]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tests: FT PMK-R0/R1 expiration
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
e1923f5b 25from test_suite_b import check_suite_b_192_capa
cd7f1b9a
JM		 26
27def ft_base_rsn():
fab49f61
JM		 28 params = {"wpa": "2",
29 "wpa_key_mgmt": "FT-PSK",
30 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 31 return params
32
33def ft_base_mixed():
fab49f61
JM		 34 params = {"wpa": "3",
35 "wpa_key_mgmt": "WPA-PSK FT-PSK",
36 "wpa_pairwise": "TKIP",
37 "rsn_pairwise": "CCMP"}
cd7f1b9a
JM		 38 return params
39
40def ft_params(rsn=True, ssid=None, passphrase=None):
41 if rsn:
42 params = ft_base_rsn()
43 else:
44 params = ft_base_mixed()
45 if ssid:
46 params["ssid"] = ssid
47 if passphrase:
48 params["wpa_passphrase"] = passphrase
49
50 params["mobility_domain"] = "a1b2"
51 params["r0_key_lifetime"] = "10000"
52 params["pmk_r1_push"] = "1"
53 params["reassociation_deadline"] = "1000"
54 return params
55
d0175d6e 56def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 57 params = ft_params(rsn, ssid, passphrase)
58 params['nas_identifier'] = "nas1.w1.fi"
59 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 60 return params
61
942b52a8 62def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 63 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 64 if discovery:
65 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
67 else:
fab49f61
JM		 68 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
69 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
942b52a8 70 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 71 return params
72
c95dd8e4
JM		 73def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
74 params = ft_params1a(rsn, ssid, passphrase)
fab49f61
JM		 75 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
76 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 77 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
78 return params
79
d0175d6e 80def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 81 params = ft_params(rsn, ssid, passphrase)
82 params['nas_identifier'] = "nas2.w1.fi"
83 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 84 return params
85
942b52a8 86def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 87 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 88 if discovery:
89 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
91 else:
fab49f61
JM		 92 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
93 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
942b52a8 94 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 95 return params
96
c95dd8e4
JM		 97def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
98 params = ft_params2a(rsn, ssid, passphrase)
fab49f61
JM		 99 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
100 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
c95dd8e4
JM		 101 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
102 return params
103
3b808945
JM		 104def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
105 params = ft_params(rsn, ssid, passphrase)
106 params['nas_identifier'] = "nas1.w1.fi"
107 params['r1_key_holder'] = "000102030405"
fab49f61
JM		 108 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
109 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
9441a227 110 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 111 return params
112
113def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
114 params = ft_params(rsn, ssid, passphrase)
115 params['nas_identifier'] = "nas2.w1.fi"
116 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 117 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
118 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
9441a227 119 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 120 return params
121
122def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
123 params = ft_params(rsn, ssid, passphrase)
124 params['nas_identifier'] = "nas2.w1.fi"
125 params['r1_key_holder'] = "000102030406"
fab49f61
JM		 126 params['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
127 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
9441a227 128 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 129 return params
130
7b741a53
JM		 131def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
132 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 133 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 134 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 135 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5 136 group_mgmt=None, ocv=None, sae_password=None,
659f7954 137 sae_password_id=None, sae_and_psk=False, pmksa_caching=False,
5916637c
JM		 138 roam_with_reassoc=False, also_non_ft=False, only_one_way=False,
139 wait_before_roam=0, return_after_initial=False):
cd7f1b9a 140 logger.info("Connect to first AP")
473e5176
MB		 141
142 copts = {}
143 copts["proto"] = "WPA2"
144 copts["ieee80211w"] = "1"
145 copts["scan_freq"] = "2412"
146 copts["pairwise"] = pairwise_cipher
fab49f61 147 copts["group"] = group_cipher
473e5176 148 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 149 if group_mgmt:
150 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 151 if ocv:
152 copts["ocv"] = ocv
6f62809b 153 if eap:
9ff2b85e
JM		 154 if pmksa_caching:
155 copts["ft_eap_pmksa_caching"] = "1"
659f7954
JM		 156 if also_non_ft:
157 copts["key_mgmt"] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384" if sha384 else "WPA-EAP FT-EAP"
158 else:
159 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 160 copts["eap"] = "GPSK"
161 copts["identity"] = eap_identity
162 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 163 else:
6f62809b 164 if sae:
cdf53910 165 copts["key_mgmt"] = "SAE FT-SAE" if sae_and_psk else "FT-SAE"
6f62809b 166 else:
473e5176 167 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 168 if passphrase:
169 copts["psk"] = passphrase
170 if sae_password:
171 copts["sae_password"] = sae_password
172 if sae_password_id:
173 copts["sae_password_id"] = sae_password_id
473e5176
MB		 174 if force_initial_conn_to_first_ap:
175 copts["bssid"] = apdev[0]['bssid']
659f7954 176 netw = dev.connect(ssid, **copts)
1211031a
JM		 177 if pmksa_caching:
178 dev.request("DISCONNECT")
179 dev.wait_disconnected()
180 dev.request("RECONNECT")
9ff2b85e
JM		 181 ev = dev.wait_event(["CTRL-EVENT-CONNECTED",
182 "CTRL-EVENT-DISCONNECTED",
183 "CTRL-EVENT-EAP-STARTED"],
1211031a
JM		 184 timeout=15)
185 if ev is None:
186 raise Exception("Reconnect timed out")
187 if "CTRL-EVENT-DISCONNECTED" in ev:
188 raise Exception("Unexpected disconnection after RECONNECT")
9ff2b85e
JM		 189 if "CTRL-EVENT-EAP-STARTED" in ev:
190 raise Exception("Unexpected EAP start after RECONNECT")
473e5176 191
cd7f1b9a
JM		 192 if dev.get_status_field('bssid') == apdev[0]['bssid']:
193 ap1 = apdev[0]
194 ap2 = apdev[1]
a8375c94
JM		 195 hapd1ap = hapd0
196 hapd2ap = hapd1
cd7f1b9a
JM		 197 else:
198 ap1 = apdev[1]
199 ap2 = apdev[0]
a8375c94
JM		 200 hapd1ap = hapd1
201 hapd2ap = hapd0
fd7205fa 202 if test_connectivity:
938c6e7b 203 hapd1ap.wait_sta()
9c50a6d3
MB		 204 if conndev:
205 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
206 else:
207 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 208
5916637c
JM		 209 if return_after_initial:
210 return ap2['bssid']
211
212 if wait_before_roam:
213 time.sleep(wait_before_roam)
655bc8bf 214 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 215
216 for i in range(0, roams):
e0382291
MB		 217 # Roaming artificially fast can make data test fail because the key is
218 # set later.
219 time.sleep(0.01)
40602101 220 logger.info("Roam to the second AP")
659f7954
JM		 221 if roam_with_reassoc:
222 dev.set_network(netw, "bssid", ap2['bssid'])
223 dev.request("REASSOCIATE")
224 dev.wait_connected()
225 elif over_ds:
40602101
JM		 226 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
227 else:
228 dev.roam(ap2['bssid'], fail_test=fail_test)
229 if fail_test:
230 return
231 if dev.get_status_field('bssid') != ap2['bssid']:
232 raise Exception("Did not connect to correct AP")
fd7205fa 233 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 234 hapd2ap.wait_sta()
9c50a6d3
MB		 235 if conndev:
236 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
237 else:
238 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 239
425e5f97
JM		 240 if only_one_way:
241 return
e0382291
MB		 242 # Roaming artificially fast can make data test fail because the key is
243 # set later.
244 time.sleep(0.01)
40602101 245 logger.info("Roam back to the first AP")
659f7954
JM		 246 if roam_with_reassoc:
247 dev.set_network(netw, "bssid", ap1['bssid'])
248 dev.request("REASSOCIATE")
249 dev.wait_connected()
250 elif over_ds:
40602101
JM		 251 dev.roam_over_ds(ap1['bssid'])
252 else:
253 dev.roam(ap1['bssid'])
254 if dev.get_status_field('bssid') != ap1['bssid']:
255 raise Exception("Did not connect to correct AP")
fd7205fa 256 if (i == 0 or i == roams - 1) and test_connectivity:
938c6e7b 257 hapd1ap.wait_sta()
9c50a6d3
MB		 258 if conndev:
259 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
260 else:
261 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 262
263def test_ap_ft(dev, apdev):
264 """WPA2-PSK-FT AP"""
265 ssid = "test-ft"
fab49f61 266 passphrase = "12345678"
cd7f1b9a
JM		 267
268 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 269 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 270 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 271 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 272
a8375c94 273 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 274 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
275 raise Exception("Scan results missing RSN element info")
cd7f1b9a 276
c95dd8e4
JM		 277def test_ap_ft_old_key(dev, apdev):
278 """WPA2-PSK-FT AP (old key)"""
279 ssid = "test-ft"
fab49f61 280 passphrase = "12345678"
c95dd8e4
JM		 281
282 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
283 hapd0 = hostapd.add_ap(apdev[0], params)
284 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
285 hapd1 = hostapd.add_ap(apdev[1], params)
286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288
e4612f84
JM		 289def test_ap_ft_multi_akm(dev, apdev):
290 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
291 ssid = "test-ft"
fab49f61 292 passphrase = "12345678"
e4612f84
JM		 293
294 params = ft_params1(ssid=ssid, passphrase=passphrase)
295 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
296 hapd0 = hostapd.add_ap(apdev[0], params)
297 params = ft_params2(ssid=ssid, passphrase=passphrase)
298 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
299 hapd1 = hostapd.add_ap(apdev[1], params)
300
301 Wlantest.setup(hapd0)
302 wt = Wlantest()
303 wt.flush()
304 wt.add_passphrase(passphrase)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
307 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
310 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
311 scan_freq="2412")
312
d0175d6e
MB		 313def test_ap_ft_local_key_gen(dev, apdev):
314 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
315 ssid = "test-ft"
fab49f61 316 passphrase = "12345678"
d0175d6e
MB		 317
318 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 319 params['ft_psk_generate_local'] = "1"
8344ba12 320 del params['pmk_r1_push']
b098542c 321 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 322 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 323 params['ft_psk_generate_local'] = "1"
8344ba12 324 del params['pmk_r1_push']
b098542c 325 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
473e5176
MB		 331def test_ap_ft_vlan(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN"""
333 ssid = "test-ft"
fab49f61 334 passphrase = "12345678"
473e5176
MB		 335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 342 params['dynamic_vlan'] = "1"
343 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 344 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
345
346 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
350def test_ap_ft_vlan_disconnected(dev, apdev):
351 """WPA2-PSK-FT AP with VLAN and local key generation"""
352 ssid = "test-ft"
fab49f61 353 passphrase = "12345678"
473e5176
MB		 354
355 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 356 params['dynamic_vlan'] = "1"
357 params['accept_mac_file'] = "hostapd.accept"
358 params['ft_psk_generate_local'] = "1"
473e5176
MB		 359 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
360
361 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 362 params['dynamic_vlan'] = "1"
363 params['accept_mac_file'] = "hostapd.accept"
364 params['ft_psk_generate_local'] = "1"
473e5176
MB		 365 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
366
367 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
368 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
369 raise Exception("Scan results missing RSN element info")
370
371def test_ap_ft_vlan_2(dev, apdev):
372 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
373 ssid = "test-ft"
fab49f61 374 passphrase = "12345678"
473e5176
MB		 375
376 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 377 params['dynamic_vlan'] = "1"
378 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 379 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
380
381 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 382 params['dynamic_vlan'] = "1"
473e5176
MB		 383 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
384
385 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
386 force_initial_conn_to_first_ap=True)
387 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
388 raise Exception("Scan results missing RSN element info")
389
40602101
JM		 390def test_ap_ft_many(dev, apdev):
391 """WPA2-PSK-FT AP multiple times"""
392 ssid = "test-ft"
fab49f61 393 passphrase = "12345678"
40602101
JM		 394
395 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 396 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 397 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 398 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 399
a8375c94 400 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 401
473e5176
MB		 402def test_ap_ft_many_vlan(dev, apdev):
403 """WPA2-PSK-FT AP with VLAN multiple times"""
404 ssid = "test-ft"
fab49f61 405 passphrase = "12345678"
473e5176
MB		 406
407 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 408 params['dynamic_vlan'] = "1"
409 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 410 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
411
412 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 413 params['dynamic_vlan'] = "1"
414 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 415 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
416
417 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
418 conndev="brvlan1")
419
cd7f1b9a
JM		 420def test_ap_ft_mixed(dev, apdev):
421 """WPA2-PSK-FT mixed-mode AP"""
422 ssid = "test-ft-mixed"
fab49f61 423 passphrase = "12345678"
cd7f1b9a
JM		 424
425 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 426 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 427 key_mgmt = hapd.get_config()['key_mgmt']
428 vals = key_mgmt.split(' ')
429 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
430 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 431 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 432 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 433
