]>
git.ipfire.org Git - thirdparty/hostap.git/blob - tests/hwsim/test_ap_ft.py
1 # Fast BSS Transition tests
2 # Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
4 # This software may be distributed under the terms of the BSD license.
5 # See README for more details.
7 from remotehost
import remote_compatible
12 logger
= logging
.getLogger()
16 from utils
import HwsimSkip
, alloc_fail
, fail_test
, wait_fail_trigger
, skip_with_fips
17 from wlantest
import Wlantest
18 from test_ap_psk
import check_mib
, find_wpas_process
, read_process_memory
, verify_not_present
, get_key_locations
21 params
= { "wpa": "2",
22 "wpa_key_mgmt": "FT-PSK",
23 "rsn_pairwise": "CCMP" }
27 params
= { "wpa": "3",
28 "wpa_key_mgmt": "WPA-PSK FT-PSK",
29 "wpa_pairwise": "TKIP",
30 "rsn_pairwise": "CCMP" }
33 def ft_params(rsn
=True, ssid
=None, passphrase
=None):
35 params
= ft_base_rsn()
37 params
= ft_base_mixed()
41 params
["wpa_passphrase"] = passphrase
43 params
["mobility_domain"] = "a1b2"
44 params
["r0_key_lifetime"] = "10000"
45 params
["pmk_r1_push"] = "1"
46 params
["reassociation_deadline"] = "1000"
49 def ft_params1a(rsn
=True, ssid
=None, passphrase
=None):
50 params
= ft_params(rsn
, ssid
, passphrase
)
51 params
['nas_identifier'] = "nas1.w1.fi"
52 params
['r1_key_holder'] = "000102030405"
55 def ft_params1(rsn
=True, ssid
=None, passphrase
=None):
56 params
= ft_params1a(rsn
, ssid
, passphrase
)
57 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
58 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
59 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
62 def ft_params2a(rsn
=True, ssid
=None, passphrase
=None):
63 params
= ft_params(rsn
, ssid
, passphrase
)
64 params
['nas_identifier'] = "nas2.w1.fi"
65 params
['r1_key_holder'] = "000102030406"
68 def ft_params2(rsn
=True, ssid
=None, passphrase
=None):
69 params
= ft_params2a(rsn
, ssid
, passphrase
)
70 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
71 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
72 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
75 def ft_params1_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
76 params
= ft_params(rsn
, ssid
, passphrase
)
77 params
['nas_identifier'] = "nas1.w1.fi"
78 params
['r1_key_holder'] = "000102030405"
79 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
80 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
81 params
['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
84 def ft_params2_incorrect_rrb_key(rsn
=True, ssid
=None, passphrase
=None):
85 params
= ft_params(rsn
, ssid
, passphrase
)
86 params
['nas_identifier'] = "nas2.w1.fi"
87 params
['r1_key_holder'] = "000102030406"
88 params
['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1",
89 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2" ]
90 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3"
93 def ft_params2_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
94 params
= ft_params(rsn
, ssid
, passphrase
)
95 params
['nas_identifier'] = "nas2.w1.fi"
96 params
['r1_key_holder'] = "000102030406"
97 params
['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
98 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
99 params
['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
102 def run_roams(dev
, apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=False,
103 sae
=False, eap
=False, fail_test
=False, roams
=1,
104 pairwise_cipher
="CCMP", group_cipher
="TKIP CCMP", ptk_rekey
="0"):
105 logger
.info("Connect to first AP")
107 dev
.connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
108 eap
="GPSK", identity
="gpsk user",
109 password
="abcdefghijklmnop0123456789abcdef",
111 pairwise
=pairwise_cipher
, group
=group_cipher
,
112 wpa_ptk_rekey
=ptk_rekey
)
118 dev
.connect(ssid
, psk
=passphrase
, key_mgmt
=key_mgmt
, proto
="WPA2",
119 ieee80211w
="1", scan_freq
="2412",
120 pairwise
=pairwise_cipher
, group
=group_cipher
,
121 wpa_ptk_rekey
=ptk_rekey
)
122 if dev
.get_status_field('bssid') == apdev
[0]['bssid']:
132 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
134 dev
.scan_for_bss(ap2
['bssid'], freq
="2412")
136 for i
in range(0, roams
):
137 logger
.info("Roam to the second AP")
139 dev
.roam_over_ds(ap2
['bssid'], fail_test
=fail_test
)
141 dev
.roam(ap2
['bssid'], fail_test
=fail_test
)
144 if dev
.get_status_field('bssid') != ap2
['bssid']:
145 raise Exception("Did not connect to correct AP")
146 if i
== 0 or i
== roams
- 1:
147 hwsim_utils
.test_connectivity(dev
, hapd2ap
)
149 logger
.info("Roam back to the first AP")
151 dev
.roam_over_ds(ap1
['bssid'])
153 dev
.roam(ap1
['bssid'])
154 if dev
.get_status_field('bssid') != ap1
['bssid']:
155 raise Exception("Did not connect to correct AP")
156 if i
== 0 or i
== roams
- 1:
157 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
159 def test_ap_ft(dev
, apdev
):
162 passphrase
="12345678"
164 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
165 hapd0
= hostapd
.add_ap(apdev
[0], params
)
166 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
167 hapd1
= hostapd
.add_ap(apdev
[1], params
)
169 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
170 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
171 raise Exception("Scan results missing RSN element info")
173 def test_ap_ft_local_key_gen(dev
, apdev
):
174 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
176 passphrase
="12345678"
178 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
179 params
['ft_psk_generate_local'] = "1";
180 del params
['pmk_r1_push']
181 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
182 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
183 params
['ft_psk_generate_local'] = "1";
184 del params
['pmk_r1_push']
185 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
187 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
188 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
189 raise Exception("Scan results missing RSN element info")
191 def test_ap_ft_many(dev
, apdev
):
192 """WPA2-PSK-FT AP multiple times"""
194 passphrase
="12345678"
196 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
197 hapd0
= hostapd
.add_ap(apdev
[0], params
)
198 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
199 hapd1
= hostapd
.add_ap(apdev
[1], params
)
201 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50)
203 def test_ap_ft_mixed(dev
, apdev
):
204 """WPA2-PSK-FT mixed-mode AP"""
205 ssid
= "test-ft-mixed"
206 passphrase
="12345678"
208 params
= ft_params1(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
209 hapd
= hostapd
.add_ap(apdev
[0], params
)
210 key_mgmt
= hapd
.get_config()['key_mgmt']
211 vals
= key_mgmt
.split(' ')
212 if vals
[0] != "WPA-PSK" or vals
[1] != "FT-PSK":
213 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
214 params
= ft_params2(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
215 hapd1
= hostapd
.add_ap(apdev
[1], params
)
217 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
