1 # Fast BSS Transition tests
2 # Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
4 # This software may be distributed under the terms of the BSD license.
5 # See README for more details.
7 from remotehost
import remote_compatible
12 logger
= logging
.getLogger()
18 from hwsim
import HWSimRadio
20 from tshark
import run_tshark
21 from utils
import HwsimSkip
, alloc_fail
, fail_test
, wait_fail_trigger
, skip_with_fips
, parse_ie
22 from wlantest
import Wlantest
23 from test_ap_psk
import check_mib
, find_wpas_process
, read_process_memory
, verify_not_present
, get_key_locations
24 from test_rrm
import check_beacon_req
28 "wpa_key_mgmt": "FT-PSK",
29 "rsn_pairwise": "CCMP"}
34 "wpa_key_mgmt": "WPA-PSK FT-PSK",
35 "wpa_pairwise": "TKIP",
36 "rsn_pairwise": "CCMP"}
39 def ft_params(rsn
=True, ssid
=None, passphrase
=None):
41 params
= ft_base_rsn()
43 params
= ft_base_mixed()
47 params
["wpa_passphrase"] = passphrase
49 params
["mobility_domain"] = "a1b2"
50 params
["r0_key_lifetime"] = "10000"
51 params
["pmk_r1_push"] = "1"
52 params
["reassociation_deadline"] = "1000"
55 def ft_params1a(rsn
=True, ssid
=None, passphrase
=None):
56 params
= ft_params(rsn
, ssid
, passphrase
)
57 params
['nas_identifier'] = "nas1.w1.fi"
58 params
['r1_key_holder'] = "000102030405"
61 def ft_params1(rsn
=True, ssid
=None, passphrase
=None, discovery
=False):
62 params
= ft_params1a(rsn
, ssid
, passphrase
)
64 params
['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
65 params
['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
67 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
68 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
69 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
72 def ft_params1_old_key(rsn
=True, ssid
=None, passphrase
=None):
73 params
= ft_params1a(rsn
, ssid
, passphrase
)
74 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
75 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
76 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
79 def ft_params2a(rsn
=True, ssid
=None, passphrase
=None):
80 params
= ft_params(rsn
, ssid
, passphrase
)
81 params
['nas_identifier'] = "nas2.w1.fi"
82 params
['r1_key_holder'] = "000102030406"
85 def ft_params2(rsn
=True, ssid
=None, passphrase
=None, discovery
=False):
86 params
= ft_params2a(rsn
, ssid
, passphrase
)
88 params
['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
89 params
['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
91 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
92 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
93 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
96 def ft_params2_old_key(rsn
=True, ssid
=None, passphrase
=None):
97 params
= ft_params2a(rsn
, ssid
, passphrase
)
98 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
99 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
100 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
103 def ft_params1_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
104 params
= ft_params(rsn
, ssid
, passphrase
)
105 params
['nas_identifier'] = "nas1.w1.fi"
106 params
['r1_key_holder'] = "000102030405"
107 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
108 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
109 params
['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
112 def ft_params2_incorrect_rrb_key(rsn
=True, ssid
=None, passphrase
=None):
113 params
= ft_params(rsn
, ssid
, passphrase
)
114 params
['nas_identifier'] = "nas2.w1.fi"
115 params
['r1_key_holder'] = "000102030406"
116 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
117 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
118 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
121 def ft_params2_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
122 params
= ft_params(rsn
, ssid
, passphrase
)
123 params
['nas_identifier'] = "nas2.w1.fi"
124 params
['r1_key_holder'] = "000102030406"
125 params
['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
126 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
127 params
['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
130 def run_roams(dev
, apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=False,
131 sae
=False, eap
=False, fail_test
=False, roams
=1,
132 pairwise_cipher
="CCMP", group_cipher
="TKIP CCMP", ptk_rekey
="0",
133 test_connectivity
=True, eap_identity
="gpsk user", conndev
=False,
134 force_initial_conn_to_first_ap
=False, sha384
=False,
135 group_mgmt
=None, ocv
=None, sae_password
=None,
136 sae_password_id
=None, sae_and_psk
=False, pmksa_caching
=False,
137 roam_with_reassoc
=False, also_non_ft
=False, only_one_way
=False):
138 logger
.info("Connect to first AP")
141 copts
["proto"] = "WPA2"
142 copts
["ieee80211w"] = "1"
143 copts
["scan_freq"] = "2412"
144 copts
["pairwise"] = pairwise_cipher
145 copts
["group"] = group_cipher
146 copts
["wpa_ptk_rekey"] = ptk_rekey
148 copts
["group_mgmt"] = group_mgmt
153 copts
["ft_eap_pmksa_caching"] = "1"
155 copts
["key_mgmt"] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384" if sha384
else "WPA-EAP FT-EAP"
157 copts
["key_mgmt"] = "FT-EAP-SHA384" if sha384
else "FT-EAP"
158 copts
["eap"] = "GPSK"
159 copts
["identity"] = eap_identity
160 copts
["password"] = "abcdefghijklmnop0123456789abcdef"
163 copts
["key_mgmt"] = "SAE FT-SAE" if sae_and_psk
else "FT-SAE"
165 copts
["key_mgmt"] = "FT-PSK"
167 copts
["psk"] = passphrase
169 copts
["sae_password"] = sae_password
171 copts
["sae_password_id"] = sae_password_id
172 if force_initial_conn_to_first_ap
:
173 copts
["bssid"] = apdev
[0]['bssid']
174 netw
= dev
.connect(ssid
, **copts
)
176 dev
.request("DISCONNECT")
177 dev
.wait_disconnected()
178 dev
.request("RECONNECT")
179 ev
= dev
.wait_event(["CTRL-EVENT-CONNECTED",
180 "CTRL-EVENT-DISCONNECTED",
181 "CTRL-EVENT-EAP-STARTED"],
184 raise Exception("Reconnect timed out")
185 if "CTRL-EVENT-DISCONNECTED" in ev
:
186 raise Exception("Unexpected disconnection after RECONNECT")
187 if "CTRL-EVENT-EAP-STARTED" in ev
:
188 raise Exception("Unexpected EAP start after RECONNECT")
190 if dev
.get_status_field('bssid') == apdev
[0]['bssid']:
200 if test_connectivity
:
202 hwsim_utils
.test_connectivity_iface(dev
, hapd1ap
, conndev
)
204 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
206 dev
.scan_for_bss(ap2
['bssid'], freq
="2412")
208 for i
in range(0, roams
):
209 # Roaming artificially fast can make data test fail because the key is
212 logger
.info("Roam to the second AP")
213 if roam_with_reassoc
:
214 dev
.set_network(netw
, "bssid", ap2
['bssid'])
215 dev
.request("REASSOCIATE")
218 dev
.roam_over_ds(ap2
['bssid'], fail_test
=fail_test
)
220 dev
.roam(ap2
['bssid'], fail_test
=fail_test
)
223 if dev
.get_status_field('bssid') != ap2
['bssid']:
224 raise Exception("Did not connect to correct AP")
225 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
227 hwsim_utils
.test_connectivity_iface(dev
, hapd2ap
, conndev
)
229 hwsim_utils
.test_connectivity(dev
, hapd2ap
)
233 # Roaming artificially fast can make data test fail because the key is
236 logger
.info("Roam back to the first AP")
237 if roam_with_reassoc
:
238 dev
.set_network(netw
, "bssid", ap1
['bssid'])
239 dev
.request("REASSOCIATE")
242 dev
.roam_over_ds(ap1
['bssid'])
244 dev
.roam(ap1
['bssid'])
245 if dev
.get_status_field('bssid') != ap1
['bssid']:
246 raise Exception("Did not connect to correct AP")
247 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
249 hwsim_utils
.test_connectivity_iface(dev
, hapd1ap
, conndev
)
251 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
253 def test_ap_ft(dev
, apdev
):
256 passphrase
= "12345678"
258 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
259 hapd0
= hostapd
.add_ap(apdev
[0], params
)
260 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
261 hapd1
= hostapd
.add_ap(apdev
[1], params
)
263 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
264 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
265 raise Exception("Scan results missing RSN element info")
267 def test_ap_ft_old_key(dev
, apdev
):
268 """WPA2-PSK-FT AP (old key)"""
270 passphrase
= "12345678"
272 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
273 hapd0
= hostapd
.add_ap(apdev
[0], params
)
274 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
275 hapd1
= hostapd
.add_ap(apdev
[1], params
)
277 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
279 def test_ap_ft_multi_akm(dev
, apdev
):
280 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
282 passphrase
= "12345678"
284 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
285 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
286 hapd0
= hostapd
.add_ap(apdev
[0], params
)
287 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
288 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
289 hapd1
= hostapd
.add_ap(apdev
[1], params
)
291 Wlantest
.setup(hapd0
)
294 wt
.add_passphrase(passphrase
)
296 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
297 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
298 raise Exception("Scan results missing RSN element info")
299 dev
[1].connect(ssid
, psk
=passphrase
, scan_freq
="2412")
300 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK-SHA256",
303 def test_ap_ft_local_key_gen(dev
, apdev
):
304 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
306 passphrase
= "12345678"
308 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
309 params
['ft_psk_generate_local'] = "1"
310 del params
['pmk_r1_push']
311 hapd0
= hostapd
.add_ap(apdev
[0], params
)
312 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
313 params
['ft_psk_generate_local'] = "1"
314 del params
['pmk_r1_push']
315 hapd1
= hostapd
.add_ap(apdev
[1], params
)
317 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
318 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
319 raise Exception("Scan results missing RSN element info")
321 def test_ap_ft_vlan(dev
, apdev
):
322 """WPA2-PSK-FT AP with VLAN"""
324 passphrase
= "12345678"
326 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
327 params
['dynamic_vlan'] = "1"
328 params
['accept_mac_file'] = "hostapd.accept"
329 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
331 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
332 params
['dynamic_vlan'] = "1"
333 params
['accept_mac_file'] = "hostapd.accept"
334 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
336 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1")
337 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
338 raise Exception("Scan results missing RSN element info")
340 def test_ap_ft_vlan_disconnected(dev
, apdev
):
341 """WPA2-PSK-FT AP with VLAN and local key generation"""
343 passphrase
= "12345678"
345 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
346 params
['dynamic_vlan'] = "1"
347 params
['accept_mac_file'] = "hostapd.accept"
348 params
['ft_psk_generate_local'] = "1"
349 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
351 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
352 params
['dynamic_vlan'] = "1"
353 params
['accept_mac_file'] = "hostapd.accept"
354 params
['ft_psk_generate_local'] = "1"
355 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
357 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1")
358 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
359 raise Exception("Scan results missing RSN element info")
361 def test_ap_ft_vlan_2(dev
, apdev
):
362 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
364 passphrase
= "12345678"
366 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
367 params
['dynamic_vlan'] = "1"
368 params
['accept_mac_file'] = "hostapd.accept"
369 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
371 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
372 params
['dynamic_vlan'] = "1"
373 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
375 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1",
376 force_initial_conn_to_first_ap
=True)
377 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
378 raise Exception("Scan results missing RSN element info")
380 def test_ap_ft_many(dev
, apdev
):
381 """WPA2-PSK-FT AP multiple times"""
383 passphrase
= "12345678"
385 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
386 hapd0
= hostapd
.add_ap(apdev
[0], params
)
387 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
388 hapd1
= hostapd
.add_ap(apdev
[1], params
)
390 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50)
392 def test_ap_ft_many_vlan(dev
, apdev
):
393 """WPA2-PSK-FT AP with VLAN multiple times"""
