]> git.ipfire.org Git - thirdparty/hostap.git/blame_incremental - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
SAE: Reorder SAE and FT-SAE AKM selection to prefer the FT option
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
... / ...
CommitLineData
1# Fast BSS Transition tests
2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
7from remotehost import remote_compatible
8import binascii
9import os
10import time
11import logging
12logger = logging.getLogger()
13import signal
14import struct
15import subprocess
16
17import hwsim_utils
18from hwsim import HWSimRadio
19import hostapd
20from tshark import run_tshark
21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
22from wlantest import Wlantest
23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
24from test_rrm import check_beacon_req
25
26def ft_base_rsn():
27 params = {"wpa": "2",
28 "wpa_key_mgmt": "FT-PSK",
29 "rsn_pairwise": "CCMP"}
30 return params
31
32def ft_base_mixed():
33 params = {"wpa": "3",
34 "wpa_key_mgmt": "WPA-PSK FT-PSK",
35 "wpa_pairwise": "TKIP",
36 "rsn_pairwise": "CCMP"}
37 return params
38
39def ft_params(rsn=True, ssid=None, passphrase=None):
40 if rsn:
41 params = ft_base_rsn()
42 else:
43 params = ft_base_mixed()
44 if ssid:
45 params["ssid"] = ssid
46 if passphrase:
47 params["wpa_passphrase"] = passphrase
48
49 params["mobility_domain"] = "a1b2"
50 params["r0_key_lifetime"] = "10000"
51 params["pmk_r1_push"] = "1"
52 params["reassociation_deadline"] = "1000"
53 return params
54
55def ft_params1a(rsn=True, ssid=None, passphrase=None):
56 params = ft_params(rsn, ssid, passphrase)
57 params['nas_identifier'] = "nas1.w1.fi"
58 params['r1_key_holder'] = "000102030405"
59 return params
60
61def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
62 params = ft_params1a(rsn, ssid, passphrase)
63 if discovery:
64 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
65 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 else:
67 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
68 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
69 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
70 return params
71
72def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
73 params = ft_params1a(rsn, ssid, passphrase)
74 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
75 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
76 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
77 return params
78
79def ft_params2a(rsn=True, ssid=None, passphrase=None):
80 params = ft_params(rsn, ssid, passphrase)
81 params['nas_identifier'] = "nas2.w1.fi"
82 params['r1_key_holder'] = "000102030406"
83 return params
84
85def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
86 params = ft_params2a(rsn, ssid, passphrase)
87 if discovery:
88 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
89 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 else:
91 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
92 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
93 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
94 return params
95
96def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
97 params = ft_params2a(rsn, ssid, passphrase)
98 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
99 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
100 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
101 return params
102
103def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
104 params = ft_params(rsn, ssid, passphrase)
105 params['nas_identifier'] = "nas1.w1.fi"
106 params['r1_key_holder'] = "000102030405"
107 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
108 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
109 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
110 return params
111
112def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
113 params = ft_params(rsn, ssid, passphrase)
114 params['nas_identifier'] = "nas2.w1.fi"
115 params['r1_key_holder'] = "000102030406"
116 params['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
117 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
118 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
119 return params
120
121def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
122 params = ft_params(rsn, ssid, passphrase)
123 params['nas_identifier'] = "nas2.w1.fi"
124 params['r1_key_holder'] = "000102030406"
125 params['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
126 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
127 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
128 return params
129
130def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
131 sae=False, eap=False, fail_test=False, roams=1,
132 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
133 test_connectivity=True, eap_identity="gpsk user", conndev=False,
134 force_initial_conn_to_first_ap=False, sha384=False,
135 group_mgmt=None, ocv=None, sae_password=None,
136 sae_password_id=None):
137 logger.info("Connect to first AP")
138
139 copts = {}
140 copts["proto"] = "WPA2"
141 copts["ieee80211w"] = "1"
142 copts["scan_freq"] = "2412"
143 copts["pairwise"] = pairwise_cipher
144 copts["group"] = group_cipher
145 copts["wpa_ptk_rekey"] = ptk_rekey
146 if group_mgmt:
147 copts["group_mgmt"] = group_mgmt
148 if ocv:
149 copts["ocv"] = ocv
150 if eap:
151 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
152 copts["eap"] = "GPSK"
153 copts["identity"] = eap_identity
154 copts["password"] = "abcdefghijklmnop0123456789abcdef"
155 else:
156 if sae:
157 copts["key_mgmt"] = "FT-SAE"
158 else:
159 copts["key_mgmt"] = "FT-PSK"
160 if passphrase:
161 copts["psk"] = passphrase
162 if sae_password:
163 copts["sae_password"] = sae_password
164 if sae_password_id:
165 copts["sae_password_id"] = sae_password_id
166 if force_initial_conn_to_first_ap:
167 copts["bssid"] = apdev[0]['bssid']
168 dev.connect(ssid, **copts)
169
170 if dev.get_status_field('bssid') == apdev[0]['bssid']:
171 ap1 = apdev[0]
172 ap2 = apdev[1]
173 hapd1ap = hapd0
174 hapd2ap = hapd1
175 else:
176 ap1 = apdev[1]
177 ap2 = apdev[0]
178 hapd1ap = hapd1
179 hapd2ap = hapd0
180 if test_connectivity:
181 if conndev:
182 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
183 else:
184 hwsim_utils.test_connectivity(dev, hapd1ap)
185
186 dev.scan_for_bss(ap2['bssid'], freq="2412")
187
188 for i in range(0, roams):
189 # Roaming artificially fast can make data test fail because the key is
190 # set later.
191 time.sleep(0.01)
192 logger.info("Roam to the second AP")
193 if over_ds:
194 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
195 else:
196 dev.roam(ap2['bssid'], fail_test=fail_test)
197 if fail_test:
198 return
199 if dev.get_status_field('bssid') != ap2['bssid']:
200 raise Exception("Did not connect to correct AP")
201 if (i == 0 or i == roams - 1) and test_connectivity:
202 if conndev:
203 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
204 else:
205 hwsim_utils.test_connectivity(dev, hapd2ap)
206
207 # Roaming artificially fast can make data test fail because the key is
208 # set later.
209 time.sleep(0.01)
210 logger.info("Roam back to the first AP")
211 if over_ds:
212 dev.roam_over_ds(ap1['bssid'])
213 else:
214 dev.roam(ap1['bssid'])
215 if dev.get_status_field('bssid') != ap1['bssid']:
216 raise Exception("Did not connect to correct AP")
217 if (i == 0 or i == roams - 1) and test_connectivity:
218 if conndev:
219 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
220 else:
221 hwsim_utils.test_connectivity(dev, hapd1ap)
222
223def test_ap_ft(dev, apdev):
224 """WPA2-PSK-FT AP"""
225 ssid = "test-ft"
226 passphrase = "12345678"
227
228 params = ft_params1(ssid=ssid, passphrase=passphrase)
229 hapd0 = hostapd.add_ap(apdev[0], params)
230 params = ft_params2(ssid=ssid, passphrase=passphrase)
231 hapd1 = hostapd.add_ap(apdev[1], params)
232
233 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
234 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
235 raise Exception("Scan results missing RSN element info")
236
237def test_ap_ft_old_key(dev, apdev):
238 """WPA2-PSK-FT AP (old key)"""
239 ssid = "test-ft"
240 passphrase = "12345678"
241
242 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
243 hapd0 = hostapd.add_ap(apdev[0], params)
244 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
245 hapd1 = hostapd.add_ap(apdev[1], params)
246
247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
248
249def test_ap_ft_multi_akm(dev, apdev):
250 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
251 ssid = "test-ft"
252 passphrase = "12345678"
253
254 params = ft_params1(ssid=ssid, passphrase=passphrase)
255 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
256 hapd0 = hostapd.add_ap(apdev[0], params)
257 params = ft_params2(ssid=ssid, passphrase=passphrase)
258 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
259 hapd1 = hostapd.add_ap(apdev[1], params)
260
261 Wlantest.setup(hapd0)
262 wt = Wlantest()
263 wt.flush()
264 wt.add_passphrase(passphrase)
265
266 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
267 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
268 raise Exception("Scan results missing RSN element info")
269 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
270 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
271 scan_freq="2412")
272
273def test_ap_ft_local_key_gen(dev, apdev):
274 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
275 ssid = "test-ft"
276 passphrase = "12345678"
277
278 params = ft_params1a(ssid=ssid, passphrase=passphrase)
279 params['ft_psk_generate_local'] = "1"
280 del params['pmk_r1_push']
281 hapd0 = hostapd.add_ap(apdev[0], params)
282 params = ft_params2a(ssid=ssid, passphrase=passphrase)
283 params['ft_psk_generate_local'] = "1"
284 del params['pmk_r1_push']
285 hapd1 = hostapd.add_ap(apdev[1], params)
286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
289 raise Exception("Scan results missing RSN element info")
290
291def test_ap_ft_vlan(dev, apdev):
292 """WPA2-PSK-FT AP with VLAN"""
293 ssid = "test-ft"
294 passphrase = "12345678"
295
296 params = ft_params1(ssid=ssid, passphrase=passphrase)
297 params['dynamic_vlan'] = "1"
298 params['accept_mac_file'] = "hostapd.accept"
299 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
300
301 params = ft_params2(ssid=ssid, passphrase=passphrase)
302 params['dynamic_vlan'] = "1"
303 params['accept_mac_file'] = "hostapd.accept"
304 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
307 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309
310def test_ap_ft_vlan_disconnected(dev, apdev):
311 """WPA2-PSK-FT AP with VLAN and local key generation"""
312 ssid = "test-ft"
313 passphrase = "12345678"
314
315 params = ft_params1a(ssid=ssid, passphrase=passphrase)
316 params['dynamic_vlan'] = "1"
317 params['accept_mac_file'] = "hostapd.accept"
318 params['ft_psk_generate_local'] = "1"
319 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
320
321 params = ft_params2a(ssid=ssid, passphrase=passphrase)
322 params['dynamic_vlan'] = "1"
323 params['accept_mac_file'] = "hostapd.accept"
324 params['ft_psk_generate_local'] = "1"
325 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
331def test_ap_ft_vlan_2(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
333 ssid = "test-ft"
334 passphrase = "12345678"
335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
342 params['dynamic_vlan'] = "1"
343 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
344
345 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
346 force_initial_conn_to_first_ap=True)
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
350def test_ap_ft_many(dev, apdev):
351 """WPA2-PSK-FT AP multiple times"""
352 ssid = "test-ft"
353 passphrase = "12345678"
354
355 params = ft_params1(ssid=ssid, passphrase=passphrase)
356 hapd0 = hostapd.add_ap(apdev[0], params)
357 params = ft_params2(ssid=ssid, passphrase=passphrase)
358 hapd1 = hostapd.add_ap(apdev[1], params)
359
360 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
361
362def test_ap_ft_many_vlan(dev, apdev):
363 """WPA2-PSK-FT AP with VLAN multiple times"""
364 ssid = "test-ft"
365 passphrase = "12345678"
366
367 params = ft_params1(ssid=ssid, passphrase=passphrase)
368 params['dynamic_vlan'] = "1"
369 params['accept_mac_file'] = "hostapd.accept"
370 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
371
372 params = ft_params2(ssid=ssid, passphrase=passphrase)
373 params['dynamic_vlan'] = "1"
374 params['accept_mac_file'] = "hostapd.accept"
375 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
376
377 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
378 conndev="brvlan1")
379
380def test_ap_ft_mixed(dev, apdev):
381 """WPA2-PSK-FT mixed-mode AP"""
382 ssid = "test-ft-mixed"
383 passphrase = "12345678"
384
385 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
386 hapd = hostapd.add_ap(apdev[0], params)
387 key_mgmt = hapd.get_config()['key_mgmt']
388 vals = key_mgmt.split(' ')
389 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
