect(ssid, psk="secret passphrase",
2731 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2732 scan_freq="2412")
2733 dev[2].connect(ssid, psk="another passphrase for all STAs",
2734 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2735 scan_freq="2412")
2736 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2737 if ev is None:
2738 raise Exception("Timed out while waiting for failure report")
2739 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2740
2741def test_ap_ft_eap_ap_config_change(dev, apdev):
2742 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2743 ssid = "test-ft"
fab49f61 2744 passphrase = "12345678"
62566bc2
JM		 2745 bssid = apdev[0]['bssid']
2746
2747 radius = hostapd.radius_params()
2748 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2749 params['wpa_key_mgmt'] = "WPA-EAP"
2750 params["ieee8021x"] = "1"
2751 params["pmk_r1_push"] = "0"
2752 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2753 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2754 params["eap_server"] = "0"
35d8c254 2755 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2756 hapd = hostapd.add_ap(apdev[0], params)
2757
2758 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2759 eap="GPSK", identity="gpsk user",
2760 password="abcdefghijklmnop0123456789abcdef",
2761 scan_freq="2412")
2762 dev[0].request("DISCONNECT")
2763 dev[0].wait_disconnected()
2764 dev[0].dump_monitor()
2765
2766 hapd.disable()
2767 hapd.set('wpa_key_mgmt', "FT-EAP")
2768 hapd.enable()
2769
2770 dev[0].request("BSS_FLUSH 0")
2771 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2772
2773 dev[0].request("RECONNECT")
2774 dev[0].wait_connected()
55b3cda7
JM		 2775
2776def test_ap_ft_eap_sha384(dev, apdev):
2777 """WPA2-EAP-FT with SHA384"""
2778 ssid = "test-ft"
fab49f61 2779 passphrase = "12345678"
55b3cda7
JM		 2780
2781 radius = hostapd.radius_params()
2782 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2783 params["ieee80211w"] = "2"
55b3cda7
JM		 2784 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2785 params["ieee8021x"] = "1"
35d8c254 2786 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2787 hapd0 = hostapd.add_ap(apdev[0], params)
2788 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2789 params["ieee80211w"] = "2"
55b3cda7
JM		 2790 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2791 params["ieee8021x"] = "1"
35d8c254 2792 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2793 hapd1 = hostapd.add_ap(apdev[1], params)
2794
2795 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2796 sha384=True)
2797
659f7954
JM		 2798def test_ap_ft_eap_sha384_reassoc(dev, apdev):
2799 """WPA2-EAP-FT with SHA384 using REASSOCIATE"""
e1923f5b 2800 check_suite_b_192_capa(dev)
659f7954
JM		 2801 ssid = "test-ft"
2802 passphrase = "12345678"
2803
2804 radius = hostapd.radius_params()
2805 params = ft_params1(ssid=ssid, passphrase=passphrase)
2806 params["ieee80211w"] = "2"
2807 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2808 params["ieee8021x"] = "1"
2809 params = dict(list(radius.items()) + list(params.items()))
2810 hapd0 = hostapd.add_ap(apdev[0], params)
2811 params = ft_params2(ssid=ssid, passphrase=passphrase)
2812 params["ieee80211w"] = "2"
2813 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2814 params["ieee8021x"] = "1"
2815 params = dict(list(radius.items()) + list(params.items()))
2816 hapd1 = hostapd.add_ap(apdev[1], params)
2817
2818 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2819 sha384=True, also_non_ft=True, roam_with_reassoc=True)
2820
55b3cda7
JM		 2821def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2822 """WPA2-EAP-FT with SHA384 over DS"""
2823 ssid = "test-ft"
fab49f61 2824 passphrase = "12345678"
55b3cda7
JM		 2825
2826 radius = hostapd.radius_params()
2827 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2828 params["ieee80211w"] = "2"
55b3cda7
JM		 2829 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2830 params["ieee8021x"] = "1"
35d8c254 2831 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2832 hapd0 = hostapd.add_ap(apdev[0], params)
2833 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2834 params["ieee80211w"] = "2"
55b3cda7
JM		 2835 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2836 params["ieee8021x"] = "1"
35d8c254 2837 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2838 hapd1 = hostapd.add_ap(apdev[1], params)
2839
2840 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2841 eap=True, sha384=True)
392aba4e
JM		 2842
2843def test_ap_ft_roam_rrm(dev, apdev):