395 passphrase
= "12345678"
397 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
398 params
['dynamic_vlan'] = "1"
399 params
['accept_mac_file'] = "hostapd.accept"
400 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
402 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
403 params
['dynamic_vlan'] = "1"
404 params
['accept_mac_file'] = "hostapd.accept"
405 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
407 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50,
410 def test_ap_ft_mixed(dev
, apdev
):
411 """WPA2-PSK-FT mixed-mode AP"""
412 ssid
= "test-ft-mixed"
413 passphrase
= "12345678"
415 params
= ft_params1(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
416 hapd
= hostapd
.add_ap(apdev
[0], params
)
417 key_mgmt
= hapd
.get_config()['key_mgmt']
418 vals
= key_mgmt
.split(' ')
419 if vals
[0] != "WPA-PSK" or vals
[1] != "FT-PSK":
420 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
421 params
= ft_params2(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
422 hapd1
= hostapd
.add_ap(apdev
[1], params
)
424 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
)
426 def test_ap_ft_pmf(dev
, apdev
):
427 """WPA2-PSK-FT AP with PMF"""
429 passphrase
= "12345678"
431 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
432 params
["ieee80211w"] = "2"
433 hapd0
= hostapd
.add_ap(apdev
[0], params
)
434 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
435 params
["ieee80211w"] = "2"
436 hapd1
= hostapd
.add_ap(apdev
[1], params
)
438 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
440 def test_ap_ft_pmf_bip_cmac_128(dev
, apdev
):
441 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
442 run_ap_ft_pmf_bip(dev
, apdev
, "AES-128-CMAC")
444 def test_ap_ft_pmf_bip_gmac_128(dev
, apdev
):
445 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
446 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-GMAC-128")
448 def test_ap_ft_pmf_bip_gmac_256(dev
, apdev
):
449 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
450 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-GMAC-256")
452 def test_ap_ft_pmf_bip_cmac_256(dev
, apdev
):
453 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
454 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-CMAC-256")
456 def run_ap_ft_pmf_bip(dev
, apdev
, cipher
):
457 if cipher
not in dev
[0].get_capability("group_mgmt"):
458 raise HwsimSkip("Cipher %s not supported" % cipher
)
461 passphrase
= "12345678"
463 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
464 params
["ieee80211w"] = "2"
465 params
["group_mgmt_cipher"] = cipher
466 hapd0
= hostapd
.add_ap(apdev
[0], params
)
467 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
468 params
["ieee80211w"] = "2"
469 params
["group_mgmt_cipher"] = cipher
470 hapd1
= hostapd
.add_ap(apdev
[1], params
)
472 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
475 def test_ap_ft_ocv(dev
, apdev
):
476 """WPA2-PSK-FT AP with OCV"""
478 passphrase
= "12345678"
480 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
481 params
["ieee80211w"] = "2"
484 hapd0
= hostapd
.add_ap(apdev
[0], params
)
485 except Exception as e
:
486 if "Failed to set hostapd parameter ocv" in str(e
):
487 raise HwsimSkip("OCV not supported")
489 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
490 params
["ieee80211w"] = "2"
492 hapd1
= hostapd
.add_ap(apdev
[1], params
)
494 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, ocv
="1")
496 def test_ap_ft_over_ds(dev
, apdev
):
497 """WPA2-PSK-FT AP over DS"""
499 passphrase
= "12345678"
501 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
502 hapd0
= hostapd
.add_ap(apdev
[0], params
)
503 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
504 hapd1
= hostapd
.add_ap(apdev
[1], params
)
506 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
507 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
508 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
510 def cleanup_ap_ft_separate_hostapd():
511 subprocess
.call(["brctl", "delif", "br0ft", "veth0"],
512 stderr
=open('/dev/null', 'w'))
513 subprocess
.call(["brctl", "delif", "br1ft", "veth1"],
514 stderr
=open('/dev/null', 'w'))
515 subprocess
.call(["ip", "link", "del", "veth0"],
516 stderr
=open('/dev/null', 'w'))
517 subprocess
.call(["ip", "link", "del", "veth1"],
518 stderr
=open('/dev/null', 'w'))
519 for ifname
in ['br0ft', 'br1ft', 'br-ft']:
520 subprocess
.call(['ip', 'link', 'set', 'dev', ifname
, 'down'],
521 stderr
=open('/dev/null', 'w'))
522 subprocess
.call(['brctl', 'delbr', ifname
],
523 stderr
=open('/dev/null', 'w'))
525 def test_ap_ft_separate_hostapd(dev
, apdev
, params
):
526 """WPA2-PSK-FT AP and separate hostapd process"""
528 run_ap_ft_separate_hostapd(dev
, apdev
, params
, False)
530 cleanup_ap_ft_separate_hostapd()
532 def test_ap_ft_over_ds_separate_hostapd(dev
, apdev
, params
):
533 """WPA2-PSK-FT AP over DS and separate hostapd process"""
535 run_ap_ft_separate_hostapd(dev
, apdev
, params
, True)
537 cleanup_ap_ft_separate_hostapd()
539 def run_ap_ft_separate_hostapd(dev
, apdev
, params
, over_ds
):
541 passphrase
= "12345678"
542 logdir
= params
['logdir']
543 pidfile
= os
.path
.join(logdir
, 'ap_ft_over_ds_separate_hostapd.pid')
544 logfile
= os
.path
.join(logdir
, 'ap_ft_over_ds_separate_hostapd.hapd')
545 global_ctrl
= '/var/run/hostapd-ft'
549 subprocess
.check_call(['brctl', 'addbr', br_ifname
])
550 subprocess
.check_call(['brctl', 'setfd', br_ifname
, '0'])
551 subprocess
.check_call(['ip', 'link', 'set', 'dev', br_ifname
, 'up'])
553 subprocess
.check_call(["ip", "link", "add", "veth0", "type", "veth",
554 "peer", "name", "veth0br"])
555 subprocess
.check_call(["ip", "link", "add", "veth1", "type", "veth",
556 "peer", "name", "veth1br"])
557 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
558 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
559 subprocess
.check_call(['brctl', 'addif', br_ifname
, 'veth0br'])
560 subprocess
.check_call(['brctl', 'addif', br_ifname
, 'veth1br'])
562 subprocess
.check_call(['brctl', 'addbr', 'br0ft'])
563 subprocess
.check_call(['brctl', 'setfd', 'br0ft', '0'])
564 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
565 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
566 subprocess
.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
567 subprocess
.check_call(['brctl', 'addbr', 'br1ft'])
568 subprocess
.check_call(['brctl', 'setfd', 'br1ft', '0'])
569 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
570 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
571 subprocess
.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
572 except subprocess
.CalledProcessError
:
573 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
575 with
HWSimRadio() as (radio
, iface
):
576 prg
= os
.path
.join(logdir
, 'alt-hostapd/hostapd/hostapd')
577 if not os
.path
.exists(prg
):
578 prg
= '../../hostapd/hostapd'
579 cmd
= [prg
, '-B', '-ddKt',
580 '-P', pidfile
, '-f', logfile
, '-g', global_ctrl
]
581 subprocess
.check_call(cmd
)
583 hglobal
= hostapd
.HostapdGlobal(global_ctrl_override
=global_ctrl
)
584 apdev_ft
= {'ifname': iface
}
585 apdev2
= [apdev_ft
, apdev
[1]]
587 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
588 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
589 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
590 params
['bridge'] = 'br0ft'
591 hapd0
= hostapd
.add_ap(apdev2
[0], params
,
592 global_ctrl_override
=global_ctrl
)
593 apdev2
[0]['bssid'] = hapd0
.own_addr()
594 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
595 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
596 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
597 params
['bridge'] = 'br1ft'
598 hapd1
= hostapd
.add_ap(apdev2
[1], params
)
600 run_roams(dev
[0], apdev2
, hapd0
, hapd1
, ssid
, passphrase
,
601 over_ds
=over_ds
, test_connectivity
=False)
605 if os
.path
.exists(pidfile
):
606 with
open(pidfile
, 'r') as f
:
609 os
.kill(pid
, signal
.SIGTERM
)
611 def test_ap_ft_over_ds_ocv(dev
, apdev
):
612 """WPA2-PSK-FT AP over DS"""
614 passphrase
= "12345678"
616 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
617 params
["ieee80211w"] = "2"
620 hapd0
= hostapd
.add_ap(apdev
[0], params
)
621 except Exception as e
:
622 if "Failed to set hostapd parameter ocv" in str(e
):
623 raise HwsimSkip("OCV not supported")
625 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
626 params
["ieee80211w"] = "2"
628 hapd1
= hostapd
.add_ap(apdev
[1], params
)
630 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
633 def test_ap_ft_over_ds_disabled(dev
, apdev
):
634 """WPA2-PSK-FT AP over DS disabled"""
636 passphrase
= "12345678"
638 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
639 params
['ft_over_ds'] = '0'
640 hapd0
= hostapd
.add_ap(apdev
[0], params
)
641 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
642 params
['ft_over_ds'] = '0'
643 hapd1
= hostapd
.add_ap(apdev
[1], params
)
645 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
648 def test_ap_ft_vlan_over_ds(dev
, apdev
):
649 """WPA2-PSK-FT AP over DS with VLAN"""
651 passphrase
= "12345678"
653 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
654 params
['dynamic_vlan'] = "1"
655 params
['accept_mac_file'] = "hostapd.accept"
656 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
657 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
658 params
['dynamic_vlan'] = "1"
659 params
['accept_mac_file'] = "hostapd.accept"
660 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
662 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
664 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
665 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
667 def test_ap_ft_over_ds_many(dev
, apdev
):
668 """WPA2-PSK-FT AP over DS multiple times"""
670 passphrase
= "12345678"
672 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
673 hapd0
= hostapd
.add_ap(apdev
[0], params
)
674 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
675 hapd1
= hostapd
.add_ap(apdev
[1], params
)
677 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
680 def test_ap_ft_vlan_over_ds_many(dev
, apdev
):
681 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
683 passphrase
= "12345678"
685 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
686 params
['dynamic_vlan'] = "1"
687 params
['accept_mac_file'] = "hostapd.accept"
688 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
689 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
690 params
['dynamic_vlan'] = "1"
691 params
['accept_mac_file'] = "hostapd.accept"
692 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
694 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
695 roams
=50, conndev
="brvlan1")
698 def test_ap_ft_over_ds_unknown_target(dev
, apdev
):
701 passphrase
= "12345678"
703 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
704 hapd0
= hostapd
.add_ap(apdev
[0], params
)
706 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
708 dev
[0].roam_over_ds("02:11:22:33:44:55", fail_test
=True)
711 def test_ap_ft_over_ds_unexpected(dev
, apdev
):
712 """WPA2-PSK-FT AP over DS and unexpected response"""
714 passphrase
= "12345678"
716 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
717 hapd0
= hostapd
.add_ap(apdev
[0], params
)
718 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
719 hapd1
= hostapd
.add_ap(apdev
[1], params
)
721 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
723 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
734 addr
= dev
[0].own_addr()
735 hapd1ap
.set("ext_mgmt_frame_handling", "1")
736 logger
.info("Foreign STA address")
740 msg
['sa'] = ap1
['bssid']
741 msg
['bssid'] = ap1
['bssid']
742 msg
['payload'] = binascii
.unhexlify("06021122334455660102030405060000")
745 logger
.info("No over-the-DS in progress")
746 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
749 logger
.info("Non-zero status code")
750 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060100")
753 hapd1ap
.dump_monitor()
755 dev
[0].scan_for_bss(ap2
['bssid'], freq
="2412")
756 if "OK" not in dev
[0].request("FT_DS " + ap2
['bssid']):
757 raise Exception("FT_DS failed")
759 req
= hapd1ap
.mgmt_rx()
761 logger
.info("Foreign Target AP")
762 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
765 addrs
= addr
.replace(':', '') + ap2
['bssid'].replace(':', '')
767 logger
.info("No IEs")
768 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "0000")
771 logger
.info("Invalid IEs (trigger parsing failure)")
772 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003700")
775 logger
.info("Too short MDIE")