390 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
391 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
392 hapd1 = hostapd.add_ap(apdev[1], params)
393
394 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
395
396def test_ap_ft_pmf(dev, apdev):
397 """WPA2-PSK-FT AP with PMF"""
398 ssid = "test-ft"
399 passphrase = "12345678"
400
401 params = ft_params1(ssid=ssid, passphrase=passphrase)
402 params["ieee80211w"] = "2"
403 hapd0 = hostapd.add_ap(apdev[0], params)
404 params = ft_params2(ssid=ssid, passphrase=passphrase)
405 params["ieee80211w"] = "2"
406 hapd1 = hostapd.add_ap(apdev[1], params)
407
408 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
409
410def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
411 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
412 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
413
414def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
415 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
416 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
417
418def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
419 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
420 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
421
422def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
423 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
424 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
425
426def run_ap_ft_pmf_bip(dev, apdev, cipher):
427 if cipher not in dev[0].get_capability("group_mgmt"):
428 raise HwsimSkip("Cipher %s not supported" % cipher)
429
430 ssid = "test-ft"
431 passphrase = "12345678"
432
433 params = ft_params1(ssid=ssid, passphrase=passphrase)
434 params["ieee80211w"] = "2"
435 params["group_mgmt_cipher"] = cipher
436 hapd0 = hostapd.add_ap(apdev[0], params)
437 params = ft_params2(ssid=ssid, passphrase=passphrase)
438 params["ieee80211w"] = "2"
439 params["group_mgmt_cipher"] = cipher
440 hapd1 = hostapd.add_ap(apdev[1], params)
441
442 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
443 group_mgmt=cipher)
444
445def test_ap_ft_ocv(dev, apdev):
446 """WPA2-PSK-FT AP with OCV"""
447 ssid = "test-ft"
448 passphrase = "12345678"
449
450 params = ft_params1(ssid=ssid, passphrase=passphrase)
451 params["ieee80211w"] = "2"
452 params["ocv"] = "1"
453 try:
454 hapd0 = hostapd.add_ap(apdev[0], params)
455 except Exception as e:
456 if "Failed to set hostapd parameter ocv" in str(e):
457 raise HwsimSkip("OCV not supported")
458 raise
459 params = ft_params2(ssid=ssid, passphrase=passphrase)
460 params["ieee80211w"] = "2"
461 params["ocv"] = "1"
462 hapd1 = hostapd.add_ap(apdev[1], params)
463
464 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
465
466def test_ap_ft_over_ds(dev, apdev):
467 """WPA2-PSK-FT AP over DS"""
468 ssid = "test-ft"
469 passphrase = "12345678"
470
471 params = ft_params1(ssid=ssid, passphrase=passphrase)
472 hapd0 = hostapd.add_ap(apdev[0], params)
473 params = ft_params2(ssid=ssid, passphrase=passphrase)
474 hapd1 = hostapd.add_ap(apdev[1], params)
475
476 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
477 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
478 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
479
480def cleanup_ap_ft_separate_hostapd():
481 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
482 stderr=open('/dev/null', 'w'))
483 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
484 stderr=open('/dev/null', 'w'))
485 subprocess.call(["ip", "link", "del", "veth0"],
486 stderr=open('/dev/null', 'w'))
487 subprocess.call(["ip", "link", "del", "veth1"],
488 stderr=open('/dev/null', 'w'))
489 for ifname in ['br0ft', 'br1ft', 'br-ft']:
490 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
491 stderr=open('/dev/null', 'w'))
492 subprocess.call(['brctl', 'delbr', ifname],
493 stderr=open('/dev/null', 'w'))
494
495def test_ap_ft_separate_hostapd(dev, apdev, params):
496 """WPA2-PSK-FT AP and separate hostapd process"""
497 try:
498 run_ap_ft_separate_hostapd(dev, apdev, params, False)
499 finally:
500 cleanup_ap_ft_separate_hostapd()
501
502def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
503 """WPA2-PSK-FT AP over DS and separate hostapd process"""
504 try:
505 run_ap_ft_separate_hostapd(dev, apdev, params, True)
506 finally:
507 cleanup_ap_ft_separate_hostapd()
508
509def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
510 ssid = "test-ft"
511 passphrase = "12345678"
512 logdir = params['logdir']
513 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
514 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
515 global_ctrl = '/var/run/hostapd-ft'
516 br_ifname = 'br-ft'
517
518 try:
519 subprocess.check_call(['brctl', 'addbr', br_ifname])
520 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
521 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
522
523 subprocess.check_call(["ip", "link", "add", "veth0", "type", "veth",
524 "peer", "name", "veth0br"])
525 subprocess.check_call(["ip", "link", "add", "veth1", "type", "veth",
526 "peer", "name", "veth1br"])
527 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
528 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
529 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
530 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
531
532 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
533 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
534 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
535 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
536 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
537 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
538 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
539 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
540 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
541 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
542 except subprocess.CalledProcessError:
543 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
544
545 with HWSimRadio() as (radio, iface):
546 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
547 if not os.path.exists(prg):
548 prg = '../../hostapd/hostapd'
549 cmd = [prg, '-B', '-ddKt',
550 '-P', pidfile, '-f', logfile, '-g', global_ctrl]
551 subprocess.check_call(cmd)
552
553 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
554 apdev_ft = {'ifname': iface}
555 apdev2 = [apdev_ft, apdev[1]]
556
557 params = ft_params1(ssid=ssid, passphrase=passphrase)
558 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
559 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
560 params['bridge'] = 'br0ft'
561 hapd0 = hostapd.add_ap(apdev2[0], params,
562 global_ctrl_override=global_ctrl)
563 apdev2[0]['bssid'] = hapd0.own_addr()
564 params = ft_params2(ssid=ssid, passphrase=passphrase)
565 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
566 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
567 params['bridge'] = 'br1ft'
568 hapd1 = hostapd.add_ap(apdev2[1], params)
569
570 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
571 over_ds=over_ds, test_connectivity=False)
572
573 hglobal.terminate()
574
575 if os.path.exists(pidfile):
576 with open(pidfile, 'r') as f:
577 pid = int(f.read())
578 f.close()
579 os.kill(pid, signal.SIGTERM)
580
581def test_ap_ft_over_ds_ocv(dev, apdev):
582 """WPA2-PSK-FT AP over DS"""
583 ssid = "test-ft"
584 passphrase = "12345678"
585
586 params = ft_params1(ssid=ssid, passphrase=passphrase)
587 params["ieee80211w"] = "2"
588 params["ocv"] = "1"
589 try:
590 hapd0 = hostapd.add_ap(apdev[0], params)
591 except Exception as e:
592 if "Failed to set hostapd parameter ocv" in str(e):
593 raise HwsimSkip("OCV not supported")
594 raise
595 params = ft_params2(ssid=ssid, passphrase=passphrase)
596 params["ieee80211w"] = "2"
597 params["ocv"] = "1"
598 hapd1 = hostapd.add_ap(apdev[1], params)
599
600 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
601 ocv="1")
602
603def test_ap_ft_over_ds_disabled(dev, apdev):
604 """WPA2-PSK-FT AP over DS disabled"""
605 ssid = "test-ft"
606 passphrase = "12345678"
607
608 params = ft_params1(ssid=ssid, passphrase=passphrase)
609 params['ft_over_ds'] = '0'
610 hapd0 = hostapd.add_ap(apdev[0], params)
611 params = ft_params2(ssid=ssid, passphrase=passphrase)
612 params['ft_over_ds'] = '0'
613 hapd1 = hostapd.add_ap(apdev[1], params)
614
615 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
616 fail_test=True)
617
618def test_ap_ft_vlan_over_ds(dev, apdev):
619 """WPA2-PSK-FT AP over DS with VLAN"""
620 ssid = "test-ft"
621 passphrase = "12345678"
622
623 params = ft_params1(ssid=ssid, passphrase=passphrase)
624 params['dynamic_vlan'] = "1"
625 params['accept_mac_file'] = "hostapd.accept"
626 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
627 params = ft_params2(ssid=ssid, passphrase=passphrase)
628 params['dynamic_vlan'] = "1"
629 params['accept_mac_file'] = "hostapd.accept"
630 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
631
632 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
633 conndev="brvlan1")
634 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
635 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
636
637def test_ap_ft_over_ds_many(dev, apdev):
638 """WPA2-PSK-FT AP over DS multiple times"""
639 ssid = "test-ft"
640 passphrase = "12345678"
641
642 params = ft_params1(ssid=ssid, passphrase=passphrase)
643 hapd0 = hostapd.add_ap(apdev[0], params)
644 params = ft_params2(ssid=ssid, passphrase=passphrase)
645 hapd1 = hostapd.add_ap(apdev[1], params)
646
647 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
648 roams=50)
649
650def test_ap_ft_vlan_over_ds_many(dev, apdev):
651 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
652 ssid = "test-ft"
653 passphrase = "12345678"
654
655 params = ft_params1(ssid=ssid, passphrase=passphrase)
656 params['dynamic_vlan'] = "1"
657 params['accept_mac_file'] = "hostapd.accept"
658 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
659 params = ft_params2(ssid=ssid, passphrase=passphrase)
660 params['dynamic_vlan'] = "1"
661 params['accept_mac_file'] = "hostapd.accept"
662 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
663
664 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
665 roams=50, conndev="brvlan1")
666
667@remote_compatible
668def test_ap_ft_over_ds_unknown_target(dev, apdev):
669 """WPA2-PSK-FT AP"""
670 ssid = "test-ft"
671 passphrase = "12345678"
672
673 params = ft_params1(ssid=ssid, passphrase=passphrase)
674 hapd0 = hostapd.add_ap(apdev[0], params)
675
676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
677 scan_freq="2412")
678 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
679
680@remote_compatible
681def test_ap_ft_over_ds_unexpected(dev, apdev):
682 """WPA2-PSK-FT AP over DS and unexpected response"""
683 ssid = "test-ft"
684 passphrase = "12345678"
685
686 params = ft_params1(ssid=ssid, passphrase=passphrase)
687 hapd0 = hostapd.add_ap(apdev[0], params)
688 params = ft_params2(ssid=ssid, passphrase=passphrase)
689 hapd1 = hostapd.add_ap(apdev[1], params)
690
691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
692 scan_freq="2412")
693 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
694 ap1 = apdev[0]
695 ap2 = apdev[1]
696 hapd1ap = hapd0
697 hapd2ap = hapd1
698 else:
699 ap1 = apdev[1]
700 ap2 = apdev[0]
701 hapd1ap = hapd1
702 hapd2ap = hapd0
703
704 addr = dev[0].own_addr()
705 hapd1ap.set("ext_mgmt_frame_handling", "1")
706 logger.info("Foreign STA address")
707 msg = {}
708 msg['fc'] = 13 << 4
709 msg['da'] = addr
710 msg['sa'] = ap1['bssid']
711 msg['bssid'] = ap1['bssid']
712 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
713 hapd1ap.mgmt_tx(msg)
714
715 logger.info("No over-the-DS in progress")
716 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
717 hapd1ap.mgmt_tx(msg)
718
719 logger.info("Non-zero status code")
720 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
721 hapd1ap.mgmt_tx(msg)
722
723 hapd1ap.dump_monitor()
724
725 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
726 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
727 raise Exception("FT_DS failed")
728
729 req = hapd1ap.mgmt_rx()
730
731 logger.info("Foreign Target AP")
732 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
733 hapd1ap.mgmt_tx(msg)
734
735 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
736
737 logger.info("No IEs")
738 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
739 hapd1ap.mgmt_tx(msg)
740
741 logger.info("Invalid IEs (trigger parsing failure)")
742 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
743 hapd1ap.mgmt_tx(msg)
744
745 logger.info("Too short MDIE")
746 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
747 hapd1ap.mgmt_tx(msg)
748
749 logger.info("Mobility domain mismatch")
750 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
751 hapd1ap.mgmt_tx(msg)
752
753 logger.info("No FTIE")
754 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
755 hapd1ap.mgmt_tx(msg)
756
757 logger.info("FTIE SNonce mismatch")
758 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
