tests/hwsim/test_ap_ft.py

   1 # Fast BSS Transition tests
   2 # Copyright (c) 2013-2017, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 from remotehost import remote_compatible
   8 import binascii
   9 import os
  10 import time
  11 import logging
  12 logger = logging.getLogger()
  13 import struct
  14
  15 import hwsim_utils
  16 import hostapd
  17 from tshark import run_tshark
  18 from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
  19 from wlantest import Wlantest
  20 from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
  21 from test_rrm import check_beacon_req
  22
  23 def ft_base_rsn():
  24     params = { "wpa": "2",
  25                "wpa_key_mgmt": "FT-PSK",
  26                "rsn_pairwise": "CCMP" }
  27     return params
  28
  29 def ft_base_mixed():
  30     params = { "wpa": "3",
  31                "wpa_key_mgmt": "WPA-PSK FT-PSK",
  32                "wpa_pairwise": "TKIP",
  33                "rsn_pairwise": "CCMP" }
  34     return params
  35
  36 def ft_params(rsn=True, ssid=None, passphrase=None):
  37     if rsn:
  38         params = ft_base_rsn()
  39     else:
  40         params = ft_base_mixed()
  41     if ssid:
  42         params["ssid"] = ssid
  43     if passphrase:
  44         params["wpa_passphrase"] = passphrase
  45
  46     params["mobility_domain"] = "a1b2"
  47     params["r0_key_lifetime"] = "10000"
  48     params["pmk_r1_push"] = "1"
  49     params["reassociation_deadline"] = "1000"
  50     return params
  51
  52 def ft_params1a(rsn=True, ssid=None, passphrase=None):
  53     params = ft_params(rsn, ssid, passphrase)
  54     params['nas_identifier'] = "nas1.w1.fi"
  55     params['r1_key_holder'] = "000102030405"
  56     return params
  57
  58 def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
  59     params = ft_params1a(rsn, ssid, passphrase)
  60     if discovery:
  61         params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  62         params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  63     else:
  64         params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
  65                            "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
  66         params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
  67     return params
  68
  69 def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
  70     params = ft_params1a(rsn, ssid, passphrase)
  71     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
  72                        "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
  73     params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
  74     return params
  75
  76 def ft_params2a(rsn=True, ssid=None, passphrase=None):
  77     params = ft_params(rsn, ssid, passphrase)
  78     params['nas_identifier'] = "nas2.w1.fi"
  79     params['r1_key_holder'] = "000102030406"
  80     return params
  81
  82 def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
  83     params = ft_params2a(rsn, ssid, passphrase)
  84     if discovery:
  85         params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  86         params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  87     else:
  88         params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
  89                            "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
  90         params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
  91     return params
  92
  93 def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
  94     params = ft_params2a(rsn, ssid, passphrase)
  95     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
  96                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
  97     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
  98     return params
  99
 100 def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
 101     params = ft_params(rsn, ssid, passphrase)
 102     params['nas_identifier'] = "nas1.w1.fi"
 103     params['r1_key_holder'] = "000102030405"
 104     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
 105                        "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
 106     params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
 107     return params
 108
 109 def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
 110     params = ft_params(rsn, ssid, passphrase)
 111     params['nas_identifier'] = "nas2.w1.fi"
 112     params['r1_key_holder'] = "000102030406"
 113     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
 114                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
 115     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
 116     return params
 117
 118 def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
 119     params = ft_params(rsn, ssid, passphrase)
 120     params['nas_identifier'] = "nas2.w1.fi"
 121     params['r1_key_holder'] = "000102030406"
 122     params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
 123                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
 124     params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
 125     return params
 126
 127 def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
 128               sae=False, eap=False, fail_test=False, roams=1,
 129               pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
 130               test_connectivity=True, eap_identity="gpsk user", conndev=False,
 131               force_initial_conn_to_first_ap=False, sha384=False,
 132               group_mgmt=None, ocv=None):
 133     logger.info("Connect to first AP")
 134
 135     copts = {}
 136     copts["proto"] = "WPA2"
 137     copts["ieee80211w"] = "1"
 138     copts["scan_freq"] = "2412"
 139     copts["pairwise"] = pairwise_cipher
 140     copts["group"]  = group_cipher
 141     copts["wpa_ptk_rekey"] = ptk_rekey
 142     if group_mgmt:
 143         copts["group_mgmt"] = group_mgmt
 144     if ocv:
 145         copts["ocv"] = ocv
 146     if eap:
 147         copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
 148         copts["eap"] = "GPSK"
 149         copts["identity"] = eap_identity
 150         copts["password"] = "abcdefghijklmnop0123456789abcdef"
 151     else:
 152         if sae:
 153             copts["key_mgmt"] = "FT-SAE"
 154         else:
 155             copts["key_mgmt"] = "FT-PSK"
 156         copts["psk"] = passphrase
 157     if force_initial_conn_to_first_ap:
 158         copts["bssid"] = apdev[0]['bssid']
 159     dev.connect(ssid, **copts)
 160
 161     if dev.get_status_field('bssid') == apdev[0]['bssid']:
 162         ap1 = apdev[0]
 163         ap2 = apdev[1]
 164         hapd1ap = hapd0
 165         hapd2ap = hapd1
 166     else:
 167         ap1 = apdev[1]
 168         ap2 = apdev[0]
 169         hapd1ap = hapd1
 170         hapd2ap = hapd0
 171     if test_connectivity:
 172         if conndev:
 173             hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
 174         else:
 175             hwsim_utils.test_connectivity(dev, hapd1ap)
 176
 177     dev.scan_for_bss(ap2['bssid'], freq="2412")
 178
 179     for i in range(0, roams):
 180         # Roaming artificially fast can make data test fail because the key is
 181         # set later.
 182         time.sleep(0.01)
 183         logger.info("Roam to the second AP")
 184         if over_ds:
 185             dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
 186         else:
 187             dev.roam(ap2['bssid'], fail_test=fail_test)
 188         if fail_test:
 189             return
 190         if dev.get_status_field('bssid') != ap2['bssid']:
 191             raise Exception("Did not connect to correct AP")
 192         if (i == 0 or i == roams - 1) and test_connectivity:
 193             if conndev:
 194                 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
 195             else:
 196                 hwsim_utils.test_connectivity(dev, hapd2ap)
 197
 198         # Roaming artificially fast can make data test fail because the key is
 199         # set later.
 200         time.sleep(0.01)
 201         logger.info("Roam back to the first AP")
 202         if over_ds:
 203             dev.roam_over_ds(ap1['bssid'])
 204         else:
 205             dev.roam(ap1['bssid'])
 206         if dev.get_status_field('bssid') != ap1['bssid']:
 207             raise Exception("Did not connect to correct AP")
 208         if (i == 0 or i == roams - 1) and test_connectivity:
 209             if conndev:
 210                 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
 211             else:
 212                 hwsim_utils.test_connectivity(dev, hapd1ap)
 213
 214 def test_ap_ft(dev, apdev):
 215     """WPA2-PSK-FT AP"""
 216     ssid = "test-ft"
 217     passphrase="12345678"
 218
 219     params = ft_params1(ssid=ssid, passphrase=passphrase)
 220     hapd0 = hostapd.add_ap(apdev[0], params)
 221     params = ft_params2(ssid=ssid, passphrase=passphrase)
 222     hapd1 = hostapd.add_ap(apdev[1], params)
 223
 224     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 225     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 226         raise Exception("Scan results missing RSN element info")
 227
 228 def test_ap_ft_old_key(dev, apdev):
 229     """WPA2-PSK-FT AP (old key)"""
 230     ssid = "test-ft"
 231     passphrase="12345678"
 232
 233     params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
 234     hapd0 = hostapd.add_ap(apdev[0], params)
 235     params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
 236     hapd1 = hostapd.add_ap(apdev[1], params)
 237
 238     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 239
 240 def test_ap_ft_multi_akm(dev, apdev):
 241     """WPA2-PSK-FT AP with non-FT AKMs enabled"""
 242     ssid = "test-ft"
 243     passphrase="12345678"
 244
 245     params = ft_params1(ssid=ssid, passphrase=passphrase)
 246     params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
 247     hapd0 = hostapd.add_ap(apdev[0], params)
 248     params = ft_params2(ssid=ssid, passphrase=passphrase)
 249     params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
 250     hapd1 = hostapd.add_ap(apdev[1], params)
 251
 252     Wlantest.setup(hapd0)
 253     wt = Wlantest()
 254     wt.flush()
 255     wt.add_passphrase(passphrase)
 256
 257     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 258     if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 259         raise Exception("Scan results missing RSN element info")
 260     dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
 261     dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
 262                    scan_freq="2412")
 263
 264 def test_ap_ft_local_key_gen(dev, apdev):
 265     """WPA2-PSK-FT AP with local key generation (without pull/push)"""
 266     ssid = "test-ft"
 267     passphrase="12345678"
 268
 269     params = ft_params1a(ssid=ssid, passphrase=passphrase)
 270     params['ft_psk_generate_local'] = "1";
 271     del params['pmk_r1_push']
 272     hapd0 = hostapd.add_ap(apdev[0], params)
 273     params = ft_params2a(ssid=ssid, passphrase=passphrase)
 274     params['ft_psk_generate_local'] = "1";
 275     del params['pmk_r1_push']
 276     hapd1 = hostapd.add_ap(apdev[1], params)
 277
 278     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 279     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 280         raise Exception("Scan results missing RSN element info")
 281
 282 def test_ap_ft_vlan(dev, apdev):
 283     """WPA2-PSK-FT AP with VLAN"""
 284     ssid = "test-ft"
 285     passphrase="12345678"
 286
 287     params = ft_params1(ssid=ssid, passphrase=passphrase)
 288     params['dynamic_vlan'] = "1";
 289     params['accept_mac_file'] = "hostapd.accept";
 290     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 291
 292     params = ft_params2(ssid=ssid, passphrase=passphrase)
 293     params['dynamic_vlan'] = "1";
 294     params['accept_mac_file'] = "hostapd.accept";
 295     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 296
 297     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
 298     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 299         raise Exception("Scan results missing RSN element info")
 300
 301 def test_ap_ft_vlan_disconnected(dev, apdev):
 302     """WPA2-PSK-FT AP with VLAN and local key generation"""
 303     ssid = "test-ft"
 304     passphrase="12345678"
 305
 306     params = ft_params1a(ssid=ssid, passphrase=passphrase)
 307     params['dynamic_vlan'] = "1";
 308     params['accept_mac_file'] = "hostapd.accept";
 309     params['ft_psk_generate_local'] = "1";
 310     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 311
 312     params = ft_params2a(ssid=ssid, passphrase=passphrase)
 313     params['dynamic_vlan'] = "1";
 314     params['accept_mac_file'] = "hostapd.accept";
 315     params['ft_psk_generate_local'] = "1";
 316     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 317
 318     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
 319     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 320         raise Exception("Scan results missing RSN element info")
 321
 322 def test_ap_ft_vlan_2(dev, apdev):
 323     """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
 324     ssid = "test-ft"
 325     passphrase="12345678"
 326
 327     params = ft_params1(ssid=ssid, passphrase=passphrase)
 328     params['dynamic_vlan'] = "1";
 329     params['accept_mac_file'] = "hostapd.accept";