)
219 def test_ap_ft_pmf(dev
, apdev
):
220 """WPA2-PSK-FT AP with PMF"""
222 passphrase
="12345678"
224 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
225 params
["ieee80211w"] = "2"
226 hapd0
= hostapd
.add_ap(apdev
[0], params
)
227 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
228 params
["ieee80211w"] = "2"
229 hapd1
= hostapd
.add_ap(apdev
[1], params
)
231 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
233 def test_ap_ft_over_ds(dev
, apdev
):
234 """WPA2-PSK-FT AP over DS"""
236 passphrase
="12345678"
238 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
239 hapd0
= hostapd
.add_ap(apdev
[0], params
)
240 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
241 hapd1
= hostapd
.add_ap(apdev
[1], params
)
243 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
244 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
245 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
247 def test_ap_ft_over_ds_disabled(dev
, apdev
):
248 """WPA2-PSK-FT AP over DS disabled"""
250 passphrase
="12345678"
252 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
253 params
['ft_over_ds'] = '0'
254 hapd0
= hostapd
.add_ap(apdev
[0], params
)
255 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
256 params
['ft_over_ds'] = '0'
257 hapd1
= hostapd
.add_ap(apdev
[1], params
)
259 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
262 def test_ap_ft_over_ds_many(dev
, apdev
):
263 """WPA2-PSK-FT AP over DS multiple times"""
265 passphrase
="12345678"
267 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
268 hapd0
= hostapd
.add_ap(apdev
[0], params
)
269 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
270 hapd1
= hostapd
.add_ap(apdev
[1], params
)
272 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
276 def test_ap_ft_over_ds_unknown_target(dev
, apdev
):
279 passphrase
="12345678"
281 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
282 hapd0
= hostapd
.add_ap(apdev
[0], params
)
284 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
286 dev
[0].roam_over_ds("02:11:22:33:44:55", fail_test
=True)
289 def test_ap_ft_over_ds_unexpected(dev
, apdev
):
290 """WPA2-PSK-FT AP over DS and unexpected response"""
292 passphrase
="12345678"
294 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
295 hapd0
= hostapd
.add_ap(apdev
[0], params
)
296 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
297 hapd1
= hostapd
.add_ap(apdev
[1], params
)
299 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
301 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
312 addr
= dev
[0].own_addr()
313 hapd1ap
.set("ext_mgmt_frame_handling", "1")
314 logger
.info("Foreign STA address")
318 msg
['sa'] = ap1
['bssid']
319 msg
['bssid'] = ap1
['bssid']
320 msg
['payload'] = binascii
.unhexlify("06021122334455660102030405060000")
323 logger
.info("No over-the-DS in progress")
324 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
327 logger
.info("Non-zero status code")
328 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060100")
331 hapd1ap
.dump_monitor()
333 dev
[0].scan_for_bss(ap2
['bssid'], freq
="2412")
334 if "OK" not in dev
[0].request("FT_DS " + ap2
['bssid']):
335 raise Exception("FT_DS failed")
337 req
= hapd1ap
.mgmt_rx()
339 logger
.info("Foreign Target AP")
340 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
343 addrs
= addr
.replace(':', '') + ap2
['bssid'].replace(':', '')
345 logger
.info("No IEs")
346 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "0000")
349 logger
.info("Invalid IEs (trigger parsing failure)")
350 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003700")
353 logger
.info("Too short MDIE")
354 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "000036021122")
357 logger
.info("Mobility domain mismatch")
358 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603112201")
361 logger
.info("No FTIE")
362 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201")
365 logger
.info("FTIE SNonce mismatch")
366 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
369 logger
.info("No R0KH-ID subelem in FTIE")
370 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
371 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
)
374 logger
.info("No R0KH-ID subelem mismatch in FTIE")
375 snonce
= binascii
.hexlify(req
['payload'][111:111+32])
376 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a11223344556677889900")
379 logger
.info("No R1KH-ID subelem in FTIE")
380 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
381 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
)
384 logger
.info("No RSNE")
385 r0khid
= binascii
.hexlify(req
['payload'][145:145+10])
386 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
+ "0106000102030405")
389 def test_ap_ft_pmf_over_ds(dev
, apdev
):
390 """WPA2-PSK-FT AP over DS with PMF"""
392 passphrase
="12345678"
394 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
395 params
["ieee80211w"] = "2"
396 hapd0
= hostapd
.add_ap(apdev
[0], params
)
397 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
398 params
["ieee80211w"] = "2"
399 hapd1
= hostapd
.add_ap(apdev
[1], params
)
401 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
403 def test_ap_ft_over_ds_pull(dev
, apdev
):
404 """WPA2-PSK-FT AP over DS (pull PMK)"""
406 passphrase
="12345678"
408 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
409 params
["pmk_r1_push"] = "0"
410 hapd0
= hostapd
.add_ap(apdev
[0], params
)
411 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
412 params
["pmk_r1_push"] = "0"
413 hapd1
= hostapd
.add_ap(apdev
[1], params
)
415 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
417 def test_ap_ft_sae(dev
, apdev
):
418 """WPA2-PSK-FT-SAE AP"""
419 if "SAE" not in dev
[0].get_capability("auth_alg"):
420 raise HwsimSkip("SAE not supported")
422 passphrase
="12345678"
424 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
425 params
['wpa_key_mgmt'] = "FT-SAE"
426 hapd0
= hostapd
.add_ap(apdev
[0], params
)
427 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
428 params
['wpa_key_mgmt'] = "FT-SAE"
429 hapd
= hostapd
.add_ap(apdev
[1], params
)
430 key_mgmt
= hapd
.get_config()['key_mgmt']
431 if key_mgmt
.split(' ')[0] != "FT-SAE":
432 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
434 dev
[0].request("SET sae_groups ")
435 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True)
437 def test_ap_ft_sae_over_ds(dev
, apdev
):
438 """WPA2-PSK-FT-SAE AP over DS"""
439 if "SAE" not in dev
[0].get_capability("auth_alg"):
440 raise HwsimSkip("SAE not supported")
442 passphrase
="12345678"
444 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
445 params
['wpa_key_mgmt'] = "FT-SAE"
446 hapd0
= hostapd
.add_ap(apdev
[0], params
)
447 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
448 params
['wpa_key_mgmt'] = "FT-SAE"
449 hapd1
= hostapd
.add_ap(apdev
[1], params
)
451 dev
[0].request("SET sae_groups ")
452 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, sae