759 hapd1ap.mgmt_tx(msg)
760
761 logger.info("No R0KH-ID subelem in FTIE")
762 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
763 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
764 hapd1ap.mgmt_tx(msg)
765
766 logger.info("No R0KH-ID subelem mismatch in FTIE")
767 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
768 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
769 hapd1ap.mgmt_tx(msg)
770
771 logger.info("No R1KH-ID subelem in FTIE")
772 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
773 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
774 hapd1ap.mgmt_tx(msg)
775
776 logger.info("No RSNE")
777 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
778 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
779 hapd1ap.mgmt_tx(msg)
780
781def test_ap_ft_pmf_over_ds(dev, apdev):
782 """WPA2-PSK-FT AP over DS with PMF"""
783 run_ap_ft_pmf_bip_over_ds(dev, apdev, None)
784
785def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
786 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
787 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
788
789def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
790 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
791 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
792
793def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
794 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
795 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
796
797def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
798 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
799 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
800
801def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
802 if cipher and cipher not in dev[0].get_capability("group_mgmt"):
803 raise HwsimSkip("Cipher %s not supported" % cipher)
804
805 ssid = "test-ft"
806 passphrase = "12345678"
807
808 params = ft_params1(ssid=ssid, passphrase=passphrase)
809 params["ieee80211w"] = "2"
810 if cipher:
811 params["group_mgmt_cipher"] = cipher
812 hapd0 = hostapd.add_ap(apdev[0], params)
813 params = ft_params2(ssid=ssid, passphrase=passphrase)
814 params["ieee80211w"] = "2"
815 if cipher:
816 params["group_mgmt_cipher"] = cipher
817 hapd1 = hostapd.add_ap(apdev[1], params)
818
819 Wlantest.setup(hapd0)
820 wt = Wlantest()
821 wt.flush()
822 wt.add_passphrase(passphrase)
823
824 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
825 group_mgmt=cipher)
826
827def test_ap_ft_over_ds_pull(dev, apdev):
828 """WPA2-PSK-FT AP over DS (pull PMK)"""
829 ssid = "test-ft"
830 passphrase = "12345678"
831
832 params = ft_params1(ssid=ssid, passphrase=passphrase)
833 params["pmk_r1_push"] = "0"
834 hapd0 = hostapd.add_ap(apdev[0], params)
835 params = ft_params2(ssid=ssid, passphrase=passphrase)
836 params["pmk_r1_push"] = "0"
837 hapd1 = hostapd.add_ap(apdev[1], params)
838
839 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
840
841def test_ap_ft_over_ds_pull_old_key(dev, apdev):
842 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
843 ssid = "test-ft"
844 passphrase = "12345678"
845
846 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
847 params["pmk_r1_push"] = "0"
848 hapd0 = hostapd.add_ap(apdev[0], params)
849 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
850 params["pmk_r1_push"] = "0"
851 hapd1 = hostapd.add_ap(apdev[1], params)
852
853 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
854
855def test_ap_ft_over_ds_pull_vlan(dev, apdev):
856 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
857 ssid = "test-ft"
858 passphrase = "12345678"
859
860 params = ft_params1(ssid=ssid, passphrase=passphrase)
861 params["pmk_r1_push"] = "0"
862 params['dynamic_vlan'] = "1"
863 params['accept_mac_file'] = "hostapd.accept"
864 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
865 params = ft_params2(ssid=ssid, passphrase=passphrase)
866 params["pmk_r1_push"] = "0"
867 params['dynamic_vlan'] = "1"
868 params['accept_mac_file'] = "hostapd.accept"
869 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
870
871 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
872 conndev="brvlan1")
873
874def test_ap_ft_sae(dev, apdev):
875 """WPA2-PSK-FT-SAE AP"""
876 if "SAE" not in dev[0].get_capability("auth_alg"):
877 raise HwsimSkip("SAE not supported")
878 ssid = "test-ft"
879 passphrase = "12345678"
880
881 params = ft_params1(ssid=ssid, passphrase=passphrase)
882 params['wpa_key_mgmt'] = "FT-SAE"
883 hapd0 = hostapd.add_ap(apdev[0], params)
884 params = ft_params2(ssid=ssid, passphrase=passphrase)
885 params['wpa_key_mgmt'] = "FT-SAE"
886 hapd = hostapd.add_ap(apdev[1], params)
887 key_mgmt = hapd.get_config()['key_mgmt']
888 if key_mgmt.split(' ')[0] != "FT-SAE":
889 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
890
891 dev[0].request("SET sae_groups ")
892 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
893
894def test_ap_ft_sae_over_ds(dev, apdev):
895 """WPA2-PSK-FT-SAE AP over DS"""
896 if "SAE" not in dev[0].get_capability("auth_alg"):
897 raise HwsimSkip("SAE not supported")
898 ssid = "test-ft"
899 passphrase = "12345678"
900
901 params = ft_params1(ssid=ssid, passphrase=passphrase)
902 params['wpa_key_mgmt'] = "FT-SAE"
903 hapd0 = hostapd.add_ap(apdev[0], params)
904 params = ft_params2(ssid=ssid, passphrase=passphrase)
905 params['wpa_key_mgmt'] = "FT-SAE"
906 hapd1 = hostapd.add_ap(apdev[1], params)
907
908 dev[0].request("SET sae_groups ")
909 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
910 over_ds=True)
911
912def test_ap_ft_sae_pw_id(dev, apdev):
913 """FT-SAE with Password Identifier"""
914 if "SAE" not in dev[0].get_capability("auth_alg"):
915 raise HwsimSkip("SAE not supported")
916 ssid = "test-ft"
917
918 params = ft_params1(ssid=ssid)
919 params["ieee80211w"] = "2"
920 params['wpa_key_mgmt'] = "FT-SAE"
921 params['sae_password'] = 'secret|id=pwid'
922 hapd0 = hostapd.add_ap(apdev[0], params)
923 params = ft_params2(ssid=ssid)
924 params["ieee80211w"] = "2"
925 params['wpa_key_mgmt'] = "FT-SAE"
926 params['sae_password'] = 'secret|id=pwid'
927 hapd = hostapd.add_ap(apdev[1], params)
928
929 dev[0].request("SET sae_groups ")
930 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
931 sae_password="secret", sae_password_id="pwid")
932
933def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
934 discovery=False, roams=1):
935 ssid = "test-ft"
936 passphrase = "12345678"
937 if vlan:
938 identity = "gpsk-vlan1"
939 conndev = "brvlan1"
940 elif cui:
941 identity = "gpsk-cui"
942 conndev = False
943 else:
944 identity = "gpsk user"
945 conndev = False
946
947 radius = hostapd.radius_params()
948 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
949 params['wpa_key_mgmt'] = "FT-EAP"
950 params["ieee8021x"] = "1"
951 if vlan:
952 params["dynamic_vlan"] = "1"
953 params = dict(list(radius.items()) + list(params.items()))
954 hapd = hostapd.add_ap(apdev[0], params)
955 key_mgmt = hapd.get_config()['key_mgmt']
956 if key_mgmt.split(' ')[0] != "FT-EAP":
957 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
958 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
959 params['wpa_key_mgmt'] = "FT-EAP"
960 params["ieee8021x"] = "1"
961 if vlan:
962 params["dynamic_vlan"] = "1"
963 params = dict(list(radius.items()) + list(params.items()))
964 hapd1 = hostapd.add_ap(apdev[1], params)
965
966 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
967 over_ds=over_ds, roams=roams, eap_identity=identity,
968 conndev=conndev)
969 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
970 raise Exception("Scan results missing RSN element info")
971 check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
972 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
973
974 # Verify EAPOL reauthentication after FT protocol
975 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
976 ap = hapd
977 else:
978 ap = hapd1
979 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
980 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
981 if ev is None:
982 raise Exception("EAP authentication did not start")
983 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
984 if ev is None:
985 raise Exception("EAP authentication did not succeed")
986 time.sleep(0.1)
987 if conndev:
988 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
989 else:
990 hwsim_utils.test_connectivity(dev[0], ap)
991
992def test_ap_ft_eap(dev, apdev):
993 """WPA2-EAP-FT AP"""
994 generic_ap_ft_eap(dev, apdev)
995
996def test_ap_ft_eap_cui(dev, apdev):
997 """WPA2-EAP-FT AP with CUI"""
998 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
999
1000def test_ap_ft_eap_vlan(dev, apdev):
1001 """WPA2-EAP-FT AP with VLAN"""
1002 generic_ap_ft_eap(dev, apdev, vlan=True)
1003
1004def test_ap_ft_eap_vlan_multi(dev, apdev):
1005 """WPA2-EAP-FT AP with VLAN"""
1006 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1007
1008def test_ap_ft_eap_over_ds(dev, apdev):
1009 """WPA2-EAP-FT AP using over-the-DS"""
1010 generic_ap_ft_eap(dev, apdev, over_ds=True)
1011
1012def test_ap_ft_eap_dis(dev, apdev):
1013 """WPA2-EAP-FT AP with AP discovery"""
1014 generic_ap_ft_eap(dev, apdev, discovery=True)
1015
1016def test_ap_ft_eap_dis_over_ds(dev, apdev):
1017 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1018 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1019
1020def test_ap_ft_eap_vlan(dev, apdev):
1021 """WPA2-EAP-FT AP with VLAN"""
1022 generic_ap_ft_eap(dev, apdev, vlan=True)
1023
1024def test_ap_ft_eap_vlan_multi(dev, apdev):
1025 """WPA2-EAP-FT AP with VLAN"""
1026 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1027
1028def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1029 """WPA2-EAP-FT AP with VLAN + over_ds"""
1030 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1031
1032def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1033 """WPA2-EAP-FT AP with VLAN + over_ds"""
1034 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1035
1036def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
1037 """WPA2-EAP-FT AP (pull PMK)"""
1038 ssid = "test-ft"
1039 passphrase = "12345678"
1040 if vlan:
1041 identity = "gpsk-vlan1"
1042 conndev = "brvlan1"
1043 else:
1044 identity = "gpsk user"
1045 conndev = False
1046
1047 radius = hostapd.radius_params()
1048 params = ft_params1(ssid=ssid, passphrase=passphrase)
1049 params['wpa_key_mgmt'] = "FT-EAP"
1050 params["ieee8021x"] = "1"
1051 params["pmk_r1_push"] = "0"
1052 if vlan:
1053 params["dynamic_vlan"] = "1"
1054 params = dict(list(radius.items()) + list(params.items()))
1055 hapd = hostapd.add_ap(apdev[0], params)
1056 key_mgmt = hapd.get_config()['key_mgmt']
1057 if key_mgmt.split(' ')[0] != "FT-EAP":
1058 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1059 params = ft_params2(ssid=ssid, passphrase=passphrase)
1060 params['wpa_key_mgmt'] = "FT-EAP"
1061 params["ieee8021x"] = "1"
1062 params["pmk_r1_push"] = "0"
1063 if vlan:
1064 params["dynamic_vlan"] = "1"
1065 params = dict(list(radius.items()) + list(params.items()))
1066 hapd1 = hostapd.add_ap(apdev[1], params)
1067
1068 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1069 eap_identity=identity, conndev=conndev)
1070
1071def test_ap_ft_eap_pull(dev, apdev):
1072 """WPA2-EAP-FT AP (pull PMK)"""
1073 generic_ap_ft_eap_pull(dev, apdev)
1074
1075def test_ap_ft_eap_pull_vlan(dev, apdev):
1076 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
1077
1078def test_ap_ft_eap_pull_wildcard(dev, apdev):
1079 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1080 ssid = "test-ft"
1081 passphrase = "12345678"
1082
1083 radius = hostapd.radius_params()
1084 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1085 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1086 params["ieee8021x"] = "1"
1087 params["pmk_r1_push"] = "0"
1088 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1089 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1090 params["ft_psk_generate_local"] = "1"
1091 params["eap_server"] = "0"
1092 params = dict(list(radius.items()) + list(params.items()))
1093 hapd = hostapd.add_ap(apdev[0], params)
1094 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1095 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1096 params["ieee8021x"] = "1"
1097 params["pmk_r1_push"] = "0"
1098 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1099 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1100 params["ft_psk_generate_local"] = "1"
1101 params["eap_server"] = "0"
1102 params = dict(list(radius.items()) + list(params.items()))
1103 hapd1 = hostapd.add_ap(apdev[1], params)
1104
1105 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1106
1107@remote_compatible
1108def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1109 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1110 ssid = "test-ft"
1111 passphrase = "12345678"
1112
1113 params = ft_params1(ssid=ssid, passphrase=passphrase)
1114 params["ieee80211w"] = "2"
1115 hapd0 = hostapd.add_ap(apdev[0], params)
1116 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1117 params["ieee80211w"] = "2"
