]>
git.ipfire.org Git - thirdparty/hostap.git/blob - tests/hwsim/test_ap_ft.py
52f4e6c296876c5cea004e6bd2776b08fc75ec73
1 # Fast BSS Transition tests
2 # Copyright (c) 2013-2017, Jouni Malinen <j@w1.fi>
4 # This software may be distributed under the terms of the BSD license.
5 # See README for more details.
7 from remotehost
import remote_compatible
12 logger
= logging
.getLogger()
17 from utils
import HwsimSkip
, alloc_fail
, fail_test
, wait_fail_trigger
, skip_with_fips
, parse_ie
18 from wlantest
import Wlantest
19 from test_ap_psk
import check_mib
, find_wpas_process
, read_process_memory
, verify_not_present
, get_key_locations
22 params
= { "wpa": "2",
23 "wpa_key_mgmt": "FT-PSK",
24 "rsn_pairwise": "CCMP" }
28 params
= { "wpa": "3",
29 "wpa_key_mgmt": "WPA-PSK FT-PSK",
30 "wpa_pairwise": "TKIP",
31 "rsn_pairwise": "CCMP" }
34 def ft_params(rsn
=True, ssid
=None, passphrase
=None):
36 params
= ft_base_rsn()
38 params
= ft_base_mixed()
42 params
["wpa_passphrase"] = passphrase
44 params
["mobility_domain"] = "a1b2"
45 params
["r0_key_lifetime"] = "10000"
46 params
["pmk_r1_push"] = "1"
47 params
["reassociation_deadline"] = "1000"
50 def ft_params1a(rsn
=True, ssid
=None, passphrase
=None):
51 params
= ft_params(rsn
, ssid
, passphrase
)
52 params
['nas_identifier'] = "nas1.w1.fi"
53 params
['r1_key_holder'] = "000102030405"
56 def ft_params1(rsn
=True, ssid
=None, passphrase
=None):
57 params
= ft_params1a(rsn
, ssid
, passphrase
)
58 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
59 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
60 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
63 def ft_params1_old_key(rsn
=True, ssid
=None, passphrase
=None):
64 params
= ft_params1a(rsn
, ssid
, passphrase
)
65 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
66 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
67 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
70 def ft_params2a(rsn
=True, ssid
=None, passphrase
=None):
71 params
= ft_params(rsn
, ssid
, passphrase
)
72 params
['nas_identifier'] = "nas2.w1.fi"
73 params
['r1_key_holder'] = "000102030406"
76 def ft_params2(rsn
=True, ssid
=None, passphrase
=None):
77 params
= ft_params2a(rsn
, ssid
, passphrase
)
78 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
79 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
80 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
83 def ft_params2_old_key(rsn
=True, ssid
=None, passphrase
=None):
84 params
= ft_params2a(rsn
, ssid
, passphrase
)
85 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
86 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
87 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
90 def ft_params1_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
91 params
= ft_params(rsn
, ssid
, passphrase
)
92 params
['nas_identifier'] = "nas1.w1.fi"
93 params
['r1_key_holder'] = "000102030405"
94 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
95 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
96 params
['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
99 def ft_params2_incorrect_rrb_key(rsn
=True, ssid
=None, passphrase
=None):
100 params
= ft_params(rsn
, ssid
, passphrase
)
101 params
['nas_identifier'] = "nas2.w1.fi"
102 params
['r1_key_holder'] = "000102030406"
103 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
104 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
105 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
108 def ft_params2_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
109 params
= ft_params(rsn
, ssid
, passphrase
)
110 params
['nas_identifier'] = "nas2.w1.fi"
111 params
['r1_key_holder'] = "000102030406"
112 params
['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
113 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
114 params
['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
117 def run_roams(dev
, apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=False,
118 sae
=False, eap
=False, fail_test
=False, roams
=1,
119 pairwise_cipher
="CCMP", group_cipher
="TKIP CCMP", ptk_rekey
="0",
120 test_connectivity
=True):
121 logger
.info("Connect to first AP")
123 dev
.connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
124 eap
="GPSK", identity
="gpsk user",
125 password
="abcdefghijklmnop0123456789abcdef",
127 pairwise
=pairwise_cipher
, group
=group_cipher
,
128 wpa_ptk_rekey
=ptk_rekey
)
134 dev
.connect(ssid
, psk
=passphrase
, key_mgmt
=key_mgmt
, proto
="WPA2",
135 ieee80211w
="1", scan_freq
="2412",
136 pairwise
=pairwise_cipher
, group
=group_cipher
,
137 wpa_ptk_rekey
=ptk_rekey
)
138 if dev
.get_status_field('bssid') == apdev
[0]['bssid']:
148 if test_connectivity
:
149 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
151 dev
.scan_for_bss(ap2
['bssid'], freq
="2412")
153 for i
in range(0, roams
):
154 logger
.info("Roam to the second AP")
156 dev
.roam_over_ds(ap2
['bssid'], fail_test
=fail_test
)
158 dev
.roam(ap2
['bssid'], fail_test
=fail_test
)
161 if dev
.get_status_field('bssid') != ap2
['bssid']:
162 raise Exception("Did not connect to correct AP")
163 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
164 hwsim_utils
.test_connectivity(dev
, hapd2ap
)
166 logger
.info("Roam back to the first AP")
168 dev
.roam_over_ds(ap1
['bssid'])
170 dev
.roam(ap1
['bssid'])
171 if dev
.get_status_field('bssid') != ap1
['bssid']:
172 raise Exception("Did not connect to correct AP")
173 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
174 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
176 def test_ap_ft(dev
, apdev
):
179 passphrase
="12345678"
181 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
182 hapd0
= hostapd
.add_ap(apdev
[0], params
)
183 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
184 hapd1
= hostapd
.add_ap(apdev
[1], params
)
186 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
187 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
188 raise Exception("Scan results missing RSN element info")
190 def test_ap_ft_old_key(dev
, apdev
):
191 """WPA2-PSK-FT AP (old key)"""
193 passphrase
="12345678"
195 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
196 hapd0
= hostapd
.add_ap(apdev
[0], params
)
197 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
198 hapd1
= hostapd
.add_ap(apdev
[1], params
)
200 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
202 def test_ap_ft_multi_akm(dev
, apdev
):
203 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
205 passphrase
="12345678"
207 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
208 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
209 hapd0
= hostapd
.add_ap(apdev
[0], params
)
210 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
211 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
212 hapd1
= hostapd
.add_ap(apdev
[1], params
)
214 Wlantest
.setup(hapd0
)
217 wt
.add_passphrase(passphrase
)
219 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
220 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
221 raise Exception("Scan results missing RSN element info")
222 dev
[1].connect(ssid
, psk
=passphrase
, scan_freq
="2412")
223 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK-SHA256",
226 def test_ap_ft_local_key_gen(dev
, apdev
):
227 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
229 passphrase
="12345678"
231 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
232 params
['ft_psk_generate_local'] = "1";
233 del params
['pmk_r1_push']
234 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
235 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
236 params
['ft_psk_generate_local'] = "1";
237 del params
['pmk_r1_push']
238 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
240 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