=True,
455 def test_ap_ft_eap(dev
, apdev
):
458 passphrase
="12345678"
460 radius
= hostapd
.radius_params()
461 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
462 params
['wpa_key_mgmt'] = "FT-EAP"
463 params
["ieee8021x"] = "1"
464 params
= dict(radius
.items() + params
.items())
465 hapd
= hostapd
.add_ap(apdev
[0], params
)
466 key_mgmt
= hapd
.get_config()['key_mgmt']
467 if key_mgmt
.split(' ')[0] != "FT-EAP":
468 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
469 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
470 params
['wpa_key_mgmt'] = "FT-EAP"
471 params
["ieee8021x"] = "1"
472 params
= dict(radius
.items() + params
.items())
473 hapd1
= hostapd
.add_ap(apdev
[1], params
)
475 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
476 if "[WPA2-FT/EAP-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
477 raise Exception("Scan results missing RSN element info")
478 check_mib(dev
[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
479 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
481 # Verify EAPOL reauthentication after FT protocol
482 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
486 ap
.request("EAPOL_REAUTH " + dev
[0].own_addr())
487 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout
=5)
489 raise Exception("EAP authentication did not start")
490 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout
=5)
492 raise Exception("EAP authentication did not succeed")
494 hwsim_utils
.test_connectivity(dev
[0], ap
)
496 def test_ap_ft_eap_pull(dev
, apdev
):
497 """WPA2-EAP-FT AP (pull PMK)"""
499 passphrase
="12345678"
501 radius
= hostapd
.radius_params()
502 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
503 params
['wpa_key_mgmt'] = "FT-EAP"
504 params
["ieee8021x"] = "1"
505 params
["pmk_r1_push"] = "0"
506 params
= dict(radius
.items() + params
.items())
507 hapd
= hostapd
.add_ap(apdev
[0], params
)
508 key_mgmt
= hapd
.get_config()['key_mgmt']
509 if key_mgmt
.split(' ')[0] != "FT-EAP":
510 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
511 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
512 params
['wpa_key_mgmt'] = "FT-EAP"
513 params
["ieee8021x"] = "1"
514 params
["pmk_r1_push"] = "0"
515 params
= dict(radius
.items() + params
.items())
516 hapd1
= hostapd
.add_ap(apdev
[1], params
)
518 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
521 def test_ap_ft_mismatching_rrb_key_push(dev
, apdev
):
522 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
524 passphrase
="12345678"
526 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
527 params
["ieee80211w"] = "2"
528 hapd0
= hostapd
.add_ap(apdev
[0], params
)
529 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
530 params
["ieee80211w"] = "2"
531 hapd1
= hostapd
.add_ap(apdev
[1], params
)
533 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
537 def test_ap_ft_mismatching_rrb_key_pull(dev
, apdev
):
538 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
540 passphrase
="12345678"
542 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
543 params
["pmk_r1_push"] = "0"
544 hapd0
= hostapd
.add_ap(apdev
[0], params
)
545 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
546 params
["pmk_r1_push"] = "0"
547 hapd1
= hostapd
.add_ap(apdev
[1], params
)
549 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
553 def test_ap_ft_mismatching_r0kh_id_pull(dev
, apdev
):
554 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
556 passphrase
="12345678"
558 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
559 params
["pmk_r1_push"] = "0"
560 params
["nas_identifier"] = "nas0.w1.fi"
561 hostapd
.add_ap(apdev
[0], params
)
562 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
565 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
566 params
["pmk_r1_push"] = "0"
567 hostapd
.add_ap(apdev
[1], params
)
569 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
570 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
573 def test_ap_ft_mismatching_rrb_r0kh_push(dev
, apdev
):
574 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
576 passphrase
="12345678"
578 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
579 params
["ieee80211w"] = "2"
580 hapd0
= hostapd
.add_ap(apdev
[0], params
)
581 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
582 params
["ieee80211w"] = "2"
583 hapd1
= hostapd
.add_ap(apdev
[1], params
)
585 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
589 def test_ap_ft_mismatching_rrb_r0kh_pull(dev
, apdev
):
590 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
592 passphrase
="12345678"
594 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
595 params
["pmk_r1_push"] = "0"
596 hapd0
= hostapd
.add_ap(apdev
[0], params
)
597 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
598 params
["pmk_r1_push"] = "0"
599 hapd1
= hostapd
.add_ap(apdev
[1], params
)
601 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
604 def test_ap_ft_mismatching_rrb_key_push_eap(dev
, apdev
):
605 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
607 passphrase
="12345678"
609 radius
= hostapd
.radius_params()
610 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
611 params
["ieee80211w"] = "2";
612 params
['wpa_key_mgmt'] = "FT-EAP"
613 params
["ieee8021x"] = "1"
614 params
= dict(radius
.items() + params
.items())
615 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
616 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
617 params
["ieee80211w"] = "2";
618 params
['wpa_key_mgmt'] = "FT-EAP"
619 params
["ieee8021x"] = "1"
620 params
= dict(radius
.items() + params
.items())
621 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
623 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
624 fail_test
=True, eap
=True)
626 def test_ap_ft_mismatching_rrb_key_pull_eap(dev
, apdev
):
627 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
629 passphrase
="12345678"
631 radius
= hostapd
.radius_params()
632 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
633 params
["pmk_r1_push"] = "0"
634 params
['wpa_key_mgmt'] = "FT-EAP"
635 params
["ieee8021x"] = "1"
636 params
= dict(radius
.items() + params
.items())
637 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
638 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
639 params
["pmk_r1_push"] = "0"
640 params
['wpa_key_mgmt'] = "FT-EAP"
641 params
["ieee8021x"] = "1"
642 params
= dict(radius
.items() + params
.items())
643 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
645 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
646 fail_test
=True, eap
=True)
648 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev
, apdev
):
649 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
651 passphrase
="12345678"
653 radius
= hostapd
.radius_params()
654 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
655 params
["pmk_r1_push"] = "0"
656 params
["nas_identifier"] = "nas0.w1.fi"
657 params
['wpa_key_mgmt'] = "FT-EAP"