 330     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 331
 332     params = ft_params2(ssid=ssid, passphrase=passphrase)
 333     params['dynamic_vlan'] = "1";
 334     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 335
 336     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
 337               force_initial_conn_to_first_ap=True)
 338     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 339         raise Exception("Scan results missing RSN element info")
 340
 341 def test_ap_ft_many(dev, apdev):
 342     """WPA2-PSK-FT AP multiple times"""
 343     ssid = "test-ft"
 344     passphrase="12345678"
 345
 346     params = ft_params1(ssid=ssid, passphrase=passphrase)
 347     hapd0 = hostapd.add_ap(apdev[0], params)
 348     params = ft_params2(ssid=ssid, passphrase=passphrase)
 349     hapd1 = hostapd.add_ap(apdev[1], params)
 350
 351     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
 352
 353 def test_ap_ft_many_vlan(dev, apdev):
 354     """WPA2-PSK-FT AP with VLAN multiple times"""
 355     ssid = "test-ft"
 356     passphrase="12345678"
 357
 358     params = ft_params1(ssid=ssid, passphrase=passphrase)
 359     params['dynamic_vlan'] = "1";
 360     params['accept_mac_file'] = "hostapd.accept";
 361     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 362
 363     params = ft_params2(ssid=ssid, passphrase=passphrase)
 364     params['dynamic_vlan'] = "1";
 365     params['accept_mac_file'] = "hostapd.accept";
 366     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 367
 368     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
 369               conndev="brvlan1")
 370
 371 def test_ap_ft_mixed(dev, apdev):
 372     """WPA2-PSK-FT mixed-mode AP"""
 373     ssid = "test-ft-mixed"
 374     passphrase="12345678"
 375
 376     params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
 377     hapd = hostapd.add_ap(apdev[0], params)
 378     key_mgmt = hapd.get_config()['key_mgmt']
 379     vals = key_mgmt.split(' ')
 380     if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
 381         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 382     params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
 383     hapd1 = hostapd.add_ap(apdev[1], params)
 384
 385     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
 386
 387 def test_ap_ft_pmf(dev, apdev):
 388     """WPA2-PSK-FT AP with PMF"""
 389     ssid = "test-ft"
 390     passphrase="12345678"
 391
 392     params = ft_params1(ssid=ssid, passphrase=passphrase)
 393     params["ieee80211w"] = "2"
 394     hapd0 = hostapd.add_ap(apdev[0], params)
 395     params = ft_params2(ssid=ssid, passphrase=passphrase)
 396     params["ieee80211w"] = "2"
 397     hapd1 = hostapd.add_ap(apdev[1], params)
 398
 399     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 400
 401 def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
 402     """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
 403     run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
 404
 405 def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
 406     """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
 407     run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
 408
 409 def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
 410     """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
 411     run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
 412
 413 def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
 414     """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
 415     run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
 416
 417 def run_ap_ft_pmf_bip(dev, apdev, cipher):
 418     if cipher not in dev[0].get_capability("group_mgmt"):
 419         raise HwsimSkip("Cipher %s not supported" % cipher)
 420
 421     ssid = "test-ft"
 422     passphrase="12345678"
 423
 424     params = ft_params1(ssid=ssid, passphrase=passphrase)
 425     params["ieee80211w"] = "2"
 426     params["group_mgmt_cipher"] = cipher
 427     hapd0 = hostapd.add_ap(apdev[0], params)
 428     params = ft_params2(ssid=ssid, passphrase=passphrase)
 429     params["ieee80211w"] = "2"
 430     params["group_mgmt_cipher"] = cipher
 431     hapd1 = hostapd.add_ap(apdev[1], params)
 432
 433     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
 434               group_mgmt=cipher)
 435
 436 def test_ap_ft_ocv(dev, apdev):
 437     """WPA2-PSK-FT AP with OCV"""
 438     ssid = "test-ft"
 439     passphrase="12345678"
 440
 441     params = ft_params1(ssid=ssid, passphrase=passphrase)
 442     params["ieee80211w"] = "2"
 443     params["ocv"] = "1"
 444     try:
 445         hapd0 = hostapd.add_ap(apdev[0], params)
 446     except Exception, e:
 447         if "Failed to set hostapd parameter ocv" in str(e):
 448             raise HwsimSkip("OCV not supported")
 449         raise
 450     params = ft_params2(ssid=ssid, passphrase=passphrase)
 451     params["ieee80211w"] = "2"
 452     params["ocv"] = "1"
 453     hapd1 = hostapd.add_ap(apdev[1], params)
 454
 455     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
 456
 457 def test_ap_ft_over_ds(dev, apdev):
 458     """WPA2-PSK-FT AP over DS"""
 459     ssid = "test-ft"
 460     passphrase="12345678"
 461
 462     params = ft_params1(ssid=ssid, passphrase=passphrase)
 463     hapd0 = hostapd.add_ap(apdev[0], params)
 464     params = ft_params2(ssid=ssid, passphrase=passphrase)
 465     hapd1 = hostapd.add_ap(apdev[1], params)
 466
 467     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 468     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
 469                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
 470
 471 def test_ap_ft_over_ds_ocv(dev, apdev):
 472     """WPA2-PSK-FT AP over DS"""
 473     ssid = "test-ft"
 474     passphrase="12345678"
 475
 476     params = ft_params1(ssid=ssid, passphrase=passphrase)
 477     params["ieee80211w"] = "2"
 478     params["ocv"] = "1"
 479     try:
 480         hapd0 = hostapd.add_ap(apdev[0], params)
 481     except Exception, e:
 482         if "Failed to set hostapd parameter ocv" in str(e):
 483             raise HwsimSkip("OCV not supported")
 484         raise
 485     params = ft_params2(ssid=ssid, passphrase=passphrase)
 486     params["ieee80211w"] = "2"
 487     params["ocv"] = "1"
 488     hapd1 = hostapd.add_ap(apdev[1], params)
 489
 490     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 491               ocv="1")
 492
 493 def test_ap_ft_over_ds_disabled(dev, apdev):
 494     """WPA2-PSK-FT AP over DS disabled"""
 495     ssid = "test-ft"
 496     passphrase="12345678"
 497
 498     params = ft_params1(ssid=ssid, passphrase=passphrase)
 499     params['ft_over_ds'] = '0'
 500     hapd0 = hostapd.add_ap(apdev[0], params)
 501     params = ft_params2(ssid=ssid, passphrase=passphrase)
 502     params['ft_over_ds'] = '0'
 503     hapd1 = hostapd.add_ap(apdev[1], params)
 504
 505     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 506               fail_test=True)
 507
 508 def test_ap_ft_vlan_over_ds(dev, apdev):
 509     """WPA2-PSK-FT AP over DS with VLAN"""
 510     ssid = "test-ft"
 511     passphrase="12345678"
 512
 513     params = ft_params1(ssid=ssid, passphrase=passphrase)
 514     params['dynamic_vlan'] = "1";
 515     params['accept_mac_file'] = "hostapd.accept";
 516     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 517     params = ft_params2(ssid=ssid, passphrase=passphrase)
 518     params['dynamic_vlan'] = "1";
 519     params['accept_mac_file'] = "hostapd.accept";
 520     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 521
 522     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 523               conndev="brvlan1")
 524     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
 525                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
 526
 527 def test_ap_ft_over_ds_many(dev, apdev):
 528     """WPA2-PSK-FT AP over DS multiple times"""
 529     ssid = "test-ft"
 530     passphrase="12345678"
 531
 532     params = ft_params1(ssid=ssid, passphrase=passphrase)
 533     hapd0 = hostapd.add_ap(apdev[0], params)
 534     params = ft_params2(ssid=ssid, passphrase=passphrase)
 535     hapd1 = hostapd.add_ap(apdev[1], params)
 536
 537     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 538               roams=50)
 539
 540 def test_ap_ft_vlan_over_ds_many(dev, apdev):
 541     """WPA2-PSK-FT AP over DS with VLAN multiple times"""
 542     ssid = "test-ft"
 543     passphrase="12345678"
 544
 545     params = ft_params1(ssid=ssid, passphrase=passphrase)
 546     params['dynamic_vlan'] = "1";
 547     params['accept_mac_file'] = "hostapd.accept";
 548     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 549     params = ft_params2(ssid=ssid, passphrase=passphrase)
 550     params['dynamic_vlan'] = "1";
 551     params['accept_mac_file'] = "hostapd.accept";
 552     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 553
 554     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 555               roams=50, conndev="brvlan1")
 556
 557 @remote_compatible
 558 def test_ap_ft_over_ds_unknown_target(dev, apdev):
 559     """WPA2-PSK-FT AP"""
 560     ssid = "test-ft"
 561     passphrase="12345678"
 562
 563     params = ft_params1(ssid=ssid, passphrase=passphrase)
 564     hapd0 = hostapd.add_ap(apdev[0], params)
 565
 566     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 567                    scan_freq="2412")
 568     dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
 569
 570 @remote_compatible
 571 def test_ap_ft_over_ds_unexpected(dev, apdev):
 572     """WPA2-PSK-FT AP over DS and unexpected response"""
 573     ssid = "test-ft"
 574     passphrase="12345678"
 575
 576     params = ft_params1(ssid=ssid, passphrase=passphrase)
 577     hapd0 = hostapd.add_ap(apdev[0], params)
 578     params = ft_params2(ssid=ssid, passphrase=passphrase)
 579     hapd1 = hostapd.add_ap(apdev[1], params)
 580
 581     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 582                    scan_freq="2412")
 583     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 584         ap1 = apdev[0]
 585         ap2 = apdev[1]
 586         hapd1ap = hapd0
 587         hapd2ap = hapd1
 588     else:
 589         ap1 = apdev[1]
 590         ap2 = apdev[0]
 591         hapd1ap = hapd1
 592         hapd2ap = hapd0
 593
 594     addr = dev[0].own_addr()
 595     hapd1ap.set("ext_mgmt_frame_handling", "1")
 596     logger.info("Foreign STA address")
 597     msg = {}
 598     msg['fc'] = 13 << 4
 599     msg['da'] = addr
 600     msg['sa'] = ap1['bssid']
 601     msg['bssid'] = ap1['bssid']
 602     msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
 603     hapd1ap.mgmt_tx(msg)
 604
 605     logger.info("No over-the-DS in progress")
 606     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 607     hapd1ap.mgmt_tx(msg)
 608
 609     logger.info("Non-zero status code")
 610     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
 611     hapd1ap.mgmt_tx(msg)
 612
 613     hapd1ap.dump_monitor()
 614
 615     dev[0].scan_for_bss(ap2['bssid'], freq="2412")
 616     if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
 617             raise Exception("FT_DS failed")
 618
 619     req = hapd1ap.mgmt_rx()
 620
 621     logger.info("Foreign Target AP")
 622     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 623     hapd1ap.mgmt_tx(msg)
 624
 625     addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
 626
 627     logger.info("No IEs")
 628     msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
 629     hapd1ap.mgmt_tx(msg)
 630
 631     logger.info("Invalid IEs (trigger parsing failure)")
 632     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
 633     hapd1ap.mgmt_tx(msg)
 634
 635     logger.info("Too short MDIE")
 636     msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
 637     hapd1ap.mgmt_tx(msg)
 638
 639     logger.info("Mobility domain mismatch")
 640     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
 641     hapd1ap.mgmt_tx(msg)
 642
 643     logger.info("No FTIE")
 644     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
 645     hapd1ap.mgmt_tx(msg)
 646
 647     logger.info("FTIE SNonce mismatch")
 648     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
 649     hapd1ap.mgmt_tx(msg)
 650
 651     logger.info("No R0KH-ID subelem in FTIE")
 652     snonce = binascii.hexlify(req['payload'][111:111+32])
 653     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
 654     hapd1ap.mgmt_tx(msg)
 655
 656     logger.info("No R0KH-ID subelem mismatch in FTIE")
 657     snonce = binascii.hexlify(req['payload'][111:111+32])
 658     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
 659     hapd1ap.mgmt_tx(msg)
 660
 661     logger.info("No R1KH-ID subelem in FTIE")
 662     r0khid = binascii.hexlify(req['payload'][145:145+10])
 663     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
 664     hapd1ap.mgmt_tx(msg)
 665
 666     logger.info("No RSNE")
 667     r0khid = binascii.hexlify(req['payload'][145:145+10])
 668     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
 669     hapd1ap.mgmt_tx(msg)
 670
 671 def test_ap_ft_pmf_over_ds(dev, apdev):
 672     """WPA2-PSK-FT AP over DS with PMF"""
 673     ssid = "test-ft"
 674     passphrase="12345678"
 675
 676     params = ft_params1(ssid=ssid, passphrase=passphrase)
 677     params["ieee80211w"] = "2"
 678     hapd0 = hostapd.add_ap(apdev[0], params)