241 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
242 raise Exception("Scan results missing RSN element info")
244 def test_ap_ft_many(dev
, apdev
):
245 """WPA2-PSK-FT AP multiple times"""
247 passphrase
="12345678"
249 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
250 hapd0
= hostapd
.add_ap(apdev
[0], params
)
251 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
252 hapd1
= hostapd
.add_ap(apdev
[1], params
)
254 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50)
256 def test_ap_ft_mixed(dev
, apdev
):
257 """WPA2-PSK-FT mixed-mode AP"""
258 ssid
= "test-ft-mixed"
259 passphrase
="12345678"
261 params
= ft_params1(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
262 hapd
= hostapd
.add_ap(apdev
[0], params
)
263 key_mgmt
= hapd
.get_config()['key_mgmt']
264 vals
= key_mgmt
.split(' ')
265 if vals
[0] != "WPA-PSK" or vals
[1] != "FT-PSK":
266 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
267 params
= ft_params2(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
268 hapd1
= hostapd
.add_ap(apdev
[1], params
)
270 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
)
272 def test_ap_ft_pmf(dev
, apdev
):
273 """WPA2-PSK-FT AP with PMF"""
275 passphrase
="12345678"
277 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
278 params
["ieee80211w"] = "2"
279 hapd0
= hostapd
.add_ap(apdev
[0], params
)
280 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
281 params
["ieee80211w"] = "2"
282 hapd1
= hostapd
.add_ap(apdev
[1], params
)
284 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
286 def test_ap_ft_over_ds(dev
, apdev
):
287 """WPA2-PSK-FT AP over DS"""
289 passphrase
="12345678"
291 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
292 hapd0
= hostapd
.add_ap(apdev
[0], params
)
293 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
294 hapd1
= hostapd
.add_ap(apdev
[1], params
)
296 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
297 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
298 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
300 def test_ap_ft_over_ds_disabled(dev
, apdev
):
301 """WPA2-PSK-FT AP over DS disabled"""
303 passphrase
="12345678"
305 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
306 params
['ft_over_ds'] = '0'
307 hapd0
= hostapd
.add_ap(apdev
[0], params
)
308 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
309 params
['ft_over_ds'] = '0'
310 hapd1
= hostapd
.add_ap(apdev
[1], params
)
312 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
315 def test_ap_ft_over_ds_many(dev
, apdev
):
316 """WPA2-PSK-FT AP over DS multiple times"""
318 passphrase
="12345678"
320 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
321 hapd0
= hostapd
.add_ap(apdev
[0], params
)
322 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
323 hapd1
= hostapd
.add_ap(apdev
[1], params
)
325 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
329 def test_ap_ft_over_ds_unknown_target(dev
, apdev
):
332 passphrase
="12345678"
334 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
335 hapd0
= hostapd
.add_ap(apdev
[0], params
)
337 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
339 dev
[0].roam_over_ds("02:11:22:33:44:55", fail_test
=True)
342 def test_ap_ft_over_ds_unexpected(dev
, apdev
):
343 """WPA2-PSK-FT AP over DS and unexpected response"""
345 passphrase
="12345678"
347 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
348 hapd0
= hostapd
.add_ap(apdev
[0], params
)
349 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
350 hapd1
= hostapd
.add_ap(apdev
[1], params
)
352 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
354 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
365 addr
= dev
[0].own_addr()
366 hapd1ap
.set("ext_mgmt_frame_handling", "1")
367 logger
.info("Foreign STA address")
371 msg
['sa'] = ap1
['bssid']
372 msg
['bssid'] = ap1
['bssid']
373 msg
['payload'] = binascii
.unhexlify("06021122334455660102030405060000")
376 logger
.info("No over-the-DS in progress")
377 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
380 logger
.info("Non-zero status code")
381 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060100")
384 hapd1ap
.dump_monitor()
386 dev
[0].scan_for_bss(ap2
['bssid'], freq
="2412")
387 if "OK" not in dev
[0].request("FT_DS " + ap2
['bssid']):
388 raise Exception("FT_DS failed")
390 req
= hapd1ap
.mgmt_rx()
392 logger
.info("Foreign Target AP")
393 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
396 addrs
= addr
.replace(':', '') + ap2
['bssid'].replace(':', '')
398 logger
.info("No IEs")
399 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "0000")
402 logger
.info("Invalid IEs (trigger parsing failure)")
403 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003700")
406 logger
.info("Too short MDIE")
407 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "000036021122")
410 logger
.info("Mobility domain mismatch")
411 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603112201")
414 logger
.info("No FTIE")
415 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201")
418 logger
.info("FTIE SNonce mismatch")
419 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
422 logger
.info("No R0KH-ID subelem in FTIE")
423 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
424 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
)
427 logger
.info("No R0KH-ID subelem mismatch in FTIE")
428 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
429 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a11223344556677889900")
432 logger
.info("No R1KH-ID subelem in FTIE")
433 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
434 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
)
437 logger
.info("No RSNE")
438 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
439 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
+ "0106000102030405")
442 def test_ap_ft_pmf_over_ds(dev
, apdev
):
443 """WPA2-PSK-FT AP over DS with PMF"""
445 passphrase
="12345678"
447 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
448 params
["ieee80211w"] = "2"
449 hapd0
= hostapd
.add_ap(apdev
[0], params
)
450 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
451 params
["ieee80211w"] = "2"
452 hapd1
= hostapd
.add_ap(apdev
[1], params
)
454 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
456 def test_ap_ft_over_ds_pull(dev
, apdev
):
457 """WPA2-PSK-FT AP over DS (pull PMK)"""
459 passphrase
="12345678"
461 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
462 params
["pmk_r1_push"] = "0"
463 hapd0
= hostapd
.add_ap(apdev
[0], params
)
464 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
465 params
["pmk_r1_push"] = "0"
466 hapd1
= hostapd
.add_ap(apdev
[1], params
)
468 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
470 def test_ap_ft_over_ds_pull_old_key(dev
, apdev
):
471 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
473 passphrase
="12345678"
475 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
476 params
["pmk_r1_push"] = "0"
477 hapd0
= hostapd
.add_ap(apdev
[0], params
)
478 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
479 params
["pmk_r1_push"] = "0"
480 hapd1
= hostapd
.add_ap(apdev
[1], params
)
482 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
484 def test_ap_ft_sae(dev
, apdev
):
485 """WPA2-PSK-FT-SAE AP"""
486 if "SAE" not in dev
[0].get_capability("auth_alg"):
487 raise HwsimSkip("SAE not supported")
489 passphrase
="12345678"
491 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
492 params
['wpa_key_mgmt'] = "FT-SAE"
493 hapd0
= hostapd
.add_ap(apdev
[0], params
)
494 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
495 params
['wpa_key_mgmt'] = "FT-SAE"
496 hapd
= hostapd
.add_ap(apdev
[1], params
)
497 key_mgmt
= hapd
.get_config()['key_mgmt']
