]>
git.ipfire.org Git - thirdparty/hostap.git/blob - tests/hwsim/test_ap_ft.py
7c2f5dca70bf9cbbe22b4e9c44778f8dbf2e4eeb
1 # Fast BSS Transition tests
2 # Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
4 # This software may be distributed under the terms of the BSD license.
5 # See README for more details.
7 from remotehost
import remote_compatible
12 logger
= logging
.getLogger()
16 from utils
import HwsimSkip
, alloc_fail
, fail_test
, skip_with_fips
17 from wlantest
import Wlantest
18 from test_ap_psk
import check_mib
, find_wpas_process
, read_process_memory
, verify_not_present
, get_key_locations
21 params
= { "wpa": "2",
22 "wpa_key_mgmt": "FT-PSK",
23 "rsn_pairwise": "CCMP" }
27 params
= { "wpa": "3",
28 "wpa_key_mgmt": "WPA-PSK FT-PSK",
29 "wpa_pairwise": "TKIP",
30 "rsn_pairwise": "CCMP" }
33 def ft_params(rsn
=True, ssid
=None, passphrase
=None):
35 params
= ft_base_rsn()
37 params
= ft_base_mixed()
41 params
["wpa_passphrase"] = passphrase
43 params
["mobility_domain"] = "a1b2"
44 params
["r0_key_lifetime"] = "10000"
45 params
["pmk_r1_push"] = "1"
46 params
["reassociation_deadline"] = "1000"
49 def ft_params1a(rsn
=True, ssid
=None, passphrase
=None):
50 params
= ft_params(rsn
, ssid
, passphrase
)
51 params
['nas_identifier'] = "nas1.w1.fi"
52 params
['r1_key_holder'] = "000102030405"
55 def ft_params1(rsn
=True, ssid
=None, passphrase
=None):
56 params
= ft_params1a(rsn
, ssid
, passphrase
)
57 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
58 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
59 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
62 def ft_params2a(rsn
=True, ssid
=None, passphrase
=None):
63 params
= ft_params(rsn
, ssid
, passphrase
)
64 params
['nas_identifier'] = "nas2.w1.fi"
65 params
['r1_key_holder'] = "000102030406"
68 def ft_params2(rsn
=True, ssid
=None, passphrase
=None):
69 params
= ft_params2a(rsn
, ssid
, passphrase
)
70 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
71 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
72 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
75 def ft_params1_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
76 params
= ft_params(rsn
, ssid
, passphrase
)
77 params
['nas_identifier'] = "nas1.w1.fi"
78 params
['r1_key_holder'] = "000102030405"
79 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
80 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
81 params
['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
84 def ft_params2_incorrect_rrb_key(rsn
=True, ssid
=None, passphrase
=None):
85 params
= ft_params(rsn
, ssid
, passphrase
)
86 params
['nas_identifier'] = "nas2.w1.fi"
87 params
['r1_key_holder'] = "000102030406"
88 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1",
89 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2" ]
90 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3"
93 def ft_params2_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
94 params
= ft_params(rsn
, ssid
, passphrase
)
95 params
['nas_identifier'] = "nas2.w1.fi"
96 params
['r1_key_holder'] = "000102030406"
97 params
['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
98 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
99 params
['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
102 def run_roams(dev
, apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=False,
103 sae
=False, eap
=False, fail_test
=False, roams
=1,
104 pairwise_cipher
="CCMP", group_cipher
="TKIP CCMP", ptk_rekey
="0"):
105 logger
.info("Connect to first AP")
107 dev
.connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
108 eap
="GPSK", identity
="gpsk user",
109 password
="abcdefghijklmnop0123456789abcdef",
111 pairwise
=pairwise_cipher
, group
=group_cipher
,
112 wpa_ptk_rekey
=ptk_rekey
)
118 dev
.connect(ssid
, psk
=passphrase
, key_mgmt
=key_mgmt
, proto
="WPA2",
119 ieee80211w
="1", scan_freq
="2412",
120 pairwise
=pairwise_cipher
, group
=group_cipher
,
121 wpa_ptk_rekey
=ptk_rekey
)
122 if dev
.get_status_field('bssid') == apdev
[0]['bssid']:
132 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
134 dev
.scan_for_bss(ap2
['bssid'], freq
="2412")
136 for i
in range(0, roams
):
137 logger
.info("Roam to the second AP")
139 dev
.roam_over_ds(ap2
['bssid'], fail_test
=fail_test
)
141 dev
.roam(ap2
['bssid'], fail_test
=fail_test
)
144 if dev
.get_status_field('bssid') != ap2
['bssid']:
145 raise Exception("Did not connect to correct AP")
146 if i
== 0 or i
== roams
- 1:
147 hwsim_utils
.test_connectivity(dev
, hapd2ap
)
149 logger
.info("Roam back to the first AP")
151 dev
.roam_over_ds(ap1
['bssid'])
153 dev
.roam(ap1
['bssid'])
154 if dev
.get_status_field('bssid') != ap1
['bssid']:
155 raise Exception("Did not connect to correct AP")
156 if i
== 0 or i
== roams
- 1:
157 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
159 def test_ap_ft(dev
, apdev
):
162 passphrase
="12345678"
164 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
165 hapd0
= hostapd
.add_ap(apdev
[0], params
)
166 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
167 hapd1
= hostapd
.add_ap(apdev
[1], params
)
169 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
170 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
171 raise Exception("Scan results missing RSN element info")
173 def test_ap_ft_local_key_gen(dev