1118 hapd1 = hostapd.add_ap(apdev[1], params)
1119
1120 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1121 fail_test=True)
1122
1123@remote_compatible
1124def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1125 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1126 ssid = "test-ft"
1127 passphrase = "12345678"
1128
1129 params = ft_params1(ssid=ssid, passphrase=passphrase)
1130 params["pmk_r1_push"] = "0"
1131 hapd0 = hostapd.add_ap(apdev[0], params)
1132 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1133 params["pmk_r1_push"] = "0"
1134 hapd1 = hostapd.add_ap(apdev[1], params)
1135
1136 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1137 fail_test=True)
1138
1139@remote_compatible
1140def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1141 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1142 ssid = "test-ft"
1143 passphrase = "12345678"
1144
1145 params = ft_params1(ssid=ssid, passphrase=passphrase)
1146 params["pmk_r1_push"] = "0"
1147 params["nas_identifier"] = "nas0.w1.fi"
1148 hostapd.add_ap(apdev[0], params)
1149 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1150 scan_freq="2412")
1151
1152 params = ft_params2(ssid=ssid, passphrase=passphrase)
1153 params["pmk_r1_push"] = "0"
1154 hostapd.add_ap(apdev[1], params)
1155
1156 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1157 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1158
1159@remote_compatible
1160def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1161 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1162 ssid = "test-ft"
1163 passphrase = "12345678"
1164
1165 params = ft_params1(ssid=ssid, passphrase=passphrase)
1166 params["ieee80211w"] = "2"
1167 hapd0 = hostapd.add_ap(apdev[0], params)
1168 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1169 params["ieee80211w"] = "2"
1170 hapd1 = hostapd.add_ap(apdev[1], params)
1171
1172 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1173 fail_test=True)
1174
1175@remote_compatible
1176def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1177 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1178 ssid = "test-ft"
1179 passphrase = "12345678"
1180
1181 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1182 params["pmk_r1_push"] = "0"
1183 hapd0 = hostapd.add_ap(apdev[0], params)
1184 params = ft_params2(ssid=ssid, passphrase=passphrase)
1185 params["pmk_r1_push"] = "0"
1186 hapd1 = hostapd.add_ap(apdev[1], params)
1187
1188 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1189 fail_test=True)
1190
1191def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1192 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1193 ssid = "test-ft"
1194 passphrase = "12345678"
1195
1196 radius = hostapd.radius_params()
1197 params = ft_params1(ssid=ssid, passphrase=passphrase)
1198 params["ieee80211w"] = "2"
1199 params['wpa_key_mgmt'] = "FT-EAP"
1200 params["ieee8021x"] = "1"
1201 params = dict(list(radius.items()) + list(params.items()))
1202 hapd0 = hostapd.add_ap(apdev[0], params)
1203 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1204 params["ieee80211w"] = "2"
1205 params['wpa_key_mgmt'] = "FT-EAP"
1206 params["ieee8021x"] = "1"
1207 params = dict(list(radius.items()) + list(params.items()))
1208 hapd1 = hostapd.add_ap(apdev[1], params)
1209
1210 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1211 fail_test=True, eap=True)
1212
1213def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1214 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1215 ssid = "test-ft"
1216 passphrase = "12345678"
1217
1218 radius = hostapd.radius_params()
1219 params = ft_params1(ssid=ssid, passphrase=passphrase)
1220 params["pmk_r1_push"] = "0"
1221 params['wpa_key_mgmt'] = "FT-EAP"
1222 params["ieee8021x"] = "1"
1223 params = dict(list(radius.items()) + list(params.items()))
1224 hapd0 = hostapd.add_ap(apdev[0], params)
1225 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1226 params["pmk_r1_push"] = "0"
1227 params['wpa_key_mgmt'] = "FT-EAP"
1228 params["ieee8021x"] = "1"
1229 params = dict(list(radius.items()) + list(params.items()))
1230 hapd1 = hostapd.add_ap(apdev[1], params)
1231
1232 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1233 fail_test=True, eap=True)
1234
1235def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1236 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1237 ssid = "test-ft"
1238 passphrase = "12345678"
1239
1240 radius = hostapd.radius_params()
1241 params = ft_params1(ssid=ssid, passphrase=passphrase)
1242 params["pmk_r1_push"] = "0"
1243 params["nas_identifier"] = "nas0.w1.fi"
1244 params['wpa_key_mgmt'] = "FT-EAP"
1245 params["ieee8021x"] = "1"
1246 params = dict(list(radius.items()) + list(params.items()))
1247 hostapd.add_ap(apdev[0], params)
1248 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1249 eap="GPSK", identity="gpsk user",
1250 password="abcdefghijklmnop0123456789abcdef",
1251 scan_freq="2412")
1252
1253 params = ft_params2(ssid=ssid, passphrase=passphrase)
1254 params["pmk_r1_push"] = "0"
1255 params['wpa_key_mgmt'] = "FT-EAP"
1256 params["ieee8021x"] = "1"
1257 params = dict(list(radius.items()) + list(params.items()))
1258 hostapd.add_ap(apdev[1], params)
1259
1260 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1261 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1262
1263def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1264 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1265 ssid = "test-ft"
1266 passphrase = "12345678"
1267
1268 radius = hostapd.radius_params()
1269 params = ft_params1(ssid=ssid, passphrase=passphrase)
1270 params["ieee80211w"] = "2"
1271 params['wpa_key_mgmt'] = "FT-EAP"
1272 params["ieee8021x"] = "1"
1273 params = dict(list(radius.items()) + list(params.items()))
1274 hapd0 = hostapd.add_ap(apdev[0], params)
1275 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1276 params["ieee80211w"] = "2"
1277 params['wpa_key_mgmt'] = "FT-EAP"
1278 params["ieee8021x"] = "1"
1279 params = dict(list(radius.items()) + list(params.items()))
1280 hapd1 = hostapd.add_ap(apdev[1], params)
1281
1282 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1283 fail_test=True, eap=True)
1284
1285def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1286 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1287 ssid = "test-ft"
1288 passphrase = "12345678"
1289
1290 radius = hostapd.radius_params()
1291 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1292 params["pmk_r1_push"] = "0"
1293 params['wpa_key_mgmt'] = "FT-EAP"
1294 params["ieee8021x"] = "1"
1295 params = dict(list(radius.items()) + list(params.items()))
1296 hapd0 = hostapd.add_ap(apdev[0], params)
1297 params = ft_params2(ssid=ssid, passphrase=passphrase)
1298 params["pmk_r1_push"] = "0"
1299 params['wpa_key_mgmt'] = "FT-EAP"
1300 params["ieee8021x"] = "1"
1301 params = dict(list(radius.items()) + list(params.items()))
1302 hapd1 = hostapd.add_ap(apdev[1], params)
1303
1304 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1305 fail_test=True, eap=True)
1306
1307def test_ap_ft_gtk_rekey(dev, apdev):
1308 """WPA2-PSK-FT AP and GTK rekey"""
1309 ssid = "test-ft"
1310 passphrase = "12345678"
1311
1312 params = ft_params1(ssid=ssid, passphrase=passphrase)
1313 params['wpa_group_rekey'] = '1'
1314 hapd = hostapd.add_ap(apdev[0], params)
1315
1316 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1317 ieee80211w="1", scan_freq="2412")
1318
1319 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1320 if ev is None:
1321 raise Exception("GTK rekey timed out after initial association")
1322 hwsim_utils.test_connectivity(dev[0], hapd)
1323
1324 params = ft_params2(ssid=ssid, passphrase=passphrase)
1325 params['wpa_group_rekey'] = '1'
1326 hapd1 = hostapd.add_ap(apdev[1], params)
1327
1328 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1329 dev[0].roam(apdev[1]['bssid'])
1330 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1331 raise Exception("Did not connect to correct AP")
1332 hwsim_utils.test_connectivity(dev[0], hapd1)
1333
1334 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1335 if ev is None:
1336 raise Exception("GTK rekey timed out after FT protocol")
1337 hwsim_utils.test_connectivity(dev[0], hapd1)
1338
1339def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1340 """WPA2-PSK-FT and key lifetime in memory"""
1341 ssid = "test-ft"
1342 passphrase = "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1343 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1344 pmk = binascii.unhexlify(psk)
1345 p = ft_params1(ssid=ssid, passphrase=passphrase)
1346 hapd0 = hostapd.add_ap(apdev[0], p)
1347 p = ft_params2(ssid=ssid, passphrase=passphrase)
1348 hapd1 = hostapd.add_ap(apdev[1], p)
1349
1350 pid = find_wpas_process(dev[0])
1351
1352 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1353 scan_freq="2412")
1354 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1355 # event has been delivered, so verify that wpa_supplicant has returned to
1356 # eloop before reading process memory.
1357 time.sleep(1)
1358 dev[0].ping()
1359
1360 buf = read_process_memory(pid, pmk)
1361
1362 dev[0].request("DISCONNECT")
1363 dev[0].wait_disconnected()
1364
1365 dev[0].relog()
1366 pmkr0 = None
1367 pmkr1 = None
1368 ptk = None
1369 gtk = None
1370 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1371 for l in f.readlines():
1372 if "FT: PMK-R0 - hexdump" in l:
1373 val = l.strip().split(':')[3].replace(' ', '')
1374 pmkr0 = binascii.unhexlify(val)
1375 if "FT: PMK-R1 - hexdump" in l:
1376 val = l.strip().split(':')[3].replace(' ', '')
1377 pmkr1 = binascii.unhexlify(val)
1378 if "FT: KCK - hexdump" in l:
1379 val = l.strip().split(':')[3].replace(' ', '')
1380 kck = binascii.unhexlify(val)
1381 if "FT: KEK - hexdump" in l:
1382 val = l.strip().split(':')[3].replace(' ', '')
1383 kek = binascii.unhexlify(val)
1384 if "FT: TK - hexdump" in l:
1385 val = l.strip().split(':')[3].replace(' ', '')
1386 tk = binascii.unhexlify(val)
1387 if "WPA: Group Key - hexdump" in l:
1388 val = l.strip().split(':')[3].replace(' ', '')
1389 gtk = binascii.unhexlify(val)
1390 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
1391 raise Exception("Could not find keys from debug log")
1392 if len(gtk) != 16:
1393 raise Exception("Unexpected GTK length")
1394
1395 logger.info("Checking keys in memory while associated")
1396 get_key_locations(buf, pmk, "PMK")
1397 get_key_locations(buf, pmkr0, "PMK-R0")
1398 get_key_locations(buf, pmkr1, "PMK-R1")
1399 if pmk not in buf:
1400 raise HwsimSkip("PMK not found while associated")
1401 if pmkr0 not in buf:
1402 raise HwsimSkip("PMK-R0 not found while associated")
1403 if pmkr1 not in buf:
1404 raise HwsimSkip("PMK-R1 not found while associated")
1405 if kck not in buf:
1406 raise Exception("KCK not found while associated")
1407 if kek not in buf:
1408 raise Exception("KEK not found while associated")
1409 #if tk in buf:
1410 # raise Exception("TK found from memory")
1411
1412 logger.info("Checking keys in memory after disassociation")
1413 buf = read_process_memory(pid, pmk)
1414 get_key_locations(buf, pmk, "PMK")
1415 get_key_locations(buf, pmkr0, "PMK-R0")
1416 get_key_locations(buf, pmkr1, "PMK-R1")
1417
1418 # Note: PMK/PSK is still present in network configuration
1419
1420 fname = os.path.join(params['logdir'],
1421 'ft_psk_key_lifetime_in_memory.memctx-')
1422 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1423 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1424 verify_not_present(buf, kck, fname, "KCK")
1425 verify_not_present(buf, kek, fname, "KEK")
1426 verify_not_present(buf, tk, fname, "TK")
1427 if gtk in buf:
1428 get_key_locations(buf, gtk, "GTK")
1429 verify_not_present(buf, gtk, fname, "GTK")
1430
1431 dev[0].request("REMOVE_NETWORK all")
1432
1433 logger.info("Checking keys in memory after network profile removal")
1434 buf = read_process_memory(pid, pmk)
1435 get_key_locations(buf, pmk, "PMK")
1436 get_key_locations(buf, pmkr0, "PMK-R0")
1437 get_key_locations(buf, pmkr1, "PMK-R1")
1438
1439 verify_not_present(buf, pmk, fname, "PMK")
1440 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1441 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1442 verify_not_present(buf, kck, fname, "KCK")
1443 verify_not_present(buf, kek, fname, "KEK")
1444 verify_not_present(buf, tk, fname, "TK")
1445 verify_not_present(buf, gtk, fname, "GTK")
1446
1447@remote_compatible
1448def test_ap_ft_invalid_resp(dev, apdev):
1449 """WPA2-PSK-FT AP and invalid response IEs"""
1450 ssid = "test-ft"
1451 passphrase = "12345678"
1452
1453 params = ft_params1(ssid=ssid, passphrase=passphrase)
1454 hapd0 = hostapd.add_ap(apdev[0], params)
1455 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1456 scan_freq="2412")
1457
1458 params = ft_params2(ssid=ssid, passphrase=passphrase)
1459 hapd1 = hostapd.add_ap(apdev[1], params)
1460
1461 tests = [
1462 # Various IEs for test coverage. The last one is FTIE with invalid
1463 # R1KH-ID subelement.