658 params
["ieee8021x"] = "1"
659 params
= dict(radius
.items() + params
.items())
660 hostapd
.add_ap(apdev
[0]['ifname'], params
)
661 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
662 eap
="GPSK", identity
="gpsk user",
663 password
="abcdefghijklmnop0123456789abcdef",
666 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
667 params
["pmk_r1_push"] = "0"
668 params
['wpa_key_mgmt'] = "FT-EAP"
669 params
["ieee8021x"] = "1"
670 params
= dict(radius
.items() + params
.items())
671 hostapd
.add_ap(apdev
[1]['ifname'], params
)
673 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
674 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
676 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev
, apdev
):
677 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
679 passphrase
="12345678"
681 radius
= hostapd
.radius_params()
682 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
683 params
["ieee80211w"] = "2";
684 params
['wpa_key_mgmt'] = "FT-EAP"
685 params
["ieee8021x"] = "1"
686 params
= dict(radius
.items() + params
.items())
687 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
688 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
689 params
["ieee80211w"] = "2";
690 params
['wpa_key_mgmt'] = "FT-EAP"
691 params
["ieee8021x"] = "1"
692 params
= dict(radius
.items() + params
.items())
693 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
695 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
696 fail_test
=True, eap
=True)
698 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev
, apdev
):
699 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
701 passphrase
="12345678"
703 radius
= hostapd
.radius_params()
704 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
705 params
["pmk_r1_push"] = "0"
706 params
['wpa_key_mgmt'] = "FT-EAP"
707 params
["ieee8021x"] = "1"
708 params
= dict(radius
.items() + params
.items())
709 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
710 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
711 params
["pmk_r1_push"] = "0"
712 params
['wpa_key_mgmt'] = "FT-EAP"
713 params
["ieee8021x"] = "1"
714 params
= dict(radius
.items() + params
.items())
715 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
717 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
718 fail_test
=True, eap
=True)
720 def test_ap_ft_gtk_rekey(dev
, apdev
):
721 """WPA2-PSK-FT AP and GTK rekey"""
723 passphrase
="12345678"
725 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
726 params
['wpa_group_rekey'] = '1'
727 hapd
= hostapd
.add_ap(apdev
[0], params
)
729 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
730 ieee80211w
="1", scan_freq
="2412")
732 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
734 raise Exception("GTK rekey timed out after initial association")
735 hwsim_utils
.test_connectivity(dev
[0], hapd
)
737 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
738 params
['wpa_group_rekey'] = '1'
739 hapd1
= hostapd
.add_ap(apdev
[1], params
)
741 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
742 dev
[0].roam(apdev
[1]['bssid'])
743 if dev
[0].get_status_field('bssid') != apdev
[1]['bssid']:
744 raise Exception("Did not connect to correct AP")
745 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
747 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
749 raise Exception("GTK rekey timed out after FT protocol")
750 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
752 def test_ft_psk_key_lifetime_in_memory(dev
, apdev
, params
):
753 """WPA2-PSK-FT and key lifetime in memory"""
755 passphrase
="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
756 psk
= '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
757 pmk
= binascii
.unhexlify(psk
)
758 p
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
759 hapd0
= hostapd
.add_ap(apdev
[0], p
)
760 p
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
761 hapd1
= hostapd
.add_ap(apdev
[1], p
)
763 pid
= find_wpas_process(dev
[0])
765 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
767 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
768 # event has been delivered, so verify that wpa_supplicant has returned to
769 # eloop before reading process memory.
773 buf
= read_process_memory(pid
, pmk
)
775 dev
[0].request("DISCONNECT")
776 dev
[0].wait_disconnected()
783 with
open(os
.path
.join(params
['logdir'], 'log0'), 'r') as f
:
784 for l
in f
.readlines():
785 if "FT: PMK-R0 - hexdump" in l
:
786 val
= l
.strip().split(':')[3].replace(' ', '')
787 pmkr0
= binascii
.unhexlify(val
)
788 if "FT: PMK-R1 - hexdump" in l
:
789 val
= l
.strip().split(':')[3].replace(' ', '')
790 pmkr1
= binascii
.unhexlify(val
)
791 if "FT: KCK - hexdump" in l
:
792 val
= l
.strip().split(':')[3].replace(' ', '')
793 kck
= binascii
.unhexlify(val
)
794 if "FT: KEK - hexdump" in l
:
795 val
= l
.strip().split(':')[3].replace(' ', '')
796 kek
= binascii
.unhexlify(val
)
797 if "FT: TK - hexdump" in l
:
798 val
= l
.strip().split(':')[3].replace(' ', '')
799 tk
= binascii
.unhexlify(val
)
800 if "WPA: Group Key - hexdump" in l
:
801 val
= l
.strip().split(':')[3].replace(' ', '')
802 gtk
= binascii
.unhexlify(val
)
803 if not pmkr0
or not pmkr1
or not kck
or not kek
or not tk
or not gtk
:
804 raise Exception("Could not find keys from debug log")
806 raise Exception("Unexpected GTK length")
808 logger
.info("Checking keys in memory while associated")
809 get_key_locations(buf
, pmk
, "PMK")
810 get_key_locations(buf
, pmkr0
, "PMK-R0")
811 get_key_locations(buf
, pmkr1
, "PMK-R1")
813 raise HwsimSkip("PMK not found while associated")
815 raise HwsimSkip("PMK-R0 not found while associated")
817 raise HwsimSkip("PMK-R1 not found while associated")
819 raise Exception("KCK not found while associated")
821 raise Exception("KEK not found while associated")
823 raise Exception("TK found from memory")
825 get_key_locations(buf
, gtk
, "GTK")
826 raise Exception("GTK found from memory")
828 logger
.info("Checking keys in memory after disassociation")
829 buf
= read_process_memory(pid
, pmk
)
830 get_key_locations(buf
, pmk
, "PMK")
831 get_key_locations(buf
, pmkr0
, "PMK-R0")
832 get_key_locations(buf
, pmkr1
, "PMK-R1")
834 # Note: PMK/PSK is still present in network configuration
836 fname
= os
.path
.join(params
['logdir'],
837 'ft_psk_key_lifetime_in_memory.memctx-')
838 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
839 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
840 verify_not_present(buf
, kck
, fname
, "KCK")
841 verify_not_present(buf
, kek
, fname
, "KEK")
842 verify_not_present(buf
, tk
, fname
, "TK")
843 verify_not_present(buf
, gtk
, fname
, "GTK")
845 dev
[0].request("REMOVE_NETWORK all")
847 logger
.info("Checking keys in memory after network profile removal")
848 buf
= read_process_memory(pid
, pmk
)
849 get_key_locations(buf
, pmk
, "PMK")
850 get_key_locations(buf
, pmkr0
, "PMK-R0")
851 get_key_locations(buf
, pmkr1
, "PMK-R1")