 679     params = ft_params2(ssid=ssid, passphrase=passphrase)
 680     params["ieee80211w"] = "2"
 681     hapd1 = hostapd.add_ap(apdev[1], params)
 682
 683 def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
 684     """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
 685     run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
 686
 687 def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
 688     """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
 689     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
 690
 691 def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
 692     """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
 693     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
 694
 695 def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
 696     """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
 697     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
 698
 699 def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
 700     if cipher not in dev[0].get_capability("group_mgmt"):
 701         raise HwsimSkip("Cipher %s not supported" % cipher)
 702
 703     ssid = "test-ft"
 704     passphrase="12345678"
 705
 706     params = ft_params1(ssid=ssid, passphrase=passphrase)
 707     params["ieee80211w"] = "2"
 708     params["group_mgmt_cipher"] = cipher
 709     hapd0 = hostapd.add_ap(apdev[0], params)
 710     params = ft_params2(ssid=ssid, passphrase=passphrase)
 711     params["ieee80211w"] = "2"
 712     params["group_mgmt_cipher"] = cipher
 713     hapd1 = hostapd.add_ap(apdev[1], params)
 714
 715     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 716               group_mgmt=cipher)
 717
 718 def test_ap_ft_over_ds_pull(dev, apdev):
 719     """WPA2-PSK-FT AP over DS (pull PMK)"""
 720     ssid = "test-ft"
 721     passphrase="12345678"
 722
 723     params = ft_params1(ssid=ssid, passphrase=passphrase)
 724     params["pmk_r1_push"] = "0"
 725     hapd0 = hostapd.add_ap(apdev[0], params)
 726     params = ft_params2(ssid=ssid, passphrase=passphrase)
 727     params["pmk_r1_push"] = "0"
 728     hapd1 = hostapd.add_ap(apdev[1], params)
 729
 730     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 731
 732 def test_ap_ft_over_ds_pull_old_key(dev, apdev):
 733     """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
 734     ssid = "test-ft"
 735     passphrase="12345678"
 736
 737     params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
 738     params["pmk_r1_push"] = "0"
 739     hapd0 = hostapd.add_ap(apdev[0], params)
 740     params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
 741     params["pmk_r1_push"] = "0"
 742     hapd1 = hostapd.add_ap(apdev[1], params)
 743
 744     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 745
 746 def test_ap_ft_over_ds_pull_vlan(dev, apdev):
 747     """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
 748     ssid = "test-ft"
 749     passphrase="12345678"
 750
 751     params = ft_params1(ssid=ssid, passphrase=passphrase)
 752     params["pmk_r1_push"] = "0"
 753     params['dynamic_vlan'] = "1";
 754     params['accept_mac_file'] = "hostapd.accept";
 755     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 756     params = ft_params2(ssid=ssid, passphrase=passphrase)
 757     params["pmk_r1_push"] = "0"
 758     params['dynamic_vlan'] = "1";
 759     params['accept_mac_file'] = "hostapd.accept";
 760     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 761
 762     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 763               conndev="brvlan1")
 764
 765 def test_ap_ft_sae(dev, apdev):
 766     """WPA2-PSK-FT-SAE AP"""
 767     if "SAE" not in dev[0].get_capability("auth_alg"):
 768         raise HwsimSkip("SAE not supported")
 769     ssid = "test-ft"
 770     passphrase="12345678"
 771
 772     params = ft_params1(ssid=ssid, passphrase=passphrase)
 773     params['wpa_key_mgmt'] = "FT-SAE"
 774     hapd0 = hostapd.add_ap(apdev[0], params)
 775     params = ft_params2(ssid=ssid, passphrase=passphrase)
 776     params['wpa_key_mgmt'] = "FT-SAE"
 777     hapd = hostapd.add_ap(apdev[1], params)
 778     key_mgmt = hapd.get_config()['key_mgmt']
 779     if key_mgmt.split(' ')[0] != "FT-SAE":
 780         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 781
 782     dev[0].request("SET sae_groups ")
 783     run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
 784
 785 def test_ap_ft_sae_over_ds(dev, apdev):
 786     """WPA2-PSK-FT-SAE AP over DS"""
 787     if "SAE" not in dev[0].get_capability("auth_alg"):
 788         raise HwsimSkip("SAE not supported")
 789     ssid = "test-ft"
 790     passphrase="12345678"
 791
 792     params = ft_params1(ssid=ssid, passphrase=passphrase)
 793     params['wpa_key_mgmt'] = "FT-SAE"
 794     hapd0 = hostapd.add_ap(apdev[0], params)
 795     params = ft_params2(ssid=ssid, passphrase=passphrase)
 796     params['wpa_key_mgmt'] = "FT-SAE"
 797     hapd1 = hostapd.add_ap(apdev[1], params)
 798
 799     dev[0].request("SET sae_groups ")
 800     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
 801               over_ds=True)
 802
 803 def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
 804                       discovery=False, roams=1):
 805     ssid = "test-ft"
 806     passphrase="12345678"
 807     if vlan:
 808         identity="gpsk-vlan1"
 809         conndev="brvlan1"
 810     elif cui:
 811         identity="gpsk-cui"
 812         conndev=False
 813     else:
 814         identity="gpsk user"
 815         conndev=False
 816
 817     radius = hostapd.radius_params()
 818     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
 819     params['wpa_key_mgmt'] = "FT-EAP"
 820     params["ieee8021x"] = "1"
 821     if vlan:
 822         params["dynamic_vlan"] = "1"
 823     params = dict(radius.items() + params.items())
 824     hapd = hostapd.add_ap(apdev[0], params)
 825     key_mgmt = hapd.get_config()['key_mgmt']
 826     if key_mgmt.split(' ')[0] != "FT-EAP":
 827         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 828     params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
 829     params['wpa_key_mgmt'] = "FT-EAP"
 830     params["ieee8021x"] = "1"
 831     if vlan:
 832         params["dynamic_vlan"] = "1"
 833     params = dict(radius.items() + params.items())
 834     hapd1 = hostapd.add_ap(apdev[1], params)
 835
 836     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
 837               over_ds=over_ds, roams=roams, eap_identity=identity,
 838               conndev=conndev)
 839     if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 840         raise Exception("Scan results missing RSN element info")
 841     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
 842                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
 843
 844     # Verify EAPOL reauthentication after FT protocol
 845     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 846         ap = hapd
 847     else:
 848         ap = hapd1
 849     ap.request("EAPOL_REAUTH " + dev[0].own_addr())
 850     ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
 851     if ev is None:
 852         raise Exception("EAP authentication did not start")
 853     ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
 854     if ev is None:
 855         raise Exception("EAP authentication did not succeed")
 856     time.sleep(0.1)
 857     if conndev:
 858         hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
 859     else:
 860         hwsim_utils.test_connectivity(dev[0], ap)
 861
 862 def test_ap_ft_eap(dev, apdev):
 863     """WPA2-EAP-FT AP"""
 864     generic_ap_ft_eap(dev, apdev)
 865
 866 def test_ap_ft_eap_cui(dev, apdev):
 867     """WPA2-EAP-FT AP with CUI"""
 868     generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
 869
 870 def test_ap_ft_eap_vlan(dev, apdev):
 871     """WPA2-EAP-FT AP with VLAN"""
 872     generic_ap_ft_eap(dev, apdev, vlan=True)
 873
 874 def test_ap_ft_eap_vlan_multi(dev, apdev):
 875     """WPA2-EAP-FT AP with VLAN"""
 876     generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
 877
 878 def test_ap_ft_eap_over_ds(dev, apdev):
 879     """WPA2-EAP-FT AP using over-the-DS"""
 880     generic_ap_ft_eap(dev, apdev, over_ds=True)
 881
 882 def test_ap_ft_eap_dis(dev, apdev):
 883     """WPA2-EAP-FT AP with AP discovery"""
 884     generic_ap_ft_eap(dev, apdev, discovery=True)
 885
 886 def test_ap_ft_eap_dis_over_ds(dev, apdev):
 887     """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
 888     generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
 889
 890 def test_ap_ft_eap_vlan(dev, apdev):
 891     """WPA2-EAP-FT AP with VLAN"""
 892     generic_ap_ft_eap(dev, apdev, vlan=True)
 893
 894 def test_ap_ft_eap_vlan_multi(dev, apdev):
 895     """WPA2-EAP-FT AP with VLAN"""
 896     generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
 897
 898 def test_ap_ft_eap_vlan_over_ds(dev, apdev):
 899     """WPA2-EAP-FT AP with VLAN + over_ds"""
 900     generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
 901
 902 def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
 903     """WPA2-EAP-FT AP with VLAN + over_ds"""
 904     generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
 905
 906 def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
 907     """WPA2-EAP-FT AP (pull PMK)"""
 908     ssid = "test-ft"
 909     passphrase="12345678"
 910     if vlan:
 911         identity="gpsk-vlan1"
 912         conndev="brvlan1"
 913     else:
 914         identity="gpsk user"
 915         conndev=False
 916
 917     radius = hostapd.radius_params()
 918     params = ft_params1(ssid=ssid, passphrase=passphrase)
 919     params['wpa_key_mgmt'] = "FT-EAP"
 920     params["ieee8021x"] = "1"
 921     params["pmk_r1_push"] = "0"
 922     if vlan:
 923         params["dynamic_vlan"] = "1"
 924     params = dict(radius.items() + params.items())
 925     hapd = hostapd.add_ap(apdev[0], params)
 926     key_mgmt = hapd.get_config()['key_mgmt']
 927     if key_mgmt.split(' ')[0] != "FT-EAP":
 928         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 929     params = ft_params2(ssid=ssid, passphrase=passphrase)
 930     params['wpa_key_mgmt'] = "FT-EAP"
 931     params["ieee8021x"] = "1"
 932     params["pmk_r1_push"] = "0"
 933     if vlan:
 934         params["dynamic_vlan"] = "1"
 935     params = dict(radius.items() + params.items())
 936     hapd1 = hostapd.add_ap(apdev[1], params)
 937
 938     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
 939               eap_identity=identity, conndev=conndev)
 940
 941 def test_ap_ft_eap_pull(dev, apdev):
 942     """WPA2-EAP-FT AP (pull PMK)"""
 943     generic_ap_ft_eap_pull(dev, apdev)
 944
 945 def test_ap_ft_eap_pull_vlan(dev, apdev):
 946     generic_ap_ft_eap_pull(dev, apdev, vlan=True)
 947
 948 def test_ap_ft_eap_pull_wildcard(dev, apdev):
 949     """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
 950     ssid = "test-ft"
 951     passphrase="12345678"
 952
 953     radius = hostapd.radius_params()
 954     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
 955     params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
 956     params["ieee8021x"] = "1"
 957     params["pmk_r1_push"] = "0"
 958     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 959     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 960     params["ft_psk_generate_local"] = "1"
 961     params["eap_server"] = "0"
 962     params = dict(radius.items() + params.items())
 963     hapd = hostapd.add_ap(apdev[0], params)
 964     params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
 965     params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
 966     params["ieee8021x"] = "1"
 967     params["pmk_r1_push"] = "0"
 968     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 969     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 970     params["ft_psk_generate_local"] = "1"
 971     params["eap_server"] = "0"
 972     params = dict(radius.items() + params.items())
 973     hapd1 = hostapd.add_ap(apdev[1], params)
 974
 975     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
 976
 977 @remote_compatible
 978 def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
 979     """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
 980     ssid = "test-ft"
 981     passphrase="12345678"
 982
 983     params = ft_params1(ssid=ssid, passphrase=passphrase)
 984     params["ieee80211w"] = "2"
 985     hapd0 = hostapd.add_ap(apdev[0], params)
 986     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
 987     params["ieee80211w"] = "2"
 988     hapd1 = hostapd.add_ap(apdev[1], params)
 989
 990     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 991               fail_test=True)
 992
 993 @remote_compatible
 994 def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
 995     """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
 996     ssid = "test-ft"
 997     passphrase="12345678"
 998
 999     params = ft_params1(ssid=ssid, passphrase=passphrase)
1000     params["pmk_r1_push"] = "0"
1001     hapd0 = hostapd.add_ap(apdev[0], params)
1002     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1003     params["pmk_r1_push"] = "0"
1004     hapd1 = hostapd.add_ap(apdev[1], params)
1005
1006     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1007               fail_test=True)
1008
1009 @remote_compatible
1010 def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1011     """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1012     ssid = "test-ft"