776 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "000036021122")
779 logger
.info("Mobility domain mismatch")
780 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603112201")
783 logger
.info("No FTIE")
784 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201")
787 logger
.info("FTIE SNonce mismatch")
788 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
791 logger
.info("No R0KH-ID subelem in FTIE")
792 snonce
= binascii
.hexlify(req
['payload'][111:111+32]).decode()
793 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
)
796 logger
.info("No R0KH-ID subelem mismatch in FTIE")
797 snonce
= binascii
.hexlify(req
['payload'][111:111+32]).decode()
798 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a11223344556677889900")
801 logger
.info("No R1KH-ID subelem in FTIE")
802 r0khid
= binascii
.hexlify(req
['payload'][145:145+10]).decode()
803 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
)
806 logger
.info("No RSNE")
807 r0khid
= binascii
.hexlify(req
['payload'][145:145+10]).decode()
808 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
+ "0106000102030405")
811 def test_ap_ft_pmf_over_ds(dev
, apdev
):
812 """WPA2-PSK-FT AP over DS with PMF"""
813 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, None)
815 def test_ap_ft_pmf_bip_cmac_128_over_ds(dev
, apdev
):
816 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
817 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "AES-128-CMAC")
819 def test_ap_ft_pmf_bip_gmac_128_over_ds(dev
, apdev
):
820 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
821 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-GMAC-128")
823 def test_ap_ft_pmf_bip_gmac_256_over_ds(dev
, apdev
):
824 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
825 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-GMAC-256")
827 def test_ap_ft_pmf_bip_cmac_256_over_ds(dev
, apdev
):
828 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
829 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-CMAC-256")
831 def run_ap_ft_pmf_bip_over_ds(dev
, apdev
, cipher
):
832 if cipher
and cipher
not in dev
[0].get_capability("group_mgmt"):
833 raise HwsimSkip("Cipher %s not supported" % cipher
)
836 passphrase
= "12345678"
838 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
839 params
["ieee80211w"] = "2"
841 params
["group_mgmt_cipher"] = cipher
842 hapd0
= hostapd
.add_ap(apdev
[0], params
)
843 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
844 params
["ieee80211w"] = "2"
846 params
["group_mgmt_cipher"] = cipher
847 hapd1
= hostapd
.add_ap(apdev
[1], params
)
849 Wlantest
.setup(hapd0
)
852 wt
.add_passphrase(passphrase
)
854 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
857 def test_ap_ft_over_ds_pull(dev
, apdev
):
858 """WPA2-PSK-FT AP over DS (pull PMK)"""
860 passphrase
= "12345678"
862 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
863 params
["pmk_r1_push"] = "0"
864 hapd0
= hostapd
.add_ap(apdev
[0], params
)
865 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
866 params
["pmk_r1_push"] = "0"
867 hapd1
= hostapd
.add_ap(apdev
[1], params
)
869 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
871 def test_ap_ft_over_ds_pull_old_key(dev
, apdev
):
872 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
874 passphrase
= "12345678"
876 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
877 params
["pmk_r1_push"] = "0"
878 hapd0
= hostapd
.add_ap(apdev
[0], params
)
879 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
880 params
["pmk_r1_push"] = "0"
881 hapd1
= hostapd
.add_ap(apdev
[1], params
)
883 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
885 def test_ap_ft_over_ds_pull_vlan(dev
, apdev
):
886 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
888 passphrase
= "12345678"
890 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
891 params
["pmk_r1_push"] = "0"
892 params
['dynamic_vlan'] = "1"
893 params
['accept_mac_file'] = "hostapd.accept"
894 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
895 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
896 params
["pmk_r1_push"] = "0"
897 params
['dynamic_vlan'] = "1"
898 params
['accept_mac_file'] = "hostapd.accept"
899 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
901 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
904 def start_ft_sae(dev
, apdev
, wpa_ptk_rekey
=None):
905 if "SAE" not in dev
.get_capability("auth_alg"):
906 raise HwsimSkip("SAE not supported")
908 passphrase
= "12345678"
910 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
911 params
['wpa_key_mgmt'] = "FT-SAE"
913 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
914 hapd0
= hostapd
.add_ap(apdev
[0], params
)
915 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
916 params
['wpa_key_mgmt'] = "FT-SAE"
918 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
919 hapd1
= hostapd
.add_ap(apdev
[1], params
)
920 key_mgmt
= hapd1
.get_config()['key_mgmt']
921 if key_mgmt
.split(' ')[0] != "FT-SAE":
922 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
924 dev
.request("SET sae_groups ")
927 def test_ap_ft_sae(dev
, apdev
):
928 """WPA2-PSK-FT-SAE AP"""
929 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
930 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True)
932 def test_ap_ft_sae_ptk_rekey0(dev
, apdev
):
933 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
934 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
935 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
936 ptk_rekey
="1", roams
=0)
937 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
939 def test_ap_ft_sae_ptk_rekey1(dev
, apdev
):
940 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
941 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
942 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
943 ptk_rekey
="1", only_one_way
=True)
944 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
946 def test_ap_ft_sae_ptk_rekey_ap(dev
, apdev
):
947 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by AP"""
948 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
, wpa_ptk_rekey
=2)
949 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
951 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
953 def test_ap_ft_sae_over_ds(dev
, apdev
):
954 """WPA2-PSK-FT-SAE AP over DS"""
955 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
956 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
959 def test_ap_ft_sae_over_ds_ptk_rekey0(dev
, apdev
):
960 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
961 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
962 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
963 over_ds
=True, ptk_rekey
="1", roams
=0)
964 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
966 def test_ap_ft_sae_over_ds_ptk_rekey1(dev
, apdev
):
967 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
968 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
969 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
970 over_ds
=True, ptk_rekey
="1", only_one_way
=True)
971 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
973 def test_ap_ft_sae_over_ds_ptk_rekey_ap(dev
, apdev
):
974 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by AP"""
975 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
, wpa_ptk_rekey
=2)
976 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
977 over_ds
=True, only_one_way
=True)
978 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
980 def test_ap_ft_sae_pw_id(dev
, apdev
):
981 """FT-SAE with Password Identifier"""
982 if "SAE" not in dev
[0].get_capability("auth_alg"):
983 raise HwsimSkip("SAE not supported")
986 params
= ft_params1(ssid
=ssid
)
987 params
["ieee80211w"] = "2"
988 params
['wpa_key_mgmt'] = "FT-SAE"
989 params
['sae_password'] = 'secret|id=pwid'
990 hapd0
= hostapd
.add_ap(apdev
[0], params
)
991 params
= ft_params2(ssid
=ssid
)
992 params
["ieee80211w"] = "2"
993 params
['wpa_key_mgmt'] = "FT-SAE"
994 params
['sae_password'] = 'secret|id=pwid'
995 hapd
= hostapd
.add_ap(apdev
[1], params
)
997 dev
[0].request("SET sae_groups ")
998 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
=None, sae
=True,
999 sae_password
="secret", sae_password_id
="pwid")
1001 def test_ap_ft_sae_with_both_akms(dev
, apdev
):
1002 """SAE + FT-SAE configuration"""
1003 if "SAE" not in dev
[0].get_capability("auth_alg"):
1004 raise HwsimSkip("SAE not supported")
1006 passphrase
= "12345678"
1008 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1009 params
['wpa_key_mgmt'] = "FT-SAE SAE"
1010 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1011 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1012 params
['wpa_key_mgmt'] = "FT-SAE SAE"
1013 hapd
= hostapd
.add_ap(apdev
[1], params
)
1014 key_mgmt
= hapd
.get_config()['key_mgmt']
1015 if key_mgmt
.split(' ')[0] != "FT-SAE":
1016 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1018 dev
[0].request("SET sae_groups ")
1019 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True,
1022 def test_ap_ft_sae_pmksa_caching(dev
, apdev
):
1023 """WPA2-FT-SAE AP and PMKSA caching for initial mobility domain association"""
1024 if "SAE" not in dev
[0].get_capability("auth_alg"):
1025 raise HwsimSkip("SAE not supported")
1027 passphrase
= "12345678"
1029 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1030 params
['wpa_key_mgmt'] = "FT-SAE"
1031 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1032 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1033 params
['wpa_key_mgmt'] = "FT-SAE"
1034 hapd
= hostapd
.add_ap(apdev
[1], params
)
1035 key_mgmt
= hapd
.get_config()['key_mgmt']
1036 if key_mgmt
.split(' ')[0] != "FT-SAE":
1037 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1039 dev
[0].request("SET sae_groups ")
1040 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True,
1043 def generic_ap_ft_eap(dev
, apdev
, vlan
=False, cui
=False, over_ds
=False,
1044 discovery
=False, roams
=1, wpa_ptk_rekey
=0,
1045 only_one_way
=False):
1047 passphrase
= "12345678"
1049 identity
= "gpsk-vlan1"
1052 identity
= "gpsk-cui"
1055 identity
= "gpsk user"
1058 radius
= hostapd
.radius_params()
1059 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=discovery
)
1060 params
['wpa_key_mgmt'] = "FT-EAP"
1061 params
["ieee8021x"] = "1"
1063 params
["dynamic_vlan"] = "1"
1064 params
= dict(list(radius
.items()) + list(params
.items()))
1065 hapd
= hostapd
.add_ap(apdev
[0], params
)
1066 key_mgmt
= hapd
.get_config()['key_mgmt']
1067 if key_mgmt
.split(' ')[0] != "FT-EAP":
1068 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1069 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
, discovery
=discovery
)
1070 params
['wpa_key_mgmt'] = "FT-EAP"
1071 params
["ieee8021x"] = "1"
1073 params
["dynamic_vlan"] = "1"
1075 params
["wpa_ptk_rekey"] = str(wpa_ptk_rekey
)
1076 params
= dict(list(radius
.items()) + list(params
.items()))
1077 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1079 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True,
1080 over_ds
=over_ds
, roams
=roams
, eap_identity
=identity
,
1081 conndev
=conndev
, only_one_way
=only_one_way
)
1082 if "[WPA2-FT/EAP-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
1083 raise Exception("Scan results missing RSN element info")
1084 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
1085 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
1089 # Verify EAPOL reauthentication after FT protocol
1090 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1094 ap
.request("EAPOL_REAUTH " + dev
[0].own_addr())
1095 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout
=5)
1097 raise Exception("EAP authentication did not start")
1098 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout
=5)
1100 raise Exception("EAP authentication did not succeed")
1103 hwsim_utils
.test_connectivity_iface(dev
[0], ap
, conndev
)
1105 hwsim_utils
.test_connectivity(dev
[0], ap
)
1107 def test_ap_ft_eap(dev
, apdev
):
1108 """WPA2-EAP-FT AP"""
1109 generic_ap_ft_eap(dev
, apdev
)
1111 def test_ap_ft_eap_cui(dev
, apdev
):
1112 """WPA2-EAP-FT AP with CUI"""
1113 generic_ap_ft_eap(dev
, apdev
, vlan
=False, cui
=True)
1115 def test_ap_ft_eap_vlan(dev
, apdev
):
1116 """WPA2-EAP-FT AP with VLAN"""
1117 generic_ap_ft_eap(dev
, apdev
, vlan
=True)
1119 def test_ap_ft_eap_vlan_multi(dev
, apdev
):
1120 """WPA2-EAP-FT AP with VLAN"""
1121 generic_ap_ft_eap(dev
, apdev
, vlan
=True, roams
=50)
1123 def test_ap_ft_eap_over_ds(dev
, apdev
):
1124 """WPA2-EAP-FT AP using over-the-DS"""
1125 generic_ap_ft_eap(dev
, apdev
, over_ds
=True)
1127 def test_ap_ft_eap_dis(dev