853 verify_not_present(buf
, pmk
, fname
, "PMK")
854 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
855 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
856 verify_not_present(buf
, kck
, fname
, "KCK")
857 verify_not_present(buf
, kek
, fname
, "KEK")
858 verify_not_present(buf
, tk
, fname
, "TK")
859 verify_not_present(buf
, gtk
, fname
, "GTK")
862 def test_ap_ft_invalid_resp(dev
, apdev
):
863 """WPA2-PSK-FT AP and invalid response IEs"""
865 passphrase
="12345678"
867 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
868 hapd0
= hostapd
.add_ap(apdev
[0], params
)
869 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
872 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
873 hapd1
= hostapd
.add_ap(apdev
[1], params
)
876 # Various IEs for test coverage. The last one is FTIE with invalid
877 # R1KH-ID subelement.
878 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
879 # FTIE with invalid R0KH-ID subelement (len=0).
880 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
881 # FTIE with invalid R0KH-ID subelement (len=49).
882 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
884 "020002000000" + "3000",
885 # Required IEs missing from protected IE count.
886 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
887 # RIC missing from protected IE count.
888 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
889 # Protected IE missing.
890 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
892 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
893 hapd1
.set("ext_mgmt_frame_handling", "1")
895 if "OK" not in dev
[0].request("ROAM " + apdev
[1]['bssid']):
896 raise Exception("ROAM failed")
899 msg
= hapd1
.mgmt_rx()
900 if msg
['subtype'] == 11:
904 raise Exception("Authentication frame not seen")
907 resp
['fc'] = auth
['fc']
908 resp
['da'] = auth
['sa']
909 resp
['sa'] = auth
['da']
910 resp
['bssid'] = auth
['bssid']
911 resp
['payload'] = binascii
.unhexlify(t
)
913 hapd1
.set("ext_mgmt_frame_handling", "0")
914 dev
[0].wait_disconnected()
916 dev
[0].request("RECONNECT")
917 dev
[0].wait_connected()
919 def test_ap_ft_gcmp_256(dev
, apdev
):
920 """WPA2-PSK-FT AP with GCMP-256 cipher"""
921 if "GCMP-256" not in dev
[0].get_capability("pairwise"):
922 raise HwsimSkip("Cipher GCMP-256 not supported")
924 passphrase
="12345678"
926 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
927 params
['rsn_pairwise'] = "GCMP-256"
928 hapd0
= hostapd
.add_ap(apdev
[0], params
)
929 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
930 params
['rsn_pairwise'] = "GCMP-256"
931 hapd1
= hostapd
.add_ap(apdev
[1], params
)
933 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
934 pairwise_cipher
="GCMP-256", group_cipher
="GCMP-256")
936 def test_ap_ft_oom(dev
, apdev
):
937 """WPA2-PSK-FT and OOM"""
938 skip_with_fips(dev
[0])
940 passphrase
="12345678"
942 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
943 hapd0
= hostapd
.add_ap(apdev
[0], params
)
944 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
945 hapd1
= hostapd
.add_ap(apdev
[1], params
)
947 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
949 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
950 dst
= apdev
[1]['bssid']
952 dst
= apdev
[0]['bssid']
954 dev
[0].scan_for_bss(dst
, freq
="2412")
955 with
alloc_fail(dev
[0], 1, "wpa_ft_gen_req_ies"):
957 with
fail_test(dev
[0], 1, "wpa_ft_mic"):
958 dev
[0].roam(dst
, fail_test
=True)
959 with
fail_test(dev
[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
960 dev
[0].roam(dst
, fail_test
=True)
962 dev
[0].request("REMOVE_NETWORK all")
963 with
alloc_fail(dev
[0], 1, "=sme_update_ft_ies"):
964 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
967 def test_ap_ft_ap_oom(dev
, apdev
):
968 """WPA2-PSK-FT and AP OOM"""
970 passphrase
="12345678"
972 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
973 hapd0
= hostapd
.add_ap(apdev
[0], params
)
974 bssid0
= hapd0
.own_addr()
976 dev
[0].scan_for_bss(bssid0
, freq
="2412")
977 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r0"):
978 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
981 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
982 hapd1
= hostapd
.add_ap(apdev
[1], params
)
983 bssid1
= hapd1
.own_addr()
984 dev
[0].scan_for_bss(bssid1
, freq
="2412")
985 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
988 def test_ap_ft_ap_oom2(dev
, apdev
):
989 """WPA2-PSK-FT and AP OOM 2"""
991 passphrase
="12345678"
993 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
994 hapd0
= hostapd
.add_ap(apdev
[0], params
)
995 bssid0
= hapd0
.own_addr()
997 dev
[0].scan_for_bss(bssid0
, freq
="2412")
998 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r1"):
999 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1002 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1003 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1004 bssid1
= hapd1
.own_addr()
1005 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1007 if dev
[0].get_status_field('bssid') != bssid1
:
1008 raise Exception("Did not roam to AP1")
1009 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1012 def test_ap_ft_ap_oom3(dev
, apdev
):
1013 """WPA2-PSK-FT and AP OOM 3"""
1015 passphrase
="12345678"
1017 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1018 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1019 bssid0
= hapd0
.own_addr()
1021 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1022 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1025 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1026 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1027 bssid1
= hapd1
.own_addr()
1028 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1029 with
alloc_fail(hapd1
, 1, "wpa_ft_pull_pmk_r1"):
1030 # This will fail due to not being able to send out PMK-R1 pull request
1033 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1034 # This will fail due to not being able to send out PMK-R1 pull request
1037 with
fail_test(hapd1
, 1, "aes_wrap;wpa_ft_pull_pmk_r1"):
1038 # This will fail due to not being able to send out PMK-R1 pull request
1041 def test_ap_ft_ap_oom4(dev
, apdev
):
1042 """WPA2-PSK-FT and AP OOM 4"""
1044 passphrase
="12345678"
1046 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1047 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1048 bssid0
= hapd0
.own_addr()
1050 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1051 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1054 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1055 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1056 bssid1
= hapd1
.own_addr()
1057 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1058 with
alloc_fail(hapd1
, 1, "wpa_ft_gtk_subelem"):
1060 if dev
[0].get_status_field('bssid') != bssid1
:
1061 raise Exception("Did not roam to AP1")
1063 with
fail_test(hapd0
, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1065 if dev
[0].get_status_field('bssid') != bssid0