a8375c94 434 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 435
436def test_ap_ft_pmf(dev, apdev):
437 """WPA2-PSK-FT AP with PMF"""
438 ssid = "test-ft"
fab49f61 439 passphrase = "12345678"
cd7f1b9a
JM		 440
441 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 442 params["ieee80211w"] = "2"
8b8a1864 443 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 444 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 445 params["ieee80211w"] = "2"
8b8a1864 446 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 447
a8375c94 448 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 449
ffcaca68
JM		 450def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
451 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
452 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
453
454def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
455 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
456 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
457
458def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
459 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
460 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
461
462def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
463 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
464 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
465
466def run_ap_ft_pmf_bip(dev, apdev, cipher):
467 if cipher not in dev[0].get_capability("group_mgmt"):
468 raise HwsimSkip("Cipher %s not supported" % cipher)
469
470 ssid = "test-ft"
fab49f61 471 passphrase = "12345678"
ffcaca68
JM		 472
473 params = ft_params1(ssid=ssid, passphrase=passphrase)
474 params["ieee80211w"] = "2"
475 params["group_mgmt_cipher"] = cipher
476 hapd0 = hostapd.add_ap(apdev[0], params)
477 params = ft_params2(ssid=ssid, passphrase=passphrase)
478 params["ieee80211w"] = "2"
479 params["group_mgmt_cipher"] = cipher
480 hapd1 = hostapd.add_ap(apdev[1], params)
481
482 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
483 group_mgmt=cipher)
484
e63d8837
MV		 485def test_ap_ft_ocv(dev, apdev):
486 """WPA2-PSK-FT AP with OCV"""
487 ssid = "test-ft"
fab49f61 488 passphrase = "12345678"
e63d8837
MV		 489
490 params = ft_params1(ssid=ssid, passphrase=passphrase)
491 params["ieee80211w"] = "2"
492 params["ocv"] = "1"
493 try:
494 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 495 except Exception as e:
e63d8837
MV		 496 if "Failed to set hostapd parameter ocv" in str(e):
497 raise HwsimSkip("OCV not supported")
498 raise
499 params = ft_params2(ssid=ssid, passphrase=passphrase)
500 params["ieee80211w"] = "2"
501 params["ocv"] = "1"
502 hapd1 = hostapd.add_ap(apdev[1], params)
503
504 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
505
b553eab1
JM		 506def test_ap_ft_over_ds(dev, apdev):
507 """WPA2-PSK-FT AP over DS"""
508 ssid = "test-ft"
fab49f61 509 passphrase = "12345678"
b553eab1
JM		 510
511 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 512 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 513 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 514 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 515
a8375c94 516 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
fab49f61
JM		 517 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
518 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
b553eab1 519
02a4ac0f
JM		 520def cleanup_ap_ft_separate_hostapd():
521 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
522 stderr=open('/dev/null', 'w'))
523 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
524 stderr=open('/dev/null', 'w'))
525 subprocess.call(["ip", "link", "del", "veth0"],
526 stderr=open('/dev/null', 'w'))
527 subprocess.call(["ip", "link", "del", "veth1"],
528 stderr=open('/dev/null', 'w'))
fab49f61 529 for ifname in ['br0ft', 'br1ft', 'br-ft']:
02a4ac0f
JM		 530 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
531 stderr=open('/dev/null', 'w'))
532 subprocess.call(['brctl', 'delbr', ifname],
533 stderr=open('/dev/null', 'w'))
534
535def test_ap_ft_separate_hostapd(dev, apdev, params):
536 """WPA2-PSK-FT AP and separate hostapd process"""
537 try:
538 run_ap_ft_separate_hostapd(dev, apdev, params, False)
539 finally:
540 cleanup_ap_ft_separate_hostapd()
541
542def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
543 """WPA2-PSK-FT AP over DS and separate hostapd process"""
544 try:
545 run_ap_ft_separate_hostapd(dev, apdev, params, True)
546 finally:
547 cleanup_ap_ft_separate_hostapd()
548
549def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
550 ssid = "test-ft"
fab49f61 551 passphrase = "12345678"
02a4ac0f
JM		 552 logdir = params['logdir']
553 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
554 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
555 global_ctrl = '/var/run/hostapd-ft'
556 br_ifname = 'br-ft'
557
558 try:
559 subprocess.check_call(['brctl', 'addbr', br_ifname])
560 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
561 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
562
fab49f61
JM		 563 subprocess.check_call(["ip", "link", "add", "veth0", "type", "veth",
564 "peer", "name", "veth0br"])
565 subprocess.check_call(["ip", "link", "add", "veth1", "type", "veth",
566 "peer", "name", "veth1br"])
02a4ac0f
JM		 567 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
568 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
569 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
570 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
571
572 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
573 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
574 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
575 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
576 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
577 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
578 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
579 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
580 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
581 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
582 except subprocess.CalledProcessError:
583 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
584
585 with HWSimRadio() as (radio, iface):
586 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
587 if not os.path.exists(prg):
588 prg = '../../hostapd/hostapd'
fab49f61
JM		 589 cmd = [prg, '-B', '-ddKt',
590 '-P', pidfile, '-f', logfile, '-g', global_ctrl]
02a4ac0f
JM		 591 subprocess.check_call(cmd)
592
593 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
fab49f61
JM		 594 apdev_ft = {'ifname': iface}
595 apdev2 = [apdev_ft, apdev[1]]
02a4ac0f
JM		 596
597 params = ft_params1(ssid=ssid, passphrase=passphrase)
598 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
599 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
600 params['bridge'] = 'br0ft'
601 hapd0 = hostapd.add_ap(apdev2[0], params,
602 global_ctrl_override=global_ctrl)
603 apdev2[0]['bssid'] = hapd0.own_addr()
604 params = ft_params2(ssid=ssid, passphrase=passphrase)
605 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
606 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
607 params['bridge'] = 'br1ft'
608 hapd1 = hostapd.add_ap(apdev2[1], params)
609
610 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
611 over_ds=over_ds, test_connectivity=False)
612
613 hglobal.terminate()
614
615 if os.path.exists(pidfile):
616 with open(pidfile, 'r') as f:
617 pid = int(f.read())
618 f.close()
619 os.kill(pid, signal.SIGTERM)
620
e63d8837
MV		 621def test_ap_ft_over_ds_ocv(dev, apdev):
622 """WPA2-PSK-FT AP over DS"""
623 ssid = "test-ft"
fab49f61 624 passphrase = "12345678"
e63d8837
MV		 625
626 params = ft_params1(ssid=ssid, passphrase=passphrase)
627 params["ieee80211w"] = "2"
628 params["ocv"] = "1"
629 try:
630 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 631 except Exception as e:
e63d8837
MV		 632 if "Failed to set hostapd parameter ocv" in str(e):
633 raise HwsimSkip("OCV not supported")
634 raise
635 params = ft_params2(ssid=ssid, passphrase=passphrase)
636 params["ieee80211w"] = "2"
637 params["ocv"] = "1"
638 hapd1 = hostapd.add_ap(apdev[1], params)
639
640 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
641 ocv="1")
642
55139acb
JM		 643def test_ap_ft_over_ds_disabled(dev, apdev):
644 """WPA2-PSK-FT AP over DS disabled"""
645 ssid = "test-ft"
fab49f61 646 passphrase = "12345678"
55139acb
JM		 647
648 params = ft_params1(ssid=ssid, passphrase=passphrase)
649 params['ft_over_ds'] = '0'
650 hapd0 = hostapd.add_ap(apdev[0], params)
651 params = ft_params2(ssid=ssid, passphrase=passphrase)
652 params['ft_over_ds'] = '0'
653 hapd1 = hostapd.add_ap(apdev[1], params)
654
655 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
656 fail_test=True)
657
473e5176
MB		 658def test_ap_ft_vlan_over_ds(dev, apdev):
659 """WPA2-PSK-FT AP over DS with VLAN"""
660 ssid = "test-ft"
fab49f61 661 passphrase = "12345678"
473e5176
MB		 662
663 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 664 params['dynamic_vlan'] = "1"
665 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 666 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
667 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 668 params['dynamic_vlan'] = "1"
669 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 670 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
671
672 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
673 conndev="brvlan1")
fab49f61
JM		 674 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
675 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
473e5176 676
40602101
JM		 677def test_ap_ft_over_ds_many(dev, apdev):
678 """WPA2-PSK-FT AP over DS multiple times"""
679 ssid = "test-ft"
fab49f61 680 passphrase = "12345678"
40602101
JM		 681
682 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 683 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 684 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 685 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 686
a8375c94
JM		 687 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
688 roams=50)
40602101 689
473e5176
MB		 690def test_ap_ft_vlan_over_ds_many(dev, apdev):
691 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
692 ssid = "test-ft"
fab49f61 693 passphrase = "12345678"
473e5176
MB		 694
695 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 696 params['dynamic_vlan'] = "1"
697 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 698 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
699 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 700 params['dynamic_vlan'] = "1"
701 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 702 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
703
704 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
705 roams=50, conndev="brvlan1")
706
9fd6804d 707@remote_compatible
c337d07a
JM		 708def test_ap_ft_over_ds_unknown_target(dev, apdev):
709 """WPA2-PSK-FT AP"""
710 ssid = "test-ft"
fab49f61 711 passphrase = "12345678"
c337d07a
JM		 712
713 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 714 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 715
716 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
717 scan_freq="2412")
718 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
719
9fd6804d 720@remote_compatible
211bb7c5
JM		 721def test_ap_ft_over_ds_unexpected(dev, apdev):
722 """WPA2-PSK-FT AP over DS and unexpected response"""
723 ssid = "test-ft"
fab49f61 724 passphrase = "12345678"
211bb7c5
JM		 725
726 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 727 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 728 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 729 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 730
731 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
732 scan_freq="2412")
733 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
734 ap1 = apdev[0]
735 ap2 = apdev[1]
736 hapd1ap = hapd0
737 hapd2ap = hapd1
738 else:
739 ap1 = apdev[1]
740 ap2 = apdev[0]
741 hapd1ap = hapd1
742 hapd2ap = hapd0
743
744 addr = dev[0].own_addr()
745 hapd1ap.set("ext_mgmt_frame_handling", "1")
746 logger.info("Foreign STA address")
747 msg = {}
748 msg['fc'] = 13 << 4
749 msg['da'] = addr
750 msg['sa'] = ap1['bssid']
751 msg['bssid'] = ap1['bssid']
752 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
753 hapd1ap.mgmt_tx(msg)
754
755 logger.info("No over-the-DS in progress")
756 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
757 hapd1ap.mgmt_tx(msg)
758
759 logger.info("Non-zero status code")
760 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
761 hapd1ap.mgmt_tx(msg)
762
763 hapd1ap.dump_monitor()
764
765 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
766 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
767 raise Exception("FT_DS failed")
768
769 req = hapd1ap.mgmt_rx()
770
771 logger.info("Foreign Target AP")
772 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
773 hapd1ap.mgmt_tx(msg)
774
775 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
776
777 logger.info("No IEs")
778 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
779 hapd1ap.mgmt_tx(msg)
780
781 logger.info("Invalid IEs (trigger parsing failure)")
782 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
783 hapd1ap.mgmt_tx(msg)
784
785 logger.info("Too short MDIE")
786 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
787 hapd1ap.mgmt_tx(msg)
788
789 logger.info("Mobility domain mismatch")
790 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
791 hapd1ap.mgmt_tx(msg)
792
793 logger.info("No FTIE")
794 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
795 hapd1ap.mgmt_tx(msg)
796
797 logger.info("FTIE SNonce mismatch")
798 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
799 hapd1ap.mgmt_tx(msg)
800
801 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 802 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 803 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
804 hapd1ap.mgmt_tx(msg)
805
806 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 807 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 808 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
809 hapd1ap.mgmt_tx(msg)
810
811 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 812 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 813 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
814 hapd1ap.mgmt_tx(msg)
815
816 logger.info("No RSNE")
7ab74770 817 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 818 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
819 hapd1ap.mgmt_tx(msg)
820
b553eab1
JM		 821def test_ap_ft_pmf_over_ds(dev, apdev):
822 """WPA2-PSK-FT AP over DS with PMF"""
0c481b78 823 run_ap_ft_pmf_bip_over_ds(dev, apdev, None)
46b8ea21 824
ffcaca68
JM		 825def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
826 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
827 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
828
829def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
830 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
831 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
832
833def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
834 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
835 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
836
837def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
838 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