, apdev
):
1128 """WPA2-EAP-FT AP with AP discovery"""
1129 generic_ap_ft_eap(dev
, apdev
, discovery
=True)
1131 def test_ap_ft_eap_dis_over_ds(dev
, apdev
):
1132 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1133 generic_ap_ft_eap(dev
, apdev
, over_ds
=True, discovery
=True)
1135 def test_ap_ft_eap_vlan(dev
, apdev
):
1136 """WPA2-EAP-FT AP with VLAN"""
1137 generic_ap_ft_eap(dev
, apdev
, vlan
=True)
1139 def test_ap_ft_eap_vlan_multi(dev
, apdev
):
1140 """WPA2-EAP-FT AP with VLAN"""
1141 generic_ap_ft_eap(dev
, apdev
, vlan
=True, roams
=50)
1143 def test_ap_ft_eap_vlan_over_ds(dev
, apdev
):
1144 """WPA2-EAP-FT AP with VLAN + over_ds"""
1145 generic_ap_ft_eap(dev
, apdev
, vlan
=True, over_ds
=True)
1147 def test_ap_ft_eap_vlan_over_ds_multi(dev
, apdev
):
1148 """WPA2-EAP-FT AP with VLAN + over_ds"""
1149 generic_ap_ft_eap(dev
, apdev
, vlan
=True, over_ds
=True, roams
=50)
1151 def generic_ap_ft_eap_pull(dev
, apdev
, vlan
=False):
1152 """WPA2-EAP-FT AP (pull PMK)"""
1154 passphrase
= "12345678"
1156 identity
= "gpsk-vlan1"
1159 identity
= "gpsk user"
1162 radius
= hostapd
.radius_params()
1163 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1164 params
['wpa_key_mgmt'] = "FT-EAP"
1165 params
["ieee8021x"] = "1"
1166 params
["pmk_r1_push"] = "0"
1168 params
["dynamic_vlan"] = "1"
1169 params
= dict(list(radius
.items()) + list(params
.items()))
1170 hapd
= hostapd
.add_ap(apdev
[0], params
)
1171 key_mgmt
= hapd
.get_config()['key_mgmt']
1172 if key_mgmt
.split(' ')[0] != "FT-EAP":
1173 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1174 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1175 params
['wpa_key_mgmt'] = "FT-EAP"
1176 params
["ieee8021x"] = "1"
1177 params
["pmk_r1_push"] = "0"
1179 params
["dynamic_vlan"] = "1"
1180 params
= dict(list(radius
.items()) + list(params
.items()))
1181 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1183 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True,
1184 eap_identity
=identity
, conndev
=conndev
)
1186 def test_ap_ft_eap_pull(dev
, apdev
):
1187 """WPA2-EAP-FT AP (pull PMK)"""
1188 generic_ap_ft_eap_pull(dev
, apdev
)
1190 def test_ap_ft_eap_pull_vlan(dev
, apdev
):
1191 generic_ap_ft_eap_pull(dev
, apdev
, vlan
=True)
1193 def test_ap_ft_eap_pull_wildcard(dev
, apdev
):
1194 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1196 passphrase
= "12345678"
1198 radius
= hostapd
.radius_params()
1199 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
1200 params
['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1201 params
["ieee8021x"] = "1"
1202 params
["pmk_r1_push"] = "0"
1203 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1204 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1205 params
["ft_psk_generate_local"] = "1"
1206 params
["eap_server"] = "0"
1207 params
= dict(list(radius
.items()) + list(params
.items()))
1208 hapd
= hostapd
.add_ap(apdev
[0], params
)
1209 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
1210 params
['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1211 params
["ieee8021x"] = "1"
1212 params
["pmk_r1_push"] = "0"
1213 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1214 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1215 params
["ft_psk_generate_local"] = "1"
1216 params
["eap_server"] = "0"
1217 params
= dict(list(radius
.items()) + list(params
.items()))
1218 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1220 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
1223 def test_ap_ft_mismatching_rrb_key_push(dev
, apdev
):
1224 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1226 passphrase
= "12345678"
1228 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1229 params
["ieee80211w"] = "2"
1230 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1231 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1232 params
["ieee80211w"] = "2"
1233 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1235 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1239 def test_ap_ft_mismatching_rrb_key_pull(dev
, apdev
):
1240 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1242 passphrase
= "12345678"
1244 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1245 params
["pmk_r1_push"] = "0"
1246 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1247 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1248 params
["pmk_r1_push"] = "0"
1249 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1251 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1255 def test_ap_ft_mismatching_r0kh_id_pull(dev
, apdev
):
1256 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1258 passphrase
= "12345678"
1260 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1261 params
["pmk_r1_push"] = "0"
1262 params
["nas_identifier"] = "nas0.w1.fi"
1263 hostapd
.add_ap(apdev
[0], params
)
1264 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1267 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1268 params
["pmk_r1_push"] = "0"
1269 hostapd
.add_ap(apdev
[1], params
)
1271 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1272 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1275 def test_ap_ft_mismatching_rrb_r0kh_push(dev
, apdev
):
1276 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1278 passphrase
= "12345678"
1280 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1281 params
["ieee80211w"] = "2"
1282 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1283 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1284 params
["ieee80211w"] = "2"
1285 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1287 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1291 def test_ap_ft_mismatching_rrb_r0kh_pull(dev
, apdev
):
1292 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1294 passphrase
= "12345678"
1296 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1297 params
["pmk_r1_push"] = "0"
1298 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1299 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1300 params
["pmk_r1_push"] = "0"
1301 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1303 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1306 def test_ap_ft_mismatching_rrb_key_push_eap(dev
, apdev
):
1307 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1309 passphrase
= "12345678"
1311 radius
= hostapd
.radius_params()
1312 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1313 params
["ieee80211w"] = "2"
1314 params
['wpa_key_mgmt'] = "FT-EAP"
1315 params
["ieee8021x"] = "1"
1316 params
= dict(list(radius
.items()) + list(params
.items()))
1317 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1318 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1319 params
["ieee80211w"] = "2"
1320 params
['wpa_key_mgmt'] = "FT-EAP"
1321 params
["ieee8021x"] = "1"
1322 params
= dict(list(radius
.items()) + list(params
.items()))
1323 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1325 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1326 fail_test
=True, eap
=True)
1328 def test_ap_ft_mismatching_rrb_key_pull_eap(dev
, apdev
):
1329 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1331 passphrase
= "12345678"
1333 radius
= hostapd
.radius_params()
1334 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1335 params
["pmk_r1_push"] = "0"
1336 params
['wpa_key_mgmt'] = "FT-EAP"
1337 params
["ieee8021x"] = "1"
1338 params
= dict(list(radius
.items()) + list(params
.items()))
1339 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1340 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1341 params
["pmk_r1_push"] = "0"
1342 params
['wpa_key_mgmt'] = "FT-EAP"
1343 params
["ieee8021x"] = "1"
1344 params
= dict(list(radius
.items()) + list(params
.items()))
1345 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1347 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1348 fail_test
=True, eap
=True)
1350 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev
, apdev
):
1351 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1353 passphrase
= "12345678"
1355 radius
= hostapd
.radius_params()
1356 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1357 params
["pmk_r1_push"] = "0"
1358 params
["nas_identifier"] = "nas0.w1.fi"
1359 params
['wpa_key_mgmt'] = "FT-EAP"
1360 params
["ieee8021x"] = "1"
1361 params
= dict(list(radius
.items()) + list(params
.items()))
1362 hostapd
.add_ap(apdev
[0], params
)
1363 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
1364 eap
="GPSK", identity
="gpsk user",
1365 password
="abcdefghijklmnop0123456789abcdef",
1368 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1369 params
["pmk_r1_push"] = "0"
1370 params
['wpa_key_mgmt'] = "FT-EAP"
1371 params
["ieee8021x"] = "1"
1372 params
= dict(list(radius
.items()) + list(params
.items()))
1373 hostapd
.add_ap(apdev
[1], params
)
1375 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1376 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1378 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev
, apdev
):
1379 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1381 passphrase
= "12345678"
1383 radius
= hostapd
.radius_params()
1384 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1385 params
["ieee80211w"] = "2"
1386 params
['wpa_key_mgmt'] = "FT-EAP"
1387 params
["ieee8021x"] = "1"
1388 params
= dict(list(radius
.items()) + list(params
.items()))
1389 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1390 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1391 params
["ieee80211w"] = "2"
1392 params
['wpa_key_mgmt'] = "FT-EAP"
1393 params
["ieee8021x"] = "1"
1394 params
= dict(list(radius
.items()) + list(params
.items()))
1395 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1397 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1398 fail_test
=True, eap
=True)
1400 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev
, apdev
):
1401 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1403 passphrase
= "12345678"
1405 radius
= hostapd
.radius_params()
1406 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1407 params
["pmk_r1_push"] = "0"
1408 params
['wpa_key_mgmt'] = "FT-EAP"
1409 params
["ieee8021x"] = "1"
1410 params
= dict(list(radius
.items()) + list(params
.items()))
1411 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1412 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1413 params
["pmk_r1_push"] = "0"
1414 params
['wpa_key_mgmt'] = "FT-EAP"
1415 params
["ieee8021x"] = "1"
1416 params
= dict(list(radius
.items()) + list(params
.items()))
1417 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1419 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1420 fail_test
=True, eap
=True)
1422 def test_ap_ft_gtk_rekey(dev
, apdev
):
1423 """WPA2-PSK-FT AP and GTK rekey"""
1425 passphrase
= "12345678"
1427 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1428 params
['wpa_group_rekey'] = '1'
1429 hapd
= hostapd
.add_ap(apdev
[0], params
)
1431 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1432 ieee80211w
="1", scan_freq
="2412")
1434 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
1436 raise Exception("GTK rekey timed out after initial association")
1437 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1439 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1440 params
['wpa_group_rekey'] = '1'
1441 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1443 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1444 dev
[0].roam(apdev
[1]['bssid'])
1445 if dev
[0].get_status_field('bssid') != apdev
[1]['bssid']:
1446 raise Exception("Did not connect to correct AP")
1447 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
1449 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
1451 raise Exception("GTK rekey timed out after FT protocol")
1452 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
1454 def test_ft_psk_key_lifetime_in_memory(dev
, apdev
, params
):
1455 """WPA2-PSK-FT and key lifetime in memory"""
1457 passphrase
= "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1458 psk
= '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1459 pmk
= binascii
.unhexlify(psk
)
1460 p
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1461 hapd0
= hostapd
.add_ap(apdev
[0], p
)
1462 p
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1463 hapd1
= hostapd
.add_ap(apdev
[1], p
)
1465 pid
= find_wpas_process(dev
[0])
1467 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1469 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1470 # event has been delivered, so verify that wpa_supplicant has returned to
1471 # eloop before reading process memory.