:
1066 raise Exception("Did not roam to AP0")
1068 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1070 if dev
[0].get_status_field('bssid') != bssid1
:
1071 raise Exception("Did not roam to AP1")
1073 def test_ap_ft_ap_oom5(dev
, apdev
):
1074 """WPA2-PSK-FT and AP OOM 5"""
1076 passphrase
="12345678"
1078 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1079 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1080 bssid0
= hapd0
.own_addr()
1082 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1083 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1086 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1087 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1088 bssid1
= hapd1
.own_addr()
1089 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1090 with
alloc_fail(hapd1
, 1, "=wpa_ft_process_auth_req"):
1091 # This will fail to roam
1094 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_process_auth_req"):
1095 # This will fail to roam
1098 with
fail_test(hapd1
, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1099 # This will fail to roam
1102 with
fail_test(hapd1
, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1103 # This will fail to roam
1106 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1107 # This will fail to roam
1110 def test_ap_ft_ap_oom6(dev
, apdev
):
1111 """WPA2-PSK-FT and AP OOM 6"""
1113 passphrase
="12345678"
1115 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1116 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1117 bssid0
= hapd0
.own_addr()
1119 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1120 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1121 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1123 dev
[0].request("REMOVE_NETWORK all")
1124 dev
[0].wait_disconnected()
1125 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1126 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1128 dev
[0].request("REMOVE_NETWORK all")
1129 dev
[0].wait_disconnected()
1130 with
fail_test(hapd0
, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1131 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1134 def test_ap_ft_ap_oom7(dev
, apdev
):
1135 """WPA2-PSK-FT and AP OOM 7"""
1137 passphrase
="12345678"
1139 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1140 params
["ieee80211w"] = "2"
1141 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1142 bssid0
= hapd0
.own_addr()
1144 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1145 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1146 ieee80211w
="2", scan_freq
="2412")
1148 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1149 params
["ieee80211w"] = "2"
1150 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1151 bssid1
= hapd1
.own_addr()
1152 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1153 with
alloc_fail(hapd1
, 1, "wpa_ft_igtk_subelem"):
1154 # This will fail to roam
1156 with
fail_test(hapd1
, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1157 # This will fail to roam
1159 with
alloc_fail(hapd1
, 1, "=wpa_sm_write_assoc_resp_ies"):
1160 # This will fail to roam
1162 with
fail_test(hapd1
, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1163 # This will fail to roam
1166 def test_ap_ft_ap_oom8(dev
, apdev
):
1167 """WPA2-PSK-FT and AP OOM 8"""
1169 passphrase
="12345678"
1171 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1172 params
['ft_psk_generate_local'] = "1";
1173 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1174 bssid0
= hapd0
.own_addr()
1176 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1177 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1180 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1181 params
['ft_psk_generate_local'] = "1";
1182 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1183 bssid1
= hapd1
.own_addr()
1184 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1185 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1186 # This will fail to roam
1188 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1189 # This will fail to roam
1192 def test_ap_ft_ap_oom9(dev
, apdev
):
1193 """WPA2-PSK-FT and AP OOM 9"""
1195 passphrase
="12345678"
1197 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1198 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1199 bssid0
= hapd0
.own_addr()
1201 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1202 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1205 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1206 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1207 bssid1
= hapd1
.own_addr()
1208 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1210 with
alloc_fail(hapd0
, 1, "wpa_ft_action_rx"):
1211 # This will fail to roam
1212 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1213 raise Exception("FT_DS failed")
1214 wait_fail_trigger(hapd0
, "GET_ALLOC_FAIL")
1216 with
alloc_fail(hapd1
, 1, "wpa_ft_rrb_rx_request"):
1217 # This will fail to roam
1218 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1219 raise Exception("FT_DS failed")
1220 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
1222 with
alloc_fail(hapd1
, 1, "wpa_ft_send_rrb_auth_resp"):
1223 # This will fail to roam
1224 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1225 raise Exception("FT_DS failed")
1226 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
1228 def test_ap_ft_ap_oom10(dev
, apdev
):
1229 """WPA2-PSK-FT and AP OOM 10"""
1231 passphrase
="12345678"
1233 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1234 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1235 bssid0
= hapd0
.own_addr()
1237 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1238 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1241 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1242 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1243 bssid1
= hapd1
.own_addr()
1244 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1246 with
fail_test(hapd0
, 1, "aes_unwrap;wpa_ft_rrb_rx_pull"):
1247 # This will fail to roam
1248 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1249 raise Exception("FT_DS failed")
1250 wait_fail_trigger(hapd0
, "GET_FAIL")
1252 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1253 # This will fail to roam
1254 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1255 raise Exception("FT_DS failed")
1256 wait_fail_trigger(hapd0
, "GET_FAIL")
1258 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_rrb_rx_pull"):
1259 # This will fail to roam
1260 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1261 raise Exception("FT_DS failed")
1262 wait_fail_trigger(hapd0
, "GET_FAIL")
1264 with
fail_test(hapd1
, 1, "aes_unwrap;wpa_ft_rrb_rx_resp"):
1265 # This will fail to roam
1266 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
1267 raise Exception("FT_DS failed")
1268 wait_fail_trigger(hapd1
, "GET_FAIL")
1270 def test_ap_ft_ap_oom11(dev
, apdev
):
1271 """WPA2-PSK-FT and AP OOM 11"""