839 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
840
841def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
0c481b78 842 if cipher and cipher not in dev[0].get_capability("group_mgmt"):
ffcaca68
JM		 843 raise HwsimSkip("Cipher %s not supported" % cipher)
844
845 ssid = "test-ft"
fab49f61 846 passphrase = "12345678"
ffcaca68
JM		 847
848 params = ft_params1(ssid=ssid, passphrase=passphrase)
849 params["ieee80211w"] = "2"
0c481b78
JM		 850 if cipher:
851 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 852 hapd0 = hostapd.add_ap(apdev[0], params)
853 params = ft_params2(ssid=ssid, passphrase=passphrase)
854 params["ieee80211w"] = "2"
0c481b78
JM		 855 if cipher:
856 params["group_mgmt_cipher"] = cipher
ffcaca68
JM		 857 hapd1 = hostapd.add_ap(apdev[1], params)
858
0defc42a
JM		 859 Wlantest.setup(hapd0)
860 wt = Wlantest()
861 wt.flush()
862 wt.add_passphrase(passphrase)
863
ffcaca68
JM		 864 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
865 group_mgmt=cipher)
6e658cc4 866
aaba98d3
JM		 867def test_ap_ft_over_ds_pull(dev, apdev):
868 """WPA2-PSK-FT AP over DS (pull PMK)"""
869 ssid = "test-ft"
fab49f61 870 passphrase = "12345678"
aaba98d3
JM		 871
872 params = ft_params1(ssid=ssid, passphrase=passphrase)
873 params["pmk_r1_push"] = "0"
8b8a1864 874 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 875 params = ft_params2(ssid=ssid, passphrase=passphrase)
876 params["pmk_r1_push"] = "0"
8b8a1864 877 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 878
a8375c94 879 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 880
c95dd8e4
JM		 881def test_ap_ft_over_ds_pull_old_key(dev, apdev):
882 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
883 ssid = "test-ft"
fab49f61 884 passphrase = "12345678"
c95dd8e4
JM		 885
886 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
887 params["pmk_r1_push"] = "0"
888 hapd0 = hostapd.add_ap(apdev[0], params)
889 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
890 params["pmk_r1_push"] = "0"
891 hapd1 = hostapd.add_ap(apdev[1], params)
892
893 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
894
473e5176
MB		 895def test_ap_ft_over_ds_pull_vlan(dev, apdev):
896 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
897 ssid = "test-ft"
fab49f61 898 passphrase = "12345678"
473e5176
MB		 899
900 params = ft_params1(ssid=ssid, passphrase=passphrase)
901 params["pmk_r1_push"] = "0"
58be42b2
JM		 902 params['dynamic_vlan'] = "1"
903 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 904 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
905 params = ft_params2(ssid=ssid, passphrase=passphrase)
906 params["pmk_r1_push"] = "0"
58be42b2
JM		 907 params['dynamic_vlan'] = "1"
908 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 909 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
910
911 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
912 conndev="brvlan1")
913
425e5f97
JM		 914def start_ft_sae(dev, apdev, wpa_ptk_rekey=None):
915 if "SAE" not in dev.get_capability("auth_alg"):
b9749b6a 916 raise HwsimSkip("SAE not supported")
6e658cc4 917 ssid = "test-ft"
fab49f61 918 passphrase = "12345678"
6e658cc4
JM		 919
920 params = ft_params1(ssid=ssid, passphrase=passphrase)
921 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 922 if wpa_ptk_rekey:
923 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 924 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 925 params = ft_params2(ssid=ssid, passphrase=passphrase)
926 params['wpa_key_mgmt'] = "FT-SAE"
425e5f97
JM		 927 if wpa_ptk_rekey:
928 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
929 hapd1 = hostapd.add_ap(apdev[1], params)
930 key_mgmt = hapd1.get_config()['key_mgmt']
65038313
JM		 931 if key_mgmt.split(' ')[0] != "FT-SAE":
932 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 933
425e5f97
JM		 934 dev.request("SET sae_groups ")
935 return hapd0, hapd1
936
937def test_ap_ft_sae(dev, apdev):
938 """WPA2-PSK-FT-SAE AP"""
939 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
940 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True)
941
942def test_ap_ft_sae_ptk_rekey0(dev, apdev):
943 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
944 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
945 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
946 ptk_rekey="1", roams=0)
947 check_ptk_rekey(dev[0], hapd0, hapd1)
948
949def test_ap_ft_sae_ptk_rekey1(dev, apdev):
950 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
951 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
952 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
953 ptk_rekey="1", only_one_way=True)
954 check_ptk_rekey(dev[0], hapd0, hapd1)
955
956def test_ap_ft_sae_ptk_rekey_ap(dev, apdev):
957 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by AP"""
958 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
959 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
960 only_one_way=True)
961 check_ptk_rekey(dev[0], hapd0, hapd1)
6e658cc4
JM		 962
963def test_ap_ft_sae_over_ds(dev, apdev):
964 """WPA2-PSK-FT-SAE AP over DS"""
425e5f97
JM		 965 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
966 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
a8375c94 967 over_ds=True)
6f62809b 968
425e5f97
JM		 969def test_ap_ft_sae_over_ds_ptk_rekey0(dev, apdev):
970 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
971 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
972 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
973 over_ds=True, ptk_rekey="1", roams=0)
974 check_ptk_rekey(dev[0], hapd0, hapd1)
975
976def test_ap_ft_sae_over_ds_ptk_rekey1(dev, apdev):
977 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
978 hapd0, hapd1 = start_ft_sae(dev[0], apdev)
979 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
980 over_ds=True, ptk_rekey="1", only_one_way=True)
981 check_ptk_rekey(dev[0], hapd0, hapd1)
982
983def test_ap_ft_sae_over_ds_ptk_rekey_ap(dev, apdev):
984 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by AP"""
985 hapd0, hapd1 = start_ft_sae(dev[0], apdev, wpa_ptk_rekey=2)
986 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", sae=True,
987 over_ds=True, only_one_way=True)
988 check_ptk_rekey(dev[0], hapd0, hapd1)
989
3d5b88b5
JM		 990def test_ap_ft_sae_pw_id(dev, apdev):
991 """FT-SAE with Password Identifier"""
992 if "SAE" not in dev[0].get_capability("auth_alg"):
993 raise HwsimSkip("SAE not supported")
994 ssid = "test-ft"
995
996 params = ft_params1(ssid=ssid)
997 params["ieee80211w"] = "2"
998 params['wpa_key_mgmt'] = "FT-SAE"
999 params['sae_password'] = 'secret|id=pwid'
1000 hapd0 = hostapd.add_ap(apdev[0], params)
1001 params = ft_params2(ssid=ssid)
1002 params["ieee80211w"] = "2"
1003 params['wpa_key_mgmt'] = "FT-SAE"
1004 params['sae_password'] = 'secret|id=pwid'
1005 hapd = hostapd.add_ap(apdev[1], params)
1006
1007 dev[0].request("SET sae_groups ")
1008 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
1009 sae_password="secret", sae_password_id="pwid")
1010
cdf53910
JM		 1011def test_ap_ft_sae_with_both_akms(dev, apdev):
1012 """SAE + FT-SAE configuration"""
1013 if "SAE" not in dev[0].get_capability("auth_alg"):
1014 raise HwsimSkip("SAE not supported")
1015 ssid = "test-ft"
1016 passphrase = "12345678"
1017
1018 params = ft_params1(ssid=ssid, passphrase=passphrase)
1019 params['wpa_key_mgmt'] = "FT-SAE SAE"
1020 hapd0 = hostapd.add_ap(apdev[0], params)
1021 params = ft_params2(ssid=ssid, passphrase=passphrase)
1022 params['wpa_key_mgmt'] = "FT-SAE SAE"
1023 hapd = hostapd.add_ap(apdev[1], params)
1024 key_mgmt = hapd.get_config()['key_mgmt']
1025 if key_mgmt.split(' ')[0] != "FT-SAE":
1026 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1027
1028 dev[0].request("SET sae_groups ")
1029 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1030 sae_and_psk=True)
1031
1211031a
JM		 1032def test_ap_ft_sae_pmksa_caching(dev, apdev):
1033 """WPA2-FT-SAE AP and PMKSA caching for initial mobility domain association"""
1034 if "SAE" not in dev[0].get_capability("auth_alg"):
1035 raise HwsimSkip("SAE not supported")
1036 ssid = "test-ft"
1037 passphrase = "12345678"
1038
1039 params = ft_params1(ssid=ssid, passphrase=passphrase)
1040 params['wpa_key_mgmt'] = "FT-SAE"
1041 hapd0 = hostapd.add_ap(apdev[0], params)
1042 params = ft_params2(ssid=ssid, passphrase=passphrase)
1043 params['wpa_key_mgmt'] = "FT-SAE"
1044 hapd = hostapd.add_ap(apdev[1], params)
1045 key_mgmt = hapd.get_config()['key_mgmt']
1046 if key_mgmt.split(' ')[0] != "FT-SAE":
1047 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1048
1049 dev[0].request("SET sae_groups ")
1050 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True,
1051 pmksa_caching=True)
1052
d269740a 1053def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
425e5f97
JM		 1054 discovery=False, roams=1, wpa_ptk_rekey=0,
1055 only_one_way=False):
6f62809b 1056 ssid = "test-ft"
fab49f61 1057 passphrase = "12345678"
9c50a6d3 1058 if vlan:
fab49f61
JM		 1059 identity = "gpsk-vlan1"
1060 conndev = "brvlan1"
d269740a 1061 elif cui:
fab49f61
JM		 1062 identity = "gpsk-cui"
1063 conndev = False
9c50a6d3 1064 else:
fab49f61
JM		 1065 identity = "gpsk user"
1066 conndev = False
6f62809b
JM		 1067
1068 radius = hostapd.radius_params()
942b52a8 1069 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1070 params['wpa_key_mgmt'] = "FT-EAP"
1071 params["ieee8021x"] = "1"
9c50a6d3
MB		 1072 if vlan:
1073 params["dynamic_vlan"] = "1"
35d8c254 1074 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1075 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 1076 key_mgmt = hapd.get_config()['key_mgmt']
1077 if key_mgmt.split(' ')[0] != "FT-EAP":
1078 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 1079 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 1080 params['wpa_key_mgmt'] = "FT-EAP"
1081 params["ieee8021x"] = "1"
9c50a6d3
MB		 1082 if vlan:
1083 params["dynamic_vlan"] = "1"
425e5f97
JM		 1084 if wpa_ptk_rekey:
1085 params["wpa_ptk_rekey"] = str(wpa_ptk_rekey)
35d8c254 1086 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1087 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 1088
942b52a8 1089 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3 1090 over_ds=over_ds, roams=roams, eap_identity=identity,
425e5f97 1091 conndev=conndev, only_one_way=only_one_way)
91bc6c36
JM		 1092 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
1093 raise Exception("Scan results missing RSN element info")
fab49f61
JM		 1094 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
1095 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
425e5f97
JM		 1096 if only_one_way:
1097 return
aaba98d3 1098
4013d688
JM		 1099 # Verify EAPOL reauthentication after FT protocol
1100 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1101 ap = hapd
1102 else:
1103 ap = hapd1
1104 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
1105 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
1106 if ev is None:
1107 raise Exception("EAP authentication did not start")
1108 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
1109 if ev is None:
1110 raise Exception("EAP authentication did not succeed")
1111 time.sleep(0.1)
9c50a6d3
MB		 1112 if conndev:
1113 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
1114 else:
1115 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 1116
942b52a8
MB		 1117def test_ap_ft_eap(dev, apdev):
1118 """WPA2-EAP-FT AP"""
1119 generic_ap_ft_eap(dev, apdev)
1120
d269740a
MB		 1121def test_ap_ft_eap_cui(dev, apdev):
1122 """WPA2-EAP-FT AP with CUI"""
1123 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
1124
9c50a6d3
MB		 1125def test_ap_ft_eap_vlan(dev, apdev):
1126 """WPA2-EAP-FT AP with VLAN"""
1127 generic_ap_ft_eap(dev, apdev, vlan=True)
1128
1129def test_ap_ft_eap_vlan_multi(dev, apdev):
1130 """WPA2-EAP-FT AP with VLAN"""
1131 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1132
942b52a8
MB		 1133def test_ap_ft_eap_over_ds(dev, apdev):
1134 """WPA2-EAP-FT AP using over-the-DS"""
1135 generic_ap_ft_eap(dev, apdev, over_ds=True)
1136
1137def test_ap_ft_eap_dis(dev, apdev):
1138 """WPA2-EAP-FT AP with AP discovery"""
1139 generic_ap_ft_eap(dev, apdev, discovery=True)
1140
1141def test_ap_ft_eap_dis_over_ds(dev, apdev):
1142 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1143 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1144
9c50a6d3
MB		 1145def test_ap_ft_eap_vlan(dev, apdev):
1146 """WPA2-EAP-FT AP with VLAN"""
1147 generic_ap_ft_eap(dev, apdev, vlan=True)
1148
1149def test_ap_ft_eap_vlan_multi(dev, apdev):
1150 """WPA2-EAP-FT AP with VLAN"""
1151 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1152
1153def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1154 """WPA2-EAP-FT AP with VLAN + over_ds"""
1155 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1156
1157def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1158 """WPA2-EAP-FT AP with VLAN + over_ds"""
1159 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1160
1161def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1162 """WPA2-EAP-FT AP (pull PMK)"""
1163 ssid = "test-ft"
fab49f61 1164 passphrase = "12345678"
9c50a6d3 1165 if vlan:
fab49f61
JM		 1166 identity = "gpsk-vlan1"
1167 conndev = "brvlan1"
9c50a6d3 1168 else:
fab49f61
JM		 1169 identity = "gpsk user"
1170 conndev = False
aaba98d3
JM		 1171
1172 radius = hostapd.radius_params()
1173 params = ft_params1(ssid=ssid, passphrase=passphrase)
1174 params['wpa_key_mgmt'] = "FT-EAP"
1175 params["ieee8021x"] = "1"
1176 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1177 if vlan:
1178 params["dynamic_vlan"] = "1"
35d8c254 1179 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1180 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1181 key_mgmt = hapd.get_config()['key_mgmt']
1182 if key_mgmt.split(' ')[0] != "FT-EAP":
1183 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1184 params = ft_params2(ssid=ssid, passphrase=passphrase)
1185 params['wpa_key_mgmt'] = "FT-EAP"
1186 params["ieee8021x"] = "1"
1187 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1188 if vlan:
1189 params["dynamic_vlan"] = "1"
35d8c254 1190 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1191 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1192
9c50a6d3
MB		 1193 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1194 eap_identity=identity, conndev=conndev)
1195
1196def test_ap_ft_eap_pull(dev, apdev):
1197 """WPA2-EAP-FT AP (pull PMK)"""
1198 generic_ap_ft_eap_pull(dev, apdev)
1199
1200def test_ap_ft_eap_pull_vlan(dev, apdev):
1201 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1202
f81c1411
JM		 1203def test_ap_ft_eap_pull_wildcard(dev, apdev):
1204 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1205 ssid = "test-ft"
fab49f61 1206 passphrase = "12345678"
f81c1411
JM		 1207
1208 radius = hostapd.radius_params()
1209 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1210 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1211 params["ieee8021x"] = "1"
1212 params["pmk_r1_push"] = "0"
1213 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1214 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1215 params["ft_psk_generate_local"] = "1"
1216 params["eap_server"] = "0"
35d8c254 1217 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1218 hapd = hostapd.add_ap(apdev[0], params)
1219 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1220 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1221 params["ieee8021x"] = "1"