2844 """WPA2-PSK-FT AP and radio measurement request"""
2845 ssid = "test-ft"
fab49f61 2846 passphrase = "12345678"
392aba4e
JM		 2847
2848 params = ft_params1(ssid=ssid, passphrase=passphrase)
2849 params["rrm_beacon_report"] = "1"
2850 hapd0 = hostapd.add_ap(apdev[0], params)
2851 bssid0 = hapd0.own_addr()
2852
2853 addr = dev[0].own_addr()
2854 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2855 scan_freq="2412")
2856 check_beacon_req(hapd0, addr, 1)
2857
2858 params = ft_params2(ssid=ssid, passphrase=passphrase)
2859 params["rrm_beacon_report"] = "1"
2860 hapd1 = hostapd.add_ap(apdev[1], params)
2861 bssid1 = hapd1.own_addr()
2862
2863 dev[0].scan_for_bss(bssid1, freq=2412)
2864 dev[0].roam(bssid1)
2865 check_beacon_req(hapd1, addr, 2)
2866
2867 dev[0].scan_for_bss(bssid0, freq=2412)
2868 dev[0].roam(bssid0)
2869 check_beacon_req(hapd0, addr, 3)
9ff2b85e
JM		 2870
2871def test_ap_ft_pmksa_caching(dev, apdev):
2872 """FT-EAP and PMKSA caching for initial mobility domain association"""
2873 ssid = "test-ft"
2874 identity = "gpsk user"
2875
2876 radius = hostapd.radius_params()
2877 params = ft_params1(ssid=ssid)
2878 params['wpa_key_mgmt'] = "FT-EAP"
2879 params["ieee8021x"] = "1"
2880 params["mobility_domain"] = "c3d4"
2881 params = dict(list(radius.items()) + list(params.items()))
2882 hapd = hostapd.add_ap(apdev[0], params)
2883
2884 params = ft_params2(ssid=ssid)
2885 params['wpa_key_mgmt'] = "FT-EAP"
2886 params["ieee8021x"] = "1"
2887 params["mobility_domain"] = "c3d4"
2888 params = dict(list(radius.items()) + list(params.items()))
2889 hapd1 = hostapd.add_ap(apdev[1], params)
2890
2891 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2892 eap_identity=identity, pmksa_caching=True)
2893
2894def test_ap_ft_pmksa_caching_sha384(dev, apdev):
2895 """FT-EAP-SHA384 and PMKSA caching for initial mobility domain association"""
2896 ssid = "test-ft"
2897 identity = "gpsk user"
2898
2899 radius = hostapd.radius_params()
2900 params = ft_params1(ssid=ssid)
2901 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2902 params["ieee8021x"] = "1"
2903 params["mobility_domain"] = "c3d4"
2904 params = dict(list(radius.items()) + list(params.items()))
2905 hapd = hostapd.add_ap(apdev[0], params)
2906
2907 params = ft_params2(ssid=ssid)
2908 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2909 params["ieee8021x"] = "1"
2910 params["mobility_domain"] = "c3d4"
2911 params = dict(list(radius.items()) + list(params.items()))
2912 hapd1 = hostapd.add_ap(apdev[1], params)
2913
2914 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2915 eap_identity=identity, pmksa_caching=True, sha384=True)
5916637c
JM		 2916
2917def test_ap_ft_r1_key_expiration(dev, apdev):
2918 """WPA2-PSK-FT and PMK-R1 expiration"""
2919 ssid = "test-ft"
2920 passphrase = "12345678"
2921
2922 params = ft_params1(ssid=ssid, passphrase=passphrase)
2923 params['r1_max_key_lifetime'] = "2"
2924 hapd0 = hostapd.add_ap(apdev[0], params)
2925 params = ft_params2(ssid=ssid, passphrase=passphrase)
2926 params['r1_max_key_lifetime'] = "2"
2927 hapd1 = hostapd.add_ap(apdev[1], params)
2928
2929 # This succeeds, but results in having to run another PMK-R1 pull before the
2930 # second AP can complete FT protocol.
2931 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, wait_before_roam=4)
2932
2933def test_ap_ft_r0_key_expiration(dev, apdev):
2934 """WPA2-PSK-FT and PMK-R0 expiration"""
2935 ssid = "test-ft"
2936 passphrase = "12345678"
2937
2938 params = ft_params1(ssid=ssid, passphrase=passphrase)
2939 params['ft_r0_key_lifetime'] = "2"
2940 hapd0 = hostapd.add_ap(apdev[0], params)
2941 params = ft_params2(ssid=ssid, passphrase=passphrase)
2942 params['ft_r0_key_lifetime'] = "2"
2943 hapd1 = hostapd.add_ap(apdev[1], params)
2944
2945 bssid2 = run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2946 return_after_initial=True)
2947 time.sleep(4)
2948 dev[0].scan_for_bss(bssid2, freq="2412")
2949 if "OK" not in dev[0].request("ROAM " + bssid2):
2950 raise Exception("ROAM failed")
2951 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2952 "CTRL-EVENT-AUTH-REJECT",
2953 "CTRL-EVENT-ASSOC-REJECT"], timeout=5)
2954 dev[0].request("DISCONNECT")
2955 if ev is None or "CTRL-EVENT-AUTH-REJECT" not in ev:
2956 raise Exception("FT protocol failure not reported")
2957 if "status_code=53" not in ev:
2958 raise Exception("Unexpected status in FT protocol failure: " + ev)
2959
2960 # Generate a new PMK-R0
2961 dev[0].dump_monitor()
2962 dev[0].request("RECONNECT")
2963 dev[0].wait_connected()
Unnamed repository; edit this file 'description' to name the repository.