1464 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1465 # FTIE with invalid R0KH-ID subelement (len=0).
1466 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1467 # FTIE with invalid R0KH-ID subelement (len=49).
1468 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1469 # Invalid RSNE.
1470 "020002000000" + "3000",
1471 # Required IEs missing from protected IE count.
1472 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1473 # RIC missing from protected IE count.
1474 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1475 # Protected IE missing.
1476 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
1477 for t in tests:
1478 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1479 hapd1.set("ext_mgmt_frame_handling", "1")
1480 hapd1.dump_monitor()
1481 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1482 raise Exception("ROAM failed")
1483 auth = None
1484 for i in range(20):
1485 msg = hapd1.mgmt_rx()
1486 if msg['subtype'] == 11:
1487 auth = msg
1488 break
1489 if not auth:
1490 raise Exception("Authentication frame not seen")
1491
1492 resp = {}
1493 resp['fc'] = auth['fc']
1494 resp['da'] = auth['sa']
1495 resp['sa'] = auth['da']
1496 resp['bssid'] = auth['bssid']
1497 resp['payload'] = binascii.unhexlify(t)
1498 hapd1.mgmt_tx(resp)
1499 hapd1.set("ext_mgmt_frame_handling", "0")
1500 dev[0].wait_disconnected()
1501
1502 dev[0].request("RECONNECT")
1503 dev[0].wait_connected()
1504
1505def test_ap_ft_gcmp_256(dev, apdev):
1506 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1507 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1508 raise HwsimSkip("Cipher GCMP-256 not supported")
1509 ssid = "test-ft"
1510 passphrase = "12345678"
1511
1512 params = ft_params1(ssid=ssid, passphrase=passphrase)
1513 params['rsn_pairwise'] = "GCMP-256"
1514 hapd0 = hostapd.add_ap(apdev[0], params)
1515 params = ft_params2(ssid=ssid, passphrase=passphrase)
1516 params['rsn_pairwise'] = "GCMP-256"
1517 hapd1 = hostapd.add_ap(apdev[1], params)
1518
1519 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1520 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
1521
1522def setup_ap_ft_oom(dev, apdev):
1523 skip_with_fips(dev[0])
1524 ssid = "test-ft"
1525 passphrase = "12345678"
1526
1527 params = ft_params1(ssid=ssid, passphrase=passphrase)
1528 hapd0 = hostapd.add_ap(apdev[0], params)
1529 params = ft_params2(ssid=ssid, passphrase=passphrase)
1530 hapd1 = hostapd.add_ap(apdev[1], params)
1531
1532 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1533 scan_freq="2412")
1534 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1535 dst = apdev[1]['bssid']
1536 else:
1537 dst = apdev[0]['bssid']
1538
1539 dev[0].scan_for_bss(dst, freq="2412")
1540
1541 return dst
1542
1543def test_ap_ft_oom(dev, apdev):
1544 """WPA2-PSK-FT and OOM"""
1545 dst = setup_ap_ft_oom(dev, apdev)
1546 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1547 dev[0].roam(dst)
1548
1549def test_ap_ft_oom2(dev, apdev):
1550 """WPA2-PSK-FT and OOM (2)"""
1551 dst = setup_ap_ft_oom(dev, apdev)
1552 with fail_test(dev[0], 1, "wpa_ft_mic"):
1553 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1554
1555def test_ap_ft_oom3(dev, apdev):
1556 """WPA2-PSK-FT and OOM (3)"""
1557 dst = setup_ap_ft_oom(dev, apdev)
1558 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1559 dev[0].roam(dst)
1560
1561def test_ap_ft_oom4(dev, apdev):
1562 """WPA2-PSK-FT and OOM (4)"""
1563 ssid = "test-ft"
1564 passphrase = "12345678"
1565 dst = setup_ap_ft_oom(dev, apdev)
1566 dev[0].request("REMOVE_NETWORK all")
1567 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1568 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1569 scan_freq="2412")
1570
1571def test_ap_ft_ap_oom(dev, apdev):
1572 """WPA2-PSK-FT and AP OOM"""
1573 ssid = "test-ft"
1574 passphrase = "12345678"
1575
1576 params = ft_params1(ssid=ssid, passphrase=passphrase)
1577 hapd0 = hostapd.add_ap(apdev[0], params)
1578 bssid0 = hapd0.own_addr()
1579
1580 dev[0].scan_for_bss(bssid0, freq="2412")
1581 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1582 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1583 scan_freq="2412")
1584
1585 params = ft_params2(ssid=ssid, passphrase=passphrase)
1586 hapd1 = hostapd.add_ap(apdev[1], params)
1587 bssid1 = hapd1.own_addr()
1588 dev[0].scan_for_bss(bssid1, freq="2412")
1589 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1590 dev[0].roam(bssid1)
1591
1592def test_ap_ft_ap_oom2(dev, apdev):
1593 """WPA2-PSK-FT and AP OOM 2"""
1594 ssid = "test-ft"
1595 passphrase = "12345678"
1596
1597 params = ft_params1(ssid=ssid, passphrase=passphrase)
1598 hapd0 = hostapd.add_ap(apdev[0], params)
1599 bssid0 = hapd0.own_addr()
1600
1601 dev[0].scan_for_bss(bssid0, freq="2412")
1602 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1603 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1604 scan_freq="2412")
1605
1606 params = ft_params2(ssid=ssid, passphrase=passphrase)
1607 hapd1 = hostapd.add_ap(apdev[1], params)
1608 bssid1 = hapd1.own_addr()
1609 dev[0].scan_for_bss(bssid1, freq="2412")
1610 dev[0].roam(bssid1)
1611 if dev[0].get_status_field('bssid') != bssid1:
1612 raise Exception("Did not roam to AP1")
1613 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1614 dev[0].roam(bssid0)
1615
1616def test_ap_ft_ap_oom3(dev, apdev):
1617 """WPA2-PSK-FT and AP OOM 3"""
1618 ssid = "test-ft"
1619 passphrase = "12345678"
1620
1621 params = ft_params1(ssid=ssid, passphrase=passphrase)
1622 hapd0 = hostapd.add_ap(apdev[0], params)
1623 bssid0 = hapd0.own_addr()
1624
1625 dev[0].scan_for_bss(bssid0, freq="2412")
1626 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1627 scan_freq="2412")
1628
1629 params = ft_params2(ssid=ssid, passphrase=passphrase)
1630 hapd1 = hostapd.add_ap(apdev[1], params)
1631 bssid1 = hapd1.own_addr()
1632 dev[0].scan_for_bss(bssid1, freq="2412")
1633 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1634 # This will fail due to not being able to send out PMK-R1 pull request
1635 dev[0].roam(bssid1)
1636
1637 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1638 # This will fail due to not being able to send out PMK-R1 pull request
1639 dev[0].roam(bssid1)
1640
1641 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1642 # This will fail due to not being able to send out PMK-R1 pull request
1643 dev[0].roam(bssid1)
1644
1645def test_ap_ft_ap_oom3b(dev, apdev):
1646 """WPA2-PSK-FT and AP OOM 3b"""
1647 ssid = "test-ft"
1648 passphrase = "12345678"
1649
1650 params = ft_params1(ssid=ssid, passphrase=passphrase)
1651 hapd0 = hostapd.add_ap(apdev[0], params)
1652 bssid0 = hapd0.own_addr()
1653
1654 dev[0].scan_for_bss(bssid0, freq="2412")
1655 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1656 scan_freq="2412")
1657
1658 params = ft_params2(ssid=ssid, passphrase=passphrase)
1659 hapd1 = hostapd.add_ap(apdev[1], params)
1660 bssid1 = hapd1.own_addr()
1661 dev[0].scan_for_bss(bssid1, freq="2412")
1662 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1663 # This will fail due to not being able to send out PMK-R1 pull request
1664 dev[0].roam(bssid1)
1665
1666def test_ap_ft_ap_oom4(dev, apdev):
1667 """WPA2-PSK-FT and AP OOM 4"""
1668 ssid = "test-ft"
1669 passphrase = "12345678"
1670
1671 params = ft_params1(ssid=ssid, passphrase=passphrase)
1672 hapd0 = hostapd.add_ap(apdev[0], params)
1673 bssid0 = hapd0.own_addr()
1674
1675 dev[0].scan_for_bss(bssid0, freq="2412")
1676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1677 scan_freq="2412")
1678
1679 params = ft_params2(ssid=ssid, passphrase=passphrase)
1680 hapd1 = hostapd.add_ap(apdev[1], params)
1681 bssid1 = hapd1.own_addr()
1682 dev[0].scan_for_bss(bssid1, freq="2412")
1683 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1684 dev[0].roam(bssid1)
1685 if dev[0].get_status_field('bssid') != bssid1:
1686 raise Exception("Did not roam to AP1")
1687
1688 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1689 dev[0].roam(bssid0)
1690 if dev[0].get_status_field('bssid') != bssid0:
1691 raise Exception("Did not roam to AP0")
1692
1693 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1694 dev[0].roam(bssid1)
1695 if dev[0].get_status_field('bssid') != bssid1:
1696 raise Exception("Did not roam to AP1")
1697
1698def test_ap_ft_ap_oom5(dev, apdev):
1699 """WPA2-PSK-FT and AP OOM 5"""
1700 ssid = "test-ft"
1701 passphrase = "12345678"
1702
1703 params = ft_params1(ssid=ssid, passphrase=passphrase)
1704 hapd0 = hostapd.add_ap(apdev[0], params)
1705 bssid0 = hapd0.own_addr()
1706
1707 dev[0].scan_for_bss(bssid0, freq="2412")
1708 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1709 scan_freq="2412")
1710
1711 params = ft_params2(ssid=ssid, passphrase=passphrase)
1712 hapd1 = hostapd.add_ap(apdev[1], params)
1713 bssid1 = hapd1.own_addr()
1714 dev[0].scan_for_bss(bssid1, freq="2412")
1715 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1716 # This will fail to roam
1717 dev[0].roam(bssid1)
1718
1719 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1720 # This will fail to roam
1721 dev[0].roam(bssid1)
1722
1723 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1724 # This will fail to roam
1725 dev[0].roam(bssid1)
1726
1727 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1728 # This will fail to roam
1729 dev[0].roam(bssid1)
1730
1731 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1732 # This will fail to roam
1733 dev[0].roam(bssid1)
1734
1735def test_ap_ft_ap_oom6(dev, apdev):
1736 """WPA2-PSK-FT and AP OOM 6"""
1737 ssid = "test-ft"
1738 passphrase = "12345678"
1739
1740 params = ft_params1(ssid=ssid, passphrase=passphrase)
1741 hapd0 = hostapd.add_ap(apdev[0], params)
1742 bssid0 = hapd0.own_addr()
1743
1744 dev[0].scan_for_bss(bssid0, freq="2412")
1745 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1746 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1747 scan_freq="2412")
1748 dev[0].request("REMOVE_NETWORK all")
1749 dev[0].wait_disconnected()
1750 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1751 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1752 scan_freq="2412")
1753 dev[0].request("REMOVE_NETWORK all")
1754 dev[0].wait_disconnected()
1755 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1756 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1757 scan_freq="2412")
1758
1759def test_ap_ft_ap_oom7a(dev, apdev):
1760 """WPA2-PSK-FT and AP OOM 7a"""
1761 ssid = "test-ft"