, apdev
):
174 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
176 passphrase
="12345678"
178 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
179 params
['ft_psk_generate_local'] = "1";
180 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
181 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
182 params
['ft_psk_generate_local'] = "1";
183 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
185 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
186 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
187 raise Exception("Scan results missing RSN element info")
189 def test_ap_ft_many(dev
, apdev
):
190 """WPA2-PSK-FT AP multiple times"""
192 passphrase
="12345678"
194 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
195 hapd0
= hostapd
.add_ap(apdev
[0], params
)
196 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
197 hapd1
= hostapd
.add_ap(apdev
[1], params
)
199 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50)
201 def test_ap_ft_mixed(dev
, apdev
):
202 """WPA2-PSK-FT mixed-mode AP"""
203 ssid
= "test-ft-mixed"
204 passphrase
="12345678"
206 params
= ft_params1(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
207 hapd
= hostapd
.add_ap(apdev
[0], params
)
208 key_mgmt
= hapd
.get_config()['key_mgmt']
209 vals
= key_mgmt
.split(' ')
210 if vals
[0] != "WPA-PSK" or vals
[1] != "FT-PSK":
211 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
212 params
= ft_params2(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
213 hapd1
= hostapd
.add_ap(apdev
[1], params
)
215 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
)
217 def test_ap_ft_pmf(dev
, apdev
):
218 """WPA2-PSK-FT AP with PMF"""
220 passphrase
="12345678"
222 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
223 params
["ieee80211w"] = "2"
224 hapd0
= hostapd
.add_ap(apdev
[0], params
)
225 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
226 params
["ieee80211w"] = "2"
227 hapd1
= hostapd
.add_ap(apdev
[1], params
)
229 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
231 def test_ap_ft_over_ds(dev
, apdev
):
232 """WPA2-PSK-FT AP over DS"""
234 passphrase
="12345678"
236 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
237 hapd0
= hostapd
.add_ap(apdev
[0], params
)
238 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
239 hapd1
= hostapd
.add_ap(apdev
[1], params
)
241 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
242 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
243 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
245 def test_ap_ft_over_ds_many(dev
, apdev
):
246 """WPA2-PSK-FT AP over DS multiple times"""
248 passphrase
="12345678"
250 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
251 hapd0
= hostapd
.add_ap(apdev
[0], params
)
252 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
253 hapd1
= hostapd
.add_ap(apdev
[1], params
)
255 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
259 def test_ap_ft_over_ds_unknown_target(dev
, apdev
):
262 passphrase
="12345678"
264 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
265 hapd0
= hostapd
.add_ap(apdev
[0], params
)
267 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
269 dev
[0].roam_over_ds("02:11:22:33:44:55", fail_test
=True)
272 def test_ap_ft_over_ds_unexpected(dev
, apdev
):
273 """WPA2-PSK-FT AP over DS and unexpected response"""
275 passphrase
="12345678"
277 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
278 hapd0
= hostapd
.add_ap(apdev
[0], params
)
279 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
280 hapd1
= hostapd
.add_ap(apdev
[1], params
)
282 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
284 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
295 addr
= dev
[0].own_addr()
296 hapd1ap
.set("ext_mgmt_frame_handling", "1")
297 logger
.info("Foreign STA address")
301 msg
['sa'] = ap1
['bssid']
302 msg
['bssid'] = ap1
['bssid']
303 msg
['payload'] = binascii
.unhexlify("06021122334455660102030405060000")
306 logger
.info("No over-the-DS in progress")
307 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
310 logger
.info("Non-zero status code")
311 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060100")
314 hapd1ap
.dump_monitor()
316 dev
[0].scan_for_bss(ap2
['bssid'], freq
="2412")
317 if "OK" not in dev
[0].request("FT_DS " + ap2
['bssid']):
318 raise Exception("FT_DS failed")
320 req
= hapd1ap
.mgmt_rx()
322 logger
.info("Foreign Target AP")
323 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
326 addrs
= addr
.replace(':', '') + ap2
['bssid'].replace(':', '')
328 logger
.info("No IEs")
329 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "0000")
332 logger
.info("Invalid IEs (trigger parsing failure)")
333 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003700")
336 logger
.info("Too short MDIE")
337 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "000036021122")
340 logger
.info("Mobility domain mismatch")
341 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603112201")
344 logger
.info("No FTIE")
345 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201")
348 logger
.info("FTIE SNonce mismatch")
349 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
352 logger
.info("No R0KH-ID subelem in FTIE")
353 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