1013     passphrase="12345678"
1014
1015     params = ft_params1(ssid=ssid, passphrase=passphrase)
1016     params["pmk_r1_push"] = "0"
1017     params["nas_identifier"] = "nas0.w1.fi"
1018     hostapd.add_ap(apdev[0], params)
1019     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1020                    scan_freq="2412")
1021
1022     params = ft_params2(ssid=ssid, passphrase=passphrase)
1023     params["pmk_r1_push"] = "0"
1024     hostapd.add_ap(apdev[1], params)
1025
1026     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1027     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1028
1029 @remote_compatible
1030 def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1031     """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1032     ssid = "test-ft"
1033     passphrase="12345678"
1034
1035     params = ft_params1(ssid=ssid, passphrase=passphrase)
1036     params["ieee80211w"] = "2"
1037     hapd0 = hostapd.add_ap(apdev[0], params)
1038     params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1039     params["ieee80211w"] = "2"
1040     hapd1 = hostapd.add_ap(apdev[1], params)
1041
1042     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1043               fail_test=True)
1044
1045 @remote_compatible
1046 def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1047     """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1048     ssid = "test-ft"
1049     passphrase="12345678"
1050
1051     params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1052     params["pmk_r1_push"] = "0"
1053     hapd0 = hostapd.add_ap(apdev[0], params)
1054     params = ft_params2(ssid=ssid, passphrase=passphrase)
1055     params["pmk_r1_push"] = "0"
1056     hapd1 = hostapd.add_ap(apdev[1], params)
1057
1058     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1059               fail_test=True)
1060
1061 def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1062     """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1063     ssid = "test-ft"
1064     passphrase="12345678"
1065
1066     radius = hostapd.radius_params()
1067     params = ft_params1(ssid=ssid, passphrase=passphrase)
1068     params["ieee80211w"] = "2";
1069     params['wpa_key_mgmt'] = "FT-EAP"
1070     params["ieee8021x"] = "1"
1071     params = dict(radius.items() + params.items())
1072     hapd0 = hostapd.add_ap(apdev[0], params)
1073     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1074     params["ieee80211w"] = "2";
1075     params['wpa_key_mgmt'] = "FT-EAP"
1076     params["ieee8021x"] = "1"
1077     params = dict(radius.items() + params.items())
1078     hapd1 = hostapd.add_ap(apdev[1], params)
1079
1080     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1081               fail_test=True, eap=True)
1082
1083 def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1084     """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1085     ssid = "test-ft"
1086     passphrase="12345678"
1087
1088     radius = hostapd.radius_params()
1089     params = ft_params1(ssid=ssid, passphrase=passphrase)
1090     params["pmk_r1_push"] = "0"
1091     params['wpa_key_mgmt'] = "FT-EAP"
1092     params["ieee8021x"] = "1"
1093     params = dict(radius.items() + params.items())
1094     hapd0 = hostapd.add_ap(apdev[0], params)
1095     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1096     params["pmk_r1_push"] = "0"
1097     params['wpa_key_mgmt'] = "FT-EAP"
1098     params["ieee8021x"] = "1"
1099     params = dict(radius.items() + params.items())
1100     hapd1 = hostapd.add_ap(apdev[1], params)
1101
1102     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1103               fail_test=True, eap=True)
1104
1105 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1106     """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1107     ssid = "test-ft"
1108     passphrase="12345678"
1109
1110     radius = hostapd.radius_params()
1111     params = ft_params1(ssid=ssid, passphrase=passphrase)
1112     params["pmk_r1_push"] = "0"
1113     params["nas_identifier"] = "nas0.w1.fi"
1114     params['wpa_key_mgmt'] = "FT-EAP"
1115     params["ieee8021x"] = "1"
1116     params = dict(radius.items() + params.items())
1117     hostapd.add_ap(apdev[0], params)
1118     dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1119                    eap="GPSK", identity="gpsk user",
1120                    password="abcdefghijklmnop0123456789abcdef",
1121                    scan_freq="2412")
1122
1123     params = ft_params2(ssid=ssid, passphrase=passphrase)
1124     params["pmk_r1_push"] = "0"
1125     params['wpa_key_mgmt'] = "FT-EAP"
1126     params["ieee8021x"] = "1"
1127     params = dict(radius.items() + params.items())
1128     hostapd.add_ap(apdev[1], params)
1129
1130     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1131     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1132
1133 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1134     """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1135     ssid = "test-ft"
1136     passphrase="12345678"
1137
1138     radius = hostapd.radius_params()
1139     params = ft_params1(ssid=ssid, passphrase=passphrase)
1140     params["ieee80211w"] = "2";
1141     params['wpa_key_mgmt'] = "FT-EAP"
1142     params["ieee8021x"] = "1"
1143     params = dict(radius.items() + params.items())
1144     hapd0 = hostapd.add_ap(apdev[0], params)
1145     params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1146     params["ieee80211w"] = "2";
1147     params['wpa_key_mgmt'] = "FT-EAP"
1148     params["ieee8021x"] = "1"
1149     params = dict(radius.items() + params.items())
1150     hapd1 = hostapd.add_ap(apdev[1], params)
1151
1152     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1153               fail_test=True, eap=True)
1154
1155 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1156     """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1157     ssid = "test-ft"
1158     passphrase="12345678"
1159
1160     radius = hostapd.radius_params()
1161     params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1162     params["pmk_r1_push"] = "0"
1163     params['wpa_key_mgmt'] = "FT-EAP"
1164     params["ieee8021x"] = "1"
1165     params = dict(radius.items() + params.items())
1166     hapd0 = hostapd.add_ap(apdev[0], params)
1167     params = ft_params2(ssid=ssid, passphrase=passphrase)
1168     params["pmk_r1_push"] = "0"
1169     params['wpa_key_mgmt'] = "FT-EAP"
1170     params["ieee8021x"] = "1"
1171     params = dict(radius.items() + params.items())
1172     hapd1 = hostapd.add_ap(apdev[1], params)
1173
1174     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1175               fail_test=True, eap=True)
1176
1177 def test_ap_ft_gtk_rekey(dev, apdev):
1178     """WPA2-PSK-FT AP and GTK rekey"""
1179     ssid = "test-ft"
1180     passphrase="12345678"
1181
1182     params = ft_params1(ssid=ssid, passphrase=passphrase)
1183     params['wpa_group_rekey'] = '1'
1184     hapd = hostapd.add_ap(apdev[0], params)
1185
1186     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1187                    ieee80211w="1", scan_freq="2412")
1188
1189     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1190     if ev is None:
1191         raise Exception("GTK rekey timed out after initial association")
1192     hwsim_utils.test_connectivity(dev[0], hapd)
1193
1194     params = ft_params2(ssid=ssid, passphrase=passphrase)
1195     params['wpa_group_rekey'] = '1'
1196     hapd1 = hostapd.add_ap(apdev[1], params)
1197
1198     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1199     dev[0].roam(apdev[1]['bssid'])
1200     if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1201         raise Exception("Did not connect to correct AP")
1202     hwsim_utils.test_connectivity(dev[0], hapd1)
1203
1204     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1205     if ev is None:
1206         raise Exception("GTK rekey timed out after FT protocol")
1207     hwsim_utils.test_connectivity(dev[0], hapd1)
1208
1209 def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1210     """WPA2-PSK-FT and key lifetime in memory"""
1211     ssid = "test-ft"
1212     passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1213     psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1214     pmk = binascii.unhexlify(psk)
1215     p = ft_params1(ssid=ssid, passphrase=passphrase)
1216     hapd0 = hostapd.add_ap(apdev[0], p)
1217     p = ft_params2(ssid=ssid, passphrase=passphrase)
1218     hapd1 = hostapd.add_ap(apdev[1], p)
1219
1220     pid = find_wpas_process(dev[0])
1221
1222     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1223                    scan_freq="2412")
1224     # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1225     # event has been delivered, so verify that wpa_supplicant has returned to
1226     # eloop before reading process memory.
1227     time.sleep(1)
1228     dev[0].ping()
1229
1230     buf = read_process_memory(pid, pmk)
1231
1232     dev[0].request("DISCONNECT")
1233     dev[0].wait_disconnected()
1234
1235     dev[0].relog()
1236     pmkr0 = None
1237     pmkr1 = None
1238     ptk = None
1239     gtk = None
1240     with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1241         for l in f.readlines():
1242             if "FT: PMK-R0 - hexdump" in l:
1243                 val = l.strip().split(':')[3].replace(' ', '')
1244                 pmkr0 = binascii.unhexlify(val)
1245             if "FT: PMK-R1 - hexdump" in l:
1246                 val = l.strip().split(':')[3].replace(' ', '')
1247                 pmkr1 = binascii.unhexlify(val)
1248             if "FT: KCK - hexdump" in l:
1249                 val = l.strip().split(':')[3].replace(' ', '')
1250                 kck = binascii.unhexlify(val)
1251             if "FT: KEK - hexdump" in l:
1252                 val = l.strip().split(':')[3].replace(' ', '')
1253                 kek = binascii.unhexlify(val)
1254             if "FT: TK - hexdump" in l:
1255                 val = l.strip().split(':')[3].replace(' ', '')
1256                 tk = binascii.unhexlify(val)
1257             if "WPA: Group Key - hexdump" in l:
1258                 val = l.strip().split(':')[3].replace(' ', '')
1259                 gtk = binascii.unhexlify(val)
1260     if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
1261         raise Exception("Could not find keys from debug log")
1262     if len(gtk) != 16:
1263         raise Exception("Unexpected GTK length")
1264
1265     logger.info("Checking keys in memory while associated")
1266     get_key_locations(buf, pmk, "PMK")
1267     get_key_locations(buf, pmkr0, "PMK-R0")
1268     get_key_locations(buf, pmkr1, "PMK-R1")
1269     if pmk not in buf:
1270         raise HwsimSkip("PMK not found while associated")
1271     if pmkr0 not in buf:
1272         raise HwsimSkip("PMK-R0 not found while associated")
1273     if pmkr1 not in buf:
1274         raise HwsimSkip("PMK-R1 not found while associated")
1275     if kck not in buf:
1276         raise Exception("KCK not found while associated")
1277     if kek not in buf:
1278         raise Exception("KEK not found while associated")
1279     #if tk in buf:
1280     #    raise Exception("TK found from memory")
1281
1282     logger.info("Checking keys in memory after disassociation")
1283     buf = read_process_memory(pid, pmk)
1284     get_key_locations(buf, pmk, "PMK")
1285     get_key_locations(buf, pmkr0, "PMK-R0")
1286     get_key_locations(buf, pmkr1, "PMK-R1")
1287
1288     # Note: PMK/PSK is still present in network configuration
1289
1290     fname = os.path.join(params['logdir'],
1291                          'ft_psk_key_lifetime_in_memory.memctx-')
1292     verify_not_present(buf, pmkr0, fname, "PMK-R0")
1293     verify_not_present(buf, pmkr1, fname, "PMK-R1")
1294     verify_not_present(buf, kck, fname, "KCK")
1295     verify_not_present(buf, kek, fname, "KEK")
1296     verify_not_present(buf, tk, fname, "TK")
1297     if gtk in buf:
1298         get_key_locations(buf, gtk, "GTK")
1299     verify_not_present(buf, gtk, fname, "GTK")
1300
1301     dev[0].request("REMOVE_NETWORK all")
1302
1303     logger.info("Checking keys in memory after network profile removal")
1304     buf = read_process_memory(pid, pmk)
1305     get_key_locations(buf, pmk, "PMK")
1306     get_key_locations(buf, pmkr0, "PMK-R0")
1307     get_key_locations(buf, pmkr1, "PMK-R1")
1308
1309     verify_not_present(buf, pmk, fname, "PMK")
1310     verify_not_present(buf, pmkr0, fname, "PMK-R0")
1311     verify_not_present(buf, pmkr1, fname, "PMK-R1")
1312     verify_not_present(buf, kck, fname, "KCK")
1313     verify_not_present(buf, kek, fname, "KEK")
1314     verify_not_present(buf, tk, fname, "TK")
1315     verify_not_present(buf, gtk, fname, "GTK")
1316
1317 @remote_compatible
1318 def test_ap_ft_invalid_resp(dev, apdev):
1319     """WPA2-PSK-FT AP and invalid response IEs"""
1320     ssid = "test-ft"
1321     passphrase="12345678"
1322
1323     params = ft_params1(ssid=ssid, passphrase=passphrase)
1324     hapd0 = hostapd.add_ap(apdev[0], params)
1325     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1326                    scan_freq="2412")
1327
1328     params = ft_params2(ssid=ssid, passphrase=passphrase)
1329     hapd1 = hostapd.add_ap(apdev[1], params)
1330
1331     tests = [
1332         # Various IEs for test coverage. The last one is FTIE with invalid
1333         # R1KH-ID subelement.