1762 passphrase = "12345678"
1763
1764 params = ft_params1(ssid=ssid, passphrase=passphrase)
1765 params["ieee80211w"] = "2"
1766 hapd0 = hostapd.add_ap(apdev[0], params)
1767 bssid0 = hapd0.own_addr()
1768
1769 dev[0].scan_for_bss(bssid0, freq="2412")
1770 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1771 ieee80211w="2", scan_freq="2412")
1772
1773 params = ft_params2(ssid=ssid, passphrase=passphrase)
1774 params["ieee80211w"] = "2"
1775 hapd1 = hostapd.add_ap(apdev[1], params)
1776 bssid1 = hapd1.own_addr()
1777 dev[0].scan_for_bss(bssid1, freq="2412")
1778 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1779 # This will fail to roam
1780 dev[0].roam(bssid1)
1781
1782def test_ap_ft_ap_oom7b(dev, apdev):
1783 """WPA2-PSK-FT and AP OOM 7b"""
1784 ssid = "test-ft"
1785 passphrase = "12345678"
1786
1787 params = ft_params1(ssid=ssid, passphrase=passphrase)
1788 params["ieee80211w"] = "2"
1789 hapd0 = hostapd.add_ap(apdev[0], params)
1790 bssid0 = hapd0.own_addr()
1791
1792 dev[0].scan_for_bss(bssid0, freq="2412")
1793 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1794 ieee80211w="2", scan_freq="2412")
1795
1796 params = ft_params2(ssid=ssid, passphrase=passphrase)
1797 params["ieee80211w"] = "2"
1798 hapd1 = hostapd.add_ap(apdev[1], params)
1799 bssid1 = hapd1.own_addr()
1800 dev[0].scan_for_bss(bssid1, freq="2412")
1801 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1802 # This will fail to roam
1803 dev[0].roam(bssid1)
1804
1805def test_ap_ft_ap_oom7c(dev, apdev):
1806 """WPA2-PSK-FT and AP OOM 7c"""
1807 ssid = "test-ft"
1808 passphrase = "12345678"
1809
1810 params = ft_params1(ssid=ssid, passphrase=passphrase)
1811 params["ieee80211w"] = "2"
1812 hapd0 = hostapd.add_ap(apdev[0], params)
1813 bssid0 = hapd0.own_addr()
1814
1815 dev[0].scan_for_bss(bssid0, freq="2412")
1816 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1817 ieee80211w="2", scan_freq="2412")
1818
1819 params = ft_params2(ssid=ssid, passphrase=passphrase)
1820 params["ieee80211w"] = "2"
1821 hapd1 = hostapd.add_ap(apdev[1], params)
1822 bssid1 = hapd1.own_addr()
1823 dev[0].scan_for_bss(bssid1, freq="2412")
1824 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1825 # This will fail to roam
1826 dev[0].roam(bssid1)
1827
1828def test_ap_ft_ap_oom7d(dev, apdev):
1829 """WPA2-PSK-FT and AP OOM 7d"""
1830 ssid = "test-ft"
1831 passphrase = "12345678"
1832
1833 params = ft_params1(ssid=ssid, passphrase=passphrase)
1834 params["ieee80211w"] = "2"
1835 hapd0 = hostapd.add_ap(apdev[0], params)
1836 bssid0 = hapd0.own_addr()
1837
1838 dev[0].scan_for_bss(bssid0, freq="2412")
1839 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1840 ieee80211w="2", scan_freq="2412")
1841
1842 params = ft_params2(ssid=ssid, passphrase=passphrase)
1843 params["ieee80211w"] = "2"
1844 hapd1 = hostapd.add_ap(apdev[1], params)
1845 bssid1 = hapd1.own_addr()
1846 dev[0].scan_for_bss(bssid1, freq="2412")
1847 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1848 # This will fail to roam
1849 dev[0].roam(bssid1)
1850
1851def test_ap_ft_ap_oom8(dev, apdev):
1852 """WPA2-PSK-FT and AP OOM 8"""
1853 ssid = "test-ft"
1854 passphrase = "12345678"
1855
1856 params = ft_params1(ssid=ssid, passphrase=passphrase)
1857 params['ft_psk_generate_local'] = "1"
1858 hapd0 = hostapd.add_ap(apdev[0], params)
1859 bssid0 = hapd0.own_addr()
1860
1861 dev[0].scan_for_bss(bssid0, freq="2412")
1862 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1863 scan_freq="2412")
1864
1865 params = ft_params2(ssid=ssid, passphrase=passphrase)
1866 params['ft_psk_generate_local'] = "1"
1867 hapd1 = hostapd.add_ap(apdev[1], params)
1868 bssid1 = hapd1.own_addr()
1869 dev[0].scan_for_bss(bssid1, freq="2412")
1870 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1871 # This will fail to roam
1872 dev[0].roam(bssid1)
1873 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1874 # This will fail to roam
1875 dev[0].roam(bssid1)
1876
1877def test_ap_ft_ap_oom9(dev, apdev):
1878 """WPA2-PSK-FT and AP OOM 9"""
1879 ssid = "test-ft"
1880 passphrase = "12345678"
1881
1882 params = ft_params1(ssid=ssid, passphrase=passphrase)
1883 hapd0 = hostapd.add_ap(apdev[0], params)
1884 bssid0 = hapd0.own_addr()
1885
1886 dev[0].scan_for_bss(bssid0, freq="2412")
1887 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1888 scan_freq="2412")
1889
1890 params = ft_params2(ssid=ssid, passphrase=passphrase)
1891 hapd1 = hostapd.add_ap(apdev[1], params)
1892 bssid1 = hapd1.own_addr()
1893 dev[0].scan_for_bss(bssid1, freq="2412")
1894
1895 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1896 # This will fail to roam
1897 if "OK" not in dev[0].request("FT_DS " + bssid1):
1898 raise Exception("FT_DS failed")
1899 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1900
1901 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1902 # This will fail to roam
1903 if "OK" not in dev[0].request("FT_DS " + bssid1):
1904 raise Exception("FT_DS failed")
1905 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1906
1907 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1908 # This will fail to roam
1909 if "OK" not in dev[0].request("FT_DS " + bssid1):
1910 raise Exception("FT_DS failed")
1911 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1912
1913def test_ap_ft_ap_oom10(dev, apdev):
1914 """WPA2-PSK-FT and AP OOM 10"""
1915 ssid = "test-ft"
1916 passphrase = "12345678"
1917
1918 params = ft_params1(ssid=ssid, passphrase=passphrase)
1919 hapd0 = hostapd.add_ap(apdev[0], params)
1920 bssid0 = hapd0.own_addr()
1921
1922 dev[0].scan_for_bss(bssid0, freq="2412")
1923 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1924 scan_freq="2412")
1925
1926 params = ft_params2(ssid=ssid, passphrase=passphrase)
1927 hapd1 = hostapd.add_ap(apdev[1], params)
1928 bssid1 = hapd1.own_addr()
1929 dev[0].scan_for_bss(bssid1, freq="2412")
1930
1931 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
1932 # This will fail to roam
1933 if "OK" not in dev[0].request("FT_DS " + bssid1):
1934 raise Exception("FT_DS failed")
1935 wait_fail_trigger(hapd0, "GET_FAIL")
1936
1937 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1938 # This will fail to roam
1939 if "OK" not in dev[0].request("FT_DS " + bssid1):
1940 raise Exception("FT_DS failed")
1941 wait_fail_trigger(hapd0, "GET_FAIL")
1942
1943 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
1944 # This will fail to roam
1945 if "OK" not in dev[0].request("FT_DS " + bssid1):
1946 raise Exception("FT_DS failed")
1947 wait_fail_trigger(hapd0, "GET_FAIL")
1948
1949 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
1950 # This will fail to roam
1951 if "OK" not in dev[0].request("FT_DS " + bssid1):
1952 raise Exception("FT_DS failed")
1953 wait_fail_trigger(hapd1, "GET_FAIL")
1954
1955def test_ap_ft_ap_oom11(dev, apdev):
1956 """WPA2-PSK-FT and AP OOM 11"""
1957 ssid = "test-ft"
1958 passphrase = "12345678"
1959
1960 params = ft_params1(ssid=ssid, passphrase=passphrase)
1961 hapd0 = hostapd.add_ap(apdev[0], params)
1962 bssid0 = hapd0.own_addr()
1963
1964 dev[0].scan_for_bss(bssid0, freq="2412")
1965 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1966 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1967 scan_freq="2412")
1968 wait_fail_trigger(hapd0, "GET_FAIL")
1969
1970 dev[1].scan_for_bss(bssid0, freq="2412")
1971 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
1972 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1973 scan_freq="2412")
1974 wait_fail_trigger(hapd0, "GET_FAIL")
1975
1976def test_ap_ft_over_ds_proto_ap(dev, apdev):
1977 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1978 ssid = "test-ft"
1979 passphrase = "12345678"
1980
1981 params = ft_params1(ssid=ssid, passphrase=passphrase)
1982 hapd0 = hostapd.add_ap(apdev[0], params)
1983 bssid0 = hapd0.own_addr()
1984 _bssid0 = bssid0.replace(':', '')
1985 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1986 scan_freq="2412")
1987 addr = dev[0].own_addr()
1988 _addr = addr.replace(':', '')
1989
1990 params = ft_params2(ssid=ssid, passphrase=passphrase)
1991 hapd1 = hostapd.add_ap(apdev[1], params)
1992 bssid1 = hapd1.own_addr()
1993 _bssid1 = bssid1.replace(':', '')
1994
1995 hapd0.set("ext_mgmt_frame_handling", "1")
1996 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1997 valid = "0601" + _addr + _bssid1
1998 tests = ["0601",
1999 "0601" + _addr,
2000 "0601" + _addr + _bssid0,
2001 "0601" + _addr + "ffffffffffff",
2002 "0601" + _bssid0 + _bssid0,
2003 valid,
2004 valid + "01",
2005 valid + "3700",
2006 valid + "3600",
2007 valid + "3603ffffff",
2008 valid + "3603a1b2ff",
2009 valid + "3603a1b2ff" + "3700",
2010 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2011 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2012 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2013 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2014 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2015 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2016 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2017 valid + "0001"]
2018 for t in tests:
2019 hapd0.dump_monitor()
2020 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2021 raise Exception("MGMT_RX_PROCESS failed")
2022
2023 hapd0.set("ext_mgmt_frame_handling", "0")
2024
2025def test_ap_ft_over_ds_proto(dev, apdev):
2026 """WPA2-PSK-FT AP over DS protocol testing"""
2027 ssid = "test-ft"
2028 passphrase = "12345678"
2029
2030 params = ft_params1(ssid=ssid, passphrase=passphrase)
2031 hapd0 = hostapd.add_ap(apdev[0], params)
2032 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2033 scan_freq="2412")
2034
2035 # FT Action Response while no FT-over-DS in progress
2036 msg = {}
2037 msg['fc'] = 13 << 4
2038 msg['da'] = dev[0].own_addr()
2039 msg['sa'] = apdev[0]['bssid']
2040 msg['bssid'] = apdev[0]['bssid']
2041 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2042 hapd0.mgmt_tx(msg)
2043
2044 params = ft_params2(ssid=ssid, passphrase=passphrase)
2045 hapd1 = hostapd.add_ap(apdev[1], params)
2046 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2047 hapd0.set("ext_mgmt_frame_handling", "1")
2048 hapd0.dump_monitor()
2049 dev[0].request("FT_DS " + apdev[1]['bssid'])
2050 for i in range(0, 10):
2051 req = hapd0.mgmt_rx()
2052 if req is None:
2053 raise Exception("MGMT RX wait timed out")
2054 if req['subtype'] == 13:
2055 break
2056 req = None
2057 if not req:
2058 raise Exception("FT Action frame not received")