354 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
)
357 logger
.info("No R0KH-ID subelem mismatch in FTIE")
358 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
359 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a11223344556677889900")
362 logger
.info("No R1KH-ID subelem in FTIE")
363 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
364 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
)
367 logger
.info("No RSNE")
368 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
369 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
+ "0106000102030405")
372 def test_ap_ft_pmf_over_ds(dev
, apdev
):
373 """WPA2-PSK-FT AP over DS with PMF"""
375 passphrase
="12345678"
377 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
378 params
["ieee80211w"] = "2"
379 hapd0
= hostapd
.add_ap(apdev
[0], params
)
380 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
381 params
["ieee80211w"] = "2"
382 hapd1
= hostapd
.add_ap(apdev
[1], params
)
384 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
386 def test_ap_ft_over_ds_pull(dev
, apdev
):
387 """WPA2-PSK-FT AP over DS (pull PMK)"""
389 passphrase
="12345678"
391 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
392 params
["pmk_r1_push"] = "0"
393 hapd0
= hostapd
.add_ap(apdev
[0], params
)
394 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
395 params
["pmk_r1_push"] = "0"
396 hapd1
= hostapd
.add_ap(apdev
[1], params
)
398 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
400 def test_ap_ft_sae(dev
, apdev
):
401 """WPA2-PSK-FT-SAE AP"""
402 if "SAE" not in dev
[0].get_capability("auth_alg"):
403 raise HwsimSkip("SAE not supported")
405 passphrase
="12345678"
407 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
408 params
['wpa_key_mgmt'] = "FT-SAE"
409 hapd0
= hostapd
.add_ap(apdev
[0], params
)
410 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
411 params
['wpa_key_mgmt'] = "FT-SAE"
412 hapd
= hostapd
.add_ap(apdev
[1], params
)
413 key_mgmt
= hapd
.get_config()['key_mgmt']
414 if key_mgmt
.split(' ')[0] != "FT-SAE":
415 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
417 dev
[0].request("SET sae_groups ")
418 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True)
420 def test_ap_ft_sae_over_ds(dev
, apdev
):
421 """WPA2-PSK-FT-SAE AP over DS"""
422 if "SAE" not in dev
[0].get_capability("auth_alg"):
423 raise HwsimSkip("SAE not supported")
425 passphrase
="12345678"
427 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
428 params
['wpa_key_mgmt'] = "FT-SAE"
429 hapd0
= hostapd
.add_ap(apdev
[0], params
)
430 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
431 params
['wpa_key_mgmt'] = "FT-SAE"
432 hapd1
= hostapd
.add_ap(apdev
[1], params
)
434 dev
[0].request("SET sae_groups ")
435 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, sae
=True,
438 def test_ap_ft_eap(dev
, apdev
):
441 passphrase
="12345678"
443 radius
= hostapd
.radius_params()
444 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
445 params
['wpa_key_mgmt'] = "FT-EAP"
446 params
["ieee8021x"] = "1"
447 params
= dict(radius
.items() + params
.items())
448 hapd
= hostapd
.add_ap(apdev
[0], params
)
449 key_mgmt
= hapd
.get_config()['key_mgmt']
450 if key_mgmt
.split(' ')[0] != "FT-EAP":
451 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
452 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
453 params
['wpa_key_mgmt'] = "FT-EAP"
454 params
["ieee8021x"] = "1"
455 params
= dict(radius
.items() + params
.items())
456 hapd1
= hostapd
.add_ap(apdev
[1], params
)
458 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
459 if "[WPA2-FT/EAP-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
460 raise Exception("Scan results missing RSN element info")
461 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
462 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
464 # Verify EAPOL reauthentication after FT protocol
465 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
469 ap
.request("EAPOL_REAUTH " + dev
[0].own_addr())
470 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout
=5)
472 raise Exception("EAP authentication did not start")
473 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout
=5)
475 raise Exception("EAP authentication did not succeed")
477 hwsim_utils
.test_connectivity(dev
[0], ap
)
479 def test_ap_ft_eap_pull(dev
, apdev
):
480 """WPA2-EAP-FT AP (pull PMK)"""
482 passphrase
="12345678"
484 radius
= hostapd
.radius_params()
485 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
486 params
['wpa_key_mgmt'] = "FT-EAP"
487 params
["ieee8021x"] = "1"
488 params
["pmk_r1_push"] = "0"
489 params
= dict(radius
.items() + params
.items())
490 hapd
= hostapd
.add_ap(apdev
[0], params
)
491 key_mgmt
= hapd
.get_config()['key_mgmt']
492 if key_mgmt
.split(' ')[0] != "FT-EAP":
493 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
494 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
495 params
['wpa_key_mgmt'] = "FT-EAP"
496 params
["ieee8021x"] = "1"
497 params
["pmk_r1_push"] = "0"
498 params
= dict(radius
.items() + params
.items())
499 hapd1
= hostapd
.add_ap(apdev
[1], params
)
501 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
504 def test_ap_ft_mismatching_rrb_key_push(dev
, apdev
):
505 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
507 passphrase
="12345678"