1475 buf
= read_process_memory(pid
, pmk
)
1477 dev
[0].request("DISCONNECT")
1478 dev
[0].wait_disconnected()
1485 with
open(os
.path
.join(params
['logdir'], 'log0'), 'r') as f
:
1486 for l
in f
.readlines():
1487 if "FT: PMK-R0 - hexdump" in l
:
1488 val
= l
.strip().split(':')[3].replace(' ', '')
1489 pmkr0
= binascii
.unhexlify(val
)
1490 if "FT: PMK-R1 - hexdump" in l
:
1491 val
= l
.strip().split(':')[3].replace(' ', '')
1492 pmkr1
= binascii
.unhexlify(val
)
1493 if "FT: KCK - hexdump" in l
:
1494 val
= l
.strip().split(':')[3].replace(' ', '')
1495 kck
= binascii
.unhexlify(val
)
1496 if "FT: KEK - hexdump" in l
:
1497 val
= l
.strip().split(':')[3].replace(' ', '')
1498 kek
= binascii
.unhexlify(val
)
1499 if "FT: TK - hexdump" in l
:
1500 val
= l
.strip().split(':')[3].replace(' ', '')
1501 tk
= binascii
.unhexlify(val
)
1502 if "WPA: Group Key - hexdump" in l
:
1503 val
= l
.strip().split(':')[3].replace(' ', '')
1504 gtk
= binascii
.unhexlify(val
)
1505 if not pmkr0
or not pmkr1
or not kck
or not kek
or not tk
or not gtk
:
1506 raise Exception("Could not find keys from debug log")
1508 raise Exception("Unexpected GTK length")
1510 logger
.info("Checking keys in memory while associated")
1511 get_key_locations(buf
, pmk
, "PMK")
1512 get_key_locations(buf
, pmkr0
, "PMK-R0")
1513 get_key_locations(buf
, pmkr1
, "PMK-R1")
1515 raise HwsimSkip("PMK not found while associated")
1516 if pmkr0
not in buf
:
1517 raise HwsimSkip("PMK-R0 not found while associated")
1518 if pmkr1
not in buf
:
1519 raise HwsimSkip("PMK-R1 not found while associated")
1521 raise Exception("KCK not found while associated")
1523 raise Exception("KEK not found while associated")
1525 # raise Exception("TK found from memory")
1527 logger
.info("Checking keys in memory after disassociation")
1528 buf
= read_process_memory(pid
, pmk
)
1529 get_key_locations(buf
, pmk
, "PMK")
1530 get_key_locations(buf
, pmkr0
, "PMK-R0")
1531 get_key_locations(buf
, pmkr1
, "PMK-R1")
1533 # Note: PMK/PSK is still present in network configuration
1535 fname
= os
.path
.join(params
['logdir'],
1536 'ft_psk_key_lifetime_in_memory.memctx-')
1537 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
1538 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
1539 verify_not_present(buf
, kck
, fname
, "KCK")
1540 verify_not_present(buf
, kek
, fname
, "KEK")
1541 verify_not_present(buf
, tk
, fname
, "TK")
1543 get_key_locations(buf
, gtk
, "GTK")
1544 verify_not_present(buf
, gtk
, fname
, "GTK")
1546 dev
[0].request("REMOVE_NETWORK all")
1548 logger
.info("Checking keys in memory after network profile removal")
1549 buf
= read_process_memory(pid
, pmk
)
1550 get_key_locations(buf
, pmk
, "PMK")
1551 get_key_locations(buf
, pmkr0
, "PMK-R0")
1552 get_key_locations(buf
, pmkr1
, "PMK-R1")
1554 verify_not_present(buf
, pmk
, fname
, "PMK")
1555 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
1556 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
1557 verify_not_present(buf
, kck
, fname
, "KCK")
1558 verify_not_present(buf
, kek
, fname
, "KEK")
1559 verify_not_present(buf
, tk
, fname
, "TK")
1560 verify_not_present(buf
, gtk
, fname
, "GTK")
1563 def test_ap_ft_invalid_resp(dev
, apdev
):
1564 """WPA2-PSK-FT AP and invalid response IEs"""
1566 passphrase
= "12345678"
1568 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1569 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1570 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1573 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1574 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1577 # Various IEs for test coverage. The last one is FTIE with invalid
1578 # R1KH-ID subelement.
1579 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1580 # FTIE with invalid R0KH-ID subelement (len=0).
1581 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1582 # FTIE with invalid R0KH-ID subelement (len=49).
1583 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1585 "020002000000" + "3000",
1586 # Required IEs missing from protected IE count.
1587 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1588 # RIC missing from protected IE count.
1589 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1590 # Protected IE missing.
1591 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
1593 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1594 hapd1
.set("ext_mgmt_frame_handling", "1")
1595 hapd1
.dump_monitor()
1596 if "OK" not in dev
[0].request("ROAM " + apdev
[1]['bssid']):
1597 raise Exception("ROAM failed")
1600 msg
= hapd1
.mgmt_rx()
1601 if msg
['subtype'] == 11:
1605 raise Exception("Authentication frame not seen")
1608 resp
['fc'] = auth
['fc']
1609 resp
['da'] = auth
['sa']
1610 resp
['sa'] = auth
['da']
1611 resp
['bssid'] = auth
['bssid']
1612 resp
['payload'] = binascii
.unhexlify(t
)
1614 hapd1
.set("ext_mgmt_frame_handling", "0")
1615 dev
[0].wait_disconnected()
1617 dev
[0].request("RECONNECT")
1618 dev
[0].wait_connected()
1620 def test_ap_ft_gcmp_256(dev
, apdev
):
1621 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1622 if "GCMP-256" not in dev
[0].get_capability("pairwise"):
1623 raise HwsimSkip("Cipher GCMP-256 not supported")
1625 passphrase
= "12345678"
1627 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1628 params
['rsn_pairwise'] = "GCMP-256"
1629 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1630 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1631 params
['rsn_pairwise'] = "GCMP-256"
1632 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1634 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
1635 pairwise_cipher
="GCMP-256", group_cipher
="GCMP-256")
1637 def setup_ap_ft_oom(dev
, apdev
):
1638 skip_with_fips(dev
[0])
1640 passphrase
= "12345678"
1642 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1643 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1644 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1645 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1647 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1649 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1650 dst
= apdev
[1]['bssid']
1652 dst
= apdev
[0]['bssid']
1654 dev
[0].scan_for_bss(dst
, freq
="2412")
1658 def test_ap_ft_oom(dev
, apdev
):
1659 """WPA2-PSK-FT and OOM"""
1660 dst
= setup_ap_ft_oom(dev
, apdev
)
1661 with
alloc_fail(dev
[0], 1, "wpa_ft_gen_req_ies"):
1664 def test_ap_ft_oom2(dev
, apdev
):
1665 """WPA2-PSK-FT and OOM (2)"""
1666 dst
= setup_ap_ft_oom(dev
, apdev
)
1667 with
fail_test(dev
[0], 1, "wpa_ft_mic"):
1668 dev
[0].roam(dst
, fail_test
=True, assoc_reject_ok
=True)
1670 def test_ap_ft_oom3(dev
, apdev
):
1671 """WPA2-PSK-FT and OOM (3)"""
1672 dst
= setup_ap_ft_oom(dev
, apdev
)
1673 with
fail_test(dev
[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1676 def test_ap_ft_oom4(dev
, apdev
):
1677 """WPA2-PSK-FT and OOM (4)"""
1679 passphrase
= "12345678"
1680 dst
= setup_ap_ft_oom(dev
, apdev
)
1681 dev
[0].request("REMOVE_NETWORK all")
1682 with
alloc_fail(dev
[0], 1, "=sme_update_ft_ies"):
1683 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1686 def test_ap_ft_ap_oom(dev
, apdev
):
1687 """WPA2-PSK-FT and AP OOM"""
1689 passphrase
= "12345678"
1691 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1692 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1693 bssid0
= hapd0
.own_addr()
1695 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1696 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r0"):
1697 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1700 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1701 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1702 bssid1
= hapd1
.own_addr()
1703 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1704 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1707 def test_ap_ft_ap_oom2(dev
, apdev
):
1708 """WPA2-PSK-FT and AP OOM 2"""
1710 passphrase
= "12345678"
1712 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1713 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1714 bssid0
= hapd0
.own_addr()
1716 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1717 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r1"):
1718 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1721 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1722 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1723 bssid1
= hapd1
.own_addr()
1724 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1726 if dev
[0].get_status_field('bssid') != bssid1
:
1727 raise Exception("Did not roam to AP1")
1728 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1731 def test_ap_ft_ap_oom3(dev
, apdev
):
1732 """WPA2-PSK-FT and AP OOM 3"""
1734 passphrase
= "12345678"
1736 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1737 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1738 bssid0
= hapd0
.own_addr()
1740 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1741 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1744 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1745 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1746 bssid1
= hapd1
.own_addr()
1747 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1748 with
alloc_fail(hapd1
, 1, "wpa_ft_pull_pmk_r1"):
1749 # This will fail due to not being able to send out PMK-R1 pull request
1752 with
fail_test(hapd1
, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1753 # This will fail due to not being able to send out PMK-R1 pull request
1756 with
fail_test(hapd1
, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1757 # This will fail due to not being able to send out PMK-R1 pull request
1760 def test_ap_ft_ap_oom3b(dev
, apdev
):
1761 """WPA2-PSK-FT and AP OOM 3b"""
1763 passphrase
= "12345678"
1765 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1766 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1767 bssid0
= hapd0
.own_addr()
1769 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1770 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1773 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1774 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1775 bssid1
= hapd1
.own_addr()
1776 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1777 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1778 # This will fail due to not being able to send out PMK-R1 pull request
1781 def test_ap_ft_ap_oom4(dev
, apdev
):
1782 """WPA2-PSK-FT and AP OOM 4"""
1784 passphrase
= "12345678"
1786 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1787 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1788 bssid0
= hapd0
.own_addr()
1790 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1791 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1794 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1795 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1796 bssid1
= hapd1
.own_addr()
1797 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1798 with
alloc_fail(hapd1
, 1, "wpa_ft_gtk_subelem"):
1800 if dev
[0].get_status_field('bssid') != bssid1
:
1801 raise Exception("Did not roam to AP1")
1803 with
fail_test(hapd0
, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1805 if dev
[0].get_status_field('bssid') != bssid0
:
1806 raise Exception("Did not roam to AP0")
1808 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1810 if dev
[0].get_status_field('bssid') != bssid1
:
1811 raise Exception("Did not roam to AP1")
1813 def test_ap_ft_ap_oom5(dev
, apdev
):
1814 """WPA2-PSK-FT and AP OOM 5"""
1816 passphrase
= "12345678"
1818 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1819 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1820 bssid0
= hapd0
.own_addr()
1822 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1823 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1826 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1827 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1828 bssid1
= hapd1
.own_addr()
1829 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1830 with
alloc_fail(hapd1
, 1, "=wpa_ft_process_auth_req"):
1831 # This will fail to roam
1834 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_process_auth_req"):
1835 # This will fail to roam
1838 with
fail_test(hapd1
, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1839 # This will fail to roam
1842 with
fail_test(hapd1
, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1843 # This will fail to roam
1846 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1847 # This will fail to roam