1222 params["pmk_r1_push"] = "0"
1223 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1224 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1225 params["ft_psk_generate_local"] = "1"
1226 params["eap_server"] = "0"
35d8c254 1227 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1228 hapd1 = hostapd.add_ap(apdev[1], params)
1229
1230 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1231
9fd6804d 1232@remote_compatible
3b808945
JM		 1233def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1234 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1235 ssid = "test-ft"
fab49f61 1236 passphrase = "12345678"
3b808945
JM		 1237
1238 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1239 params["ieee80211w"] = "2"
8b8a1864 1240 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1241 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1242 params["ieee80211w"] = "2"
8b8a1864 1243 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1244
a8375c94
JM		 1245 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1246 fail_test=True)
3b808945 1247
9fd6804d 1248@remote_compatible
3b808945
JM		 1249def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1250 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1251 ssid = "test-ft"
fab49f61 1252 passphrase = "12345678"
3b808945
JM		 1253
1254 params = ft_params1(ssid=ssid, passphrase=passphrase)
1255 params["pmk_r1_push"] = "0"
8b8a1864 1256 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1257 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1258 params["pmk_r1_push"] = "0"
8b8a1864 1259 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1260
a8375c94
JM		 1261 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1262 fail_test=True)
3b808945 1263
9fd6804d 1264@remote_compatible
ae14a2e2
JM		 1265def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1266 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1267 ssid = "test-ft"
fab49f61 1268 passphrase = "12345678"
ae14a2e2
JM		 1269
1270 params = ft_params1(ssid=ssid, passphrase=passphrase)
1271 params["pmk_r1_push"] = "0"
1272 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1273 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1274 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1275 scan_freq="2412")
ae14a2e2
JM		 1276
1277 params = ft_params2(ssid=ssid, passphrase=passphrase)
1278 params["pmk_r1_push"] = "0"
8b8a1864 1279 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1280
1281 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1282 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1283
9fd6804d 1284@remote_compatible
3b808945
JM		 1285def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1286 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1287 ssid = "test-ft"
fab49f61 1288 passphrase = "12345678"
3b808945
JM		 1289
1290 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1291 params["ieee80211w"] = "2"
8b8a1864 1292 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1293 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1294 params["ieee80211w"] = "2"
8b8a1864 1295 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1296
a8375c94
JM		 1297 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1298 fail_test=True)
3b808945 1299
9fd6804d 1300@remote_compatible
3b808945
JM		 1301def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1302 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1303 ssid = "test-ft"
fab49f61 1304 passphrase = "12345678"
3b808945
JM		 1305
1306 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1307 params["pmk_r1_push"] = "0"
8b8a1864 1308 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1309 params = ft_params2(ssid=ssid, passphrase=passphrase)
1310 params["pmk_r1_push"] = "0"
8b8a1864 1311 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1312
a8375c94
JM		 1313 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1314 fail_test=True)
c6b6e105 1315
150948e6
MB		 1316def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1317 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1318 ssid = "test-ft"
fab49f61 1319 passphrase = "12345678"
150948e6
MB		 1320
1321 radius = hostapd.radius_params()
1322 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1323 params["ieee80211w"] = "2"
150948e6
MB		 1324 params['wpa_key_mgmt'] = "FT-EAP"
1325 params["ieee8021x"] = "1"
35d8c254 1326 params = dict(list(radius.items()) + list(params.items()))
b098542c 1327 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1328 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1329 params["ieee80211w"] = "2"
150948e6
MB		 1330 params['wpa_key_mgmt'] = "FT-EAP"
1331 params["ieee8021x"] = "1"
35d8c254 1332 params = dict(list(radius.items()) + list(params.items()))
b098542c 1333 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1334
1335 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1336 fail_test=True, eap=True)
1337
1338def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1339 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1340 ssid = "test-ft"
fab49f61 1341 passphrase = "12345678"
150948e6
MB		 1342
1343 radius = hostapd.radius_params()
1344 params = ft_params1(ssid=ssid, passphrase=passphrase)
1345 params["pmk_r1_push"] = "0"
1346 params['wpa_key_mgmt'] = "FT-EAP"
1347 params["ieee8021x"] = "1"
35d8c254 1348 params = dict(list(radius.items()) + list(params.items()))
b098542c 1349 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1350 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1351 params["pmk_r1_push"] = "0"
1352 params['wpa_key_mgmt'] = "FT-EAP"
1353 params["ieee8021x"] = "1"
35d8c254 1354 params = dict(list(radius.items()) + list(params.items()))
b098542c 1355 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1356
1357 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1358 fail_test=True, eap=True)
1359
1360def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1361 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1362 ssid = "test-ft"
fab49f61 1363 passphrase = "12345678"
150948e6
MB		 1364
1365 radius = hostapd.radius_params()
1366 params = ft_params1(ssid=ssid, passphrase=passphrase)
1367 params["pmk_r1_push"] = "0"
1368 params["nas_identifier"] = "nas0.w1.fi"
1369 params['wpa_key_mgmt'] = "FT-EAP"
1370 params["ieee8021x"] = "1"
35d8c254 1371 params = dict(list(radius.items()) + list(params.items()))
b098542c 1372 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1373 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1374 eap="GPSK", identity="gpsk user",
1375 password="abcdefghijklmnop0123456789abcdef",
1376 scan_freq="2412")
1377
1378 params = ft_params2(ssid=ssid, passphrase=passphrase)
1379 params["pmk_r1_push"] = "0"
1380 params['wpa_key_mgmt'] = "FT-EAP"
1381 params["ieee8021x"] = "1"
35d8c254 1382 params = dict(list(radius.items()) + list(params.items()))
b098542c 1383 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1384
1385 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1386 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1387
1388def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1389 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1390 ssid = "test-ft"
fab49f61 1391 passphrase = "12345678"
150948e6
MB		 1392
1393 radius = hostapd.radius_params()
1394 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1395 params["ieee80211w"] = "2"
150948e6
MB		 1396 params['wpa_key_mgmt'] = "FT-EAP"
1397 params["ieee8021x"] = "1"
35d8c254 1398 params = dict(list(radius.items()) + list(params.items()))
b098542c 1399 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1400 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1401 params["ieee80211w"] = "2"
150948e6
MB		 1402 params['wpa_key_mgmt'] = "FT-EAP"
1403 params["ieee8021x"] = "1"
35d8c254 1404 params = dict(list(radius.items()) + list(params.items()))
b098542c 1405 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1406
1407 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1408 fail_test=True, eap=True)
1409
1410def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1411 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1412 ssid = "test-ft"
fab49f61 1413 passphrase = "12345678"
150948e6
MB		 1414
1415 radius = hostapd.radius_params()
1416 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1417 params["pmk_r1_push"] = "0"
1418 params['wpa_key_mgmt'] = "FT-EAP"
1419 params["ieee8021x"] = "1"
35d8c254 1420 params = dict(list(radius.items()) + list(params.items()))
b098542c 1421 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1422 params = ft_params2(ssid=ssid, passphrase=passphrase)
1423 params["pmk_r1_push"] = "0"
1424 params['wpa_key_mgmt'] = "FT-EAP"
1425 params["ieee8021x"] = "1"
35d8c254 1426 params = dict(list(radius.items()) + list(params.items()))
b098542c 1427 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1428
1429 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1430 fail_test=True, eap=True)
1431
c6b6e105
JM		 1432def test_ap_ft_gtk_rekey(dev, apdev):
1433 """WPA2-PSK-FT AP and GTK rekey"""
1434 ssid = "test-ft"
fab49f61 1435 passphrase = "12345678"
c6b6e105
JM		 1436
1437 params = ft_params1(ssid=ssid, passphrase=passphrase)
1438 params['wpa_group_rekey'] = '1'
8b8a1864 1439 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1440
1441 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1442 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1443
1444 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1445 if ev is None:
1446 raise Exception("GTK rekey timed out after initial association")
a8375c94 1447 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1448
1449 params = ft_params2(ssid=ssid, passphrase=passphrase)
1450 params['wpa_group_rekey'] = '1'
8b8a1864 1451 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1452
1453 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1454 dev[0].roam(apdev[1]['bssid'])
1455 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1456 raise Exception("Did not connect to correct AP")
a8375c94 1457 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1458
1459 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1460 if ev is None:
1461 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1462 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1463
1464def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1465 """WPA2-PSK-FT and key lifetime in memory"""
1466 ssid = "test-ft"
fab49f61 1467 passphrase = "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
5b3c40a6
JM		 1468 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1469 pmk = binascii.unhexlify(psk)
1470 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1471 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1472 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1473 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1474
1475 pid = find_wpas_process(dev[0])
1476
1477 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1478 scan_freq="2412")
8e416cec
JM		 1479 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1480 # event has been delivered, so verify that wpa_supplicant has returned to
1481 # eloop before reading process memory.
54f2cae2 1482 time.sleep(1)
8e416cec 1483 dev[0].ping()
5b3c40a6
JM		 1484
1485 buf = read_process_memory(pid, pmk)
1486
1487 dev[0].request("DISCONNECT")
1488 dev[0].wait_disconnected()
1489
1490 dev[0].relog()
1491 pmkr0 = None
1492 pmkr1 = None
1493 ptk = None
1494 gtk = None
1495 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1496 for l in f.readlines():
1497 if "FT: PMK-R0 - hexdump" in l:
1498 val = l.strip().split(':')[3].replace(' ', '')
1499 pmkr0 = binascii.unhexlify(val)
1500 if "FT: PMK-R1 - hexdump" in l:
1501 val = l.strip().split(':')[3].replace(' ', '')
1502 pmkr1 = binascii.unhexlify(val)
f918b95b 1503 if "FT: KCK - hexdump" in l:
5b3c40a6 1504 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1505 kck = binascii.unhexlify(val)
1506 if "FT: KEK - hexdump" in l:
1507 val = l.strip().split(':')[3].replace(' ', '')
1508 kek = binascii.unhexlify(val)
1509 if "FT: TK - hexdump" in l:
1510 val = l.strip().split(':')[3].replace(' ', '')
1511 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1512 if "WPA: Group Key - hexdump" in l:
1513 val = l.strip().split(':')[3].replace(' ', '')
1514 gtk = binascii.unhexlify(val)
f918b95b 1515 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1516 raise Exception("Could not find keys from debug log")
1517 if len(gtk) != 16:
1518 raise Exception("Unexpected GTK length")
1519
5b3c40a6
JM		 1520 logger.info("Checking keys in memory while associated")
1521 get_key_locations(buf, pmk, "PMK")
1522 get_key_locations(buf, pmkr0, "PMK-R0")
1523 get_key_locations(buf, pmkr1, "PMK-R1")
1524 if pmk not in buf:
81e787b7 1525 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1526 if pmkr0 not in buf:
81e787b7 1527 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1528 if pmkr1 not in buf:
81e787b7 1529 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1530 if kck not in buf:
1531 raise Exception("KCK not found while associated")
1532 if kek not in buf:
1533 raise Exception("KEK not found while associated")
b74f82a4
JM		 1534 #if tk in buf:
1535 # raise Exception("TK found from memory")
5b3c40a6
JM		 1536
1537 logger.info("Checking keys in memory after disassociation")
1538 buf = read_process_memory(pid, pmk)
1539 get_key_locations(buf, pmk, "PMK")
1540 get_key_locations(buf, pmkr0, "PMK-R0")
1541 get_key_locations(buf, pmkr1, "PMK-R1")
1542
1543 # Note: PMK/PSK is still present in network configuration
1544
1545 fname = os.path.join(params['logdir'],
1546 'ft_psk_key_lifetime_in_memory.memctx-')
1547 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1548 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1549 verify_not_present(buf, kck, fname, "KCK")
1550 verify_not_present(buf, kek, fname, "KEK")
1551 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1552 if gtk in buf:
1553 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1554 verify_not_present(buf, gtk, fname, "GTK")
1555
1556 dev[0].request("REMOVE_NETWORK all")
1557
1558 logger.info("Checking keys in memory after network profile removal")
1559 buf = read_process_memory(pid, pmk)
1560 get_key_locations(buf, pmk, "PMK")
1561 get_key_locations(buf, pmkr0, "PMK-R0")
1562 get_key_locations(buf, pmkr1, "PMK-R1")
1563
1564 verify_not_present(buf, pmk, fname, "PMK")
1565 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1566 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1567 verify_not_present(buf, kck, fname, "KCK")
1568 verify_not_present(buf, kek, fname, "KEK")
1569 verify_not_present(buf, tk, fname, "TK")
1570 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1571
9fd6804d 1572@remote_compatible
664093b5
JM		 1573def test_ap_ft_invalid_resp(dev, apdev):
1574 """WPA2-PSK-FT AP and invalid response IEs"""
1575 ssid = "test-ft"
fab49f61 1576 passphrase = "12345678"
664093b5
JM		 1577
1578 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1579 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1580 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1581 scan_freq="2412")
1582
1583 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1584 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1585
1586 tests = [
1587 # Various IEs for test coverage. The last one is FTIE with invalid
1588 # R1KH-ID subelement.