509 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
510 params
["ieee80211w"] = "2"
511 hapd0
= hostapd
.add_ap(apdev
[0], params
)
512 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
513 params
["ieee80211w"] = "2"
514 hapd1
= hostapd
.add_ap(apdev
[1], params
)
516 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
520 def test_ap_ft_mismatching_rrb_key_pull(dev
, apdev
):
521 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
523 passphrase
="12345678"
525 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
526 params
["pmk_r1_push"] = "0"
527 hapd0
= hostapd
.add_ap(apdev
[0], params
)
528 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
529 params
["pmk_r1_push"] = "0"
530 hapd1
= hostapd
.add_ap(apdev
[1], params
)
532 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
536 def test_ap_ft_mismatching_r0kh_id_pull(dev
, apdev
):
537 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
539 passphrase
="12345678"
541 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
542 params
["pmk_r1_push"] = "0"
543 params
["nas_identifier"] = "nas0.w1.fi"
544 hostapd
.add_ap(apdev
[0], params
)
545 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
548 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
549 params
["pmk_r1_push"] = "0"
550 hostapd
.add_ap(apdev
[1], params
)
552 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
553 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
556 def test_ap_ft_mismatching_rrb_r0kh_push(dev
, apdev
):
557 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
559 passphrase
="12345678"
561 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
562 params
["ieee80211w"] = "2"
563 hapd0
= hostapd
.add_ap(apdev
[0], params
)
564 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
565 params
["ieee80211w"] = "2"
566 hapd1
= hostapd
.add_ap(apdev
[1], params
)
568 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
572 def test_ap_ft_mismatching_rrb_r0kh_pull(dev
, apdev
):
573 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
575 passphrase
="12345678"
577 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
578 params
["pmk_r1_push"] = "0"
579 hapd0
= hostapd
.add_ap(apdev
[0], params
)
580 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
581 params
["pmk_r1_push"] = "0"
582 hapd1
= hostapd
.add_ap(apdev
[1], params
)
584 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
587 def test_ap_ft_mismatching_rrb_key_push_eap(dev
, apdev
):
588 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
590 passphrase
="12345678"
592 radius
= hostapd
.radius_params()
593 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
594 params
["ieee80211w"] = "2";
595 params
['wpa_key_mgmt'] = "FT-EAP"
596 params
["ieee8021x"] = "1"
597 params
= dict(radius
.items() + params
.items())
598 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
599 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
600 params
["ieee80211w"] = "2";
601 params
['wpa_key_mgmt'] = "FT-EAP"
602 params
["ieee8021x"] = "1"
603 params
= dict(radius
.items() + params
.items())
604 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
606 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
607 fail_test
=True, eap
=True)
609 def test_ap_ft_mismatching_rrb_key_pull_eap(dev
, apdev
):
610 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
612 passphrase
="12345678"
614 radius
= hostapd
.radius_params()
615 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
616 params
["pmk_r1_push"] = "0"
617 params
['wpa_key_mgmt'] = "FT-EAP"
618 params
["ieee8021x"] = "1"
619 params
= dict(radius
.items() + params
.items())
620 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
621 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
622 params
["pmk_r1_push"] = "0"
623 params
['wpa_key_mgmt'] = "FT-EAP"
624 params
["ieee8021x"] = "1"
625 params
= dict(radius
.items() + params
.items())
626 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
628 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
629 fail_test
=True, eap
=True)
631 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev
, apdev
):
632 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
634 passphrase
="12345678"
636 radius
= hostapd
.radius_params()
637 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
638 params
["pmk_r1_push"] = "0"
639 params
["nas_identifier"] = "nas0.w1.fi"
640 params
['wpa_key_mgmt'] = "FT-EAP"
641 params
["ieee8021x"] = "1"
642 params
= dict(radius
.items() + params
.items())
643 hostapd
.add_ap(apdev
[0]['ifname'], params
)
644 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
645 eap
="GPSK", identity
="gpsk user",
646 password
="abcdefghijklmnop0123456789abcdef",
649 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
650 params
["pmk_r1_push"] = "0"
651 params
['wpa_key_mgmt'] = "FT-EAP"
652 params
["ieee8021x"] = "1"
653 params
= dict(radius
.items() + params
.items())
654 hostapd
.add_ap(apdev
[1]['ifname'], params
)
656 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
657 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
659 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev
, apdev
):
660 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
662 passphrase
="12345678"
664 radius
= hostapd
.radius_params()
665 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