1850 def test_ap_ft_ap_oom6(dev
, apdev
):
1851 """WPA2-PSK-FT and AP OOM 6"""
1853 passphrase
= "12345678"
1855 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1856 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1857 bssid0
= hapd0
.own_addr()
1859 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1860 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1861 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1863 dev
[0].request("REMOVE_NETWORK all")
1864 dev
[0].wait_disconnected()
1865 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1866 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1868 dev
[0].request("REMOVE_NETWORK all")
1869 dev
[0].wait_disconnected()
1870 with
fail_test(hapd0
, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1871 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1874 def test_ap_ft_ap_oom7a(dev
, apdev
):
1875 """WPA2-PSK-FT and AP OOM 7a"""
1877 passphrase
= "12345678"
1879 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1880 params
["ieee80211w"] = "2"
1881 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1882 bssid0
= hapd0
.own_addr()
1884 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1885 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1886 ieee80211w
="2", scan_freq
="2412")
1888 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1889 params
["ieee80211w"] = "2"
1890 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1891 bssid1
= hapd1
.own_addr()
1892 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1893 with
alloc_fail(hapd1
, 1, "wpa_ft_igtk_subelem"):
1894 # This will fail to roam
1897 def test_ap_ft_ap_oom7b(dev
, apdev
):
1898 """WPA2-PSK-FT and AP OOM 7b"""
1900 passphrase
= "12345678"
1902 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1903 params
["ieee80211w"] = "2"
1904 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1905 bssid0
= hapd0
.own_addr()
1907 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1908 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1909 ieee80211w
="2", scan_freq
="2412")
1911 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1912 params
["ieee80211w"] = "2"
1913 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1914 bssid1
= hapd1
.own_addr()
1915 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1916 with
fail_test(hapd1
, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1917 # This will fail to roam
1920 def test_ap_ft_ap_oom7c(dev
, apdev
):
1921 """WPA2-PSK-FT and AP OOM 7c"""
1923 passphrase
= "12345678"
1925 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1926 params
["ieee80211w"] = "2"
1927 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1928 bssid0
= hapd0
.own_addr()
1930 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1931 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1932 ieee80211w
="2", scan_freq
="2412")
1934 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1935 params
["ieee80211w"] = "2"
1936 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1937 bssid1
= hapd1
.own_addr()
1938 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1939 with
alloc_fail(hapd1
, 1, "=wpa_sm_write_assoc_resp_ies"):
1940 # This will fail to roam
1943 def test_ap_ft_ap_oom7d(dev
, apdev
):
1944 """WPA2-PSK-FT and AP OOM 7d"""
1946 passphrase
= "12345678"
1948 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1949 params
["ieee80211w"] = "2"
1950 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1951 bssid0
= hapd0
.own_addr()
1953 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1954 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1955 ieee80211w
="2", scan_freq
="2412")
1957 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1958 params
["ieee80211w"] = "2"
1959 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1960 bssid1
= hapd1
.own_addr()
1961 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1962 with
fail_test(hapd1
, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1963 # This will fail to roam
1966 def test_ap_ft_ap_oom8(dev
, apdev
):
1967 """WPA2-PSK-FT and AP OOM 8"""
1969 passphrase
= "12345678"
1971 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1972 params
['ft_psk_generate_local'] = "1"
1973 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1974 bssid0
= hapd0
.own_addr()
1976 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1977 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1980 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1981 params
['ft_psk_generate_local'] = "1"
1982 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1983 bssid1
= hapd1
.own_addr()
1984 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1985 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1986 # This will fail to roam
1988 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1989 # This will fail to roam
1992 def test_ap_ft_ap_oom9(dev
, apdev
):
1993 """WPA2-PSK-FT and AP OOM 9"""
1995 passphrase
= "12345678"
1997 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1998 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1999 bssid0
= hapd0
.own_addr()
2001 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2002 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2005 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2006 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2007 bssid1
= hapd1
.own_addr()
2008 dev
[0].scan_for_bss(bssid1
, freq
="2412")
2010 with
alloc_fail(hapd0
, 1, "wpa_ft_action_rx"):
2011 # This will fail to roam
2012 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2013 raise Exception("FT_DS failed")
2014 wait_fail_trigger(hapd0
, "GET_ALLOC_FAIL")
2016 with
alloc_fail(hapd1
, 1, "wpa_ft_rrb_rx_request"):
2017 # This will fail to roam
2018 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2019 raise Exception("FT_DS failed")
2020 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
2022 with
alloc_fail(hapd1
, 1, "wpa_ft_send_rrb_auth_resp"):
2023 # This will fail to roam
2024 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2025 raise Exception("FT_DS failed")
2026 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
2028 def test_ap_ft_ap_oom10(dev
, apdev
):
2029 """WPA2-PSK-FT and AP OOM 10"""
2031 passphrase
= "12345678"
2033 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2034 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2035 bssid0
= hapd0
.own_addr()
2037 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2038 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2041 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2042 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2043 bssid1
= hapd1
.own_addr()
2044 dev
[0].scan_for_bss(bssid1
, freq
="2412")
2046 with
fail_test(hapd0
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
2047 # This will fail to roam
2048 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2049 raise Exception("FT_DS failed")
2050 wait_fail_trigger(hapd0
, "GET_FAIL")
2052 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
2053 # This will fail to roam
2054 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2055 raise Exception("FT_DS failed")
2056 wait_fail_trigger(hapd0
, "GET_FAIL")
2058 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
2059 # This will fail to roam
2060 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2061 raise Exception("FT_DS failed")
2062 wait_fail_trigger(hapd0
, "GET_FAIL")
2064 with
fail_test(hapd1
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
2065 # This will fail to roam
2066 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2067 raise Exception("FT_DS failed")
2068 wait_fail_trigger(hapd1
, "GET_FAIL")
2070 def test_ap_ft_ap_oom11(dev
, apdev
):
2071 """WPA2-PSK-FT and AP OOM 11"""
2073 passphrase
= "12345678"
2075 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2076 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2077 bssid0
= hapd0
.own_addr()
2079 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2080 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
2081 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2083 wait_fail_trigger(hapd0
, "GET_FAIL")
2085 dev
[1].scan_for_bss(bssid0
, freq
="2412")
2086 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
2087 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2089 wait_fail_trigger(hapd0
, "GET_FAIL")
2091 def test_ap_ft_over_ds_proto_ap(dev
, apdev
):
2092 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
2094 passphrase
= "12345678"
2096 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2097 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2098 bssid0
= hapd0
.own_addr()
2099 _bssid0
= bssid0
.replace(':', '')
2100 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2102 addr
= dev
[0].own_addr()
2103 _addr
= addr
.replace(':', '')
2105 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2106 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2107 bssid1
= hapd1
.own_addr()
2108 _bssid1
= bssid1
.replace(':', '')
2110 hapd0
.set("ext_mgmt_frame_handling", "1")
2111 hdr
= "d0003a01" + _bssid0
+ _addr
+ _bssid0
+ "1000"
2112 valid
= "0601" + _addr
+ _bssid1
2115 "0601" + _addr
+ _bssid0
,
2116 "0601" + _addr
+ "ffffffffffff",
2117 "0601" + _bssid0
+ _bssid0
,
2122 valid
+ "3603ffffff",
2123 valid
+ "3603a1b2ff",
2124 valid
+ "3603a1b2ff" + "3700",
2125 valid
+ "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2126 valid
+ "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2127 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2128 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2129 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2130 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2131 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2134 hapd0
.dump_monitor()
2135 if "OK" not in hapd0
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ t
):
2136 raise Exception("MGMT_RX_PROCESS failed")
2138 hapd0
.set("ext_mgmt_frame_handling", "0")
2140 def test_ap_ft_over_ds_proto(dev
, apdev
):
2141 """WPA2-PSK-FT AP over DS protocol testing"""
2143 passphrase
= "12345678"
2145 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2146 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2147 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2150 # FT Action Response while no FT-over-DS in progress
2153 msg
['da'] = dev
[0].own_addr()
2154 msg
['sa'] = apdev
[0]['bssid']
2155 msg
['bssid'] = apdev
[0]['bssid']
2156 msg
['payload'] = binascii
.unhexlify("06020200000000000200000004000000")
2159 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2160 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2161 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
2162 hapd0
.set("ext_mgmt_frame_handling", "1")
2163 hapd0
.dump_monitor()
2164 dev
[0].request("FT_DS " + apdev
[1]['bssid'])
2165 for i
in range(0, 10):
2166 req
= hapd0
.mgmt_rx()
2168 raise Exception("MGMT RX wait timed out")
2169 if req
['subtype'] == 13:
2173 raise Exception("FT Action frame not received")
2175 # FT Action Response for unexpected Target AP
2176 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "f20000000400" + "0000")
2179 # FT Action Response without MDIE
2180 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000")
2183 # FT Action Response without FTIE
2184 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2187 # FT Action Response with FTIE SNonce mismatch
2188 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2192 def test_ap_ft_rrb(dev
, apdev
):
2193 """WPA2-PSK-FT RRB protocol testing"""
2195 passphrase
= "12345678"
2197 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2198 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2200 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2203 _dst_ll
= binascii
.unhexlify(apdev
[0]['bssid'].replace(':', ''))
2204 _src_ll
= binascii
.unhexlify(dev
[0].own_addr().replace(':', ''))
2206 ehdr
= _dst_ll
+ _src_ll
+ proto
2208 # Too short RRB frame
2209 pkt
= ehdr
+ b
'\x01'
2210 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2211 raise Exception("DATA_TEST_FRAME failed")
2213 # RRB discarded frame wikth unrecognized type
2214 pkt
= ehdr
+ b
'\x02' + b
'\x02' + b
'\x01\x00' + _src_ll
2215 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2216 raise Exception("DATA_TEST_FRAME failed")
2218 # RRB frame too short for action frame
2219 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x01\x00' + _src_ll