498 if key_mgmt
.split(' ')[0] != "FT-SAE":
499 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
501 dev
[0].request("SET sae_groups ")
502 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True)
504 def test_ap_ft_sae_over_ds(dev
, apdev
):
505 """WPA2-PSK-FT-SAE AP over DS"""
506 if "SAE" not in dev
[0].get_capability("auth_alg"):
507 raise HwsimSkip("SAE not supported")
509 passphrase
="12345678"
511 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
512 params
['wpa_key_mgmt'] = "FT-SAE"
513 hapd0
= hostapd
.add_ap(apdev
[0], params
)
514 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
515 params
['wpa_key_mgmt'] = "FT-SAE"
516 hapd1
= hostapd
.add_ap(apdev
[1], params
)
518 dev
[0].request("SET sae_groups ")
519 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, sae
=True,
522 def test_ap_ft_eap(dev
, apdev
):
525 passphrase
="12345678"
527 radius
= hostapd
.radius_params()
528 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
529 params
['wpa_key_mgmt'] = "FT-EAP"
530 params
["ieee8021x"] = "1"
531 params
= dict(radius
.items() + params
.items())
532 hapd
= hostapd
.add_ap(apdev
[0], params
)
533 key_mgmt
= hapd
.get_config()['key_mgmt']
534 if key_mgmt
.split(' ')[0] != "FT-EAP":
535 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
536 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
537 params
['wpa_key_mgmt'] = "FT-EAP"
538 params
["ieee8021x"] = "1"
539 params
= dict(radius
.items() + params
.items())
540 hapd1
= hostapd
.add_ap(apdev
[1], params
)
542 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
543 if "[WPA2-FT/EAP-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
544 raise Exception("Scan results missing RSN element info")
545 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
546 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
548 # Verify EAPOL reauthentication after FT protocol
549 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
553 ap
.request("EAPOL_REAUTH " + dev
[0].own_addr())
554 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout
=5)
556 raise Exception("EAP authentication did not start")
557 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout
=5)
559 raise Exception("EAP authentication did not succeed")
561 hwsim_utils
.test_connectivity(dev
[0], ap
)
563 def test_ap_ft_eap_pull(dev
, apdev
):
564 """WPA2-EAP-FT AP (pull PMK)"""
566 passphrase
="12345678"
568 radius
= hostapd
.radius_params()
569 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
570 params
['wpa_key_mgmt'] = "FT-EAP"
571 params
["ieee8021x"] = "1"
572 params
["pmk_r1_push"] = "0"
573 params
= dict(radius
.items() + params
.items())
574 hapd
= hostapd
.add_ap(apdev
[0], params
)
575 key_mgmt
= hapd
.get_config()['key_mgmt']
576 if key_mgmt
.split(' ')[0] != "FT-EAP":
577 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
578 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
579 params
['wpa_key_mgmt'] = "FT-EAP"
580 params
["ieee8021x"] = "1"
581 params
["pmk_r1_push"] = "0"
582 params
= dict(radius
.items() + params
.items())
583 hapd1
= hostapd
.add_ap(apdev
[1], params
)
585 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
588 def test_ap_ft_mismatching_rrb_key_push(dev
, apdev
):
589 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
591 passphrase
="12345678"
593 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
594 params
["ieee80211w"] = "2"
595 hapd0
= hostapd
.add_ap(apdev
[0], params
)
596 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
597 params
["ieee80211w"] = "2"
598 hapd1
= hostapd
.add_ap(apdev
[1], params
)
600 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
604 def test_ap_ft_mismatching_rrb_key_pull(dev
, apdev
):
605 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
607 passphrase
="12345678"
609 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
610 params
["pmk_r1_push"] = "0"
611 hapd0
= hostapd
.add_ap(apdev
[0], params
)
612 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
613 params
["pmk_r1_push"] = "0"
614 hapd1
= hostapd
.add_ap(apdev
[1], params
)
616 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
620 def test_ap_ft_mismatching_r0kh_id_pull(dev
, apdev
):
621 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
623 passphrase
="12345678"
625 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
626 params
["pmk_r1_push"] = "0"
627 params
["nas_identifier"] = "nas0.w1.fi"
628 hostapd
.add_ap(apdev
[0], params
)
629 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
632 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
633 params
["pmk_r1_push"] = "0"
634 hostapd
.add_ap(apdev
[1], params
)
636 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
637 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
640 def test_ap_ft_mismatching_rrb_r0kh_push(dev
, apdev
):
641 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
643 passphrase
="12345678"
645 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
646 params
["ieee80211w"] = "2"
647 hapd0
= hostapd
.add_ap(apdev
[0], params
)
648 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
649 params
["ieee80211w"] = "2"
650 hapd1
= hostapd
.add_ap(apdev
[1], params
)
652 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
656 def test_ap_ft_mismatching_rrb_r0kh_pull(dev
, apdev
):
657 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
659 passphrase
="12345678"
661 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
662 params
["pmk_r1_push"] = "0"
663 hapd0
= hostapd
.add_ap(apdev
[0], params
)
664 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
665 params
["pmk_r1_push"] = "0"
666 hapd1
= hostapd
.add_ap(apdev
[1], params
)
668 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
671 def test_ap_ft_mismatching_rrb_key_push_eap(dev
, apdev
):
672 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
674 passphrase
="12345678"
676 radius
= hostapd
.radius_params()
677 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
678 params
["ieee80211w"] = "2";
679 params
['wpa_key_mgmt'] = "FT-EAP"
680 params
["ieee8021x"] = "1"
681 params
= dict(radius
.items() + params
.items())
682 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
683 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
684 params
["ieee80211w"] = "2";
685 params
['wpa_key_mgmt'] = "FT-EAP"
686 params
["ieee8021x"] = "1"
687 params
= dict(radius
.items() + params
.items())
688 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
690 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
691 fail_test
=True, eap
=True)
693 def test_ap_ft_mismatching_rrb_key_pull_eap(dev
, apdev
):
694 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
696 passphrase
="12345678"
698 radius
= hostapd
.radius_params()
699 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
700 params
["pmk_r1_push"] = "0"
701 params
['wpa_key_mgmt'] = "FT-EAP"
702 params
["ieee8021x"] = "1"
703 params
= dict(radius
.items() + params
.items())
704 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
705 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
706 params
["pmk_r1_push"] = "0"
707 params
['wpa_key_mgmt'] = "FT-EAP"
708 params
["ieee8021x"] = "1"
709 params
= dict(radius
.items() + params
.items())
710 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
712 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
713 fail_test
=True, eap
=True)
715 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev
, apdev
):
716 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
718 passphrase
="12345678"
720 radius
= hostapd
.radius_params()
721 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
722 params
["pmk_r1_push"] = "0"
723 params
["nas_identifier"] = "nas0.w1.fi"
724 params
['wpa_key_mgmt'] = "FT-EAP"
725 params
["ieee8021x"] = "1"