1273 passphrase
="12345678"
1275 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1276 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1277 bssid0
= hapd0
.own_addr()
1279 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1280 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1281 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1283 wait_fail_trigger(hapd0
, "GET_FAIL")
1285 dev
[1].scan_for_bss(bssid0
, freq
="2412")
1286 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_generate_pmk_r1"):
1287 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1289 wait_fail_trigger(hapd0
, "GET_FAIL")
1291 def test_ap_ft_over_ds_proto_ap(dev
, apdev
):
1292 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1294 passphrase
="12345678"
1296 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1297 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1298 bssid0
= hapd0
.own_addr()
1299 _bssid0
= bssid0
.replace(':', '')
1300 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1302 addr
= dev
[0].own_addr()
1303 _addr
= addr
.replace(':', '')
1305 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1306 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1307 bssid1
= hapd1
.own_addr()
1308 _bssid1
= bssid1
.replace(':', '')
1310 hapd0
.set("ext_mgmt_frame_handling", "1")
1311 hdr
= "d0003a01" + _bssid0
+ _addr
+ _bssid0
+ "1000"
1312 valid
= "0601" + _addr
+ _bssid1
1315 "0601" + _addr
+ _bssid0
,
1316 "0601" + _addr
+ "ffffffffffff",
1317 "0601" + _bssid0
+ _bssid0
,
1322 valid
+ "3603ffffff",
1323 valid
+ "3603a1b2ff",
1324 valid
+ "3603a1b2ff" + "3700",
1325 valid
+ "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
1326 valid
+ "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
1327 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
1328 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
1329 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
1330 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1331 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1334 hapd0
.dump_monitor()
1335 if "OK" not in hapd0
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ t
):
1336 raise Exception("MGMT_RX_PROCESS failed")
1338 hapd0
.set("ext_mgmt_frame_handling", "0")
1340 def test_ap_ft_over_ds_proto(dev
, apdev
):
1341 """WPA2-PSK-FT AP over DS protocol testing"""
1343 passphrase
="12345678"
1345 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1346 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1347 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1350 # FT Action Response while no FT-over-DS in progress
1353 msg
['da'] = dev
[0].own_addr()
1354 msg
['sa'] = apdev
[0]['bssid']
1355 msg
['bssid'] = apdev
[0]['bssid']
1356 msg
['payload'] = binascii
.unhexlify("06020200000000000200000004000000")
1359 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1360 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1361 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1362 hapd0
.set("ext_mgmt_frame_handling", "1")
1363 hapd0
.dump_monitor()
1364 dev
[0].request("FT_DS " + apdev
[1]['bssid'])
1365 for i
in range(0, 10):
1366 req
= hapd0
.mgmt_rx()
1368 raise Exception("MGMT RX wait timed out")
1369 if req
['subtype'] == 13:
1373 raise Exception("FT Action frame not received")
1375 # FT Action Response for unexpected Target AP
1376 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "f20000000400" + "0000")
1379 # FT Action Response without MDIE
1380 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000")
1383 # FT Action Response without FTIE
1384 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
1387 # FT Action Response with FTIE SNonce mismatch
1388 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1392 def test_ap_ft_rrb(dev
, apdev
):
1393 """WPA2-PSK-FT RRB protocol testing"""
1395 passphrase
="12345678"
1397 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1398 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1400 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1403 _dst_ll
= binascii
.unhexlify(apdev
[0]['bssid'].replace(':',''))
1404 _src_ll
= binascii
.unhexlify(dev
[0].own_addr().replace(':',''))
1406 ehdr
= _dst_ll
+ _src_ll
+ proto
1408 # Too short RRB frame
1410 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1411 raise Exception("DATA_TEST_FRAME failed")
1413 # RRB discarded frame wikth unrecognized type
1414 pkt
= ehdr
+ '\x02' + '\x02' + '\x01\x00' + _src_ll
1415 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1416 raise Exception("DATA_TEST_FRAME failed")
1418 # RRB frame too short for action frame
1419 pkt
= ehdr
+ '\x01' + '\x02' + '\x01\x00' + _src_ll
1420 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1421 raise Exception("DATA_TEST_FRAME failed")
1423 # Too short RRB frame (not enough room for Action Frame body)
1424 pkt
= ehdr
+ '\x01' + '\x02' + '\x00\x00' + _src_ll
1425 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1426 raise Exception("DATA_TEST_FRAME failed")
1428 # Unexpected Action frame category
1429 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1430 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1431 raise Exception("DATA_TEST_FRAME failed")
1433 # Unexpected Action in RRB Request
1434 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1435 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1436 raise Exception("DATA_TEST_FRAME failed")
1438 # Target AP address in RRB Request does not match with own address
1439 pkt
= ehdr
+ '\x01' + '\x00' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1440 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1441 raise Exception("DATA_TEST_FRAME failed")
1443 # Not enough room for status code in RRB Response
1444 pkt
= ehdr
+ '\x01' + '\x01' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1445 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1446 raise Exception("DATA_TEST_FRAME failed")
1448 # RRB discarded frame with unknown packet_type
1449 pkt
= ehdr
+ '\x01' + '\x02' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1450 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1451 raise Exception("DATA_TEST_FRAME failed")
1453 # RRB Response with non-zero status code; no STA match
1454 pkt
= ehdr
+ '\x01' + '\x01' + '\x10\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
1455 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1456 raise Exception("DATA_TEST_FRAME failed")
1458 # RRB Response with zero status code and extra data; STA match
1459 pkt
= ehdr
+ '\x01' + '\x01' + '\x11\x00' + _src_ll
+ '\x06\x01' + _src_ll
+ '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
1460 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1461 raise Exception("DATA_TEST_FRAME failed")
1463 # Too short PMK-R1 pull
1464 pkt
= ehdr
+ '\x01' + '\xc8' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1465 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1466 raise Exception("DATA_TEST_FRAME failed")
1468 # Too short PMK-R1 resp