2059
2060 # FT Action Response for unexpected Target AP
2061 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2062 hapd0.mgmt_tx(msg)
2063
2064 # FT Action Response without MDIE
2065 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2066 hapd0.mgmt_tx(msg)
2067
2068 # FT Action Response without FTIE
2069 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2070 hapd0.mgmt_tx(msg)
2071
2072 # FT Action Response with FTIE SNonce mismatch
2073 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2074 hapd0.mgmt_tx(msg)
2075
2076@remote_compatible
2077def test_ap_ft_rrb(dev, apdev):
2078 """WPA2-PSK-FT RRB protocol testing"""
2079 ssid = "test-ft"
2080 passphrase = "12345678"
2081
2082 params = ft_params1(ssid=ssid, passphrase=passphrase)
2083 hapd0 = hostapd.add_ap(apdev[0], params)
2084
2085 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2086 scan_freq="2412")
2087
2088 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':', ''))
2089 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':', ''))
2090 proto = b'\x89\x0d'
2091 ehdr = _dst_ll + _src_ll + proto
2092
2093 # Too short RRB frame
2094 pkt = ehdr + b'\x01'
2095 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2096 raise Exception("DATA_TEST_FRAME failed")
2097
2098 # RRB discarded frame wikth unrecognized type
2099 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
2100 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2101 raise Exception("DATA_TEST_FRAME failed")
2102
2103 # RRB frame too short for action frame
2104 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
2105 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2106 raise Exception("DATA_TEST_FRAME failed")
2107
2108 # Too short RRB frame (not enough room for Action Frame body)
2109 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
2110 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2111 raise Exception("DATA_TEST_FRAME failed")
2112
2113 # Unexpected Action frame category
2114 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2115 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2116 raise Exception("DATA_TEST_FRAME failed")
2117
2118 # Unexpected Action in RRB Request
2119 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2120 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2121 raise Exception("DATA_TEST_FRAME failed")
2122
2123 # Target AP address in RRB Request does not match with own address
2124 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2125 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2126 raise Exception("DATA_TEST_FRAME failed")
2127
2128 # Not enough room for status code in RRB Response
2129 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2130 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2131 raise Exception("DATA_TEST_FRAME failed")
2132
2133 # RRB discarded frame with unknown packet_type
2134 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2135 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2136 raise Exception("DATA_TEST_FRAME failed")
2137
2138 # RRB Response with non-zero status code; no STA match
2139 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
2140 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2141 raise Exception("DATA_TEST_FRAME failed")
2142
2143 # RRB Response with zero status code and extra data; STA match
2144 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
2145 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2146 raise Exception("DATA_TEST_FRAME failed")
2147
2148 # Too short PMK-R1 pull
2149 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2150 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2151 raise Exception("DATA_TEST_FRAME failed")
2152
2153 # Too short PMK-R1 resp
2154 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2155 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2156 raise Exception("DATA_TEST_FRAME failed")
2157
2158 # Too short PMK-R1 push
2159 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2160 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2161 raise Exception("DATA_TEST_FRAME failed")
2162
2163 # No matching R0KH address found for PMK-R0 pull response
2164 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
2165 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
2166 raise Exception("DATA_TEST_FRAME failed")
2167
2168@remote_compatible
2169def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2170 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2171 bssid = apdev[0]['bssid']
2172 ssid = "test-ft"
2173 passphrase = "12345678"
2174
2175 params = ft_params1(ssid=ssid, passphrase=passphrase)
2176 params["ieee80211w"] = "1"
2177 # This is the RSN element used normally by hostapd
2178 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
2179 hapd = hostapd.add_ap(apdev[0], params)
2180 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2181 ieee80211w="1", scan_freq="2412",
2182 pairwise="CCMP", group="CCMP")
2183
2184 tests = [('PMKIDCount field included',
2185 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2186 ('Extra IE before RSNE',
2187 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2188 ('PMKIDCount and Group Management Cipher suite fields included',
2189 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2190 ('Extra octet after defined fields (future extensibility)',
2191 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2192 ('No RSN Capabilities field (PMF disabled in practice)',
2193 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2194 for txt, ie in tests:
2195 dev[0].request("DISCONNECT")
2196 dev[0].wait_disconnected()
2197 logger.info(txt)
2198 hapd.disable()
2199 hapd.set('own_ie_override', ie)
2200 hapd.enable()
2201 dev[0].request("BSS_FLUSH 0")
2202 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2203 dev[0].select_network(id, freq=2412)
2204 dev[0].wait_connected()
2205
2206 dev[0].request("DISCONNECT")
2207 dev[0].wait_disconnected()
2208
2209 logger.info('Invalid RSNE causing internal hostapd error')
2210 hapd.disable()
2211 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2212 hapd.enable()
2213 dev[0].request("BSS_FLUSH 0")
2214 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2215 dev[0].select_network(id, freq=2412)
2216 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2217 # complete.
2218 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2219 if ev is not None:
2220 raise Exception("Unexpected connection")
2221 dev[0].request("DISCONNECT")
2222
2223 logger.info('Unexpected PMKID causing internal hostapd error')
2224 hapd.disable()
2225 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2226 hapd.enable()
2227 dev[0].request("BSS_FLUSH 0")
2228 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2229 dev[0].select_network(id, freq=2412)
2230 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2231 # complete.
2232 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2233 if ev is not None:
2234 raise Exception("Unexpected connection")
2235 dev[0].request("DISCONNECT")
2236
2237def test_ap_ft_ptk_rekey(dev, apdev):
2238 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2239 ssid = "test-ft"
2240 passphrase = "12345678"
2241
2242 params = ft_params1(ssid=ssid, passphrase=passphrase)
2243 hapd0 = hostapd.add_ap(apdev[0], params)
2244 params = ft_params2(ssid=ssid, passphrase=passphrase)
2245 hapd1 = hostapd.add_ap(apdev[1], params)
2246
2247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2248
2249 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2250 "WPA: Key negotiation completed"], timeout=5)
2251 if ev is None:
2252 raise Exception("No event received after roam")
2253 if "CTRL-EVENT-DISCONNECTED" in ev:
2254 raise Exception("Unexpected disconnection after roam")
2255
2256 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2257 hapd = hapd0
2258 else:
2259 hapd = hapd1
2260 hwsim_utils.test_connectivity(dev[0], hapd)
2261
2262def test_ap_ft_ptk_rekey_ap(dev, apdev):
2263 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2264 ssid = "test-ft"
2265 passphrase = "12345678"
2266
2267 params = ft_params1(ssid=ssid, passphrase=passphrase)
2268 params['wpa_ptk_rekey'] = '2'
2269 hapd0 = hostapd.add_ap(apdev[0], params)
2270 params = ft_params2(ssid=ssid, passphrase=passphrase)
2271 params['wpa_ptk_rekey'] = '2'
2272 hapd1 = hostapd.add_ap(apdev[1], params)
2273
2274 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2275
2276 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2277 "WPA: Key negotiation completed"], timeout=5)
2278 if ev is None:
2279 raise Exception("No event received after roam")
2280 if "CTRL-EVENT-DISCONNECTED" in ev:
2281 raise Exception("Unexpected disconnection after roam")
2282
2283 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2284 hapd = hapd0
2285 else:
2286 hapd = hapd1
2287 hwsim_utils.test_connectivity(dev[0], hapd)
2288
2289def test_ap_ft_internal_rrb_check(dev, apdev):
2290 """RRB internal delivery only to WPA enabled BSS"""
2291 ssid = "test-ft"
2292 passphrase = "12345678"
2293
2294 radius = hostapd.radius_params()
2295 params = ft_params1(ssid=ssid, passphrase=passphrase)
2296 params['wpa_key_mgmt'] = "FT-EAP"
2297 params["ieee8021x"] = "1"
2298 params = dict(list(radius.items()) + list(params.items()))
2299 hapd = hostapd.add_ap(apdev[0], params)
2300 key_mgmt = hapd.get_config()['key_mgmt']
2301 if key_mgmt.split(' ')[0] != "FT-EAP":
2302 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2303
2304 hapd1 = hostapd.add_ap(apdev[1], {"ssid": ssid})
2305
2306 # Connect to WPA enabled AP
2307 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2308 eap="GPSK", identity="gpsk user",
2309 password="abcdefghijklmnop0123456789abcdef",
2310 scan_freq="2412")
2311
2312 # Try over_ds roaming to non-WPA-enabled AP.
2313 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2314 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
2315
2316def test_ap_ft_extra_ie(dev, apdev):
2317 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2318 ssid = "test-ft"
2319 passphrase = "12345678"
2320
2321 params = ft_params1(ssid=ssid, passphrase=passphrase)
2322 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2323 hapd0 = hostapd.add_ap(apdev[0], params)
2324 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2325 scan_freq="2412")
2326 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2327 scan_freq="2412")
2328 try:
2329 # Add Mobility Domain element to test AP validation code.