726 params
= dict(radius
.items() + params
.items())
727 hostapd
.add_ap(apdev
[0]['ifname'], params
)
728 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
729 eap
="GPSK", identity
="gpsk user",
730 password
="abcdefghijklmnop0123456789abcdef",
733 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
734 params
["pmk_r1_push"] = "0"
735 params
['wpa_key_mgmt'] = "FT-EAP"
736 params
["ieee8021x"] = "1"
737 params
= dict(radius
.items() + params
.items())
738 hostapd
.add_ap(apdev
[1]['ifname'], params
)
740 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
741 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
743 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev
, apdev
):
744 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
746 passphrase
="12345678"
748 radius
= hostapd
.radius_params()
749 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
750 params
["ieee80211w"] = "2";
751 params
['wpa_key_mgmt'] = "FT-EAP"
752 params
["ieee8021x"] = "1"
753 params
= dict(radius
.items() + params
.items())
754 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
755 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
756 params
["ieee80211w"] = "2";
757 params
['wpa_key_mgmt'] = "FT-EAP"
758 params
["ieee8021x"] = "1"
759 params
= dict(radius
.items() + params
.items())
760 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
762 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
763 fail_test
=True, eap
=True)
765 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev
, apdev
):
766 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
768 passphrase
="12345678"
770 radius
= hostapd
.radius_params()
771 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
772 params
["pmk_r1_push"] = "0"
773 params
['wpa_key_mgmt'] = "FT-EAP"
774 params
["ieee8021x"] = "1"
775 params
= dict(radius
.items() + params
.items())
776 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
777 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
778 params
["pmk_r1_push"] = "0"
779 params
['wpa_key_mgmt'] = "FT-EAP"
780 params
["ieee8021x"] = "1"
781 params
= dict(radius
.items() + params
.items())
782 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
784 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
785 fail_test
=True, eap
=True)
787 def test_ap_ft_gtk_rekey(dev
, apdev
):
788 """WPA2-PSK-FT AP and GTK rekey"""
790 passphrase
="12345678"
792 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
793 params
['wpa_group_rekey'] = '1'
794 hapd
= hostapd
.add_ap(apdev
[0], params
)
796 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
797 ieee80211w
="1", scan_freq
="2412")
799 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
801 raise Exception("GTK rekey timed out after initial association")
802 hwsim_utils
.test_connectivity(dev
[0], hapd
)
804 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
805 params
['wpa_group_rekey'] = '1'
806 hapd1
= hostapd
.add_ap(apdev
[1], params
)
808 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
809 dev
[0].roam(apdev
[1]['bssid'])
810 if dev
[0].get_status_field('bssid') != apdev
[1]['bssid']:
811 raise Exception("Did not connect to correct AP")
812 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
814 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
816 raise Exception("GTK rekey timed out after FT protocol")
817 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
819 def test_ft_psk_key_lifetime_in_memory(dev
, apdev
, params
):
820 """WPA2-PSK-FT and key lifetime in memory"""
822 passphrase
="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
823 psk
= '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
824 pmk
= binascii
.unhexlify(psk
)
825 p
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
826 hapd0
= hostapd
.add_ap(apdev
[0], p
)
827 p
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
828 hapd1
= hostapd
.add_ap(apdev
[1], p
)
830 pid
= find_wpas_process(dev
[0])
832 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
834 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
835 # event has been delivered, so verify that wpa_supplicant has returned to
836 # eloop before reading process memory.
840 buf
= read_process_memory(pid
, pmk
)
842 dev
[0].request("DISCONNECT")
843 dev
[0].wait_disconnected()
850 with
open(os
.path
.join(params
['logdir'], 'log0'), 'r') as f
:
851 for l
in f
.readlines():
852 if "FT: PMK-R0 - hexdump" in l
:
853 val
= l
.strip().split(':')[3].replace(' ', '')
854 pmkr0
= binascii
.unhexlify(val
)
855 if "FT: PMK-R1 - hexdump" in l
:
856 val
= l
.strip().split(':')[3].replace(' ', '')
857 pmkr1
= binascii
.unhexlify(val
)
858 if "FT: KCK - hexdump" in l
:
859 val
= l
.strip().split(':')[3].replace(' ', '')
860 kck
= binascii
.unhexlify(val
)
861 if "FT: KEK - hexdump" in l
:
862 val
= l
.strip().split(':')[3].replace(' ', '')
863 kek
= binascii
.unhexlify(val
)
864 if "FT: TK - hexdump" in l
:
865 val
= l
.strip().split(':')[3].replace(' ', '')
866 tk
= binascii
.unhexlify(val
)
867 if "WPA: Group Key - hexdump" in l
:
868 val
= l
.strip().split(':')[3].replace(' ', '')
869 gtk
= binascii
.unhexlify(val
)
870 if not pmkr0
or not pmkr1
or not kck
or not kek
or not tk
or not gtk
:
871 raise Exception("Could not find keys from debug log")
873 raise Exception("Unexpected GTK length")
875 logger
.info("Checking keys in memory while associated")
876 get_key_locations(buf
, pmk
, "PMK")
877 get_key_locations(buf
, pmkr0
, "PMK-R0")
878 get_key_locations(buf
, pmkr1
, "PMK-R1")
880 raise HwsimSkip("PMK not found while associated")
882 raise HwsimSkip("PMK-R0 not found while associated")
884 raise HwsimSkip("PMK-R1 not found while associated")
886 raise Exception("KCK not found while associated")
888 raise Exception("KEK not found while associated")
890 raise Exception("TK found from memory")
892 get_key_locations(buf
, gtk
, "GTK")
893 raise Exception("GTK found from memory")
895 logger
.info("Checking keys in memory after disassociation")
896 buf
= read_process_memory(pid
, pmk
)
897 get_key_locations(buf
, pmk
, "PMK")
898 get_key_locations(buf
, pmkr0
, "PMK-R0")
899 get_key_locations(buf
, pmkr1
, "PMK-R1")
901 # Note: PMK/PSK is still present in network configuration
903 fname
= os
.path
.join(params
['logdir'],
904 'ft_psk_key_lifetime_in_memory.memctx-')
905 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
906 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
907 verify_not_present(buf
, kck
, fname
, "KCK")
908 verify_not_present(buf
, kek
, fname
, "KEK")
909 verify_not_present(buf
, tk
, fname
, "TK")
910 verify_not_present(buf
, gtk
, fname
, "GTK")
912 dev
[0].request("REMOVE_NETWORK all")
914 logger
.info("Checking keys in memory after network profile removal")
915 buf
= read_process_memory(pid
, pmk
)
916 get_key_locations(buf
, pmk
, "PMK")
917 get_key_locations(buf
, pmkr0
, "PMK-R0")
918 get_key_locations(buf
, pmkr1
, "PMK-R1")
920 verify_not_present(buf
, pmk
, fname
, "PMK")
921 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
922 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
923 verify_not_present(buf
, kck
, fname
, "KCK")
924 verify_not_present(buf
, kek
, fname
, "KEK")
925 verify_not_present(buf
, tk
, fname
, "TK")
926 verify_not_present(buf
, gtk
, fname
, "GTK")
929 def test_ap_ft_invalid_resp(dev
, apdev
):
930 """WPA2-PSK-FT AP and invalid response IEs"""
932 passphrase
="12345678"
934 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
935 hapd0
= hostapd
.add_ap(apdev
[0], params
)
936 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
939 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
940 hapd1
= hostapd
.add_ap(apdev
[1], params
)
943 # Various IEs for test coverage. The last one is FTIE with invalid
944 # R1KH-ID subelement.