1469 pkt
= ehdr
+ '\x01' + '\xc9' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1470 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1471 raise Exception("DATA_TEST_FRAME failed")
1473 # Too short PMK-R1 push
1474 pkt
= ehdr
+ '\x01' + '\xca' + '\x0e\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1475 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1476 raise Exception("DATA_TEST_FRAME failed")
1478 # No matching R0KH address found for PMK-R0 pull response
1479 pkt
= ehdr
+ '\x01' + '\xc9' + '\x5a\x00' + _src_ll
+ '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
1480 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
)):
1481 raise Exception("DATA_TEST_FRAME failed")
1484 def test_rsn_ie_proto_ft_psk_sta(dev
, apdev
):
1485 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
1486 bssid
= apdev
[0]['bssid']
1488 passphrase
="12345678"
1490 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1491 params
["ieee80211w"] = "1"
1492 # This is the RSN element used normally by hostapd
1493 params
['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
1494 hapd
= hostapd
.add_ap(apdev
[0], params
)
1495 id = dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1496 ieee80211w
="1", scan_freq
="2412",
1497 pairwise
="CCMP", group
="CCMP")
1499 tests
= [ ('PMKIDCount field included',
1500 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
1501 ('Extra IE before RSNE',
1502 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
1503 ('PMKIDCount and Group Management Cipher suite fields included',
1504 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
1505 ('Extra octet after defined fields (future extensibility)',
1506 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
1507 ('No RSN Capabilities field (PMF disabled in practice)',
1508 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
1509 for txt
,ie
in tests
:
1510 dev
[0].request("DISCONNECT")
1511 dev
[0].wait_disconnected()
1514 hapd
.set('own_ie_override', ie
)
1516 dev
[0].request("BSS_FLUSH 0")
1517 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1518 dev
[0].select_network(id, freq
=2412)
1519 dev
[0].wait_connected()
1521 dev
[0].request("DISCONNECT")
1522 dev
[0].wait_disconnected()
1524 logger
.info('Invalid RSNE causing internal hostapd error')
1526 hapd
.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
1528 dev
[0].request("BSS_FLUSH 0")
1529 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1530 dev
[0].select_network(id, freq
=2412)
1531 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1533 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1535 raise Exception("Unexpected connection")
1536 dev
[0].request("DISCONNECT")
1538 logger
.info('Unexpected PMKID causing internal hostapd error')
1540 hapd
.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
1542 dev
[0].request("BSS_FLUSH 0")
1543 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
1544 dev
[0].select_network(id, freq
=2412)
1545 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1547 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
1549 raise Exception("Unexpected connection")
1550 dev
[0].request("DISCONNECT")
1552 def test_ap_ft_ptk_rekey(dev
, apdev
):
1553 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
1555 passphrase
="12345678"
1557 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1558 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1559 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1560 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1562 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, ptk_rekey
="1")
1564 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1565 "WPA: Key negotiation completed"], timeout
=5)
1567 raise Exception("No event received after roam")
1568 if "CTRL-EVENT-DISCONNECTED" in ev
:
1569 raise Exception("Unexpected disconnection after roam")
1571 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1575 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1577 def test_ap_ft_ptk_rekey_ap(dev
, apdev
):
1578 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
1580 passphrase
="12345678"
1582 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1583 params
['wpa_ptk_rekey'] = '2'
1584 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1585 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1586 params
['wpa_ptk_rekey'] = '2'
1587 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1589 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
1591 ev
= dev
[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1592 "WPA: Key negotiation completed"], timeout
=5)
1594 raise Exception("No event received after roam")
1595 if "CTRL-EVENT-DISCONNECTED" in ev
:
1596 raise Exception("Unexpected disconnection after roam")
1598 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1602 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1604 def test_ap_ft_internal_rrb_check(dev
, apdev
):
1605 """RRB internal delivery only to WPA enabled BSS"""
1607 passphrase
="12345678"
1609 radius
= hostapd
.radius_params()
1610 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1611 params
['wpa_key_mgmt'] = "FT-EAP"
1612 params
["ieee8021x"] = "1"
1613 params
= dict(radius
.items() + params
.items())
1614 hapd
= hostapd
.add_ap(apdev
[0], params
)
1615 key_mgmt
= hapd
.get_config()['key_mgmt']
1616 if key_mgmt
.split(' ')[0] != "FT-EAP":
1617 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1619 hapd1
= hostapd
.add_ap(apdev
[1], { "ssid" : ssid
})
1621 # Connect to WPA enabled AP
1622 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
1623 eap
="GPSK", identity
="gpsk user",
1624 password
="abcdefghijklmnop0123456789abcdef",
1627 # Try over_ds roaming to non-WPA-enabled AP.
1628 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
1629 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1631 def test_ap_ft_extra_ie(dev
, apdev
):
1632 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
1634 passphrase
="12345678"
1636 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1637 params
["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
1638 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1639 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1641 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1644 # Add Mobility Domain element to test AP validation code.
1645 dev
[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
1646 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
1647 scan_freq
="2412", wait_connect
=False)
1648 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED",
1649 "CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
1651 raise Exception("No connection result")
1652 if "CTRL-EVENT-CONNECTED" in ev
:
1653 raise Exception("Non-FT association accepted with MDE")
1654 if "status_code=43" not in ev
:
1655 raise Exception("Unexpected status code: " + ev
)
1656 dev
[0].request("DISCONNECT")
1658 dev
[0].request("VENDOR_ELEM_REMOVE 13 *")