1589 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1590 # FTIE with invalid R0KH-ID subelement (len=0).
1591 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1592 # FTIE with invalid R0KH-ID subelement (len=49).
1593 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1594 # Invalid RSNE.
1595 "020002000000" + "3000",
1596 # Required IEs missing from protected IE count.
1597 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1598 # RIC missing from protected IE count.
1599 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1600 # Protected IE missing.
fab49f61 1601 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
664093b5
JM		 1602 for t in tests:
1603 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1604 hapd1.set("ext_mgmt_frame_handling", "1")
1605 hapd1.dump_monitor()
1606 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1607 raise Exception("ROAM failed")
1608 auth = None
1609 for i in range(20):
1610 msg = hapd1.mgmt_rx()
1611 if msg['subtype'] == 11:
1612 auth = msg
1613 break
1614 if not auth:
1615 raise Exception("Authentication frame not seen")
1616
1617 resp = {}
1618 resp['fc'] = auth['fc']
1619 resp['da'] = auth['sa']
1620 resp['sa'] = auth['da']
1621 resp['bssid'] = auth['bssid']
1622 resp['payload'] = binascii.unhexlify(t)
1623 hapd1.mgmt_tx(resp)
1624 hapd1.set("ext_mgmt_frame_handling", "0")
1625 dev[0].wait_disconnected()
1626
1627 dev[0].request("RECONNECT")
1628 dev[0].wait_connected()
7b741a53
JM		 1629
1630def test_ap_ft_gcmp_256(dev, apdev):
1631 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1632 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1633 raise HwsimSkip("Cipher GCMP-256 not supported")
1634 ssid = "test-ft"
fab49f61 1635 passphrase = "12345678"
7b741a53
JM		 1636
1637 params = ft_params1(ssid=ssid, passphrase=passphrase)
1638 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1639 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1640 params = ft_params2(ssid=ssid, passphrase=passphrase)
1641 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1642 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1643
1644 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1645 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1646
63a7683b 1647def setup_ap_ft_oom(dev, apdev):
38934ed1 1648 skip_with_fips(dev[0])
cf671d54 1649 ssid = "test-ft"
fab49f61 1650 passphrase = "12345678"
cf671d54
JM		 1651
1652 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1653 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1654 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1655 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1656
1657 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1658 scan_freq="2412")
1659 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1660 dst = apdev[1]['bssid']
1661 else:
1662 dst = apdev[0]['bssid']
1663
1664 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1665
1666 return dst
1667
1668def test_ap_ft_oom(dev, apdev):
1669 """WPA2-PSK-FT and OOM"""
1670 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1671 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1672 dev[0].roam(dst)
63a7683b
JM		 1673
1674def test_ap_ft_oom2(dev, apdev):
1675 """WPA2-PSK-FT and OOM (2)"""
1676 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1677 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1678 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1679
1680def test_ap_ft_oom3(dev, apdev):
1681 """WPA2-PSK-FT and OOM (3)"""
1682 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1683 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1684 dev[0].roam(dst)
34d3eaa8 1685
63a7683b
JM		 1686def test_ap_ft_oom4(dev, apdev):
1687 """WPA2-PSK-FT and OOM (4)"""
1688 ssid = "test-ft"
fab49f61 1689 passphrase = "12345678"
63a7683b 1690 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1691 dev[0].request("REMOVE_NETWORK all")
1692 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1693 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1694 scan_freq="2412")
1695
682a79f0
JM		 1696def test_ap_ft_ap_oom(dev, apdev):
1697 """WPA2-PSK-FT and AP OOM"""
1698 ssid = "test-ft"
fab49f61 1699 passphrase = "12345678"
682a79f0
JM		 1700
1701 params = ft_params1(ssid=ssid, passphrase=passphrase)
1702 hapd0 = hostapd.add_ap(apdev[0], params)
1703 bssid0 = hapd0.own_addr()
1704
1705 dev[0].scan_for_bss(bssid0, freq="2412")
1706 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1707 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1708 scan_freq="2412")
1709
1710 params = ft_params2(ssid=ssid, passphrase=passphrase)
1711 hapd1 = hostapd.add_ap(apdev[1], params)
1712 bssid1 = hapd1.own_addr()
1713 dev[0].scan_for_bss(bssid1, freq="2412")
1714 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1715 dev[0].roam(bssid1)
1716
1717def test_ap_ft_ap_oom2(dev, apdev):
1718 """WPA2-PSK-FT and AP OOM 2"""
1719 ssid = "test-ft"
fab49f61 1720 passphrase = "12345678"
682a79f0
JM		 1721
1722 params = ft_params1(ssid=ssid, passphrase=passphrase)
1723 hapd0 = hostapd.add_ap(apdev[0], params)
1724 bssid0 = hapd0.own_addr()
1725
1726 dev[0].scan_for_bss(bssid0, freq="2412")
1727 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1728 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1729 scan_freq="2412")
1730
1731 params = ft_params2(ssid=ssid, passphrase=passphrase)
1732 hapd1 = hostapd.add_ap(apdev[1], params)
1733 bssid1 = hapd1.own_addr()
1734 dev[0].scan_for_bss(bssid1, freq="2412")
1735 dev[0].roam(bssid1)
1736 if dev[0].get_status_field('bssid') != bssid1:
1737 raise Exception("Did not roam to AP1")
1738 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1739 dev[0].roam(bssid0)
1740
1741def test_ap_ft_ap_oom3(dev, apdev):
1742 """WPA2-PSK-FT and AP OOM 3"""
1743 ssid = "test-ft"
fab49f61 1744 passphrase = "12345678"
682a79f0
JM		 1745
1746 params = ft_params1(ssid=ssid, passphrase=passphrase)
1747 hapd0 = hostapd.add_ap(apdev[0], params)
1748 bssid0 = hapd0.own_addr()
1749
1750 dev[0].scan_for_bss(bssid0, freq="2412")
1751 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1752 scan_freq="2412")
1753
1754 params = ft_params2(ssid=ssid, passphrase=passphrase)
1755 hapd1 = hostapd.add_ap(apdev[1], params)
1756 bssid1 = hapd1.own_addr()
1757 dev[0].scan_for_bss(bssid1, freq="2412")
1758 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1759 # This will fail due to not being able to send out PMK-R1 pull request
1760 dev[0].roam(bssid1)
1761
ba88dd65 1762 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1763 # This will fail due to not being able to send out PMK-R1 pull request
1764 dev[0].roam(bssid1)
1765
ba88dd65
MB		 1766 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1767 # This will fail due to not being able to send out PMK-R1 pull request
1768 dev[0].roam(bssid1)
1769
1770def test_ap_ft_ap_oom3b(dev, apdev):
1771 """WPA2-PSK-FT and AP OOM 3b"""
1772 ssid = "test-ft"
fab49f61 1773 passphrase = "12345678"
ba88dd65
MB		 1774
1775 params = ft_params1(ssid=ssid, passphrase=passphrase)
1776 hapd0 = hostapd.add_ap(apdev[0], params)
1777 bssid0 = hapd0.own_addr()
1778
1779 dev[0].scan_for_bss(bssid0, freq="2412")
1780 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1781 scan_freq="2412")
1782
1783 params = ft_params2(ssid=ssid, passphrase=passphrase)
1784 hapd1 = hostapd.add_ap(apdev[1], params)
1785 bssid1 = hapd1.own_addr()
1786 dev[0].scan_for_bss(bssid1, freq="2412")
1787 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1788 # This will fail due to not being able to send out PMK-R1 pull request
1789 dev[0].roam(bssid1)
1790
1791def test_ap_ft_ap_oom4(dev, apdev):
1792 """WPA2-PSK-FT and AP OOM 4"""
1793 ssid = "test-ft"
fab49f61 1794 passphrase = "12345678"
682a79f0
JM		 1795
1796 params = ft_params1(ssid=ssid, passphrase=passphrase)
1797 hapd0 = hostapd.add_ap(apdev[0], params)
1798 bssid0 = hapd0.own_addr()
1799
1800 dev[0].scan_for_bss(bssid0, freq="2412")
1801 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1802 scan_freq="2412")
1803
1804 params = ft_params2(ssid=ssid, passphrase=passphrase)
1805 hapd1 = hostapd.add_ap(apdev[1], params)
1806 bssid1 = hapd1.own_addr()
1807 dev[0].scan_for_bss(bssid1, freq="2412")
1808 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1809 dev[0].roam(bssid1)
1810 if dev[0].get_status_field('bssid') != bssid1:
1811 raise Exception("Did not roam to AP1")
1812
1813 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1814 dev[0].roam(bssid0)
1815 if dev[0].get_status_field('bssid') != bssid0:
1816 raise Exception("Did not roam to AP0")
1817
1818 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1819 dev[0].roam(bssid1)
1820 if dev[0].get_status_field('bssid') != bssid1:
1821 raise Exception("Did not roam to AP1")
1822
1823def test_ap_ft_ap_oom5(dev, apdev):
1824 """WPA2-PSK-FT and AP OOM 5"""
1825 ssid = "test-ft"
fab49f61 1826 passphrase = "12345678"
682a79f0
JM		 1827
1828 params = ft_params1(ssid=ssid, passphrase=passphrase)
1829 hapd0 = hostapd.add_ap(apdev[0], params)
1830 bssid0 = hapd0.own_addr()
1831
1832 dev[0].scan_for_bss(bssid0, freq="2412")
1833 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1834 scan_freq="2412")
1835
1836 params = ft_params2(ssid=ssid, passphrase=passphrase)
1837 hapd1 = hostapd.add_ap(apdev[1], params)
1838 bssid1 = hapd1.own_addr()
1839 dev[0].scan_for_bss(bssid1, freq="2412")
1840 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1841 # This will fail to roam
1842 dev[0].roam(bssid1)
1843
1844 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1845 # This will fail to roam
1846 dev[0].roam(bssid1)
1847
1848 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1849 # This will fail to roam
1850 dev[0].roam(bssid1)
1851
1852 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1853 # This will fail to roam
1854 dev[0].roam(bssid1)
1855
1856 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1857 # This will fail to roam
1858 dev[0].roam(bssid1)
1859
1860def test_ap_ft_ap_oom6(dev, apdev):
1861 """WPA2-PSK-FT and AP OOM 6"""
1862 ssid = "test-ft"
fab49f61 1863 passphrase = "12345678"
682a79f0
JM		 1864
1865 params = ft_params1(ssid=ssid, passphrase=passphrase)
1866 hapd0 = hostapd.add_ap(apdev[0], params)
1867 bssid0 = hapd0.own_addr()
1868
1869 dev[0].scan_for_bss(bssid0, freq="2412")
1870 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1871 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1872 scan_freq="2412")
1873 dev[0].request("REMOVE_NETWORK all")
1874 dev[0].wait_disconnected()
1875 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1876 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1877 scan_freq="2412")
1878 dev[0].request("REMOVE_NETWORK all")
1879 dev[0].wait_disconnected()
1880 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1881 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1882 scan_freq="2412")
1883
c5262648
JM		 1884def test_ap_ft_ap_oom7a(dev, apdev):
1885 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0 1886 ssid = "test-ft"
fab49f61 1887 passphrase = "12345678"
682a79f0
JM		 1888
1889 params = ft_params1(ssid=ssid, passphrase=passphrase)
1890 params["ieee80211w"] = "2"
1891 hapd0 = hostapd.add_ap(apdev[0], params)
1892 bssid0 = hapd0.own_addr()
1893
1894 dev[0].scan_for_bss(bssid0, freq="2412")
1895 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1896 ieee80211w="2", scan_freq="2412")
1897
1898 params = ft_params2(ssid=ssid, passphrase=passphrase)
1899 params["ieee80211w"] = "2"
1900 hapd1 = hostapd.add_ap(apdev[1], params)
1901 bssid1 = hapd1.own_addr()
1902 dev[0].scan_for_bss(bssid1, freq="2412")
1903 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1904 # This will fail to roam
1905 dev[0].roam(bssid1)
c5262648
JM		 1906
1907def test_ap_ft_ap_oom7b(dev, apdev):
1908 """WPA2-PSK-FT and AP OOM 7b"""
1909 ssid = "test-ft"
fab49f61 1910 passphrase = "12345678"
c5262648
JM		 1911
1912 params = ft_params1(ssid=ssid, passphrase=passphrase)
1913 params["ieee80211w"] = "2"
1914 hapd0 = hostapd.add_ap(apdev[0], params)
1915 bssid0 = hapd0.own_addr()
1916
1917 dev[0].scan_for_bss(bssid0, freq="2412")
1918 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1919 ieee80211w="2", scan_freq="2412")
1920
1921 params = ft_params2(ssid=ssid, passphrase=passphrase)
1922 params["ieee80211w"] = "2"
1923 hapd1 = hostapd.add_ap(apdev[1], params)
1924 bssid1 = hapd1.own_addr()
1925 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1926 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1927 # This will fail to roam
1928 dev[0].roam(bssid1)
c5262648
JM		 1929
1930def test_ap_ft_ap_oom7c(dev, apdev):
1931 """WPA2-PSK-FT and AP OOM 7c"""
1932 ssid = "test-ft"
fab49f61 1933 passphrase = "12345678"
c5262648
JM		 1934
1935 params = ft_params1(ssid=ssid, passphrase=passphrase)
1936 params["ieee80211w"] = "2"
1937 hapd0 = hostapd.add_ap(apdev[0], params)
1938 bssid0 = hapd0.own_addr()
1939
1940 dev[0].scan_for_bss(bssid0, freq="2412")
1941 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1942 ieee80211w="2", scan_freq="2412")
1943
1944 params = ft_params2(ssid=ssid, passphrase=passphrase)
1945 params["ieee80211w"] = "2"
1946 hapd1 = hostapd.add_ap(apdev[1], params)
1947 bssid1 = hapd1.own_addr()
1948 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1949 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1950 # This will fail to roam
1951 dev[0].roam(bssid1)
c5262648
JM		 1952
1953def test_ap_ft_ap_oom7d(dev, apdev):
1954 """WPA2-PSK-FT and AP OOM 7d"""
1955 ssid = "test-ft"
fab49f61 1956 passphrase = "12345678"
c5262648
JM		 1957
1958 params = ft_params1(ssid=ssid, passphrase=passphrase)
1959 params["ieee80211w"] = "2"
1960 hapd0 = hostapd.add_ap(apdev[0], params)
1961 bssid0 = hapd0.own_addr()
1962
1963 dev[0].scan_for_bss(bssid0, freq="2412")
1964 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1965 ieee80211w="2", scan_freq="2412")
1966
1967 params = ft_params2(ssid=ssid, passphrase=passphrase)
1968 params["ieee80211w"] = "2"
1969 hapd1 = hostapd.add_ap(apdev[1], params)
1970 bssid1 = hapd1.own_addr()
1971 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1972 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1973 # This will fail to roam
1974 dev[0].roam(bssid1)
1975
1976def test_ap_ft_ap_oom8(dev, apdev):