945 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
946 # FTIE with invalid R0KH-ID subelement (len=0).
947 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
948 # FTIE with invalid R0KH-ID subelement (len=49).
949 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
951 "020002000000" + "3000",
952 # Required IEs missing from protected IE count.
953 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
954 # RIC missing from protected IE count.
955 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
956 # Protected IE missing.
957 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
959 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
960 hapd1
.set("ext_mgmt_frame_handling", "1")
962 if "OK" not in dev
[0].request("ROAM " + apdev
[1]['bssid']):
963 raise Exception("ROAM failed")
966 msg
= hapd1
.mgmt_rx()
967 if msg
['subtype'] == 11:
971 raise Exception("Authentication frame not seen")
974 resp
['fc'] = auth
['fc']
975 resp
['da'] = auth
['sa']
976 resp
['sa'] = auth
['da']
977 resp
['bssid'] = auth
['bssid']
978 resp
['payload'] = binascii
.unhexlify(t
)
980 hapd1
.set("ext_mgmt_frame_handling", "0")
981 dev
[0].wait_disconnected()
983 dev
[0].request("RECONNECT")
984 dev
[0].wait_connected()
986 def test_ap_ft_gcmp_256(dev
, apdev
):
987 """WPA2-PSK-FT AP with GCMP-256 cipher"""
988 if "GCMP-256" not in dev
[0].get_capability("pairwise"):
989 raise HwsimSkip("Cipher GCMP-256 not supported")
991 passphrase
="12345678"
993 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
994 params
['rsn_pairwise'] = "GCMP-256"
995 hapd0
= hostapd
.add_ap(apdev
[0], params
)
996 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
997 params
['rsn_pairwise'] = "GCMP-256"
998 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1000 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
1001 pairwise_cipher
="GCMP-256", group_cipher
="GCMP-256")
1003 def test_ap_ft_oom(dev
, apdev
):
1004 """WPA2-PSK-FT and OOM"""
1005 skip_with_fips(dev
[0])
1007 passphrase
="12345678"
1009 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1010 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1011 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1012 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1014 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1016 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1017 dst
= apdev
[1]['bssid']
1019 dst
= apdev
[0]['bssid']
1021 dev
[0].scan_for_bss(dst
, freq
="2412")
1022 with
alloc_fail(dev
[0], 1, "wpa_ft_gen_req_ies"):
1024 with
fail_test(dev
[0], 1, "wpa_ft_mic"):
1025 dev
[0].roam(dst
, fail_test
=True)
1026 with
fail_test(dev
[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1027 dev
[0].roam(dst
, fail_test
=True)
1029 dev
[0].request("REMOVE_NETWORK all")
1030 with
alloc_fail(dev
[0], 1, "=sme_update_ft_ies"):
1031 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1034 def test_ap_ft_ap_oom(dev
, apdev
):
1035 """WPA2-PSK-FT and AP OOM"""
1037 passphrase
="12345678"
1039 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1040 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1041 bssid0
= hapd0
.own_addr()
1043 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1044 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r0"):
1045 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1048 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1049 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1050 bssid1
= hapd1
.own_addr()
1051 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1052 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1055 def test_ap_ft_ap_oom2(dev
, apdev
):
1056 """WPA2-PSK-FT and AP OOM 2"""
1058 passphrase
="12345678"
1060 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1061 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1062 bssid0
= hapd0
.own_addr()
1064 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1065 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r1"):
1066 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1069 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1070 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1071 bssid1
= hapd1
.own_addr()
1072 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1074 if dev
[0].get_status_field('bssid') != bssid1
:
1075 raise Exception("Did not roam to AP1")
1076 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1079 def test_ap_ft_ap_oom3(dev
, apdev
):
1080 """WPA2-PSK-FT and AP OOM 3"""
1082 passphrase
="12345678"
1084 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1085 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1086 bssid0
= hapd0
.own_addr()
1088 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1089 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1092 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1093 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1094 bssid1
= hapd1
.own_addr()
1095 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1096 with
alloc_fail(hapd1
, 1, "wpa_ft_pull_pmk_r1"):
1097 # This will fail due to not being able to send out PMK-R1 pull request
1100 with
fail_test(hapd1
, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1101 # This will fail due to not being able to send out PMK-R1 pull request
1104 with
fail_test(hapd1
, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1105 # This will fail due to not being able to send out PMK-R1 pull request
1108 def test_ap_ft_ap_oom3b(dev
, apdev
):
1109 """WPA2-PSK-FT and AP OOM 3b"""
1111 passphrase
="12345678"
1113 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1114 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1115 bssid0
= hapd0
.own_addr()
1117 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1118 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1121 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1122 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1123 bssid1
= hapd1
.own_addr()
1124 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1125 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1126 # This will fail due to not being able to send out PMK-R1 pull request
1129 def test_ap_ft_ap_oom4(dev
, apdev
):
1130 """WPA2-PSK-FT and AP OOM 4"""
1132 passphrase
="12345678"
1134 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1135 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1136 bssid0
= hapd0
.own_addr()
1138 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1139 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1142 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1143 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1144 bssid1
= hapd1
.own_addr()
1145 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1146 with
alloc_fail(hapd1
, 1, "wpa_ft_gtk_subelem"):
1148 if dev
[0].get_status_field('bssid') != bssid1
:
1149 raise Exception("Did not roam to AP1")
1151 with
fail_test(hapd0
, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1153 if dev
[0].get_status_field('bssid') != bssid0
:
1154 raise Exception("Did not roam to AP0")
1156 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1158 if dev
[0].get_status_field('bssid') != bssid1
:
1159 raise Exception("Did not roam to AP1")
1161 def test_ap_ft_ap_oom5(dev
, apdev
):
1162 """WPA2-PSK-FT and AP OOM 5"""
1164 passphrase
="12345678"
1166 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1167 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1168 bssid0
= hapd0
.own_addr()
1170 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1171 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1174 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1175 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1176 bssid1
= hapd1
.own_addr()
1177 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1178 with
alloc_fail(hapd1
, 1, "=wpa_ft_process_auth_req"):
1179 # This will fail to roam
1182 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_process_auth_req"):
1183 # This will fail to roam
1186 with
fail_test(hapd1
, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1187 # This will fail to roam
1190 with
fail_test(hapd1
, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1191 # This will fail to roam
1194 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1195 # This will fail to roam
1198 def test_ap_ft_ap_oom6(dev
, apdev
):
1199 """WPA2-PSK-FT and AP OOM 6"""
1201 passphrase
="12345678"
1203 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1204 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1205 bssid0
= hapd0
.own_addr()
1207 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1208 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1209 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1211 dev
[0].request("REMOVE_NETWORK all")
1212 dev
[0].wait_disconnected()