2330 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2331 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2332 scan_freq="2412", wait_connect=False)
2333 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2334 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2335 if ev is None:
2336 raise Exception("No connection result")
2337 if "CTRL-EVENT-CONNECTED" in ev:
2338 raise Exception("Non-FT association accepted with MDE")
2339 if "status_code=43" not in ev:
2340 raise Exception("Unexpected status code: " + ev)
2341 dev[0].request("DISCONNECT")
2342 finally:
2343 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
2344
2345def test_ap_ft_ric(dev, apdev):
2346 """WPA2-PSK-FT AP and RIC"""
2347 ssid = "test-ft"
2348 passphrase = "12345678"
2349
2350 params = ft_params1(ssid=ssid, passphrase=passphrase)
2351 hapd0 = hostapd.add_ap(apdev[0], params)
2352 params = ft_params2(ssid=ssid, passphrase=passphrase)
2353 hapd1 = hostapd.add_ap(apdev[1], params)
2354
2355 dev[0].set("ric_ies", "")
2356 dev[0].set("ric_ies", '""')
2357 if "FAIL" not in dev[0].request("SET ric_ies q"):
2358 raise Exception("Invalid ric_ies value accepted")
2359
2360 tests = ["3900",
2361 "3900ff04eeeeeeee",
2362 "390400000000",
2363 "390400000000" + "390400000000",
2364 "390400000000" + "dd050050f20202",
2365 "390400000000" + "dd3d0050f2020201" + 55*"00",
2366 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2367 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
2368 for t in tests:
2369 dev[0].set("ric_ies", t)
2370 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2371 test_connectivity=False)
2372 dev[0].request("REMOVE_NETWORK all")
2373 dev[0].wait_disconnected()
2374 dev[0].dump_monitor()
2375
2376def ie_hex(ies, id):
2377 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
2378
2379def test_ap_ft_reassoc_proto(dev, apdev):
2380 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2381 ssid = "test-ft"
2382 passphrase = "12345678"
2383
2384 params = ft_params1(ssid=ssid, passphrase=passphrase)
2385 hapd0 = hostapd.add_ap(apdev[0], params)
2386 params = ft_params2(ssid=ssid, passphrase=passphrase)
2387 hapd1 = hostapd.add_ap(apdev[1], params)
2388
2389 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2390 ieee80211w="1", scan_freq="2412")
2391 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2392 hapd1ap = hapd0
2393 hapd2ap = hapd1
2394 else:
2395 hapd1ap = hapd1
2396 hapd2ap = hapd0
2397
2398 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2399 hapd2ap.set("ext_mgmt_frame_handling", "1")
2400 dev[0].request("ROAM " + hapd2ap.own_addr())
2401
2402 while True:
2403 req = hapd2ap.mgmt_rx()
2404 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
2405 if req['subtype'] == 11:
2406 break
2407
2408 while True:
2409 req = hapd2ap.mgmt_rx()
2410 if req['subtype'] == 2:
2411 break
2412 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
2413
2414 # IEEE 802.11 header + fixed fields before IEs
2415 hdr = binascii.hexlify(req['frame'][0:34]).decode()
2416 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2417 # First elements: SSID, Supported Rates, Extended Supported Rates
2418 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2419
2420 rsne = ie_hex(ies, 48)
2421 mde = ie_hex(ies, 54)
2422 fte = ie_hex(ies, 55)
2423 tests = []
2424 # RSN: Trying to use FT, but MDIE not included
2425 tests += [rsne]
2426 # RSN: Attempted to use unknown MDIE
2427 tests += [rsne + "3603000000"]
2428 # Invalid RSN pairwise cipher
2429 tests += ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
2430 # FT: No PMKID in RSNIE
2431 tests += ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54)]
2432 # FT: Invalid FTIE
2433 tests += [rsne + mde]
2434 # FT: RIC IE(s) in the frame, but not included in protected IE count
2435 # FT: Failed to parse FT IEs
2436 tests += [rsne + mde + fte + "3900"]
2437 # FT: SNonce mismatch in FTIE
2438 tests += [rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00"]
2439 # FT: ANonce mismatch in FTIE
2440 tests += [rsne + mde + fte[0:40] + 32*"00" + fte[104:]]
2441 # FT: No R0KH-ID subelem in FTIE
2442 tests += [rsne + mde + "3752" + fte[4:168]]
2443 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2444 tests += [rsne + mde + "3755" + fte[4:168] + "0301ff"]
2445 # FT: No R1KH-ID subelem in FTIE
2446 tests += [rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode()]
2447 # FT: Unknown R1KH-ID used in ReassocReq
2448 tests += [rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000"]
2449 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2450 tests += [rsne[:-32] + 16*"00" + mde + fte]
2451 # Invalid MIC in FTIE
2452 tests += [rsne + mde + fte[0:8] + 16*"00" + fte[40:]]
2453 for t in tests:
2454 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2455
2456def test_ap_ft_reassoc_local_fail(dev, apdev):
2457 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2458 ssid = "test-ft"
2459 passphrase = "12345678"
2460
2461 params = ft_params1(ssid=ssid, passphrase=passphrase)
2462 hapd0 = hostapd.add_ap(apdev[0], params)
2463 params = ft_params2(ssid=ssid, passphrase=passphrase)
2464 hapd1 = hostapd.add_ap(apdev[1], params)
2465
2466 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2467 ieee80211w="1", scan_freq="2412")
2468 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2469 hapd1ap = hapd0
2470 hapd2ap = hapd1
2471 else:
2472 hapd1ap = hapd1
2473 hapd2ap = hapd0
2474
2475 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2476 # FT: Failed to calculate MIC
2477 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2478 dev[0].request("ROAM " + hapd2ap.own_addr())
2479 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2480 dev[0].request("DISCONNECT")
2481 if ev is None:
2482 raise Exception("Association reject not seen")
2483
2484def test_ap_ft_reassoc_replay(dev, apdev, params):
2485 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2486 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2487 ssid = "test-ft"
2488 passphrase = "12345678"
2489
2490 params = ft_params1(ssid=ssid, passphrase=passphrase)
2491 hapd0 = hostapd.add_ap(apdev[0], params)
2492 params = ft_params2(ssid=ssid, passphrase=passphrase)
2493 hapd1 = hostapd.add_ap(apdev[1], params)
2494
2495 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2496 scan_freq="2412")
2497 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2498 hapd1ap = hapd0
2499 hapd2ap = hapd1
2500 else:
2501 hapd1ap = hapd1
2502 hapd2ap = hapd0
2503
2504 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2505 hapd2ap.set("ext_mgmt_frame_handling", "1")
2506 dev[0].dump_monitor()
2507 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2508 raise Exception("ROAM failed")
2509
2510 reassocreq = None
2511 count = 0
2512 while count < 100:
2513 req = hapd2ap.mgmt_rx()
2514 count += 1
2515 hapd2ap.dump_monitor()
2516 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
2517 if req['subtype'] == 2:
2518 reassocreq = req
2519 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2520 if ev is None:
2521 raise Exception("No TX status seen")
2522 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2523 if "OK" not in hapd2ap.request(cmd):
2524 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2525 break
2526 hapd2ap.set("ext_mgmt_frame_handling", "0")
2527 if reassocreq is None:
2528 raise Exception("No Reassociation Request frame seen")
2529 dev[0].wait_connected()
2530 dev[0].dump_monitor()
2531 hapd2ap.dump_monitor()
2532
2533 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2534
2535 logger.info("Replay the last Reassociation Request frame")
2536 hapd2ap.dump_monitor()
2537 hapd2ap.set("ext_mgmt_frame_handling", "1")
2538 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
2539 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2540 if ev is None:
2541 raise Exception("No TX status seen")
2542 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2543 if "OK" not in hapd2ap.request(cmd):
2544 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2545 hapd2ap.set("ext_mgmt_frame_handling", "0")
2546
2547 try:
2548 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2549 ok = True
2550 except:
2551 ok = False
2552
2553 ap = hapd2ap.own_addr()
2554 sta = dev[0].own_addr()
2555 filt = "wlan.fc.type == 2 && " + \
2556 "wlan.da == " + sta + " && " + \
2557 "wlan.sa == " + ap
2558 fields = ["wlan.ccmp.extiv"]
2559 res = run_tshark(capfile, filt, fields)
2560 vals = res.splitlines()
2561 logger.info("CCMP PN: " + str(vals))
2562 if len(vals) < 2:
2563 raise Exception("Could not find all CCMP protected frames from capture")
2564 if len(set(vals)) < len(vals):
2565 raise Exception("Duplicate CCMP PN used")
2566
2567 if not ok:
2568 raise Exception("The second hwsim connectivity test failed")
2569
2570def test_ap_ft_psk_file(dev, apdev):
2571 """WPA2-PSK-FT AP with PSK from a file"""
2572 ssid = "test-ft"
2573 passphrase = "12345678"
2574
2575 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2576 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2577 hapd = hostapd.add_ap(apdev[0], params)
2578
2579 dev[1].connect(ssid, psk="very secret",
2580 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2581 scan_freq="2412", wait_connect=False)
2582 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2583 ieee80211w="1", scan_freq="2412")
2584 dev[0].request("REMOVE_NETWORK all")
2585 dev[0].wait_disconnected()
2586 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2587 ieee80211w="1", scan_freq="2412")
2588 dev[0].request("REMOVE_NETWORK all")
2589 dev[0].wait_disconnected()
2590 dev[0].connect(ssid, psk="secret passphrase",
2591 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2592 scan_freq="2412")
2593 dev[2].connect(ssid, psk="another passphrase for all STAs",
2594 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2595 scan_freq="2412")
2596 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2597 if ev is None:
2598 raise Exception("Timed out while waiting for failure report")
2599 dev[1].request("REMOVE_NETWORK all")
2600
2601def test_ap_ft_eap_ap_config_change(dev, apdev):
2602 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2603 ssid = "test-ft"
2604 passphrase = "12345678"
2605 bssid = apdev[0]['bssid']
2606
2607 radius = hostapd.radius_params()
2608 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2609 params['wpa_key_mgmt'] = "WPA-EAP"
2610 params["ieee8021x"] = "1"
2611 params["pmk_r1_push"] = "0"
2612 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2613 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2614 params["eap_server"] = "0"
2615 params = dict(list(radius.items()) + list(params.items()))
2616 hapd = hostapd.add_ap(apdev[0], params)
2617
2618 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2619 eap="GPSK", identity="gpsk user",
2620 password="abcdefghijklmnop0123456789abcdef",
2621 scan_freq="2412")
2622 dev[0].request("DISCONNECT")
2623 dev[0].wait_disconnected()
2624 dev[0].dump_monitor()
2625
2626 hapd.disable()
2627 hapd.set('wpa_key_mgmt', "FT-EAP")
2628 hapd.enable()
2629
2630 dev[0].request("BSS_FLUSH 0")
2631 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2632
2633 dev[0].request("RECONNECT")
2634 dev[0].wait_connected()
2635
2636def test_ap_ft_eap_sha384(dev, apdev):
2637 """WPA2-EAP-FT with SHA384"""
2638 ssid = "test-ft"
2639 passphrase = "12345678"
2640
2641 radius = hostapd.radius_params()
2642 params = ft_params1(ssid=ssid, passphrase=passphrase)
2643 params["ieee80211w"] = "2"
2644 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2645 params["ieee8021x"] = "1"
2646 params = dict(list(radius.items()) + list(params.items()))
2647 hapd0 = hostapd.add_ap(apdev[0], params)
2648 params = ft_params2(ssid=ssid, passphrase=passphrase)
2649 params["ieee80211w"] = "2"
2650 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2651 params["ieee8021x"] = "1"
2652 params = dict(list(radius.items()) + list(params.items()))
2653 hapd1 = hostapd.add_ap(apdev[1], params)
2654
2655 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2656 sha384=True)
2657
2658def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2659 """WPA2-EAP-FT with SHA384 over DS"""
2660 ssid = "test-ft"
2661 passphrase = "12345678"
2662
2663 radius = hostapd.radius_params()
2664 params = ft_params1(ssid=ssid, passphrase=passphrase)
2665 params["ieee80211w"] = "2"
2666 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2667 params["ieee8021x"] = "1"
2668 params = dict(list(radius.items()) + list(params.items()))
2669 hapd0 = hostapd.add_ap(apdev[0], params)
2670 params = ft_params2(ssid=ssid, passphrase=passphrase)
2671 params["ieee80211w"] = "2"
2672 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2673 params["ieee8021x"] = "1"
2674 params = dict(list(radius.items()) + list(params.items()))
2675 hapd1 = hostapd.add_ap(apdev[1], params)
2676
2677 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2678 eap=True, sha384=True)
2679
2680def test_ap_ft_roam_rrm(dev, apdev):
2681 """WPA2-PSK-FT AP and radio measurement request"""
2682 ssid = "test-ft"
2683 passphrase = "12345678"
2684
2685 params = ft_params1(ssid=ssid, passphrase=passphrase)
2686 params["rrm_beacon_report"] = "1"
2687 hapd0 = hostapd.add_ap(apdev[0], params)
2688 bssid0 = hapd0.own_addr()
2689
2690 addr = dev[0].own_addr()
2691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2692 scan_freq="2412")
2693 check_beacon_req(hapd0, addr, 1)
2694
2695 params = ft_params2(ssid=ssid, passphrase=passphrase)
2696 params["rrm_beacon_report"] = "1"
2697 hapd1 = hostapd.add_ap(apdev[1], params)
2698 bssid1 = hapd1.own_addr()
2699
2700 dev[0].scan_for_bss(bssid1, freq=2412)
2701 dev[0].roam(bssid1)
2702 check_beacon_req(hapd1, addr, 2)
2703
2704 dev[0].scan_for_bss(bssid0, freq=2412)
2705 dev[0].roam(bssid0)
2706 check_beacon_req(hapd0, addr, 3)
Unnamed repository; edit this file 'description' to name the repository.