1977 """WPA2-PSK-FT and AP OOM 8"""
1978 ssid = "test-ft"
fab49f61 1979 passphrase = "12345678"
682a79f0
JM		 1980
1981 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1982 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1983 hapd0 = hostapd.add_ap(apdev[0], params)
1984 bssid0 = hapd0.own_addr()
1985
1986 dev[0].scan_for_bss(bssid0, freq="2412")
1987 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1988 scan_freq="2412")
1989
1990 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 1991 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1992 hapd1 = hostapd.add_ap(apdev[1], params)
1993 bssid1 = hapd1.own_addr()
1994 dev[0].scan_for_bss(bssid1, freq="2412")
1995 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1996 # This will fail to roam
1997 dev[0].roam(bssid1)
1998 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1999 # This will fail to roam
2000 dev[0].roam(bssid1)
2001
2002def test_ap_ft_ap_oom9(dev, apdev):
2003 """WPA2-PSK-FT and AP OOM 9"""
2004 ssid = "test-ft"
fab49f61 2005 passphrase = "12345678"
682a79f0
JM		 2006
2007 params = ft_params1(ssid=ssid, passphrase=passphrase)
2008 hapd0 = hostapd.add_ap(apdev[0], params)
2009 bssid0 = hapd0.own_addr()
2010
2011 dev[0].scan_for_bss(bssid0, freq="2412")
2012 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2013 scan_freq="2412")
2014
2015 params = ft_params2(ssid=ssid, passphrase=passphrase)
2016 hapd1 = hostapd.add_ap(apdev[1], params)
2017 bssid1 = hapd1.own_addr()
2018 dev[0].scan_for_bss(bssid1, freq="2412")
2019
2020 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
2021 # This will fail to roam
2022 if "OK" not in dev[0].request("FT_DS " + bssid1):
2023 raise Exception("FT_DS failed")
2024 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
2025
2026 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
2027 # This will fail to roam
2028 if "OK" not in dev[0].request("FT_DS " + bssid1):
2029 raise Exception("FT_DS failed")
2030 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2031
2032 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
2033 # This will fail to roam
2034 if "OK" not in dev[0].request("FT_DS " + bssid1):
2035 raise Exception("FT_DS failed")
2036 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
2037
2038def test_ap_ft_ap_oom10(dev, apdev):
2039 """WPA2-PSK-FT and AP OOM 10"""
2040 ssid = "test-ft"
fab49f61 2041 passphrase = "12345678"
682a79f0
JM		 2042
2043 params = ft_params1(ssid=ssid, passphrase=passphrase)
2044 hapd0 = hostapd.add_ap(apdev[0], params)
2045 bssid0 = hapd0.own_addr()
2046
2047 dev[0].scan_for_bss(bssid0, freq="2412")
2048 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2049 scan_freq="2412")
2050
2051 params = ft_params2(ssid=ssid, passphrase=passphrase)
2052 hapd1 = hostapd.add_ap(apdev[1], params)
2053 bssid1 = hapd1.own_addr()
2054 dev[0].scan_for_bss(bssid1, freq="2412")
2055
9441a227 2056 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2057 # This will fail to roam
2058 if "OK" not in dev[0].request("FT_DS " + bssid1):
2059 raise Exception("FT_DS failed")
2060 wait_fail_trigger(hapd0, "GET_FAIL")
2061
2062 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
2063 # This will fail to roam
2064 if "OK" not in dev[0].request("FT_DS " + bssid1):
2065 raise Exception("FT_DS failed")
2066 wait_fail_trigger(hapd0, "GET_FAIL")
2067
9441a227 2068 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 2069 # This will fail to roam
2070 if "OK" not in dev[0].request("FT_DS " + bssid1):
2071 raise Exception("FT_DS failed")
2072 wait_fail_trigger(hapd0, "GET_FAIL")
2073
9441a227 2074 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 2075 # This will fail to roam
2076 if "OK" not in dev[0].request("FT_DS " + bssid1):
2077 raise Exception("FT_DS failed")
2078 wait_fail_trigger(hapd1, "GET_FAIL")
2079
2080def test_ap_ft_ap_oom11(dev, apdev):
2081 """WPA2-PSK-FT and AP OOM 11"""
2082 ssid = "test-ft"
fab49f61 2083 passphrase = "12345678"
682a79f0
JM		 2084
2085 params = ft_params1(ssid=ssid, passphrase=passphrase)
2086 hapd0 = hostapd.add_ap(apdev[0], params)
2087 bssid0 = hapd0.own_addr()
2088
2089 dev[0].scan_for_bss(bssid0, freq="2412")
2090 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
2091 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2092 scan_freq="2412")
2093 wait_fail_trigger(hapd0, "GET_FAIL")
2094
2095 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 2096 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 2097 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2098 scan_freq="2412")
2099 wait_fail_trigger(hapd0, "GET_FAIL")
2100
a04e6f3d
JM		 2101def test_ap_ft_over_ds_proto_ap(dev, apdev):
2102 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
2103 ssid = "test-ft"
fab49f61 2104 passphrase = "12345678"
a04e6f3d
JM		 2105
2106 params = ft_params1(ssid=ssid, passphrase=passphrase)
2107 hapd0 = hostapd.add_ap(apdev[0], params)
2108 bssid0 = hapd0.own_addr()
2109 _bssid0 = bssid0.replace(':', '')
2110 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2111 scan_freq="2412")
2112 addr = dev[0].own_addr()
2113 _addr = addr.replace(':', '')
2114
2115 params = ft_params2(ssid=ssid, passphrase=passphrase)
2116 hapd1 = hostapd.add_ap(apdev[1], params)
2117 bssid1 = hapd1.own_addr()
2118 _bssid1 = bssid1.replace(':', '')
2119
2120 hapd0.set("ext_mgmt_frame_handling", "1")
2121 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
2122 valid = "0601" + _addr + _bssid1
fab49f61
JM		 2123 tests = ["0601",
2124 "0601" + _addr,
2125 "0601" + _addr + _bssid0,
2126 "0601" + _addr + "ffffffffffff",
2127 "0601" + _bssid0 + _bssid0,
2128 valid,
2129 valid + "01",
2130 valid + "3700",
2131 valid + "3600",
2132 valid + "3603ffffff",
2133 valid + "3603a1b2ff",
2134 valid + "3603a1b2ff" + "3700",
2135 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2136 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2137 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2138 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2139 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2140 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2141 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2142 valid + "0001"]
a04e6f3d
JM		 2143 for t in tests:
2144 hapd0.dump_monitor()
2145 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2146 raise Exception("MGMT_RX_PROCESS failed")
2147
2148 hapd0.set("ext_mgmt_frame_handling", "0")
2149
34d3eaa8
JM		 2150def test_ap_ft_over_ds_proto(dev, apdev):
2151 """WPA2-PSK-FT AP over DS protocol testing"""
2152 ssid = "test-ft"
fab49f61 2153 passphrase = "12345678"
34d3eaa8
JM		 2154
2155 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2156 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2157 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2158 scan_freq="2412")
2159
2160 # FT Action Response while no FT-over-DS in progress
2161 msg = {}
2162 msg['fc'] = 13 << 4
2163 msg['da'] = dev[0].own_addr()
2164 msg['sa'] = apdev[0]['bssid']
2165 msg['bssid'] = apdev[0]['bssid']
2166 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2167 hapd0.mgmt_tx(msg)
2168
2169 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2170 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2171 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2172 hapd0.set("ext_mgmt_frame_handling", "1")
2173 hapd0.dump_monitor()
2174 dev[0].request("FT_DS " + apdev[1]['bssid'])
2175 for i in range(0, 10):
2176 req = hapd0.mgmt_rx()
2177 if req is None:
2178 raise Exception("MGMT RX wait timed out")
2179 if req['subtype'] == 13:
2180 break
2181 req = None
2182 if not req:
2183 raise Exception("FT Action frame not received")
2184
2185 # FT Action Response for unexpected Target AP
2186 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2187 hapd0.mgmt_tx(msg)
2188
2189 # FT Action Response without MDIE
2190 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2191 hapd0.mgmt_tx(msg)
2192
2193 # FT Action Response without FTIE
2194 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2195 hapd0.mgmt_tx(msg)
2196
2197 # FT Action Response with FTIE SNonce mismatch
2198 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2199 hapd0.mgmt_tx(msg)
6f3815c0 2200
9fd6804d 2201@remote_compatible
6f3815c0
JM		 2202def test_ap_ft_rrb(dev, apdev):
2203 """WPA2-PSK-FT RRB protocol testing"""
2204 ssid = "test-ft"
fab49f61 2205 passphrase = "12345678"
6f3815c0
JM		 2206
2207 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2208 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2209
2210 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2211 scan_freq="2412")
2212
fab49f61
JM		 2213 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':', ''))
2214 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':', ''))
15dfcb69 2215 proto = b'\x89\x0d'
6f3815c0
JM		 2216 ehdr = _dst_ll + _src_ll + proto
2217
2218 # Too short RRB frame
15dfcb69 2219 pkt = ehdr + b'\x01'
7ab74770 2220 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2221 raise Exception("DATA_TEST_FRAME failed")
2222
2223 # RRB discarded frame wikth unrecognized type
15dfcb69 2224 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2225 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2226 raise Exception("DATA_TEST_FRAME failed")
2227
2228 # RRB frame too short for action frame
15dfcb69 2229 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2230 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2231 raise Exception("DATA_TEST_FRAME failed")
2232
2233 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2234 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2235 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2236 raise Exception("DATA_TEST_FRAME failed")
2237
2238 # Unexpected Action frame category
15dfcb69 2239 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2240 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2241 raise Exception("DATA_TEST_FRAME failed")
2242
2243 # Unexpected Action in RRB Request
15dfcb69 2244 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2245 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2246 raise Exception("DATA_TEST_FRAME failed")
2247
2248 # Target AP address in RRB Request does not match with own address
15dfcb69 2249 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2250 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2251 raise Exception("DATA_TEST_FRAME failed")
2252
2253 # Not enough room for status code in RRB Response
15dfcb69 2254 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2255 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2256 raise Exception("DATA_TEST_FRAME failed")
2257
2258 # RRB discarded frame with unknown packet_type
15dfcb69 2259 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2260 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2261 raise Exception("DATA_TEST_FRAME failed")
2262
2263 # RRB Response with non-zero status code; no STA match
15dfcb69 2264 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2265 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2266 raise Exception("DATA_TEST_FRAME failed")
2267
2268 # RRB Response with zero status code and extra data; STA match
15dfcb69 2269 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2270 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2271 raise Exception("DATA_TEST_FRAME failed")
2272
2273 # Too short PMK-R1 pull
15dfcb69 2274 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2275 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2276 raise Exception("DATA_TEST_FRAME failed")
2277
2278 # Too short PMK-R1 resp
15dfcb69 2279 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2280 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2281 raise Exception("DATA_TEST_FRAME failed")
2282
2283 # Too short PMK-R1 push
15dfcb69 2284 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2285 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2286 raise Exception("DATA_TEST_FRAME failed")
2287
2288 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2289 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2290 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2291 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2292
9fd6804d 2293@remote_compatible
ecafa0cf
JM		 2294def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2295 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2296 bssid = apdev[0]['bssid']
2297 ssid = "test-ft"
fab49f61 2298 passphrase = "12345678"
ecafa0cf
JM		 2299
2300 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2301 params["ieee80211w"] = "1"
ecafa0cf
JM		 2302 # This is the RSN element used normally by hostapd
2303 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2304 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2305 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2306 ieee80211w="1", scan_freq="2412",
2307 pairwise="CCMP", group="CCMP")
2308
fab49f61
JM		 2309 tests = [('PMKIDCount field included',
2310 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2311 ('Extra IE before RSNE',
2312 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2313 ('PMKIDCount and Group Management Cipher suite fields included',
2314 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2315 ('Extra octet after defined fields (future extensibility)',
2316 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2317 ('No RSN Capabilities field (PMF disabled in practice)',
2318 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2319 for txt, ie in tests:
ecafa0cf
JM		 2320 dev[0].request("DISCONNECT")
2321 dev[0].wait_disconnected()
2322 logger.info(txt)
2323 hapd.disable()
2324 hapd.set('own_ie_override', ie)
2325 hapd.enable()
2326 dev[0].request("BSS_FLUSH 0")
2327 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2328 dev[0].select_network(id, freq=2412)
2329 dev[0].wait_connected()
2330
2331 dev[0].request("DISCONNECT")
2332 dev[0].wait_disconnected()
2333
2334 logger.info('Invalid RSNE causing internal hostapd error')
2335 hapd.disable()
2336 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2337 hapd.enable()
2338 dev[0].request("BSS_FLUSH 0")
2339 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2340 dev[0].select_network(id, freq=2412)
2341 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2342 # complete.