1213 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1214 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1216 dev
[0].request("REMOVE_NETWORK all")
1217 dev
[0].wait_disconnected()
1218 with
fail_test(hapd0
, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1219 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1222 def test_ap_ft_ap_oom7(dev
, apdev
):
1223 """WPA2-PSK-FT and AP OOM 7"""
1225 passphrase
="12345678"
1227 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1228 params
["ieee80211w"] = "2"
1229 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1230 bssid0
= hapd0
.own_addr()
1232 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1233 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1234 ieee80211w
="2", scan_freq
="2412")
1236 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1237 params
["ieee80211w"] = "2"
1238 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1239 bssid1
= hapd1
.own_addr()
1240 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1241 with
alloc_fail(hapd1
, 1, "wpa_ft_igtk_subelem"):
1242 # This will fail to roam
1244 with
fail_test(hapd1
, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1245 # This will fail to roam
1247 with
alloc_fail(hapd1
, 1, "=wpa_sm_write_assoc_resp_ies"):
1248 # This will fail to roam
1250 with
fail_test(hapd1
, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1251 # This will fail to roam
1254 def test_ap_ft_ap_oom8(dev
, apdev
):
1255 """WPA2-PSK-FT and AP OOM 8"""
1257 passphrase
="12345678"
1259 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1260 params
['ft_psk_generate_local'] = "1";
1261 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1262 bssid0
= hapd0
.own_addr()
1264 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1265 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1268 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1269 params
['ft_psk_generate_local'] = "1";
1270 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1271 bssid1
= hapd1
.own_addr()
1272 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1273 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1274 # This will fail to roam
1276 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1277 # This will fail to roam
1280 def test_ap_ft_ap_oom9(dev
, apdev
):
1281 """WPA2-PSK-FT and AP OOM 9"""
1283 passphrase
="12345678"
1285 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1286 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1287 bssid0
= hapd0
.own_addr()
1289 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1290 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1293 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1294 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1295 bssid1
= hapd1
.own_addr()
1296 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1298 with
alloc_fail(hapd0
, 1, "wpa_ft_action_rx"):
1299 # This will fail to roam
1300 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1301 raise Exception("FT_DS failed")
1302 wait_fail_trigger(hapd0
, "GET_ALLOC_FAIL")
1304 with
alloc_fail(hapd1
, 1, "wpa_ft_rrb_rx_request"):
1305 # This will fail to roam
1306 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1307 raise Exception("FT_DS failed")
1308 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
1310 with
alloc_fail(hapd1
, 1, "wpa_ft_send_rrb_auth_resp"):
1311 # This will fail to roam
1312 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1313 raise Exception("FT_DS failed")
1314 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
1316 def test_ap_ft_ap_oom10(dev
, apdev
):
1317 """WPA2-PSK-FT and AP OOM 10"""
1319 passphrase
="12345678"
1321 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1322 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1323 bssid0
= hapd0
.own_addr()
1325 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1326 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1329 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1330 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1331 bssid1
= hapd1
.own_addr()
1332 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1334 with
fail_test(hapd0
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
1335 # This will fail to roam
1336 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1337 raise Exception("FT_DS failed")
1338 wait_fail_trigger(hapd0
, "GET_FAIL")
1340 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1341 # This will fail to roam
1342 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1343 raise Exception("FT_DS failed")
1344 wait_fail_trigger(hapd0
, "GET_FAIL")
1346 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
1347 # This will fail to roam
1348 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1349 raise Exception("FT_DS failed")
1350 wait_fail_trigger(hapd0
, "GET_FAIL")
1352 with
fail_test(hapd1
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
1353 # This will fail to roam
1354 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1355 raise Exception("FT_DS failed")
1356 wait_fail_trigger(hapd1
, "GET_FAIL")
1358 def test_ap_ft_ap_oom11(dev
, apdev
):
1359 """WPA2-PSK-FT and AP OOM 11"""
1361 passphrase
="12345678"
1363 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1364 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1365 bssid0
= hapd0
.own_addr()
1367 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1368 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1369 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1371 wait_fail_trigger(hapd0
, "GET_FAIL")
1373 dev
[1].scan_for_bss(bssid0
, freq
="2412")
1374 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
1375 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1377 wait_fail_trigger(hapd0
, "GET_FAIL")
1379 def test_ap_ft_over_ds_proto_ap(dev
, apdev
):
1380 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1382 passphrase
="12345678"
1384 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1385 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1386 bssid0
= hapd0
.own_addr()
1387 _bssid0
= bssid0
.replace(':', '')
1388 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1390 addr
= dev
[0].own_addr()
1391 _addr
= addr
.replace(':', '')
1393 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1394 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1395 bssid1
= hapd1
.own_addr()
1396 _bssid1
= bssid1
.replace(':', '')
1398 hapd0
.set("ext_mgmt_frame_handling", "1")
1399 hdr
= "d0003a01" + _bssid0
+ _addr
+ _bssid0
+ "1000"
1400 valid
= "0601" + _addr
+ _bssid1
1403 "0601" + _addr
+ _bssid0
,
1404 "0601" + _addr
+ "ffffffffffff",
1405 "0601" + _bssid0
+ _bssid0
,
1410 valid
+ "3603ffffff",
1411 valid
+ "3603a1b2ff",
1412 valid
+ "3603a1b2ff" + "3700",
1413 valid
+ "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
1414 valid
+ "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
1415 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
1416 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
1417 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
1418 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1419 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1422 hapd0
.dump_monitor()
1423 if "OK" not in hapd0
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ t
):
1424 raise Exception("MGMT_RX_PROCESS failed")
1426 hapd0
.set("ext_mgmt_frame_handling", "0")
1428 def test_ap_ft_over_ds_proto(dev
, apdev
):
1429 """WPA2-PSK-FT AP over DS protocol testing"""
1431 passphrase
="12345678"
1433 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1434 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1435 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1438 # FT Action Response while no FT-over-DS in progress
1441 msg
['da'] = dev
[0].own_addr()
1442 msg
['sa'] = apdev
[0]['bssid']
1443 msg
['bssid'] = apdev
[0]['bssid']
1444 msg
['payload'] = binascii
.unhexlify("06020200000000000200000004000000")
1447 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1448 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1449 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1450 hapd0
.set("ext_mgmt_frame_handling", "1")
1451 hapd0
.dump_monitor()
1452 dev
[0].request("FT_DS " + apdev
[1]['bssid'])
1453 for i
in range(0, 10):
1454 req
= hapd0
.mgmt_rx()
1456 raise Exception("MGMT RX wait timed out")
1457 if req
['subtype'] == 13:
1461 raise Exception("FT Action frame not received")
1463 # FT Action Response for unexpected Target AP
1464 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "f20000000400" + "0000")
1467 # FT Action Response without MDIE
1468 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000")
1471 # FT Action Response without FTIE
1472 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
1475 # FT Action Response with FTIE SNonce mismatch
1476 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1480 def test_ap_ft_rrb(dev