1334         "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1335         # FTIE with invalid R0KH-ID subelement (len=0).
1336         "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1337         # FTIE with invalid R0KH-ID subelement (len=49).
1338         "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1339         # Invalid RSNE.
1340         "020002000000" + "3000",
1341         # Required IEs missing from protected IE count.
1342         "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1343         # RIC missing from protected IE count.
1344         "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1345         # Protected IE missing.
1346         "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1347     for t in tests:
1348         dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1349         hapd1.set("ext_mgmt_frame_handling", "1")
1350         hapd1.dump_monitor()
1351         if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1352             raise Exception("ROAM failed")
1353         auth = None
1354         for i in range(20):
1355             msg = hapd1.mgmt_rx()
1356             if msg['subtype'] == 11:
1357                 auth = msg
1358                 break
1359         if not auth:
1360             raise Exception("Authentication frame not seen")
1361
1362         resp = {}
1363         resp['fc'] = auth['fc']
1364         resp['da'] = auth['sa']
1365         resp['sa'] = auth['da']
1366         resp['bssid'] = auth['bssid']
1367         resp['payload'] = binascii.unhexlify(t)
1368         hapd1.mgmt_tx(resp)
1369         hapd1.set("ext_mgmt_frame_handling", "0")
1370         dev[0].wait_disconnected()
1371
1372         dev[0].request("RECONNECT")
1373         dev[0].wait_connected()
1374
1375 def test_ap_ft_gcmp_256(dev, apdev):
1376     """WPA2-PSK-FT AP with GCMP-256 cipher"""
1377     if "GCMP-256" not in dev[0].get_capability("pairwise"):
1378         raise HwsimSkip("Cipher GCMP-256 not supported")
1379     ssid = "test-ft"
1380     passphrase="12345678"
1381
1382     params = ft_params1(ssid=ssid, passphrase=passphrase)
1383     params['rsn_pairwise'] = "GCMP-256"
1384     hapd0 = hostapd.add_ap(apdev[0], params)
1385     params = ft_params2(ssid=ssid, passphrase=passphrase)
1386     params['rsn_pairwise'] = "GCMP-256"
1387     hapd1 = hostapd.add_ap(apdev[1], params)
1388
1389     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1390               pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
1391
1392 def setup_ap_ft_oom(dev, apdev):
1393     skip_with_fips(dev[0])
1394     ssid = "test-ft"
1395     passphrase="12345678"
1396
1397     params = ft_params1(ssid=ssid, passphrase=passphrase)
1398     hapd0 = hostapd.add_ap(apdev[0], params)
1399     params = ft_params2(ssid=ssid, passphrase=passphrase)
1400     hapd1 = hostapd.add_ap(apdev[1], params)
1401
1402     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1403                    scan_freq="2412")
1404     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1405         dst = apdev[1]['bssid']
1406     else:
1407         dst = apdev[0]['bssid']
1408
1409     dev[0].scan_for_bss(dst, freq="2412")
1410
1411     return dst
1412
1413 def test_ap_ft_oom(dev, apdev):
1414     """WPA2-PSK-FT and OOM"""
1415     dst = setup_ap_ft_oom(dev, apdev)
1416     with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1417         dev[0].roam(dst)
1418
1419 def test_ap_ft_oom2(dev, apdev):
1420     """WPA2-PSK-FT and OOM (2)"""
1421     dst = setup_ap_ft_oom(dev, apdev)
1422     with fail_test(dev[0], 1, "wpa_ft_mic"):
1423         dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1424
1425 def test_ap_ft_oom3(dev, apdev):
1426     """WPA2-PSK-FT and OOM (3)"""
1427     dst = setup_ap_ft_oom(dev, apdev)
1428     with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1429         dev[0].roam(dst)
1430
1431 def test_ap_ft_oom4(dev, apdev):
1432     """WPA2-PSK-FT and OOM (4)"""
1433     ssid = "test-ft"
1434     passphrase="12345678"
1435     dst = setup_ap_ft_oom(dev, apdev)
1436     dev[0].request("REMOVE_NETWORK all")
1437     with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1438         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1439                        scan_freq="2412")
1440
1441 def test_ap_ft_ap_oom(dev, apdev):
1442     """WPA2-PSK-FT and AP OOM"""
1443     ssid = "test-ft"
1444     passphrase="12345678"
1445
1446     params = ft_params1(ssid=ssid, passphrase=passphrase)
1447     hapd0 = hostapd.add_ap(apdev[0], params)
1448     bssid0 = hapd0.own_addr()
1449
1450     dev[0].scan_for_bss(bssid0, freq="2412")
1451     with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1452         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1453                        scan_freq="2412")
1454
1455     params = ft_params2(ssid=ssid, passphrase=passphrase)
1456     hapd1 = hostapd.add_ap(apdev[1], params)
1457     bssid1 = hapd1.own_addr()
1458     dev[0].scan_for_bss(bssid1, freq="2412")
1459     # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1460     dev[0].roam(bssid1)
1461
1462 def test_ap_ft_ap_oom2(dev, apdev):
1463     """WPA2-PSK-FT and AP OOM 2"""
1464     ssid = "test-ft"
1465     passphrase="12345678"
1466
1467     params = ft_params1(ssid=ssid, passphrase=passphrase)
1468     hapd0 = hostapd.add_ap(apdev[0], params)
1469     bssid0 = hapd0.own_addr()
1470
1471     dev[0].scan_for_bss(bssid0, freq="2412")
1472     with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1473         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1474                        scan_freq="2412")
1475
1476     params = ft_params2(ssid=ssid, passphrase=passphrase)
1477     hapd1 = hostapd.add_ap(apdev[1], params)
1478     bssid1 = hapd1.own_addr()
1479     dev[0].scan_for_bss(bssid1, freq="2412")
1480     dev[0].roam(bssid1)
1481     if dev[0].get_status_field('bssid') != bssid1:
1482         raise Exception("Did not roam to AP1")
1483     # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1484     dev[0].roam(bssid0)
1485
1486 def test_ap_ft_ap_oom3(dev, apdev):
1487     """WPA2-PSK-FT and AP OOM 3"""
1488     ssid = "test-ft"
1489     passphrase="12345678"
1490
1491     params = ft_params1(ssid=ssid, passphrase=passphrase)
1492     hapd0 = hostapd.add_ap(apdev[0], params)
1493     bssid0 = hapd0.own_addr()
1494
1495     dev[0].scan_for_bss(bssid0, freq="2412")
1496     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1497                    scan_freq="2412")
1498
1499     params = ft_params2(ssid=ssid, passphrase=passphrase)
1500     hapd1 = hostapd.add_ap(apdev[1], params)
1501     bssid1 = hapd1.own_addr()
1502     dev[0].scan_for_bss(bssid1, freq="2412")
1503     with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1504         # This will fail due to not being able to send out PMK-R1 pull request
1505         dev[0].roam(bssid1)
1506
1507     with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1508         # This will fail due to not being able to send out PMK-R1 pull request
1509         dev[0].roam(bssid1)
1510
1511     with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1512         # This will fail due to not being able to send out PMK-R1 pull request
1513         dev[0].roam(bssid1)
1514
1515 def test_ap_ft_ap_oom3b(dev, apdev):
1516     """WPA2-PSK-FT and AP OOM 3b"""
1517     ssid = "test-ft"
1518     passphrase="12345678"
1519
1520     params = ft_params1(ssid=ssid, passphrase=passphrase)
1521     hapd0 = hostapd.add_ap(apdev[0], params)
1522     bssid0 = hapd0.own_addr()
1523
1524     dev[0].scan_for_bss(bssid0, freq="2412")
1525     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1526                    scan_freq="2412")
1527
1528     params = ft_params2(ssid=ssid, passphrase=passphrase)
1529     hapd1 = hostapd.add_ap(apdev[1], params)
1530     bssid1 = hapd1.own_addr()
1531     dev[0].scan_for_bss(bssid1, freq="2412")
1532     with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1533         # This will fail due to not being able to send out PMK-R1 pull request
1534         dev[0].roam(bssid1)
1535
1536 def test_ap_ft_ap_oom4(dev, apdev):
1537     """WPA2-PSK-FT and AP OOM 4"""
1538     ssid = "test-ft"
1539     passphrase="12345678"
1540
1541     params = ft_params1(ssid=ssid, passphrase=passphrase)
1542     hapd0 = hostapd.add_ap(apdev[0], params)
1543     bssid0 = hapd0.own_addr()
1544
1545     dev[0].scan_for_bss(bssid0, freq="2412")
1546     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1547                    scan_freq="2412")
1548
1549     params = ft_params2(ssid=ssid, passphrase=passphrase)
1550     hapd1 = hostapd.add_ap(apdev[1], params)
1551     bssid1 = hapd1.own_addr()
1552     dev[0].scan_for_bss(bssid1, freq="2412")
1553     with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1554         dev[0].roam(bssid1)
1555         if dev[0].get_status_field('bssid') != bssid1:
1556             raise Exception("Did not roam to AP1")
1557
1558     with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1559         dev[0].roam(bssid0)
1560         if dev[0].get_status_field('bssid') != bssid0:
1561             raise Exception("Did not roam to AP0")
1562
1563     with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1564         dev[0].roam(bssid1)
1565         if dev[0].get_status_field('bssid') != bssid1:
1566             raise Exception("Did not roam to AP1")
1567
1568 def test_ap_ft_ap_oom5(dev, apdev):
1569     """WPA2-PSK-FT and AP OOM 5"""
1570     ssid = "test-ft"
1571     passphrase="12345678"
1572
1573     params = ft_params1(ssid=ssid, passphrase=passphrase)
1574     hapd0 = hostapd.add_ap(apdev[0], params)
1575     bssid0 = hapd0.own_addr()
1576
1577     dev[0].scan_for_bss(bssid0, freq="2412")
1578     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1579                    scan_freq="2412")
1580
1581     params = ft_params2(ssid=ssid, passphrase=passphrase)
1582     hapd1 = hostapd.add_ap(apdev[1], params)
1583     bssid1 = hapd1.own_addr()
1584     dev[0].scan_for_bss(bssid1, freq="2412")
1585     with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1586         # This will fail to roam
1587         dev[0].roam(bssid1)
1588
1589     with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1590         # This will fail to roam
1591         dev[0].roam(bssid1)
1592
1593     with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1594         # This will fail to roam
1595         dev[0].roam(bssid1)
1596
1597     with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1598         # This will fail to roam
1599         dev[0].roam(bssid1)
1600
1601     with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1602         # This will fail to roam
1603         dev[0].roam(bssid1)
1604
1605 def test_ap_ft_ap_oom6(dev, apdev):
1606     """WPA2-PSK-FT and AP OOM 6"""
1607     ssid = "test-ft"
1608     passphrase="12345678"
1609
1610     params = ft_params1(ssid=ssid, passphrase=passphrase)
1611     hapd0 = hostapd.add_ap(apdev[0], params)
1612     bssid0 = hapd0.own_addr()
1613
1614     dev[0].scan_for_bss(bssid0, freq="2412")
1615     with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1616         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1617                        scan_freq="2412")
1618     dev[0].request("REMOVE_NETWORK all")
1619     dev[0].wait_disconnected()
1620     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1621         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1622                        scan_freq="2412")
1623     dev[0].request("REMOVE_NETWORK all")
1624     dev[0].wait_disconnected()
1625     with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1626         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1627                        scan_freq="2412")
1628
1629 def test_ap_ft_ap_oom7a(dev, apdev):
1630     """WPA2-PSK-FT and AP OOM 7a"""
1631     ssid = "test-ft"
1632     passphrase="12345678"
1633