2220 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2221 raise Exception("DATA_TEST_FRAME failed")
2223 # Too short RRB frame (not enough room for Action Frame body)
2224 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x00\x00' + _src_ll
2225 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2226 raise Exception("DATA_TEST_FRAME failed")
2228 # Unexpected Action frame category
2229 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x0e\x00' + _src_ll
+ b
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2230 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2231 raise Exception("DATA_TEST_FRAME failed")
2233 # Unexpected Action in RRB Request
2234 pkt
= ehdr
+ b
'\x01' + b
'\x00' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2235 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2236 raise Exception("DATA_TEST_FRAME failed")
2238 # Target AP address in RRB Request does not match with own address
2239 pkt
= ehdr
+ b
'\x01' + b
'\x00' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2240 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2241 raise Exception("DATA_TEST_FRAME failed")
2243 # Not enough room for status code in RRB Response
2244 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2245 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2246 raise Exception("DATA_TEST_FRAME failed")
2248 # RRB discarded frame with unknown packet_type
2249 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2250 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2251 raise Exception("DATA_TEST_FRAME failed")
2253 # RRB Response with non-zero status code; no STA match
2254 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x10\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b
'\xff\xff'
2255 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2256 raise Exception("DATA_TEST_FRAME failed")
2258 # RRB Response with zero status code and extra data; STA match
2259 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x11\x00' + _src_ll
+ b
'\x06\x01' + _src_ll
+ b
'\x00\x00\x00\x00\x00\x00' + b
'\x00\x00' + b
'\x00'
2260 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2261 raise Exception("DATA_TEST_FRAME failed")
2263 # Too short PMK-R1 pull
2264 pkt
= ehdr
+ b
'\x01' + b
'\xc8' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2265 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2266 raise Exception("DATA_TEST_FRAME failed")
2268 # Too short PMK-R1 resp
2269 pkt
= ehdr
+ b
'\x01' + b
'\xc9' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2270 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2271 raise Exception("DATA_TEST_FRAME failed")
2273 # Too short PMK-R1 push
2274 pkt
= ehdr
+ b
'\x01' + b
'\xca' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2275 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2276 raise Exception("DATA_TEST_FRAME failed")
2278 # No matching R0KH address found for PMK-R0 pull response
2279 pkt
= ehdr
+ b
'\x01' + b
'\xc9' + b
'\x5a\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b
'\00'
2280 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2281 raise Exception("DATA_TEST_FRAME failed")
2284 def test_rsn_ie_proto_ft_psk_sta(dev
, apdev
):
2285 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2286 bssid
= apdev
[0]['bssid']
2288 passphrase
= "12345678"
2290 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2291 params
["ieee80211w"] = "1"
2292 # This is the RSN element used normally by hostapd
2293 params
['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
2294 hapd
= hostapd
.add_ap(apdev
[0], params
)
2295 id = dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2296 ieee80211w
="1", scan_freq
="2412",
2297 pairwise
="CCMP", group
="CCMP")
2299 tests
= [('PMKIDCount field included',
2300 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2301 ('Extra IE before RSNE',
2302 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2303 ('PMKIDCount and Group Management Cipher suite fields included',
2304 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2305 ('Extra octet after defined fields (future extensibility)',
2306 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2307 ('No RSN Capabilities field (PMF disabled in practice)',
2308 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2309 for txt
, ie
in tests
:
2310 dev
[0].request("DISCONNECT")
2311 dev
[0].wait_disconnected()
2314 hapd
.set('own_ie_override', ie
)
2316 dev
[0].request("BSS_FLUSH 0")
2317 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2318 dev
[0].select_network(id, freq
=2412)
2319 dev
[0].wait_connected()
2321 dev
[0].request("DISCONNECT")
2322 dev
[0].wait_disconnected()
2324 logger
.info('Invalid RSNE causing internal hostapd error')
2326 hapd
.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2328 dev
[0].request("BSS_FLUSH 0")
2329 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2330 dev
[0].select_network(id, freq
=2412)
2331 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2333 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
2335 raise Exception("Unexpected connection")
2336 dev
[0].request("DISCONNECT")
2338 logger
.info('Unexpected PMKID causing internal hostapd error')
2340 hapd
.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2342 dev
[0].request("BSS_FLUSH 0")
2343 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2344 dev
[0].select_network(id, freq
=2412)
2345 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2347 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
2349 raise Exception("Unexpected connection")
2350 dev
[0].request("DISCONNECT")
2352 def start_ft(apdev
, wpa_ptk_rekey
=None):
2354 passphrase
= "12345678"
2356 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2358 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
2359 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2360 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2362 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
2363 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2367 def check_ptk_rekey(dev
, hapd0
=None, hapd1
=None):
2368 ev
= dev
.wait_event(["CTRL-EVENT-DISCONNECTED",
2369 "WPA: Key negotiation completed"], timeout
=5)
2371 raise Exception("No event received after roam")
2372 if "CTRL-EVENT-DISCONNECTED" in ev
:
2373 raise Exception("Unexpected disconnection after roam")
2375 if not hapd0
or not hapd1
:
2377 if dev
.get_status_field('bssid') == hapd0
.own_addr():
2381 hwsim_utils
.test_connectivity(dev
, hapd
)
2383 def test_ap_ft_ptk_rekey(dev
, apdev
):
2384 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2385 hapd0
, hapd1
= start_ft(apdev
)
2386 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", ptk_rekey
="1")
2387 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2389 def test_ap_ft_ptk_rekey2(dev
, apdev
):
2390 """WPA2-PSK-FT PTK rekeying triggered by station after one roam"""
2391 hapd0
, hapd1
= start_ft(apdev
)
2392 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", ptk_rekey
="1",
2394 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2396 def test_ap_ft_ptk_rekey_ap(dev
, apdev
):
2397 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2398 hapd0
, hapd1
= start_ft(apdev
, wpa_ptk_rekey
=2)
2399 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678")
2400 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2402 def test_ap_ft_ptk_rekey_ap2(dev
, apdev
):
2403 """WPA2-PSK-FT PTK rekeying triggered by AP after one roam"""
2404 hapd0
, hapd1
= start_ft(apdev
, wpa_ptk_rekey
=2)
2405 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678",
2407 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2409 def test_ap_ft_eap_ptk_rekey_ap(dev
, apdev
):
2410 """WPA2-EAP-FT PTK rekeying triggered by AP"""
2411 generic_ap_ft_eap(dev
, apdev
, only_one_way
=True, wpa_ptk_rekey
=2)
2412 check_ptk_rekey(dev
[0])
2414 def test_ap_ft_internal_rrb_check(dev
, apdev
):
2415 """RRB internal delivery only to WPA enabled BSS"""
2417 passphrase
= "12345678"
2419 radius
= hostapd
.radius_params()
2420 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2421 params
['wpa_key_mgmt'] = "FT-EAP"
2422 params
["ieee8021x"] = "1"
2423 params
= dict(list(radius
.items()) + list(params
.items()))
2424 hapd
= hostapd
.add_ap(apdev
[0], params
)
2425 key_mgmt
= hapd
.get_config()['key_mgmt']
2426 if key_mgmt
.split(' ')[0] != "FT-EAP":
2427 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
2429 hapd1
= hostapd
.add_ap(apdev
[1], {"ssid": ssid
})
2431 # Connect to WPA enabled AP
2432 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
2433 eap
="GPSK", identity
="gpsk user",
2434 password
="abcdefghijklmnop0123456789abcdef",
2437 # Try over_ds roaming to non-WPA-enabled AP.
2438 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2439 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
2441 def test_ap_ft_extra_ie(dev
, apdev
):
2442 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2444 passphrase
= "12345678"
2446 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2447 params
["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2448 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2449 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2451 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
2454 # Add Mobility Domain element to test AP validation code.
2455 dev
[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2456 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
2457 scan_freq
="2412", wait_connect
=False)
2458 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED",
2459 "CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
2461 raise Exception("No connection result")
2462 if "CTRL-EVENT-CONNECTED" in ev
:
2463 raise Exception("Non-FT association accepted with MDE")
2464 if "status_code=43" not in ev
:
2465 raise Exception("Unexpected status code: " + ev
)
2466 dev
[0].request("DISCONNECT")
2468 dev
[0].request("VENDOR_ELEM_REMOVE 13 *")
2470 def test_ap_ft_ric(dev
, apdev
):
2471 """WPA2-PSK-FT AP and RIC"""
2473 passphrase
= "12345678"
2475 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2476 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2477 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2478 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2480 dev
[0].set("ric_ies", "")
2481 dev
[0].set("ric_ies", '""')
2482 if "FAIL" not in dev
[0].request("SET ric_ies q"):
2483 raise Exception("Invalid ric_ies value accepted")
2488 "390400000000" + "390400000000",
2489 "390400000000" + "dd050050f20202",
2490 "390400000000" + "dd3d0050f2020201" + 55*"00",
2491 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2492 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
2494 dev
[0].set("ric_ies", t
)
2495 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
2496 test_connectivity
=False)
2497 dev
[0].request("REMOVE_NETWORK all")
2498 dev
[0].wait_disconnected()
2499 dev
[0].dump_monitor()
2501 def ie_hex(ies
, id):
2502 return binascii
.hexlify(struct
.pack('BB', id, len(ies
[id])) + ies
[id]).decode()
2504 def test_ap_ft_reassoc_proto(dev
, apdev
):
2505 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2507 passphrase
= "12345678"
2509 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2510 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2511 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2512 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2514 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2515 ieee80211w
="1", scan_freq
="2412")
2516 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2523 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2524 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2525 dev
[0].request("ROAM " + hapd2ap
.own_addr())
2528 req
= hapd2ap
.mgmt_rx()
2529 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2530 if req
['subtype'] == 11:
2534 req
= hapd2ap
.mgmt_rx()
2535 if req
['subtype'] == 2:
2537 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2539 # IEEE 802.11 header + fixed fields before IEs
2540 hdr
= binascii
.hexlify(req
['frame'][0:34]).decode()
2541 ies
= parse_ie(binascii
.hexlify(req
['frame'][34:]))
2542 # First elements: SSID, Supported Rates, Extended Supported Rates
2543 ies1
= ie_hex(ies
, 0) + ie_hex(ies
, 1) + ie_hex(ies
, 50)
2545 rsne
= ie_hex(ies
, 48)
2546 mde
= ie_hex(ies
, 54)
2547 fte
= ie_hex(ies
, 55)
2549 # RSN: Trying to use FT, but MDIE not included
2551 # RSN: Attempted to use unknown MDIE
2552 tests
+= [rsne
+ "3603000000"]
2553 # Invalid RSN pairwise cipher