, apdev
):
1481 """WPA2-PSK-FT RRB protocol testing"""
1483 passphrase
="12345678"
1485 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1486 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1488 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1491 _dst_ll
= binascii
.unhexlify(apdev
[0]['bssid'].replace(':',''))
1492 _src_ll
= binascii
.unhexlify(dev
[0].own_addr().replace(':',''))
1494 ehdr
= _dst_ll
+ _src_ll
+ proto
1496 # Too short RRB frame
1498 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1499 raise Exception("DATA_TEST_FRAME failed")
1501 # RRB discarded frame wikth unrecognized type
1502 pkt
= ehdr
+ '\x02' + '\x02' + '\x01\x00' + _src_ll
1503 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1504 raise Exception("DATA_TEST_FRAME failed")
1506 # RRB frame too short for action frame
1507 pkt
= ehdr
+ '\x01' + '\x02' + '\x01\x00' + _src_ll
1508 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1509 raise Exception("DATA_TEST_FRAME failed")
1511 # Too short RRB frame (not enough room for Action Frame body)
1512 pkt
= ehdr
+ '\x01' + '\x02' + '\x00\x00' + _src_ll
1513 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1514 raise Exception("DATA_TEST_FRAME failed")
1516 # Unexpected Action frame category
1517 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1518 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1519 raise Exception("DATA_TEST_FRAME failed")
1521 # Unexpected Action in RRB Request
1522 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1523 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1524 raise Exception("DATA_TEST_FRAME failed")
1526 # Target AP address in RRB Request does not match with own address
1527 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1528 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1529 raise Exception("DATA_TEST_FRAME failed")
1531 # Not enough room for status code in RRB Response
1532 pkt
= ehdr
+ '\x01' + '\x01' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1533 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1534 raise Exception("DATA_TEST_FRAME failed")
1536 # RRB discarded frame with unknown packet_type
1537 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1538 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1539 raise Exception("DATA_TEST_FRAME failed")
1541 # RRB Response with non-zero status code; no STA match
1542 pkt
= ehdr
+ '\x01' + '\x01' + '\x10\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
1543 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1544 raise Exception("DATA_TEST_FRAME failed")
1546 # RRB Response with zero status code and extra data; STA match
1547 pkt
= ehdr
+ '\x01' + '\x01' + '\x11\x00' + _src_ll
+ '\x06\x01' + _src_ll
+ '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
1548 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1549 raise Exception("DATA_TEST_FRAME failed")
1551 # Too short PMK-R1 pull
1552 pkt
= ehdr
+ '\x01' + '\xc8' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1553 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1554 raise Exception("DATA_TEST_FRAME failed")
1556 # Too short PMK-R1 resp
1557 pkt
= ehdr
+ '\x01' + '\xc9' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1558 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1559 raise Exception("DATA_TEST_FRAME failed")
1561 # Too short PMK-R1 push
1562 pkt
= ehdr
+ '\x01' + '\xca' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1563 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1564 raise Exception("DATA_TEST_FRAME failed")
1566 # No matching R0KH address found for PMK-R0 pull response
1567 pkt
= ehdr
+ '\x01' + '\xc9' + '\x5a\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
1568 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1569 raise Exception("DATA_TEST_FRAME failed")
1572 def test_rsn_ie_proto_ft_psk_sta(dev
, apdev
):
1573 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
1574 bssid
= apdev
[0]['bssid']
1576 passphrase
="12345678"
1578 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1579 params
["ieee80211w"] = "1"
1580 # This is the RSN element used normally by hostapd
1581 params
['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
1582 hapd
= hostapd
.add_ap(apdev
[0], params
)
1583 id = dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1584 ieee80211w
="1", scan_freq
="2412",
1585 pairwise
="CCMP", group
="CCMP")
1587 tests
= [ ('PMKIDCount field included',
1588 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
1589 ('Extra IE before RSNE',
1590 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
1591 ('PMKIDCount and Group Management Cipher suite fields included',
1592 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
1593 ('Extra octet after defined fields (future extensibility)',
1594 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
1595 ('No RSN Capabilities field (PMF disabled in practice)',
1596 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
1597 for txt
,ie
in tests
:
1598 dev
[0].request("DISCONNECT")
1599 dev
[0].wait_disconnected()
1602 hapd
.set('own_ie_override', ie
)
1604 dev
[0].request("BSS_FLUSH 0")
1605 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1606 dev
[0].select_network(id, freq
=2412)
1607 dev
[0].wait_connected()
1609 dev
[0].request("DISCONNECT")
1610 dev
[0].wait_disconnected()
1612 logger
.info('Invalid RSNE causing internal hostapd error')
1614 hapd
.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
1616 dev
[0].request("BSS_FLUSH 0")
1617 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1618 dev
[0].select_network(id, freq
=2412)
1619 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1621 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1623 raise Exception("Unexpected connection")
1624 dev
[0].request("DISCONNECT")
1626 logger
.info('Unexpected PMKID causing internal hostapd error')
1628 hapd
.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
1630 dev
[0].request("BSS_FLUSH 0")
1631 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1632 dev
[0].select_network(id, freq
=2412)
1633 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1635 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1637 raise Exception("Unexpected connection")
1638 dev
[0].request("DISCONNECT")
1640 def test_ap_ft_ptk_rekey(dev
, apdev
):
1641 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
1643 passphrase
="12345678"
1645 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1646 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1647 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1648 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1650 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, ptk_rekey
="1")
1652 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1653 "WPA: Key negotiation completed"], timeout
=5)
1655 raise Exception("No event received after roam")
1656 if "CTRL-EVENT-DISCONNECTED" in ev
:
1657 raise Exception("Unexpected disconnection after roam")
1659 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1663 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1665 def test_ap_ft_ptk_rekey_ap(dev
, apdev
):
1666 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
1668 passphrase
="12345678"
1670 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1671 params
['wpa_ptk_rekey'] = '2'
1672 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1673 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1674 params
['wpa_ptk_rekey'] = '2'
1675 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1677 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
1679 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1680 "WPA: Key negotiation completed"], timeout
=5)
1682 raise Exception("No event received after roam")
1683 if "CTRL-EVENT-DISCONNECTED" in ev
:
1684 raise Exception("Unexpected disconnection after roam")
1686 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1690 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1692 def test_ap_ft_internal_rrb_check(dev
, apdev
):
1693 """RRB internal delivery only to WPA enabled BSS"""
1695 passphrase
="12345678"
1697 radius
= hostapd
.radius_params()
1698 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1699 params
['wpa_key_mgmt'] = "FT-EAP"
1700 params
["ieee8021x"] = "1"
1701 params
= dict(radius
.items() + params
.items())
1702 hapd
= hostapd
.add_ap(apdev
[0], params
)
1703 key_mgmt
= hapd
.get_config()['key_mgmt']
1704 if key_mgmt
.split(' ')[0] != "FT-EAP":
1705 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1707 hapd1
= hostapd
.add_ap(apdev
[1], { "ssid" : ssid
})
1709 # Connect to WPA enabled AP
1710 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
1711 eap
="GPSK", identity
="gpsk user",
1712 password
="abcdefghijklmnop0123456789abcdef",
1715 # Try over_ds roaming to non-WPA-enabled AP.