666 params
["ieee80211w"] = "2";
667 params
['wpa_key_mgmt'] = "FT-EAP"
668 params
["ieee8021x"] = "1"
669 params
= dict(radius
.items() + params
.items())
670 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
671 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
672 params
["ieee80211w"] = "2";
673 params
['wpa_key_mgmt'] = "FT-EAP"
674 params
["ieee8021x"] = "1"
675 params
= dict(radius
.items() + params
.items())
676 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
678 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
679 fail_test
=True, eap
=True)
681 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev
, apdev
):
682 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
684 passphrase
="12345678"
686 radius
= hostapd
.radius_params()
687 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
688 params
["pmk_r1_push"] = "0"
689 params
['wpa_key_mgmt'] = "FT-EAP"
690 params
["ieee8021x"] = "1"
691 params
= dict(radius
.items() + params
.items())
692 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
693 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
694 params
["pmk_r1_push"] = "0"
695 params
['wpa_key_mgmt'] = "FT-EAP"
696 params
["ieee8021x"] = "1"
697 params
= dict(radius
.items() + params
.items())
698 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
700 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
701 fail_test
=True, eap
=True)
703 def test_ap_ft_gtk_rekey(dev
, apdev
):
704 """WPA2-PSK-FT AP and GTK rekey"""
706 passphrase
="12345678"
708 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
709 params
['wpa_group_rekey'] = '1'
710 hapd
= hostapd
.add_ap(apdev
[0], params
)
712 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
713 ieee80211w
="1", scan_freq
="2412")
715 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
717 raise Exception("GTK rekey timed out after initial association")
718 hwsim_utils
.test_connectivity(dev
[0], hapd
)
720 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
721 params
['wpa_group_rekey'] = '1'
722 hapd1
= hostapd
.add_ap(apdev
[1], params
)
724 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
725 dev
[0].roam(apdev
[1]['bssid'])
726 if dev
[0].get_status_field('bssid') != apdev
[1]['bssid']:
727 raise Exception("Did not connect to correct AP")
728 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
730 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
732 raise Exception("GTK rekey timed out after FT protocol")
733 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
735 def test_ft_psk_key_lifetime_in_memory(dev
, apdev
, params
):
736 """WPA2-PSK-FT and key lifetime in memory"""
738 passphrase
="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
739 psk
= '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
740 pmk
= binascii
.unhexlify(psk
)
741 p
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
742 hapd0
= hostapd
.add_ap(apdev
[0], p
)
743 p
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
744 hapd1
= hostapd
.add_ap(apdev
[1], p
)
746 pid
= find_wpas_process(dev
[0])
748 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
750 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
751 # event has been delivered, so verify that wpa_supplicant has returned to
752 # eloop before reading process memory.
756 buf
= read_process_memory(pid
, pmk
)
758 dev
[0].request("DISCONNECT")
759 dev
[0].wait_disconnected()
766 with
open(os
.path
.join(params
['logdir'], 'log0'), 'r') as f
:
767 for l
in f
.readlines():
768 if "FT: PMK-R0 - hexdump" in l
:
769 val
= l
.strip().split(':')[3].replace(' ', '')
770 pmkr0
= binascii
.unhexlify(val
)
771 if "FT: PMK-R1 - hexdump" in l
:
772 val
= l
.strip().split(':')[3].replace(' ', '')
773 pmkr1
= binascii
.unhexlify(val
)
774 if "FT: KCK - hexdump" in l
:
775 val
= l
.strip().split(':')[3].replace(' ', '')
776 kck
= binascii
.unhexlify(val
)
777 if "FT: KEK - hexdump" in l
:
778 val
= l
.strip().split(':')[3].replace(' ', '')
779 kek
= binascii
.unhexlify(val
)
780 if "FT: TK - hexdump" in l
:
781 val
= l
.strip().split(':')[3].replace(' ', '')
782 tk
= binascii
.unhexlify(val
)
783 if "WPA: Group Key - hexdump" in l
:
784 val
= l
.strip().split(':')[3].replace(' ', '')
785 gtk
= binascii
.unhexlify(val
)
786 if not pmkr0
or not pmkr1
or not kck
or not kek
or not tk
or not gtk
:
787 raise Exception("Could not find keys from debug log")
789 raise Exception("Unexpected GTK length")
791 logger
.info("Checking keys in memory while associated")
792 get_key_locations(buf
, pmk
, "PMK")
793 get_key_locations(buf
, pmkr0
, "PMK-R0")
794 get_key_locations(buf
, pmkr1
, "PMK-R1")
796 raise HwsimSkip("PMK not found while associated")
798 raise HwsimSkip("PMK-R0 not found while associated")
800 raise HwsimSkip("PMK-R1 not found while associated")
802 raise Exception("KCK not found while associated")
804 raise Exception("KEK not found while associated")
806 raise Exception("TK found from memory")
808 get_key_locations(buf
, gtk
, "GTK")
809 raise Exception("GTK found from memory")
811 logger
.info("Checking keys in memory after disassociation")
812 buf
= read_process_memory(pid
, pmk
)
813 get_key_locations(buf
, pmk
, "PMK")
814 get_key_locations(buf
, pmkr0
, "PMK-R0")
815 get_key_locations(buf
, pmkr1
, "PMK-R1")