2554 tests
+= ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
2555 # FT: No PMKID in RSNIE
2556 tests
+= ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies
, 54)]
2558 tests
+= [rsne
+ mde
]
2559 # FT: RIC IE(s) in the frame, but not included in protected IE count
2560 # FT: Failed to parse FT IEs
2561 tests
+= [rsne
+ mde
+ fte
+ "3900"]
2562 # FT: SNonce mismatch in FTIE
2563 tests
+= [rsne
+ mde
+ "37520000" + 16*"00" + 32*"00" + 32*"00"]
2564 # FT: ANonce mismatch in FTIE
2565 tests
+= [rsne
+ mde
+ fte
[0:40] + 32*"00" + fte
[104:]]
2566 # FT: No R0KH-ID subelem in FTIE
2567 tests
+= [rsne
+ mde
+ "3752" + fte
[4:168]]
2568 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2569 tests
+= [rsne
+ mde
+ "3755" + fte
[4:168] + "0301ff"]
2570 # FT: No R1KH-ID subelem in FTIE
2571 tests
+= [rsne
+ mde
+ "375e" + fte
[4:168] + "030a" + binascii
.hexlify(b
"nas1.w1.fi").decode()]
2572 # FT: Unknown R1KH-ID used in ReassocReq
2573 tests
+= [rsne
+ mde
+ "3766" + fte
[4:168] + "030a" + binascii
.hexlify(b
"nas1.w1.fi").decode() + "0106000000000000"]
2574 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2575 tests
+= [rsne
[:-32] + 16*"00" + mde
+ fte
]
2576 # Invalid MIC in FTIE
2577 tests
+= [rsne
+ mde
+ fte
[0:8] + 16*"00" + fte
[40:]]
2579 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ ies1
+ t
)
2581 def test_ap_ft_reassoc_local_fail(dev
, apdev
):
2582 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2584 passphrase
= "12345678"
2586 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2587 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2588 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2589 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2591 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2592 ieee80211w
="1", scan_freq
="2412")
2593 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2600 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2601 # FT: Failed to calculate MIC
2602 with
fail_test(hapd2ap
, 1, "wpa_ft_validate_reassoc"):
2603 dev
[0].request("ROAM " + hapd2ap
.own_addr())
2604 ev
= dev
[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
2605 dev
[0].request("DISCONNECT")
2607 raise Exception("Association reject not seen")
2609 def test_ap_ft_reassoc_replay(dev
, apdev
, params
):
2610 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2611 capfile
= os
.path
.join(params
['logdir'], "hwsim0.pcapng")
2613 passphrase
= "12345678"
2615 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2616 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2617 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2618 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2620 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2622 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2629 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2630 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2631 dev
[0].dump_monitor()
2632 if "OK" not in dev
[0].request("ROAM " + hapd2ap
.own_addr()):
2633 raise Exception("ROAM failed")
2638 req
= hapd2ap
.mgmt_rx()
2640 hapd2ap
.dump_monitor()
2641 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2642 if req
['subtype'] == 2:
2644 ev
= hapd2ap
.wait_event(["MGMT-TX-STATUS"], timeout
=5)
2646 raise Exception("No TX status seen")
2647 cmd
= "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev
.split(' ')[1:4]))
2648 if "OK" not in hapd2ap
.request(cmd
):
2649 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2651 hapd2ap
.set("ext_mgmt_frame_handling", "0")
2652 if reassocreq
is None:
2653 raise Exception("No Reassociation Request frame seen")
2654 dev
[0].wait_connected()
2655 dev
[0].dump_monitor()
2656 hapd2ap
.dump_monitor()
2658 hwsim_utils
.test_connectivity(dev
[0], hapd2ap
)
2660 logger
.info("Replay the last Reassociation Request frame")
2661 hapd2ap
.dump_monitor()
2662 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2663 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2664 ev
= hapd2ap
.wait_event(["MGMT-TX-STATUS"], timeout
=5)
2666 raise Exception("No TX status seen")
2667 cmd
= "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev
.split(' ')[1:4]))
2668 if "OK" not in hapd2ap
.request(cmd
):
2669 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2670 hapd2ap
.set("ext_mgmt_frame_handling", "0")
2673 hwsim_utils
.test_connectivity(dev
[0], hapd2ap
)
2678 ap
= hapd2ap
.own_addr()
2679 sta
= dev
[0].own_addr()
2680 filt
= "wlan.fc.type == 2 && " + \
2681 "wlan.da == " + sta
+ " && " + \
2683 fields
= ["wlan.ccmp.extiv"]
2684 res
= run_tshark(capfile
, filt
, fields
)
2685 vals
= res
.splitlines()
2686 logger
.info("CCMP PN: " + str(vals
))
2688 raise Exception("Could not find all CCMP protected frames from capture")
2689 if len(set(vals
)) < len(vals
):
2690 raise Exception("Duplicate CCMP PN used")
2693 raise Exception("The second hwsim connectivity test failed")
2695 def test_ap_ft_psk_file(dev
, apdev
):
2696 """WPA2-PSK-FT AP with PSK from a file"""
2698 passphrase
= "12345678"
2700 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
2701 params
['wpa_psk_file'] = 'hostapd.wpa_psk'
2702 hapd
= hostapd
.add_ap(apdev
[0], params
)
2704 dev
[1].connect(ssid
, psk
="very secret",
2705 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2706 scan_freq
="2412", wait_connect
=False)
2707 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2708 ieee80211w
="1", scan_freq
="2412")
2709 dev
[0].request("REMOVE_NETWORK all")
2710 dev
[0].wait_disconnected()
2711 dev
[0].connect(ssid
, psk
="very secret", key_mgmt
="FT-PSK", proto
="WPA2",
2712 ieee80211w
="1", scan_freq
="2412")
2713 dev
[0].request("REMOVE_NETWORK all")
2714 dev
[0].wait_disconnected()
2715 dev
[0].connect(ssid
, psk
="secret passphrase",
2716 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2718 dev
[2].connect(ssid
, psk
="another passphrase for all STAs",
2719 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2721 ev
= dev
[1].wait_event(["WPA: 4-Way Handshake failed"], timeout
=10)
2723 raise Exception("Timed out while waiting for failure report")
2724 dev
[1].request("REMOVE_NETWORK all")
2726 def test_ap_ft_eap_ap_config_change(dev
, apdev
):
2727 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2729 passphrase
= "12345678"
2730 bssid
= apdev
[0]['bssid']
2732 radius
= hostapd
.radius_params()
2733 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
2734 params
['wpa_key_mgmt'] = "WPA-EAP"
2735 params
["ieee8021x"] = "1"
2736 params
["pmk_r1_push"] = "0"
2737 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2738 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2739 params
["eap_server"] = "0"
2740 params
= dict(list(radius
.items()) + list(params
.items()))
2741 hapd
= hostapd
.add_ap(apdev
[0], params
)
2743 dev
[0].connect(ssid
, key_mgmt
="FT-EAP WPA-EAP", proto
="WPA2",
2744 eap
="GPSK", identity
="gpsk user",
2745 password
="abcdefghijklmnop0123456789abcdef",
2747 dev
[0].request("DISCONNECT")
2748 dev
[0].wait_disconnected()
2749 dev
[0].dump_monitor()
2752 hapd
.set('wpa_key_mgmt', "FT-EAP")
2755 dev
[0].request("BSS_FLUSH 0")
2756 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2758 dev
[0].request("RECONNECT")
2759 dev
[0].wait_connected()
2761 def test_ap_ft_eap_sha384(dev
, apdev
):
2762 """WPA2-EAP-FT with SHA384"""
2764 passphrase
= "12345678"
2766 radius
= hostapd
.radius_params()
2767 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2768 params
["ieee80211w"] = "2"
2769 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2770 params
["ieee8021x"] = "1"
2771 params
= dict(list(radius
.items()) + list(params
.items()))
2772 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2773 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2774 params
["ieee80211w"] = "2"
2775 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2776 params
["ieee8021x"] = "1"
2777 params
= dict(list(radius
.items()) + list(params
.items()))
2778 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2780 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, eap
=True,
2783 def test_ap_ft_eap_sha384_reassoc(dev
, apdev
):
2784 """WPA2-EAP-FT with SHA384 using REASSOCIATE"""
2786 passphrase
= "12345678"
2788 radius
= hostapd
.radius_params()
2789 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2790 params
["ieee80211w"] = "2"
2791 params
['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2792 params
["ieee8021x"] = "1"
2793 params
= dict(list(radius
.items()) + list(params
.items()))
2794 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2795 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2796 params
["ieee80211w"] = "2"
2797 params
['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2798 params
["ieee8021x"] = "1"
2799 params
= dict(list(radius
.items()) + list(params
.items()))
2800 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2802 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, eap
=True,
2803 sha384
=True, also_non_ft
=True, roam_with_reassoc
=True)
2805 def test_ap_ft_eap_sha384_over_ds(dev
, apdev
):
2806 """WPA2-EAP-FT with SHA384 over DS"""
2808 passphrase
= "12345678"
2810 radius
= hostapd
.radius_params()
2811 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2812 params
["ieee80211w"] = "2"
2813 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2814 params
["ieee8021x"] = "1"
2815 params
= dict(list(radius
.items()) + list(params
.items()))
2816 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2817 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2818 params
["ieee80211w"] = "2"
2819 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2820 params
["ieee8021x"] = "1"
2821 params
= dict(list(radius
.items()) + list(params
.items()))
2822 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2824 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
2825 eap
=True, sha384
=True)
2827 def test_ap_ft_roam_rrm(dev
, apdev
):
2828 """WPA2-PSK-FT AP and radio measurement request"""
2830 passphrase
= "12345678"
2832 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2833 params
["rrm_beacon_report"] = "1"
2834 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2835 bssid0
= hapd0
.own_addr()
2837 addr
= dev
[0].own_addr()
2838 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2840 check_beacon_req(hapd0
, addr
, 1)
2842 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2843 params
["rrm_beacon_report"] = "1"
2844 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2845 bssid1
= hapd1
.own_addr()
2847 dev
[0].scan_for_bss(bssid1
, freq
=2412)
2849 check_beacon_req(hapd1
, addr
, 2)
2851 dev
[0].scan_for_bss(bssid0
, freq
=2412)
2853 check_beacon_req(hapd0
, addr
, 3)
2855 def test_ap_ft_pmksa_caching(dev
, apdev
):
2856 """FT-EAP and PMKSA caching for initial mobility domain association"""
2858 identity
= "gpsk user"
2860 radius
= hostapd
.radius_params()
2861 params
= ft_params1(ssid
=ssid
)
2862 params
['wpa_key_mgmt'] = "FT-EAP"
2863 params
["ieee8021x"] = "1"
2864 params
["mobility_domain"] = "c3d4"
2865 params
= dict(list(radius
.items()) + list(params
.items()))
2866 hapd
= hostapd
.add_ap(apdev
[0], params
)
2868 params
= ft_params2(ssid
=ssid
)
2869 params
['wpa_key_mgmt'] = "FT-EAP"
2870 params
["ieee8021x"] = "1"
2871 params
["mobility_domain"] = "c3d4"
2872 params
= dict(list(radius
.items()) + list(params
.items()))
2873 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2875 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, None, eap
=True,
2876 eap_identity
=identity
, pmksa_caching
=True)
2878 def test_ap_ft_pmksa_caching_sha384(dev
, apdev
):
2879 """FT-EAP-SHA384 and PMKSA caching for initial mobility domain association"""
2881 identity
= "gpsk user"
2883 radius
= hostapd
.radius_params()
2884 params
= ft_params1(ssid
=ssid
)
2885 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2886 params
["ieee8021x"] = "1"
2887 params
["mobility_domain"] = "c3d4"
2888 params
= dict(list(radius
.items()) + list(params
.items()))
2889 hapd
= hostapd
.add_ap(apdev
[0], params
)
2891 params
= ft_params2(ssid
=ssid
)
2892 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2893 params
["ieee8021x"] = "1"
2894 params
["mobility_domain"] = "c3d4"
2895 params
= dict(list(radius
.items()) + list(params
.items()))
2896 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2898 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, None, eap
=True,
2899 eap_identity
=identity
, pmksa_caching
=True, sha384
=True)