1634     params = ft_params1(ssid=ssid, passphrase=passphrase)
1635     params["ieee80211w"] = "2"
1636     hapd0 = hostapd.add_ap(apdev[0], params)
1637     bssid0 = hapd0.own_addr()
1638
1639     dev[0].scan_for_bss(bssid0, freq="2412")
1640     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1641                    ieee80211w="2", scan_freq="2412")
1642
1643     params = ft_params2(ssid=ssid, passphrase=passphrase)
1644     params["ieee80211w"] = "2"
1645     hapd1 = hostapd.add_ap(apdev[1], params)
1646     bssid1 = hapd1.own_addr()
1647     dev[0].scan_for_bss(bssid1, freq="2412")
1648     with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1649         # This will fail to roam
1650         dev[0].roam(bssid1)
1651
1652 def test_ap_ft_ap_oom7b(dev, apdev):
1653     """WPA2-PSK-FT and AP OOM 7b"""
1654     ssid = "test-ft"
1655     passphrase="12345678"
1656
1657     params = ft_params1(ssid=ssid, passphrase=passphrase)
1658     params["ieee80211w"] = "2"
1659     hapd0 = hostapd.add_ap(apdev[0], params)
1660     bssid0 = hapd0.own_addr()
1661
1662     dev[0].scan_for_bss(bssid0, freq="2412")
1663     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1664                    ieee80211w="2", scan_freq="2412")
1665
1666     params = ft_params2(ssid=ssid, passphrase=passphrase)
1667     params["ieee80211w"] = "2"
1668     hapd1 = hostapd.add_ap(apdev[1], params)
1669     bssid1 = hapd1.own_addr()
1670     dev[0].scan_for_bss(bssid1, freq="2412")
1671     with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1672         # This will fail to roam
1673         dev[0].roam(bssid1)
1674
1675 def test_ap_ft_ap_oom7c(dev, apdev):
1676     """WPA2-PSK-FT and AP OOM 7c"""
1677     ssid = "test-ft"
1678     passphrase="12345678"
1679
1680     params = ft_params1(ssid=ssid, passphrase=passphrase)
1681     params["ieee80211w"] = "2"
1682     hapd0 = hostapd.add_ap(apdev[0], params)
1683     bssid0 = hapd0.own_addr()
1684
1685     dev[0].scan_for_bss(bssid0, freq="2412")
1686     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1687                    ieee80211w="2", scan_freq="2412")
1688
1689     params = ft_params2(ssid=ssid, passphrase=passphrase)
1690     params["ieee80211w"] = "2"
1691     hapd1 = hostapd.add_ap(apdev[1], params)
1692     bssid1 = hapd1.own_addr()
1693     dev[0].scan_for_bss(bssid1, freq="2412")
1694     with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1695         # This will fail to roam
1696         dev[0].roam(bssid1)
1697
1698 def test_ap_ft_ap_oom7d(dev, apdev):
1699     """WPA2-PSK-FT and AP OOM 7d"""
1700     ssid = "test-ft"
1701     passphrase="12345678"
1702
1703     params = ft_params1(ssid=ssid, passphrase=passphrase)
1704     params["ieee80211w"] = "2"
1705     hapd0 = hostapd.add_ap(apdev[0], params)
1706     bssid0 = hapd0.own_addr()
1707
1708     dev[0].scan_for_bss(bssid0, freq="2412")
1709     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1710                    ieee80211w="2", scan_freq="2412")
1711
1712     params = ft_params2(ssid=ssid, passphrase=passphrase)
1713     params["ieee80211w"] = "2"
1714     hapd1 = hostapd.add_ap(apdev[1], params)
1715     bssid1 = hapd1.own_addr()
1716     dev[0].scan_for_bss(bssid1, freq="2412")
1717     with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1718         # This will fail to roam
1719         dev[0].roam(bssid1)
1720
1721 def test_ap_ft_ap_oom8(dev, apdev):
1722     """WPA2-PSK-FT and AP OOM 8"""
1723     ssid = "test-ft"
1724     passphrase="12345678"
1725
1726     params = ft_params1(ssid=ssid, passphrase=passphrase)
1727     params['ft_psk_generate_local'] = "1";
1728     hapd0 = hostapd.add_ap(apdev[0], params)
1729     bssid0 = hapd0.own_addr()
1730
1731     dev[0].scan_for_bss(bssid0, freq="2412")
1732     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1733                    scan_freq="2412")
1734
1735     params = ft_params2(ssid=ssid, passphrase=passphrase)
1736     params['ft_psk_generate_local'] = "1";
1737     hapd1 = hostapd.add_ap(apdev[1], params)
1738     bssid1 = hapd1.own_addr()
1739     dev[0].scan_for_bss(bssid1, freq="2412")
1740     with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1741         # This will fail to roam
1742         dev[0].roam(bssid1)
1743     with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1744         # This will fail to roam
1745         dev[0].roam(bssid1)
1746
1747 def test_ap_ft_ap_oom9(dev, apdev):
1748     """WPA2-PSK-FT and AP OOM 9"""
1749     ssid = "test-ft"
1750     passphrase="12345678"
1751
1752     params = ft_params1(ssid=ssid, passphrase=passphrase)
1753     hapd0 = hostapd.add_ap(apdev[0], params)
1754     bssid0 = hapd0.own_addr()
1755
1756     dev[0].scan_for_bss(bssid0, freq="2412")
1757     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1758                    scan_freq="2412")
1759
1760     params = ft_params2(ssid=ssid, passphrase=passphrase)
1761     hapd1 = hostapd.add_ap(apdev[1], params)
1762     bssid1 = hapd1.own_addr()
1763     dev[0].scan_for_bss(bssid1, freq="2412")
1764
1765     with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1766         # This will fail to roam
1767         if "OK" not in dev[0].request("FT_DS " + bssid1):
1768             raise Exception("FT_DS failed")
1769         wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1770
1771     with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1772         # This will fail to roam
1773         if "OK" not in dev[0].request("FT_DS " + bssid1):
1774             raise Exception("FT_DS failed")
1775         wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1776
1777     with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1778         # This will fail to roam
1779         if "OK" not in dev[0].request("FT_DS " + bssid1):
1780             raise Exception("FT_DS failed")
1781         wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1782
1783 def test_ap_ft_ap_oom10(dev, apdev):
1784     """WPA2-PSK-FT and AP OOM 10"""
1785     ssid = "test-ft"
1786     passphrase="12345678"
1787
1788     params = ft_params1(ssid=ssid, passphrase=passphrase)
1789     hapd0 = hostapd.add_ap(apdev[0], params)
1790     bssid0 = hapd0.own_addr()
1791
1792     dev[0].scan_for_bss(bssid0, freq="2412")
1793     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1794                    scan_freq="2412")
1795
1796     params = ft_params2(ssid=ssid, passphrase=passphrase)
1797     hapd1 = hostapd.add_ap(apdev[1], params)
1798     bssid1 = hapd1.own_addr()
1799     dev[0].scan_for_bss(bssid1, freq="2412")
1800
1801     with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
1802         # This will fail to roam
1803         if "OK" not in dev[0].request("FT_DS " + bssid1):
1804             raise Exception("FT_DS failed")
1805         wait_fail_trigger(hapd0, "GET_FAIL")
1806
1807     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1808         # This will fail to roam
1809         if "OK" not in dev[0].request("FT_DS " + bssid1):
1810             raise Exception("FT_DS failed")
1811         wait_fail_trigger(hapd0, "GET_FAIL")
1812
1813     with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
1814         # This will fail to roam
1815         if "OK" not in dev[0].request("FT_DS " + bssid1):
1816             raise Exception("FT_DS failed")
1817         wait_fail_trigger(hapd0, "GET_FAIL")
1818
1819     with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
1820         # This will fail to roam
1821         if "OK" not in dev[0].request("FT_DS " + bssid1):
1822             raise Exception("FT_DS failed")
1823         wait_fail_trigger(hapd1, "GET_FAIL")
1824
1825 def test_ap_ft_ap_oom11(dev, apdev):
1826     """WPA2-PSK-FT and AP OOM 11"""
1827     ssid = "test-ft"
1828     passphrase="12345678"
1829
1830     params = ft_params1(ssid=ssid, passphrase=passphrase)
1831     hapd0 = hostapd.add_ap(apdev[0], params)
1832     bssid0 = hapd0.own_addr()
1833
1834     dev[0].scan_for_bss(bssid0, freq="2412")
1835     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1836         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1837                        scan_freq="2412")
1838         wait_fail_trigger(hapd0, "GET_FAIL")
1839
1840     dev[1].scan_for_bss(bssid0, freq="2412")
1841     with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
1842         dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1843                        scan_freq="2412")
1844         wait_fail_trigger(hapd0, "GET_FAIL")
1845
1846 def test_ap_ft_over_ds_proto_ap(dev, apdev):
1847     """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1848     ssid = "test-ft"
1849     passphrase="12345678"
1850
1851     params = ft_params1(ssid=ssid, passphrase=passphrase)
1852     hapd0 = hostapd.add_ap(apdev[0], params)
1853     bssid0 = hapd0.own_addr()
1854     _bssid0 = bssid0.replace(':', '')
1855     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1856                    scan_freq="2412")
1857     addr = dev[0].own_addr()
1858     _addr = addr.replace(':', '')
1859
1860     params = ft_params2(ssid=ssid, passphrase=passphrase)
1861     hapd1 = hostapd.add_ap(apdev[1], params)
1862     bssid1 = hapd1.own_addr()
1863     _bssid1 = bssid1.replace(':', '')
1864
1865     hapd0.set("ext_mgmt_frame_handling", "1")
1866     hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1867     valid = "0601" + _addr + _bssid1
1868     tests = [ "0601",
1869               "0601" + _addr,
1870               "0601" + _addr + _bssid0,
1871               "0601" + _addr + "ffffffffffff",
1872               "0601" + _bssid0 + _bssid0,
1873               valid,
1874               valid + "01",
1875               valid + "3700",
1876               valid + "3600",
1877               valid + "3603ffffff",
1878               valid + "3603a1b2ff",
1879               valid + "3603a1b2ff" + "3700",
1880               valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
1881               valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
1882               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
1883               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
1884               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
1885               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1886               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1887               valid + "0001" ]
1888     for t in tests:
1889         hapd0.dump_monitor()
1890         if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
1891             raise Exception("MGMT_RX_PROCESS failed")
1892
1893     hapd0.set("ext_mgmt_frame_handling", "0")
1894
1895 def test_ap_ft_over_ds_proto(dev, apdev):
1896     """WPA2-PSK-FT AP over DS protocol testing"""
1897     ssid = "test-ft"
1898     passphrase="12345678"
1899
1900     params = ft_params1(ssid=ssid, passphrase=passphrase)
1901     hapd0 = hostapd.add_ap(apdev[0], params)
1902     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1903                    scan_freq="2412")
1904
1905     # FT Action Response while no FT-over-DS in progress
1906     msg = {}
1907     msg['fc'] = 13 << 4
1908     msg['da'] = dev[0].own_addr()
1909     msg['sa'] = apdev[0]['bssid']
1910     msg['bssid'] = apdev[0]['bssid']
1911     msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
1912     hapd0.mgmt_tx(msg)
1913
1914     params = ft_params2(ssid=ssid, passphrase=passphrase)
1915     hapd1 = hostapd.add_ap(apdev[1], params)
1916     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1917     hapd0.set("ext_mgmt_frame_handling", "1")
1918     hapd0.dump_monitor()
1919     dev[0].request("FT_DS " + apdev[1]['bssid'])
1920     for i in range(0, 10):
1921         req = hapd0.mgmt_rx()
1922         if req is None:
1923             raise Exception("MGMT RX wait timed out")
1924         if req['subtype'] == 13:
1925             break
1926         req = None
1927     if not req:
1928         raise Exception("FT Action frame not received")
1929
1930     # FT Action Response for unexpected Target AP
1931     msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
1932     hapd0.mgmt_tx(msg)
1933
1934     # FT Action Response without MDIE
1935     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
1936     hapd0.mgmt_tx(msg)
1937
1938     # FT Action Response without FTIE
1939     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
1940     hapd0.mgmt_tx(msg)
1941
1942     # FT Action Response with FTIE SNonce mismatch
1943     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1944     hapd0.mgmt_tx(msg)
1945
1946 @remote_compatible
1947 def test_ap_ft_rrb(dev, apdev):
1948     """WPA2-PSK-FT RRB protocol testing"""
1949     ssid = "test-ft"
1950     passphrase="12345678"
1951
1952     params = ft_params1(ssid=ssid, passphrase=passphrase)
1953     hapd0 = hostapd.add_ap(apdev[0], params)
1954
1955     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1956                    scan_freq="2412")
1957
1958     _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
1959     _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
1960     proto = '\x89\x0d'
1961     ehdr = _dst_ll + _src_ll + proto
1962
1963     # Too short RRB frame
1964     pkt = ehdr + '\x01'
1965     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1966         raise Exception("DATA_TEST_FRAME failed")
1967
1968     # RRB discarded frame wikth unrecognized type
1969     pkt = ehdr + '\x02' + '\x02' + '\x01\x00' + _src_ll
1970     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1971         raise Exception("DATA_TEST_FRAME failed")
1972
1973     # RRB frame too short for action frame
1974     pkt = ehdr + '\x01' + '\x02' + '\x01\x00' + _src_ll
1975     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1976         raise Exception("DATA_TEST_FRAME failed")
1977
1978     # Too short RRB frame (not enough room for Action Frame body)
1979     pkt = ehdr + '\x01' + '\x02' + '\x00\x00' + _src_ll
1980     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1981         raise Exception("DATA_TEST_FRAME failed")
1982
1983     # Unexpected Action frame category
1984     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1985     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1986         raise Exception("DATA_TEST_FRAME failed")
1987
1988     # Unexpected Action in RRB Request
1989     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1990     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1991         raise Exception("DATA_TEST_FRAME failed")
1992
1993     # Target AP address in RRB Request does not match with own address
1994     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1995     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1996         raise Exception("DATA_TEST_FRAME failed")
1997
1998     # Not enough room for status code in RRB Response
1999     pkt = ehdr + '\x01' + '\x01' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2000     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2001         raise Exception("DATA_TEST_FRAME failed")
2002
2003     # RRB discarded frame with unknown packet_type
2004     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2005     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2006         raise Exception("DATA_TEST_FRAME failed")
2007
2008     # RRB Response with non-zero status code; no STA match
2009     pkt = ehdr + '\x01' + '\x01' + '\x10\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
2010     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2011         raise Exception("DATA_TEST_FRAME failed")
2012
2013     # RRB Response with zero status code and extra data; STA match
2014     pkt = ehdr + '\x01' + '\x01' + '\x11\x00' + _src_ll + '\x06\x01' + _src_ll + '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
2015     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2016         raise Exception("DATA_TEST_FRAME failed")
2017
2018     # Too short PMK-R1 pull
2019     pkt = ehdr + '\x01' + '\xc8' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2020     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2021         raise Exception("DATA_TEST_FRAME failed")
2022
2023     # Too short PMK-R1 resp
2024     pkt = ehdr + '\x01' + '\xc9' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2025     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2026         raise Exception("DATA_TEST_FRAME failed")
2027
2028     # Too short PMK-R1 push
2029     pkt = ehdr + '\x01' + '\xca' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2030     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2031         raise Exception("DATA_TEST_FRAME failed")
2032
2033     # No matching R0KH address found for PMK-R0 pull response
2034     pkt = ehdr + '\x01' + '\xc9' + '\x5a\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
2035     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2036         raise Exception("DATA_TEST_FRAME failed")
2037
2038 @remote_compatible
2039 def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2040     """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2041     bssid = apdev[0]['bssid']
2042     ssid = "test-ft"
2043     passphrase="12345678"
2044
2045     params = ft_params1(ssid=ssid, passphrase=passphrase)
2046     params["ieee80211w"] = "1"
2047     # This is the RSN element used normally by hostapd
2048     params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
2049     hapd = hostapd.add_ap(apdev[0], params)
2050     id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2051                         ieee80211w="1", scan_freq="2412",
2052                         pairwise="CCMP", group="CCMP")
2053
2054     tests = [ ('PMKIDCount field included',
2055                '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2056               ('Extra IE before RSNE',
2057                'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2058               ('PMKIDCount and Group Management Cipher suite fields included',
2059                '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2060               ('Extra octet after defined fields (future extensibility)',
2061                '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2062               ('No RSN Capabilities field (PMF disabled in practice)',
2063                '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2064     for txt,ie in tests:
2065         dev[0].request("DISCONNECT")
2066         dev[0].wait_disconnected()
2067         logger.info(txt)
2068         hapd.disable()
2069         hapd.set('own_ie_override', ie)
2070         hapd.enable()
2071         dev[0].request("BSS_FLUSH 0")
2072         dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2073         dev[0].select_network(id, freq=2412)
2074         dev[0].wait_connected()
2075
2076     dev[0].request("DISCONNECT")
2077     dev[0].wait_disconnected()
2078
2079     logger.info('Invalid RSNE causing internal hostapd error')
2080     hapd.disable()
2081     hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2082     hapd.enable()
2083     dev[0].request("BSS_FLUSH 0")
2084     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2085     dev[0].select_network(id, freq=2412)
2086     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2087     # complete.
2088     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2089     if ev is not None:
2090         raise Exception("Unexpected connection")
2091     dev[0].request("DISCONNECT")
2092
2093     logger.info('Unexpected PMKID causing internal hostapd error')
2094     hapd.disable()
2095     hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2096     hapd.enable()
2097     dev[0].request("BSS_FLUSH 0")
2098     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2099     dev[0].select_network(id, freq=2412)
2100     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2101     # complete.
2102     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2103     if ev is not None:
2104         raise Exception("Unexpected connection")
2105     dev[0].request("DISCONNECT")
2106
2107 def test_ap_ft_ptk_rekey(dev, apdev):
2108     """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2109     ssid = "test-ft"
2110     passphrase="12345678"
2111
2112     params = ft_params1(ssid=ssid, passphrase=passphrase)
2113     hapd0 = hostapd.add_ap(apdev[0], params)
2114     params = ft_params2(ssid=ssid, passphrase=passphrase)
2115     hapd1 = hostapd.add_ap(apdev[1], params)
2116
2117     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2118
2119     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2120                             "WPA: Key negotiation completed"], timeout=5)
2121     if ev is None:
2122         raise Exception("No event received after roam")
2123     if "CTRL-EVENT-DISCONNECTED" in ev:
2124         raise Exception("Unexpected disconnection after roam")
2125
2126     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2127         hapd = hapd0
2128     else:
2129         hapd = hapd1
2130     hwsim_utils.test_connectivity(dev[0], hapd)
2131
2132 def test_ap_ft_ptk_rekey_ap(dev, apdev):
2133     """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2134     ssid = "test-ft"
2135     passphrase="12345678"
2136
2137     params = ft_params1(ssid=ssid, passphrase=passphrase)
2138     params['wpa_ptk_rekey'] = '2'
2139     hapd0 = hostapd.add_ap(apdev[0], params)
2140     params = ft_params2(ssid=ssid, passphrase=passphrase)
2141     params['wpa_ptk_rekey'] = '2'
2142     hapd1 = hostapd.add_ap(apdev[1], params)
2143
2144     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2145
2146     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2147                             "WPA: Key negotiation completed"], timeout=5)
2148     if ev is None:
2149         raise Exception("No event received after roam")
2150     if "CTRL-EVENT-DISCONNECTED" in ev:
2151         raise Exception("Unexpected disconnection after roam")
2152
2153     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2154         hapd = hapd0
2155     else:
2156         hapd = hapd1
2157     hwsim_utils.test_connectivity(dev[0], hapd)
2158
2159 def test_ap_ft_internal_rrb_check(dev, apdev):
2160     """RRB internal delivery only to WPA enabled BSS"""
2161     ssid = "test-ft"
2162     passphrase="12345678"
2163
2164     radius = hostapd.radius_params()
2165     params = ft_params1(ssid=ssid, passphrase=passphrase)
2166     params['wpa_key_mgmt'] = "FT-EAP"
2167     params["ieee8021x"] = "1"
2168     params = dict(radius.items() + params.items())
2169     hapd = hostapd.add_ap(apdev[0], params)
2170     key_mgmt = hapd.get_config()['key_mgmt']
2171     if key_mgmt.split(' ')[0] != "FT-EAP":
2172         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2173
2174     hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
2175
2176     # Connect to WPA enabled AP
2177     dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2178                    eap="GPSK", identity="gpsk user",
2179                    password="abcdefghijklmnop0123456789abcdef",
2180                    scan_freq="2412")
2181
2182     # Try over_ds roaming to non-WPA-enabled AP.
2183     # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2184     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
2185
2186 def test_ap_ft_extra_ie(dev, apdev):
2187     """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2188     ssid = "test-ft"
2189     passphrase="12345678"
2190
2191     params = ft_params1(ssid=ssid, passphrase=passphrase)
2192     params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2193     hapd0 = hostapd.add_ap(apdev[0], params)
2194     dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2195                    scan_freq="2412")
2196     dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2197                    scan_freq="2412")
2198     try:
2199         # Add Mobility Domain element to test AP validation code.