817 # Note: PMK/PSK is still present in network configuration
819 fname
= os
.path
.join(params
['logdir'],
820 'ft_psk_key_lifetime_in_memory.memctx-')
821 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
822 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
823 verify_not_present(buf
, kck
, fname
, "KCK")
824 verify_not_present(buf
, kek
, fname
, "KEK")
825 verify_not_present(buf
, tk
, fname
, "TK")
826 verify_not_present(buf
, gtk
, fname
, "GTK")
828 dev
[0].request("REMOVE_NETWORK all")
830 logger
.info("Checking keys in memory after network profile removal")
831 buf
= read_process_memory(pid
, pmk
)
832 get_key_locations(buf
, pmk
, "PMK")
833 get_key_locations(buf
, pmkr0
, "PMK-R0")
834 get_key_locations(buf
, pmkr1
, "PMK-R1")
836 verify_not_present(buf
, pmk
, fname
, "PMK")
837 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
838 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
839 verify_not_present(buf
, kck
, fname
, "KCK")
840 verify_not_present(buf
, kek
, fname
, "KEK")
841 verify_not_present(buf
, tk
, fname
, "TK")
842 verify_not_present(buf
, gtk
, fname
, "GTK")
845 def test_ap_ft_invalid_resp(dev
, apdev
):
846 """WPA2-PSK-FT AP and invalid response IEs"""
848 passphrase
="12345678"
850 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
851 hapd0
= hostapd
.add_ap(apdev
[0], params
)
852 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
855 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
856 hapd1
= hostapd
.add_ap(apdev
[1], params
)
859 # Various IEs for test coverage. The last one is FTIE with invalid
860 # R1KH-ID subelement.
861 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
862 # FTIE with invalid R0KH-ID subelement (len=0).
863 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
864 # FTIE with invalid R0KH-ID subelement (len=49).
865 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
867 "020002000000" + "3000",
868 # Required IEs missing from protected IE count.
869 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
870 # RIC missing from protected IE count.
871 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
872 # Protected IE missing.
873 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
875 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
876 hapd1
.set("ext_mgmt_frame_handling", "1")
878 if "OK" not in dev
[0].request("ROAM " + apdev
[1]['bssid']):
879 raise Exception("ROAM failed")
882 msg
= hapd1
.mgmt_rx()
883 if msg
['subtype'] == 11:
887 raise Exception("Authentication frame not seen")
890 resp
['fc'] = auth
['fc']
891 resp
['da'] = auth
['sa']
892 resp
['sa'] = auth
['da']
893 resp
['bssid'] = auth
['bssid']
894 resp
['payload'] = binascii
.unhexlify(t
)
896 hapd1
.set("ext_mgmt_frame_handling", "0")
897 dev
[0].wait_disconnected()
899 dev
[0].request("RECONNECT")
900 dev
[0].wait_connected()
902 def test_ap_ft_gcmp_256(dev
, apdev
):
903 """WPA2-PSK-FT AP with GCMP-256 cipher"""
904 if "GCMP-256" not in dev
[0].get_capability("pairwise"):
905 raise HwsimSkip("Cipher GCMP-256 not supported")
907 passphrase
="12345678"
909 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
910 params
['rsn_pairwise'] = "GCMP-256"
911 hapd0
= hostapd
.add_ap(apdev
[0], params
)
912 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
913 params
['rsn_pairwise'] = "GCMP-256"
914 hapd1
= hostapd
.add_ap(apdev
[1], params
)
916 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
917 pairwise_cipher
="GCMP-256", group_cipher
="GCMP-256")
919 def test_ap_ft_oom(dev
, apdev
):
920 """WPA2-PSK-FT and OOM"""
921 skip_with_fips(dev
[0])
923 passphrase
="12345678"
925 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
926 hapd0
= hostapd
.add_ap(apdev
[0], params
)
927 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
928 hapd1
= hostapd
.add_ap(apdev
[1], params
)
930 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
932 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
933 dst
= apdev
[1]['bssid']
935 dst
= apdev
[0]['bssid']
937 dev
[0].scan_for_bss(dst
, freq
="2412")
938 with
alloc_fail(dev
[0], 1, "wpa_ft_gen_req_ies"):
940 with
fail_test(dev
[0], 1, "wpa_ft_mic"):
941 dev
[0].roam(dst
, fail_test
=True)
942 with
fail_test(dev
[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
943 dev
[0].roam(dst
, fail_test
=True)
945 dev
[0].request("REMOVE_NETWORK all")
946 with
alloc_fail(dev
[0], 1, "=sme_update_ft_ies"):
947 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
950 def test_ap_ft_over_ds_proto(dev
, apdev
):
951 """WPA2-PSK-FT AP over DS protocol testing"""
953 passphrase
="12345678"
955 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
956 hapd0
= hostapd
.add_ap(apdev
[0], params
)
957 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
960 # FT Action Response while no FT-over-DS in progress
963 msg
['da'] = dev
[0].own_addr()
964 msg
['sa'] = apdev
[0]['bssid']
965 msg
['bssid'] = apdev
[0]['bssid']
966 msg
['payload'] = binascii
.unhexlify("06020200000000000200000004000000")
969 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
970 hapd1
= hostapd
.add_ap(apdev
[1], params
)
971 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
972 hapd0
.set("ext_mgmt_frame_handling", "1")
974 dev
[0].request("FT_DS " + apdev
[1]['bssid'])
975 for i
in range(0, 10):
976 req
= hapd0
.mgmt_rx()
978 raise Exception("MGMT RX wait timed out")