2343 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2344 if ev is not None:
2345 raise Exception("Unexpected connection")
2346 dev[0].request("DISCONNECT")
2347
2348 logger.info('Unexpected PMKID causing internal hostapd error')
2349 hapd.disable()
2350 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2351 hapd.enable()
2352 dev[0].request("BSS_FLUSH 0")
2353 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2354 dev[0].select_network(id, freq=2412)
2355 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2356 # complete.
2357 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2358 if ev is not None:
2359 raise Exception("Unexpected connection")
2360 dev[0].request("DISCONNECT")
1025603b 2361
425e5f97 2362def start_ft(apdev, wpa_ptk_rekey=None):
1025603b 2363 ssid = "test-ft"
fab49f61 2364 passphrase = "12345678"
1025603b
JM		 2365
2366 params = ft_params1(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2367 if wpa_ptk_rekey:
2368 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2369 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2370 params = ft_params2(ssid=ssid, passphrase=passphrase)
425e5f97
JM		 2371 if wpa_ptk_rekey:
2372 params['wpa_ptk_rekey'] = str(wpa_ptk_rekey)
8b8a1864 2373 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b 2374
425e5f97 2375 return hapd0, hapd1
1025603b 2376
425e5f97
JM		 2377def check_ptk_rekey(dev, hapd0=None, hapd1=None):
2378 ev = dev.wait_event(["CTRL-EVENT-DISCONNECTED",
2379 "WPA: Key negotiation completed"], timeout=5)
1025603b
JM		 2380 if ev is None:
2381 raise Exception("No event received after roam")
2382 if "CTRL-EVENT-DISCONNECTED" in ev:
2383 raise Exception("Unexpected disconnection after roam")
2384
425e5f97
JM		 2385 if not hapd0 or not hapd1:
2386 return
2387 if dev.get_status_field('bssid') == hapd0.own_addr():
1025603b
JM		 2388 hapd = hapd0
2389 else:
2390 hapd = hapd1
d22f0902 2391 time.sleep(0.1)
425e5f97 2392 hwsim_utils.test_connectivity(dev, hapd)
1025603b 2393
425e5f97
JM		 2394def test_ap_ft_ptk_rekey(dev, apdev):
2395 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2396 hapd0, hapd1 = start_ft(apdev)
2397 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1")
2398 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2399
425e5f97
JM		 2400def test_ap_ft_ptk_rekey2(dev, apdev):
2401 """WPA2-PSK-FT PTK rekeying triggered by station after one roam"""
2402 hapd0, hapd1 = start_ft(apdev)
2403 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678", ptk_rekey="1",
2404 only_one_way=True)
2405 check_ptk_rekey(dev[0], hapd0, hapd1)
1025603b 2406
425e5f97
JM		 2407def test_ap_ft_ptk_rekey_ap(dev, apdev):
2408 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2409 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2410 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678")
2411 check_ptk_rekey(dev[0], hapd0, hapd1)
2412
2413def test_ap_ft_ptk_rekey_ap2(dev, apdev):
2414 """WPA2-PSK-FT PTK rekeying triggered by AP after one roam"""
2415 hapd0, hapd1 = start_ft(apdev, wpa_ptk_rekey=2)
2416 run_roams(dev[0], apdev, hapd0, hapd1, "test-ft", "12345678",
2417 only_one_way=True)
2418 check_ptk_rekey(dev[0], hapd0, hapd1)
2419
2420def test_ap_ft_eap_ptk_rekey_ap(dev, apdev):
2421 """WPA2-EAP-FT PTK rekeying triggered by AP"""
2422 generic_ap_ft_eap(dev, apdev, only_one_way=True, wpa_ptk_rekey=2)
2423 check_ptk_rekey(dev[0])
186ca473
MB		 2424
2425def test_ap_ft_internal_rrb_check(dev, apdev):
2426 """RRB internal delivery only to WPA enabled BSS"""
2427 ssid = "test-ft"
fab49f61 2428 passphrase = "12345678"
186ca473
MB		 2429
2430 radius = hostapd.radius_params()
2431 params = ft_params1(ssid=ssid, passphrase=passphrase)
2432 params['wpa_key_mgmt'] = "FT-EAP"
2433 params["ieee8021x"] = "1"
35d8c254 2434 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2435 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2436 key_mgmt = hapd.get_config()['key_mgmt']
2437 if key_mgmt.split(' ')[0] != "FT-EAP":
2438 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2439
fab49f61 2440 hapd1 = hostapd.add_ap(apdev[1], {"ssid": ssid})
186ca473
MB		 2441
2442 # Connect to WPA enabled AP
2443 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2444 eap="GPSK", identity="gpsk user",
2445 password="abcdefghijklmnop0123456789abcdef",
2446 scan_freq="2412")
2447
2448 # Try over_ds roaming to non-WPA-enabled AP.
2449 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2450 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2451
2452def test_ap_ft_extra_ie(dev, apdev):
2453 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2454 ssid = "test-ft"
fab49f61 2455 passphrase = "12345678"
c85fcff2
JM		 2456
2457 params = ft_params1(ssid=ssid, passphrase=passphrase)
2458 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2459 hapd0 = hostapd.add_ap(apdev[0], params)
2460 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2461 scan_freq="2412")
2462 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2463 scan_freq="2412")
2464 try:
2465 # Add Mobility Domain element to test AP validation code.
2466 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2467 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2468 scan_freq="2412", wait_connect=False)
2469 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2470 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2471 if ev is None:
2472 raise Exception("No connection result")
2473 if "CTRL-EVENT-CONNECTED" in ev:
2474 raise Exception("Non-FT association accepted with MDE")
2475 if "status_code=43" not in ev:
2476 raise Exception("Unexpected status code: " + ev)
2477 dev[0].request("DISCONNECT")
2478 finally:
2479 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2480
2481def test_ap_ft_ric(dev, apdev):
2482 """WPA2-PSK-FT AP and RIC"""
2483 ssid = "test-ft"
fab49f61 2484 passphrase = "12345678"
fd7205fa
JM		 2485
2486 params = ft_params1(ssid=ssid, passphrase=passphrase)
2487 hapd0 = hostapd.add_ap(apdev[0], params)
2488 params = ft_params2(ssid=ssid, passphrase=passphrase)
2489 hapd1 = hostapd.add_ap(apdev[1], params)
2490
2491 dev[0].set("ric_ies", "")
2492 dev[0].set("ric_ies", '""')
2493 if "FAIL" not in dev[0].request("SET ric_ies q"):
2494 raise Exception("Invalid ric_ies value accepted")
2495
fab49f61
JM		 2496 tests = ["3900",
2497 "3900ff04eeeeeeee",
2498 "390400000000",
2499 "390400000000" + "390400000000",
2500 "390400000000" + "dd050050f20202",
2501 "390400000000" + "dd3d0050f2020201" + 55*"00",
2502 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2503 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
fd7205fa
JM		 2504 for t in tests:
2505 dev[0].set("ric_ies", t)
2506 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2507 test_connectivity=False)
2508 dev[0].request("REMOVE_NETWORK all")
2509 dev[0].wait_disconnected()
2510 dev[0].dump_monitor()
c8942286
JM		 2511
2512def ie_hex(ies, id):
7ab74770 2513 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2514
2515def test_ap_ft_reassoc_proto(dev, apdev):
2516 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2517 ssid = "test-ft"
fab49f61 2518 passphrase = "12345678"
c8942286
JM		 2519
2520 params = ft_params1(ssid=ssid, passphrase=passphrase)
2521 hapd0 = hostapd.add_ap(apdev[0], params)
2522 params = ft_params2(ssid=ssid, passphrase=passphrase)
2523 hapd1 = hostapd.add_ap(apdev[1], params)
2524
2525 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2526 ieee80211w="1", scan_freq="2412")
2527 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2528 hapd1ap = hapd0
2529 hapd2ap = hapd1
2530 else:
2531 hapd1ap = hapd1
2532 hapd2ap = hapd0
2533
2534 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2535 hapd2ap.set("ext_mgmt_frame_handling", "1")
2536 dev[0].request("ROAM " + hapd2ap.own_addr())
2537
2538 while True:
2539 req = hapd2ap.mgmt_rx()
7ab74770 2540 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2541 if req['subtype'] == 11:
2542 break
2543
2544 while True:
2545 req = hapd2ap.mgmt_rx()
2546 if req['subtype'] == 2:
2547 break
7ab74770 2548 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2549
2550 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2551 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2552 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2553 # First elements: SSID, Supported Rates, Extended Supported Rates
2554 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2555
2556 rsne = ie_hex(ies, 48)
2557 mde = ie_hex(ies, 54)
2558 fte = ie_hex(ies, 55)
fab49f61 2559 tests = []
c8942286 2560 # RSN: Trying to use FT, but MDIE not included
fab49f61 2561 tests += [rsne]
c8942286 2562 # RSN: Attempted to use unknown MDIE
fab49f61 2563 tests += [rsne + "3603000000"]
c8942286 2564 # Invalid RSN pairwise cipher
fab49f61 2565 tests += ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
c8942286 2566 # FT: No PMKID in RSNIE
fab49f61 2567 tests += ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54)]
c8942286 2568 # FT: Invalid FTIE
fab49f61 2569 tests += [rsne + mde]
c8942286
JM		 2570 # FT: RIC IE(s) in the frame, but not included in protected IE count
2571 # FT: Failed to parse FT IEs
fab49f61 2572 tests += [rsne + mde + fte + "3900"]
c8942286 2573 # FT: SNonce mismatch in FTIE
fab49f61 2574 tests += [rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00"]
c8942286 2575 # FT: ANonce mismatch in FTIE
fab49f61 2576 tests += [rsne + mde + fte[0:40] + 32*"00" + fte[104:]]
c8942286 2577 # FT: No R0KH-ID subelem in FTIE
fab49f61 2578 tests += [rsne + mde + "3752" + fte[4:168]]
c8942286 2579 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
fab49f61 2580 tests += [rsne + mde + "3755" + fte[4:168] + "0301ff"]
c8942286 2581 # FT: No R1KH-ID subelem in FTIE
fab49f61 2582 tests += [rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode()]
c8942286 2583 # FT: Unknown R1KH-ID used in ReassocReq
fab49f61 2584 tests += [rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000"]
c8942286 2585 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
fab49f61 2586 tests += [rsne[:-32] + 16*"00" + mde + fte]
c8942286 2587 # Invalid MIC in FTIE
fab49f61 2588 tests += [rsne + mde + fte[0:8] + 16*"00" + fte[40:]]
c8942286
JM		 2589 for t in tests:
2590 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2591
2592def test_ap_ft_reassoc_local_fail(dev, apdev):
2593 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2594 ssid = "test-ft"
fab49f61 2595 passphrase = "12345678"
c8942286
JM		 2596
2597 params = ft_params1(ssid=ssid, passphrase=passphrase)
2598 hapd0 = hostapd.add_ap(apdev[0], params)
2599 params = ft_params2(ssid=ssid, passphrase=passphrase)
2600 hapd1 = hostapd.add_ap(apdev[1], params)
2601
2602 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2603 ieee80211w="1", scan_freq="2412")
2604 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2605 hapd1ap = hapd0
2606 hapd2ap = hapd1
2607 else:
2608 hapd1ap = hapd1
2609 hapd2ap = hapd0
2610
2611 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2612 # FT: Failed to calculate MIC
2613 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2614 dev[0].request("ROAM " + hapd2ap.own_addr())
2615 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2616 dev[0].request("DISCONNECT")
2617 if ev is None:
2618 raise Exception("Association reject not seen")
d7f0bef9
JM		 2619
2620def test_ap_ft_reassoc_replay(dev, apdev, params):
2621 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2622 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2623 ssid = "test-ft"
fab49f61 2624 passphrase = "12345678"
d7f0bef9
JM		 2625
2626 params = ft_params1(ssid=ssid, passphrase=passphrase)
2627 hapd0 = hostapd.add_ap(apdev[0], params)
2628 params = ft_params2(ssid=ssid, passphrase=passphrase)
2629 hapd1 = hostapd.add_ap(apdev[1], params)
2630
2631 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2632 scan_freq="2412")
2633 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2634 hapd1ap = hapd0
2635 hapd2ap = hapd1
2636 else:
2637 hapd1ap = hapd1
2638 hapd2ap = hapd0
2639
2640 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2641 hapd2ap.set("ext_mgmt_frame_handling", "1")
2642 dev[0].dump_monitor()