2200         dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2201         dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2202                        scan_freq="2412", wait_connect=False)
2203         ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2204                                 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2205         if ev is None:
2206             raise Exception("No connection result")
2207         if "CTRL-EVENT-CONNECTED" in ev:
2208             raise Exception("Non-FT association accepted with MDE")
2209         if "status_code=43" not in ev:
2210             raise Exception("Unexpected status code: " + ev)
2211         dev[0].request("DISCONNECT")
2212     finally:
2213         dev[0].request("VENDOR_ELEM_REMOVE 13 *")
2214
2215 def test_ap_ft_ric(dev, apdev):
2216     """WPA2-PSK-FT AP and RIC"""
2217     ssid = "test-ft"
2218     passphrase="12345678"
2219
2220     params = ft_params1(ssid=ssid, passphrase=passphrase)
2221     hapd0 = hostapd.add_ap(apdev[0], params)
2222     params = ft_params2(ssid=ssid, passphrase=passphrase)
2223     hapd1 = hostapd.add_ap(apdev[1], params)
2224
2225     dev[0].set("ric_ies", "")
2226     dev[0].set("ric_ies", '""')
2227     if "FAIL" not in dev[0].request("SET ric_ies q"):
2228         raise Exception("Invalid ric_ies value accepted")
2229
2230     tests = [ "3900",
2231               "3900ff04eeeeeeee",
2232               "390400000000",
2233               "390400000000" + "390400000000",
2234               "390400000000" + "dd050050f20202",
2235               "390400000000" + "dd3d0050f2020201" + 55*"00",
2236               "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2237               "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2238     for t in tests:
2239         dev[0].set("ric_ies", t)
2240         run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2241                   test_connectivity=False)
2242         dev[0].request("REMOVE_NETWORK all")
2243         dev[0].wait_disconnected()
2244         dev[0].dump_monitor()
2245
2246 def ie_hex(ies, id):
2247     return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id])
2248
2249 def test_ap_ft_reassoc_proto(dev, apdev):
2250     """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2251     ssid = "test-ft"
2252     passphrase="12345678"
2253
2254     params = ft_params1(ssid=ssid, passphrase=passphrase)
2255     hapd0 = hostapd.add_ap(apdev[0], params)
2256     params = ft_params2(ssid=ssid, passphrase=passphrase)
2257     hapd1 = hostapd.add_ap(apdev[1], params)
2258
2259     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2260                    ieee80211w="1", scan_freq="2412")
2261     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2262         hapd1ap = hapd0
2263         hapd2ap = hapd1
2264     else:
2265         hapd1ap = hapd1
2266         hapd2ap = hapd0
2267
2268     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2269     hapd2ap.set("ext_mgmt_frame_handling", "1")
2270     dev[0].request("ROAM " + hapd2ap.own_addr())
2271
2272     while True:
2273         req = hapd2ap.mgmt_rx()
2274         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2275         if req['subtype'] == 11:
2276             break
2277
2278     while True:
2279         req = hapd2ap.mgmt_rx()
2280         if req['subtype'] == 2:
2281             break
2282         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2283
2284     # IEEE 802.11 header + fixed fields before IEs
2285     hdr = binascii.hexlify(req['frame'][0:34])
2286     ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2287     # First elements: SSID, Supported Rates, Extended Supported Rates
2288     ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2289
2290     rsne = ie_hex(ies, 48)
2291     mde = ie_hex(ies, 54)
2292     fte = ie_hex(ies, 55)
2293     tests = [ ]
2294     # RSN: Trying to use FT, but MDIE not included
2295     tests += [ rsne ]
2296     # RSN: Attempted to use unknown MDIE
2297     tests += [ rsne + "3603000000" ]
2298     # Invalid RSN pairwise cipher
2299     tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2300     # FT: No PMKID in RSNIE
2301     tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2302     # FT: Invalid FTIE
2303     tests += [ rsne + mde ]
2304     # FT: RIC IE(s) in the frame, but not included in protected IE count
2305     # FT: Failed to parse FT IEs
2306     tests += [ rsne + mde + fte + "3900" ]
2307     # FT: SNonce mismatch in FTIE
2308     tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2309     # FT: ANonce mismatch in FTIE
2310     tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2311     # FT: No R0KH-ID subelem in FTIE
2312     tests += [ rsne + mde + "3752" + fte[4:168] ]
2313     # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2314     tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2315     # FT: No R1KH-ID subelem in FTIE
2316     tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") ]
2317     # FT: Unknown R1KH-ID used in ReassocReq
2318     tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") + "0106000000000000" ]
2319     # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2320     tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2321     # Invalid MIC in FTIE
2322     tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2323     for t in tests:
2324         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2325
2326 def test_ap_ft_reassoc_local_fail(dev, apdev):
2327     """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2328     ssid = "test-ft"
2329     passphrase="12345678"
2330
2331     params = ft_params1(ssid=ssid, passphrase=passphrase)
2332     hapd0 = hostapd.add_ap(apdev[0], params)
2333     params = ft_params2(ssid=ssid, passphrase=passphrase)
2334     hapd1 = hostapd.add_ap(apdev[1], params)
2335
2336     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2337                    ieee80211w="1", scan_freq="2412")
2338     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2339         hapd1ap = hapd0
2340         hapd2ap = hapd1
2341     else:
2342         hapd1ap = hapd1
2343         hapd2ap = hapd0
2344
2345     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2346     # FT: Failed to calculate MIC
2347     with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2348         dev[0].request("ROAM " + hapd2ap.own_addr())
2349         ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2350         dev[0].request("DISCONNECT")
2351         if ev is None:
2352             raise Exception("Association reject not seen")
2353
2354 def test_ap_ft_reassoc_replay(dev, apdev, params):
2355     """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2356     capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2357     ssid = "test-ft"
2358     passphrase="12345678"
2359
2360     params = ft_params1(ssid=ssid, passphrase=passphrase)
2361     hapd0 = hostapd.add_ap(apdev[0], params)
2362     params = ft_params2(ssid=ssid, passphrase=passphrase)
2363     hapd1 = hostapd.add_ap(apdev[1], params)
2364
2365     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2366                    scan_freq="2412")
2367     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2368         hapd1ap = hapd0
2369         hapd2ap = hapd1
2370     else:
2371         hapd1ap = hapd1
2372         hapd2ap = hapd0
2373
2374     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2375     hapd2ap.set("ext_mgmt_frame_handling", "1")
2376     dev[0].dump_monitor()
2377     if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2378         raise Exception("ROAM failed")
2379
2380     reassocreq = None
2381     count = 0
2382     while count < 100:
2383         req = hapd2ap.mgmt_rx()
2384         count += 1
2385         hapd2ap.dump_monitor()
2386         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2387         if req['subtype'] == 2:
2388             reassocreq = req
2389             ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2390             if ev is None:
2391                 raise Exception("No TX status seen")
2392             cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2393             if "OK" not in hapd2ap.request(cmd):
2394                 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2395             break
2396     hapd2ap.set("ext_mgmt_frame_handling", "0")
2397     if reassocreq is None:
2398         raise Exception("No Reassociation Request frame seen")
2399     dev[0].wait_connected()
2400     dev[0].dump_monitor()
2401     hapd2ap.dump_monitor()
2402
2403     hwsim_utils.test_connectivity(dev[0], hapd2ap)
2404
2405     logger.info("Replay the last Reassociation Request frame")
2406     hapd2ap.dump_monitor()
2407     hapd2ap.set("ext_mgmt_frame_handling", "1")
2408     hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2409     ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2410     if ev is None:
2411         raise Exception("No TX status seen")
2412     cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2413     if "OK" not in hapd2ap.request(cmd):
2414         raise Exception("MGMT_TX_STATUS_PROCESS failed")
2415     hapd2ap.set("ext_mgmt_frame_handling", "0")
2416
2417     try:
2418         hwsim_utils.test_connectivity(dev[0], hapd2ap)
2419         ok = True
2420     except:
2421         ok = False
2422
2423     ap = hapd2ap.own_addr()
2424     sta = dev[0].own_addr()
2425     filt = "wlan.fc.type == 2 && " + \
2426            "wlan.da == " + sta + " && " + \
2427            "wlan.sa == " + ap
2428     fields = [ "wlan.ccmp.extiv" ]
2429     res = run_tshark(capfile, filt, fields)
2430     vals = res.splitlines()
2431     logger.info("CCMP PN: " + str(vals))
2432     if len(vals) < 2:
2433         raise Exception("Could not find all CCMP protected frames from capture")
2434     if len(set(vals)) < len(vals):
2435         raise Exception("Duplicate CCMP PN used")
2436
2437     if not ok:
2438         raise Exception("The second hwsim connectivity test failed")
2439
2440 def test_ap_ft_psk_file(dev, apdev):
2441     """WPA2-PSK-FT AP with PSK from a file"""
2442     ssid = "test-ft"
2443     passphrase="12345678"
2444
2445     params = ft_params1a(ssid=ssid, passphrase=passphrase)
2446     params['wpa_psk_file'] = 'hostapd.wpa_psk'
2447     hapd = hostapd.add_ap(apdev[0], params)
2448
2449     dev[1].connect(ssid, psk="very secret",
2450                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2451                    scan_freq="2412", wait_connect=False)
2452     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2453                    ieee80211w="1", scan_freq="2412")
2454     dev[0].request("REMOVE_NETWORK all")
2455     dev[0].wait_disconnected()
2456     dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2457                    ieee80211w="1", scan_freq="2412")
2458     dev[0].request("REMOVE_NETWORK all")
2459     dev[0].wait_disconnected()
2460     dev[0].connect(ssid, psk="secret passphrase",
2461                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2462                    scan_freq="2412")
2463     dev[2].connect(ssid, psk="another passphrase for all STAs",
2464                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2465                    scan_freq="2412")
2466     ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2467     if ev is None:
2468         raise Exception("Timed out while waiting for failure report")
2469     dev[1].request("REMOVE_NETWORK all")
2470
2471 def test_ap_ft_eap_ap_config_change(dev, apdev):
2472     """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2473     ssid = "test-ft"
2474     passphrase="12345678"
2475     bssid = apdev[0]['bssid']
2476
2477     radius = hostapd.radius_params()
2478     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2479     params['wpa_key_mgmt'] = "WPA-EAP"
2480     params["ieee8021x"] = "1"
2481     params["pmk_r1_push"] = "0"
2482     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2483     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2484     params["eap_server"] = "0"
2485     params = dict(radius.items() + params.items())
2486     hapd = hostapd.add_ap(apdev[0], params)
2487
2488     dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2489                    eap="GPSK", identity="gpsk user",
2490                    password="abcdefghijklmnop0123456789abcdef",
2491                    scan_freq="2412")
2492     dev[0].request("DISCONNECT")
2493     dev[0].wait_disconnected()
2494     dev[0].dump_monitor()
2495
2496     hapd.disable()
2497     hapd.set('wpa_key_mgmt', "FT-EAP")
2498     hapd.enable()
2499
2500     dev[0].request("BSS_FLUSH 0")
2501     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2502
2503     dev[0].request("RECONNECT")
2504     dev[0].wait_connected()
2505
2506 def test_ap_ft_eap_sha384(dev, apdev):
2507     """WPA2-EAP-FT with SHA384"""
2508     ssid = "test-ft"
2509     passphrase="12345678"
2510
2511     radius = hostapd.radius_params()
2512     params = ft_params1(ssid=ssid, passphrase=passphrase)
2513     params["ieee80211w"] = "2";
2514     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2515     params["ieee8021x"] = "1"
2516     params = dict(radius.items() + params.items())
2517     hapd0 = hostapd.add_ap(apdev[0], params)
2518     params = ft_params2(ssid=ssid, passphrase=passphrase)
2519     params["ieee80211w"] = "2";
2520     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2521     params["ieee8021x"] = "1"
2522     params = dict(radius.items() + params.items())
2523     hapd1 = hostapd.add_ap(apdev[1], params)
2524
2525     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2526               sha384=True)
2527
2528 def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2529     """WPA2-EAP-FT with SHA384 over DS"""
2530     ssid = "test-ft"
2531     passphrase="12345678"
2532
2533     radius = hostapd.radius_params()
2534     params = ft_params1(ssid=ssid, passphrase=passphrase)
2535     params["ieee80211w"] = "2";
2536     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2537     params["ieee8021x"] = "1"
2538     params = dict(radius.items() + params.items())
2539     hapd0 = hostapd.add_ap(apdev[0], params)
2540     params = ft_params2(ssid=ssid, passphrase=passphrase)
2541     params["ieee80211w"] = "2";
2542     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2543     params["ieee8021x"] = "1"
2544     params = dict(radius.items() + params.items())
2545     hapd1 = hostapd.add_ap(apdev[1], params)
2546
2547     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2548               eap=True, sha384=True)
2549
2550 def test_ap_ft_roam_rrm(dev, apdev):
2551     """WPA2-PSK-FT AP and radio measurement request"""
2552     ssid = "test-ft"
2553     passphrase="12345678"
2554
2555     params = ft_params1(ssid=ssid, passphrase=passphrase)
2556     params["rrm_beacon_report"] = "1"
2557     hapd0 = hostapd.add_ap(apdev[0], params)
2558     bssid0 = hapd0.own_addr()
2559
2560     addr = dev[0].own_addr()
2561     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2562                    scan_freq="2412")
2563     check_beacon_req(hapd0, addr, 1)
2564
2565     params = ft_params2(ssid=ssid, passphrase=passphrase)
2566     params["rrm_beacon_report"] = "1"
2567     hapd1 = hostapd.add_ap(apdev[1], params)
2568     bssid1 = hapd1.own_addr()
2569
2570     dev[0].scan_for_bss(bssid1, freq=2412)
2571     dev[0].roam(bssid1)
2572     check_beacon_req(hapd1, addr, 2)
2573
2574     dev[0].scan_for_bss(bssid0, freq=2412)
2575     dev[0].roam(bssid0)
2576     check_beacon_req(hapd0, addr, 3)