979 if req
['subtype'] == 13:
983 raise Exception("FT Action frame not received")
985 # FT Action Response for unexpected Target AP
986 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "f20000000400" + "0000")
989 # FT Action Response without MDIE
990 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000")
993 # FT Action Response without FTIE
994 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
997 # FT Action Response with FTIE SNonce mismatch
998 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1002 def test_ap_ft_rrb(dev
, apdev
):
1003 """WPA2-PSK-FT RRB protocol testing"""
1005 passphrase
="12345678"
1007 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1008 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1010 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1013 _dst_ll
= binascii
.unhexlify(apdev
[0]['bssid'].replace(':',''))
1014 _src_ll
= binascii
.unhexlify(dev
[0].own_addr().replace(':',''))
1016 ehdr
= _dst_ll
+ _src_ll
+ proto
1018 # Too short RRB frame
1020 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1021 raise Exception("DATA_TEST_FRAME failed")
1023 # RRB discarded frame wikth unrecognized type
1024 pkt
= ehdr
+ '\x02' + '\x02' + '\x01\x00' + _src_ll
1025 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1026 raise Exception("DATA_TEST_FRAME failed")
1028 # RRB frame too short for action frame
1029 pkt
= ehdr
+ '\x01' + '\x02' + '\x01\x00' + _src_ll
1030 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1031 raise Exception("DATA_TEST_FRAME failed")
1033 # Too short RRB frame (not enough room for Action Frame body)
1034 pkt
= ehdr
+ '\x01' + '\x02' + '\x00\x00' + _src_ll
1035 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1036 raise Exception("DATA_TEST_FRAME failed")
1038 # Unexpected Action frame category
1039 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1040 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1041 raise Exception("DATA_TEST_FRAME failed")
1043 # Unexpected Action in RRB Request
1044 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1045 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1046 raise Exception("DATA_TEST_FRAME failed")
1048 # Target AP address in RRB Request does not match with own address
1049 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1050 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1051 raise Exception("DATA_TEST_FRAME failed")
1053 # Not enough room for status code in RRB Response
1054 pkt
= ehdr
+ '\x01' + '\x01' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1055 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1056 raise Exception("DATA_TEST_FRAME failed")
1058 # RRB discarded frame with unknown packet_type
1059 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1060 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1061 raise Exception("DATA_TEST_FRAME failed")
1063 # RRB Response with non-zero status code; no STA match
1064 pkt
= ehdr
+ '\x01' + '\x01' + '\x10\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
1065 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1066 raise Exception("DATA_TEST_FRAME failed")
1068 # RRB Response with zero status code and extra data; STA match
1069 pkt
= ehdr
+ '\x01' + '\x01' + '\x11\x00' + _src_ll
+ '\x06\x01' + _src_ll
+ '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
1070 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1071 raise Exception("DATA_TEST_FRAME failed")
1073 # Too short PMK-R1 pull
1074 pkt
= ehdr
+ '\x01' + '\xc8' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1075 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1076 raise Exception("DATA_TEST_FRAME failed")
1078 # Too short PMK-R1 resp
1079 pkt
= ehdr
+ '\x01' + '\xc9' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1080 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1081 raise Exception("DATA_TEST_FRAME failed")
1083 # Too short PMK-R1 push
1084 pkt
= ehdr
+ '\x01' + '\xca' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1085 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1086 raise Exception("DATA_TEST_FRAME failed")
1088 # No matching R0KH address found for PMK-R0 pull response
1089 pkt
= ehdr
+ '\x01' + '\xc9' + '\x5a\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
1090 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1091 raise Exception("DATA_TEST_FRAME failed")
1094 def test_rsn_ie_proto_ft_psk_sta(dev
, apdev
):
1095 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
1096 bssid
= apdev
[0]['bssid']
1098 passphrase
="12345678"
1100 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1101 params
["ieee80211w"] = "1"
1102 # This is the RSN element used normally by hostapd
1103 params
['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
1104 hapd
= hostapd
.add_ap(apdev
[0], params
)
1105 id = dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1106 ieee80211w
="1", scan_freq
="2412",
1107 pairwise
="CCMP", group
="CCMP")
1109 tests
= [ ('PMKIDCount field included',
1110 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
1111 ('Extra IE before RSNE',
1112 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
1113 ('PMKIDCount and Group Management Cipher suite fields included',
1114 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