1716 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
1717 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1719 def test_ap_ft_extra_ie(dev
, apdev
):
1720 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
1722 passphrase
="12345678"
1724 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1725 params
["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
1726 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1727 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1729 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1732 # Add Mobility Domain element to test AP validation code.
1733 dev
[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
1734 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1735 scan_freq
="2412", wait_connect
=False)
1736 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED",
1737 "CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
1739 raise Exception("No connection result")
1740 if "CTRL-EVENT-CONNECTED" in ev
:
1741 raise Exception("Non-FT association accepted with MDE")
1742 if "status_code=43" not in ev
:
1743 raise Exception("Unexpected status code: " + ev
)
1744 dev
[0].request("DISCONNECT")
1746 dev
[0].request("VENDOR_ELEM_REMOVE 13 *")
1748 def test_ap_ft_ric(dev
, apdev
):
1749 """WPA2-PSK-FT AP and RIC"""
1751 passphrase
="12345678"
1753 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1754 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1755 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1756 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1758 dev
[0].set("ric_ies", "")
1759 dev
[0].set("ric_ies", '""')
1760 if "FAIL" not in dev
[0].request("SET ric_ies q"):
1761 raise Exception("Invalid ric_ies value accepted")
1766 "390400000000" + "390400000000",
1767 "390400000000" + "dd050050f20202",
1768 "390400000000" + "dd3d0050f2020201" + 55*"00",
1769 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
1770 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
1772 dev
[0].set("ric_ies", t
)
1773 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
1774 test_connectivity
=False)
1775 dev
[0].request("REMOVE_NETWORK all")
1776 dev
[0].wait_disconnected()
1777 dev
[0].dump_monitor()
1779 def ie_hex(ies
, id):
1780 return binascii
.hexlify(struct
.pack('BB', id, len(ies
[id])) + ies
[id])
1782 def test_ap_ft_reassoc_proto(dev
, apdev
):
1783 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
1785 passphrase
="12345678"
1787 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1788 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1789 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1790 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1792 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1793 ieee80211w
="1", scan_freq
="2412")
1794 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
1801 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
1802 hapd2ap
.set("ext_mgmt_frame_handling", "1")
1803 dev
[0].request("ROAM " + hapd2ap
.own_addr())
1806 req
= hapd2ap
.mgmt_rx()
1807 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']))
1808 if req
['subtype'] == 11:
1812 req
= hapd2ap
.mgmt_rx()
1813 if req
['subtype'] == 2:
1815 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']))
1817 # IEEE 802.11 header + fixed fields before IEs
1818 hdr
= binascii
.hexlify(req
['frame'][0:34])
1819 ies
= parse_ie(binascii
.hexlify(req
['frame'][34:]))
1820 # First elements: SSID, Supported Rates, Extended Supported Rates
1821 ies1
= ie_hex(ies
, 0) + ie_hex(ies
, 1) + ie_hex(ies
, 50)
1823 rsne
= ie_hex(ies
, 48)
1824 mde
= ie_hex(ies
, 54)
1825 fte
= ie_hex(ies
, 55)
1827 # RSN: Trying to use FT, but MDIE not included
1829 # RSN: Attempted to use unknown MDIE
1830 tests
+= [ rsne
+ "3603000000" ]
1831 # Invalid RSN pairwise cipher
1832 tests
+= [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
1833 # FT: No PMKID in RSNIE
1834 tests
+= [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies
, 54) ]
1836 tests
+= [ rsne
+ mde
]
1837 # FT: RIC IE(s) in the frame, but not included in protected IE count
1838 # FT: Failed to parse FT IEs
1839 tests
+= [ rsne
+ mde
+ fte
+ "3900" ]
1840 # FT: SNonce mismatch in FTIE
1841 tests
+= [ rsne
+ mde
+ "37520000" + 16*"00" + 32*"00" + 32*"00" ]
1842 # FT: ANonce mismatch in FTIE
1843 tests
+= [ rsne
+ mde
+ fte
[0:40] + 32*"00" + fte
[104:] ]
1844 # FT: No R0KH-ID subelem in FTIE
1845 tests
+= [ rsne
+ mde
+ "3752" + fte
[4:168] ]
1846 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
1847 tests
+= [ rsne
+ mde
+ "3755" + fte
[4:168] + "0301ff" ]
1848 # FT: No R1KH-ID subelem in FTIE
1849 tests
+= [ rsne
+ mde
+ "375e" + fte
[4:168] + "030a" + "nas1.w1.fi".encode("hex") ]
1850 # FT: Unknown R1KH-ID used in ReassocReq
1851 tests
+= [ rsne
+ mde
+ "3766" + fte
[4:168] + "030a" + "nas1.w1.fi".encode("hex") + "0106000000000000" ]
1852 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
1853 tests
+= [ rsne
[:-32] + 16*"00" + mde
+ fte
]
1854 # Invalid MIC in FTIE
1855 tests
+= [ rsne
+ mde
+ fte
[0:8] + 16*"00" + fte
[40:] ]
1857 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ ies1
+ t
)
1859 def test_ap_ft_reassoc_local_fail(dev
, apdev
):
1860 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
1862 passphrase
="12345678"
1864 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1865 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1866 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1867 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1869 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1870 ieee80211w
="1", scan_freq
="2412")
1871 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
1878 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
1879 # FT: Failed to calculate MIC
1880 with
fail_test(hapd2ap
, 1, "wpa_ft_validate_reassoc"):
1881 dev
[0].request("ROAM " + hapd2ap
.own_addr())
1882 ev
= dev
[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
1883 dev
[0].request("DISCONNECT")
1885 raise Exception("Association reject not seen")