2643 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2644 raise Exception("ROAM failed")
2645
2646 reassocreq = None
2647 count = 0
2648 while count < 100:
2649 req = hapd2ap.mgmt_rx()
2650 count += 1
2651 hapd2ap.dump_monitor()
7ab74770 2652 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2653 if req['subtype'] == 2:
2654 reassocreq = req
2655 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2656 if ev is None:
2657 raise Exception("No TX status seen")
2658 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2659 if "OK" not in hapd2ap.request(cmd):
2660 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2661 break
2662 hapd2ap.set("ext_mgmt_frame_handling", "0")
2663 if reassocreq is None:
2664 raise Exception("No Reassociation Request frame seen")
2665 dev[0].wait_connected()
2666 dev[0].dump_monitor()
2667 hapd2ap.dump_monitor()
2668
2669 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2670
2671 logger.info("Replay the last Reassociation Request frame")
2672 hapd2ap.dump_monitor()
2673 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2674 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2675 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2676 if ev is None:
2677 raise Exception("No TX status seen")
2678 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2679 if "OK" not in hapd2ap.request(cmd):
2680 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2681 hapd2ap.set("ext_mgmt_frame_handling", "0")
2682
2683 try:
2684 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2685 ok = True
2686 except:
2687 ok = False
2688
2689 ap = hapd2ap.own_addr()
2690 sta = dev[0].own_addr()
2691 filt = "wlan.fc.type == 2 && " + \
2692 "wlan.da == " + sta + " && " + \
2693 "wlan.sa == " + ap
fab49f61 2694 fields = ["wlan.ccmp.extiv"]
d7f0bef9
JM		 2695 res = run_tshark(capfile, filt, fields)
2696 vals = res.splitlines()
2697 logger.info("CCMP PN: " + str(vals))
2698 if len(vals) < 2:
2699 raise Exception("Could not find all CCMP protected frames from capture")
2700 if len(set(vals)) < len(vals):
2701 raise Exception("Duplicate CCMP PN used")
2702
2703 if not ok:
2704 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2705
2706def test_ap_ft_psk_file(dev, apdev):
2707 """WPA2-PSK-FT AP with PSK from a file"""
2708 ssid = "test-ft"
fab49f61 2709 passphrase = "12345678"
0dc3c5f2
JM		 2710
2711 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2712 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2713 hapd = hostapd.add_ap(apdev[0], params)
2714
2715 dev[1].connect(ssid, psk="very secret",
2716 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2717 scan_freq="2412", wait_connect=False)
2718 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2719 ieee80211w="1", scan_freq="2412")
2720 dev[0].request("REMOVE_NETWORK all")
2721 dev[0].wait_disconnected()
2722 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2723 ieee80211w="1", scan_freq="2412")
2724 dev[0].request("REMOVE_NETWORK all")
2725 dev[0].wait_disconnected()
2726 dev[0].connect(ssid, psk="secret passphrase",
2727 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2728 scan_freq="2412")
2729 dev[2].connect(ssid, psk="another passphrase for all STAs",
2730 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2731 scan_freq="2412")
2732 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2733 if ev is None:
2734 raise Exception("Timed out while waiting for failure report")
2735 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2736
2737def test_ap_ft_eap_ap_config_change(dev, apdev):
2738 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2739 ssid = "test-ft"
fab49f61 2740 passphrase = "12345678"
62566bc2
JM		 2741 bssid = apdev[0]['bssid']
2742
2743 radius = hostapd.radius_params()
2744 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2745 params['wpa_key_mgmt'] = "WPA-EAP"
2746 params["ieee8021x"] = "1"
2747 params["pmk_r1_push"] = "0"
2748 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2749 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2750 params["eap_server"] = "0"
35d8c254 2751 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2752 hapd = hostapd.add_ap(apdev[0], params)
2753
2754 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2755 eap="GPSK", identity="gpsk user",
2756 password="abcdefghijklmnop0123456789abcdef",
2757 scan_freq="2412")
2758 dev[0].request("DISCONNECT")
2759 dev[0].wait_disconnected()
2760 dev[0].dump_monitor()
2761
2762 hapd.disable()
2763 hapd.set('wpa_key_mgmt', "FT-EAP")
2764 hapd.enable()
2765
2766 dev[0].request("BSS_FLUSH 0")
2767 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2768
2769 dev[0].request("RECONNECT")
2770 dev[0].wait_connected()
55b3cda7
JM		 2771
2772def test_ap_ft_eap_sha384(dev, apdev):
2773 """WPA2-EAP-FT with SHA384"""
2774 ssid = "test-ft"
fab49f61 2775 passphrase = "12345678"
55b3cda7
JM		 2776
2777 radius = hostapd.radius_params()
2778 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2779 params["ieee80211w"] = "2"
55b3cda7
JM		 2780 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2781 params["ieee8021x"] = "1"
35d8c254 2782 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2783 hapd0 = hostapd.add_ap(apdev[0], params)
2784 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2785 params["ieee80211w"] = "2"
55b3cda7
JM		 2786 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2787 params["ieee8021x"] = "1"
35d8c254 2788 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2789 hapd1 = hostapd.add_ap(apdev[1], params)
2790
2791 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2792 sha384=True)
2793
659f7954
JM		 2794def test_ap_ft_eap_sha384_reassoc(dev, apdev):
2795 """WPA2-EAP-FT with SHA384 using REASSOCIATE"""
e1923f5b 2796 check_suite_b_192_capa(dev)
659f7954
JM		 2797 ssid = "test-ft"
2798 passphrase = "12345678"
2799
2800 radius = hostapd.radius_params()
2801 params = ft_params1(ssid=ssid, passphrase=passphrase)
2802 params["ieee80211w"] = "2"
2803 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2804 params["ieee8021x"] = "1"
2805 params = dict(list(radius.items()) + list(params.items()))
2806 hapd0 = hostapd.add_ap(apdev[0], params)
2807 params = ft_params2(ssid=ssid, passphrase=passphrase)
2808 params["ieee80211w"] = "2"
2809 params['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2810 params["ieee8021x"] = "1"
2811 params = dict(list(radius.items()) + list(params.items()))
2812 hapd1 = hostapd.add_ap(apdev[1], params)
2813
2814 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2815 sha384=True, also_non_ft=True, roam_with_reassoc=True)
2816
55b3cda7
JM		 2817def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2818 """WPA2-EAP-FT with SHA384 over DS"""
2819 ssid = "test-ft"
fab49f61 2820 passphrase = "12345678"
55b3cda7
JM		 2821
2822 radius = hostapd.radius_params()
2823 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2824 params["ieee80211w"] = "2"
55b3cda7
JM		 2825 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2826 params["ieee8021x"] = "1"
35d8c254 2827 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2828 hapd0 = hostapd.add_ap(apdev[0], params)
2829 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2830 params["ieee80211w"] = "2"
55b3cda7
JM		 2831 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2832 params["ieee8021x"] = "1"
35d8c254 2833 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2834 hapd1 = hostapd.add_ap(apdev[1], params)
2835
2836 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2837 eap=True, sha384=True)
392aba4e
JM		 2838
2839def test_ap_ft_roam_rrm(dev, apdev):
2840 """WPA2-PSK-FT AP and radio measurement request"""
2841 ssid = "test-ft"
fab49f61 2842 passphrase = "12345678"
392aba4e
JM		 2843
2844 params = ft_params1(ssid=ssid, passphrase=passphrase)
2845 params["rrm_beacon_report"] = "1"
2846 hapd0 = hostapd.add_ap(apdev[0], params)
2847 bssid0 = hapd0.own_addr()
2848
2849 addr = dev[0].own_addr()
2850 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2851 scan_freq="2412")
2852 check_beacon_req(hapd0, addr, 1)
2853
2854 params = ft_params2(ssid=ssid, passphrase=passphrase)
2855 params["rrm_beacon_report"] = "1"
2856 hapd1 = hostapd.add_ap(apdev[1], params)
2857 bssid1 = hapd1.own_addr()
2858
2859 dev[0].scan_for_bss(bssid1, freq=2412)
2860 dev[0].roam(bssid1)
2861 check_beacon_req(hapd1, addr, 2)
2862
2863 dev[0].scan_for_bss(bssid0, freq=2412)
2864 dev[0].roam(bssid0)
2865 check_beacon_req(hapd0, addr, 3)
9ff2b85e
JM		 2866
2867def test_ap_ft_pmksa_caching(dev, apdev):
2868 """FT-EAP and PMKSA caching for initial mobility domain association"""
2869 ssid = "test-ft"
2870 identity = "gpsk user"
2871
2872 radius = hostapd.radius_params()
2873 params = ft_params1(ssid=ssid)
2874 params['wpa_key_mgmt'] = "FT-EAP"
2875 params["ieee8021x"] = "1"
2876 params["mobility_domain"] = "c3d4"
2877 params = dict(list(radius.items()) + list(params.items()))
2878 hapd = hostapd.add_ap(apdev[0], params)
2879
2880 params = ft_params2(ssid=ssid)
2881 params['wpa_key_mgmt'] = "FT-EAP"
2882 params["ieee8021x"] = "1"
2883 params["mobility_domain"] = "c3d4"
2884 params = dict(list(radius.items()) + list(params.items()))
2885 hapd1 = hostapd.add_ap(apdev[1], params)
2886
2887 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2888 eap_identity=identity, pmksa_caching=True)
2889
2890def test_ap_ft_pmksa_caching_sha384(dev, apdev):
2891 """FT-EAP-SHA384 and PMKSA caching for initial mobility domain association"""
2892 ssid = "test-ft"
2893 identity = "gpsk user"
2894
2895 radius = hostapd.radius_params()
2896 params = ft_params1(ssid=ssid)
2897 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2898 params["ieee8021x"] = "1"
2899 params["mobility_domain"] = "c3d4"
2900 params = dict(list(radius.items()) + list(params.items()))
2901 hapd = hostapd.add_ap(apdev[0], params)
2902
2903 params = ft_params2(ssid=ssid)
2904 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2905 params["ieee8021x"] = "1"
2906 params["mobility_domain"] = "c3d4"
2907 params = dict(list(radius.items()) + list(params.items()))
2908 hapd1 = hostapd.add_ap(apdev[1], params)
2909
2910 run_roams(dev[0], apdev, hapd, hapd1, ssid, None, eap=True,
2911 eap_identity=identity, pmksa_caching=True, sha384=True)
5916637c
JM		 2912
2913def test_ap_ft_r1_key_expiration(dev, apdev):
2914 """WPA2-PSK-FT and PMK-R1 expiration"""
2915 ssid = "test-ft"
2916 passphrase = "12345678"
2917
2918 params = ft_params1(ssid=ssid, passphrase=passphrase)
2919 params['r1_max_key_lifetime'] = "2"
2920 hapd0 = hostapd.add_ap(apdev[0], params)
2921 params = ft_params2(ssid=ssid, passphrase=passphrase)
2922 params['r1_max_key_lifetime'] = "2"
2923 hapd1 = hostapd.add_ap(apdev[1], params)
2924
2925 # This succeeds, but results in having to run another PMK-R1 pull before the
2926 # second AP can complete FT protocol.
2927 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, wait_before_roam=4)
2928
2929def test_ap_ft_r0_key_expiration(dev, apdev):
2930 """WPA2-PSK-FT and PMK-R0 expiration"""
2931 ssid = "test-ft"
2932 passphrase = "12345678"
2933
2934 params = ft_params1(ssid=ssid, passphrase=passphrase)
2935 params['ft_r0_key_lifetime'] = "2"
2936 hapd0 = hostapd.add_ap(apdev[0], params)
2937 params = ft_params2(ssid=ssid, passphrase=passphrase)
2938 params['ft_r0_key_lifetime'] = "2"
2939 hapd1 = hostapd.add_ap(apdev[1], params)
2940
2941 bssid2 = run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2942 return_after_initial=True)
2943 time.sleep(4)
2944 dev[0].scan_for_bss(bssid2, freq="2412")
2945 if "OK" not in dev[0].request("ROAM " + bssid2):
2946 raise Exception("ROAM failed")
2947 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2948 "CTRL-EVENT-AUTH-REJECT",
2949 "CTRL-EVENT-ASSOC-REJECT"], timeout=5)
2950 dev[0].request("DISCONNECT")
2951 if ev is None or "CTRL-EVENT-AUTH-REJECT" not in ev:
2952 raise Exception("FT protocol failure not reported")
2953 if "status_code=53" not in ev:
2954 raise Exception("Unexpected status in FT protocol failure: " + ev)
2955
2956 # Generate a new PMK-R0
2957 dev[0].dump_monitor()
2958 dev[0].request("RECONNECT")
2959 dev[0].wait_connected()
Unnamed repository; edit this file 'description' to name the repository.