1115 ('Extra octet after defined fields (future extensibility)',
1116 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
1117 ('No RSN Capabilities field (PMF disabled in practice)',
1118 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
1119 for txt
,ie
in tests
:
1120 dev
[0].request("DISCONNECT")
1121 dev
[0].wait_disconnected()
1124 hapd
.set('own_ie_override', ie
)
1126 dev
[0].request("BSS_FLUSH 0")
1127 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1128 dev
[0].select_network(id, freq
=2412)
1129 dev
[0].wait_connected()
1131 dev
[0].request("DISCONNECT")
1132 dev
[0].wait_disconnected()
1134 logger
.info('Invalid RSNE causing internal hostapd error')
1136 hapd
.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
1138 dev
[0].request("BSS_FLUSH 0")
1139 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1140 dev
[0].select_network(id, freq
=2412)
1141 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1143 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1145 raise Exception("Unexpected connection")
1146 dev
[0].request("DISCONNECT")
1148 logger
.info('Unexpected PMKID causing internal hostapd error')
1150 hapd
.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
1152 dev
[0].request("BSS_FLUSH 0")
1153 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1154 dev
[0].select_network(id, freq
=2412)
1155 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1157 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1159 raise Exception("Unexpected connection")
1160 dev
[0].request("DISCONNECT")
1162 def test_ap_ft_ptk_rekey(dev
, apdev
):
1163 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
1165 passphrase
="12345678"
1167 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1168 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1169 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1170 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1172 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, ptk_rekey
="1")
1174 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1175 "WPA: Key negotiation completed"], timeout
=5)
1177 raise Exception("No event received after roam")
1178 if "CTRL-EVENT-DISCONNECTED" in ev
:
1179 raise Exception("Unexpected disconnection after roam")
1181 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1185 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1187 def test_ap_ft_ptk_rekey_ap(dev
, apdev
):
1188 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
1190 passphrase
="12345678"
1192 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1193 params
['wpa_ptk_rekey'] = '2'
1194 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1195 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1196 params
['wpa_ptk_rekey'] = '2'
1197 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1199 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
1201 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1202 "WPA: Key negotiation completed"], timeout
=5)
1204 raise Exception("No event received after roam")
1205 if "CTRL-EVENT-DISCONNECTED" in ev
:
1206 raise Exception("Unexpected disconnection after roam")
1208 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1212 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1214 def test_ap_ft_internal_rrb_check(dev
, apdev
):
1215 """RRB internal delivery only to WPA enabled BSS"""
1217 passphrase
="12345678"
1219 radius
= hostapd
.radius_params()
1220 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1221 params
['wpa_key_mgmt'] = "FT-EAP"
1222 params
["ieee8021x"] = "1"
1223 params
= dict(radius
.items() + params
.items())
1224 hapd
= hostapd
.add_ap(apdev
[0], params
)
1225 key_mgmt
= hapd
.get_config()['key_mgmt']
1226 if key_mgmt
.split(' ')[0] != "FT-EAP":
1227 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1229 hapd1
= hostapd
.add_ap(apdev
[1], { "ssid" : ssid
})
1231 # Connect to WPA enabled AP
1232 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
1233 eap
="GPSK", identity
="gpsk user",
1234 password
="abcdefghijklmnop0123456789abcdef",
1237 # Try over_ds roaming to non-WPA-enabled AP.
1238 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
1239 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1241 def test_ap_ft_extra_ie(dev
, apdev
):
1242 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
1244 passphrase
="12345678"
1246 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1247 params
["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
1248 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1249 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1251 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1254 # Add Mobility Domain element to test AP validation code.
1255 dev
[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
1256 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1257 scan_freq
="2412", wait_connect
=False)
1258 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED",
1259 "CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
1261 raise Exception("No connection result")
1262 if "CTRL-EVENT-CONNECTED" in ev
:
1263 raise Exception("Non-FT association accepted with MDE")
1264 if "status_code=43" not in ev
:
1265 raise Exception("Unexpected status code: " + ev
)
1266 dev
[0].request("DISCONNECT")
1268 dev
[0].request("VENDOR_ELEM_REMOVE 13 *")