1 # Fast BSS Transition tests
2 # Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
4 # This software may be distributed under the terms of the BSD license.
5 # See README for more details.
7 from remotehost
import remote_compatible
12 logger
= logging
.getLogger()
18 from hwsim
import HWSimRadio
20 from tshark
import run_tshark
21 from utils
import HwsimSkip
, alloc_fail
, fail_test
, wait_fail_trigger
, skip_with_fips
, parse_ie
22 from wlantest
import Wlantest
23 from test_ap_psk
import check_mib
, find_wpas_process
, read_process_memory
, verify_not_present
, get_key_locations
24 from test_rrm
import check_beacon_req
25 from test_suite_b
import check_suite_b_192_capa
29 "wpa_key_mgmt": "FT-PSK",
30 "rsn_pairwise": "CCMP"}
35 "wpa_key_mgmt": "WPA-PSK FT-PSK",
36 "wpa_pairwise": "TKIP",
37 "rsn_pairwise": "CCMP"}
40 def ft_params(rsn
=True, ssid
=None, passphrase
=None):
42 params
= ft_base_rsn()
44 params
= ft_base_mixed()
48 params
["wpa_passphrase"] = passphrase
50 params
["mobility_domain"] = "a1b2"
51 params
["r0_key_lifetime"] = "10000"
52 params
["pmk_r1_push"] = "1"
53 params
["reassociation_deadline"] = "1000"
56 def ft_params1a(rsn
=True, ssid
=None, passphrase
=None):
57 params
= ft_params(rsn
, ssid
, passphrase
)
58 params
['nas_identifier'] = "nas1.w1.fi"
59 params
['r1_key_holder'] = "000102030405"
62 def ft_params1(rsn
=True, ssid
=None, passphrase
=None, discovery
=False):
63 params
= ft_params1a(rsn
, ssid
, passphrase
)
65 params
['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 params
['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
68 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
69 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
70 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
73 def ft_params1_old_key(rsn
=True, ssid
=None, passphrase
=None):
74 params
= ft_params1a(rsn
, ssid
, passphrase
)
75 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
76 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f"]
77 params
['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
80 def ft_params2a(rsn
=True, ssid
=None, passphrase
=None):
81 params
= ft_params(rsn
, ssid
, passphrase
)
82 params
['nas_identifier'] = "nas2.w1.fi"
83 params
['r1_key_holder'] = "000102030406"
86 def ft_params2(rsn
=True, ssid
=None, passphrase
=None, discovery
=False):
87 params
= ft_params2a(rsn
, ssid
, passphrase
)
89 params
['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 params
['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
92 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
93 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
94 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
97 def ft_params2_old_key(rsn
=True, ssid
=None, passphrase
=None):
98 params
= ft_params2a(rsn
, ssid
, passphrase
)
99 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
100 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f"]
101 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
104 def ft_params1_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
105 params
= ft_params(rsn
, ssid
, passphrase
)
106 params
['nas_identifier'] = "nas1.w1.fi"
107 params
['r1_key_holder'] = "000102030405"
108 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
109 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"]
110 params
['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
113 def ft_params2_incorrect_rrb_key(rsn
=True, ssid
=None, passphrase
=None):
114 params
= ft_params(rsn
, ssid
, passphrase
)
115 params
['nas_identifier'] = "nas2.w1.fi"
116 params
['r1_key_holder'] = "000102030406"
117 params
['r0kh'] = ["02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
118 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2"]
119 params
['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
122 def ft_params2_r0kh_mismatch(rsn
=True, ssid
=None, passphrase
=None):
123 params
= ft_params(rsn
, ssid
, passphrase
)
124 params
['nas_identifier'] = "nas2.w1.fi"
125 params
['r1_key_holder'] = "000102030406"
126 params
['r0kh'] = ["12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
127 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f"]
128 params
['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
131 def run_roams(dev
, apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=False,
132 sae
=False, eap
=False, fail_test
=False, roams
=1,
133 pairwise_cipher
="CCMP", group_cipher
="TKIP CCMP", ptk_rekey
="0",
134 test_connectivity
=True, eap_identity
="gpsk user", conndev
=False,
135 force_initial_conn_to_first_ap
=False, sha384
=False,
136 group_mgmt
=None, ocv
=None, sae_password
=None,
137 sae_password_id
=None, sae_and_psk
=False, pmksa_caching
=False,
138 roam_with_reassoc
=False, also_non_ft
=False, only_one_way
=False):
139 logger
.info("Connect to first AP")
142 copts
["proto"] = "WPA2"
143 copts
["ieee80211w"] = "1"
144 copts
["scan_freq"] = "2412"
145 copts
["pairwise"] = pairwise_cipher
146 copts
["group"] = group_cipher
147 copts
["wpa_ptk_rekey"] = ptk_rekey
149 copts
["group_mgmt"] = group_mgmt
154 copts
["ft_eap_pmksa_caching"] = "1"
156 copts
["key_mgmt"] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384" if sha384
else "WPA-EAP FT-EAP"
158 copts
["key_mgmt"] = "FT-EAP-SHA384" if sha384
else "FT-EAP"
159 copts
["eap"] = "GPSK"
160 copts
["identity"] = eap_identity
161 copts
["password"] = "abcdefghijklmnop0123456789abcdef"
164 copts
["key_mgmt"] = "SAE FT-SAE" if sae_and_psk
else "FT-SAE"
166 copts
["key_mgmt"] = "FT-PSK"
168 copts
["psk"] = passphrase
170 copts
["sae_password"] = sae_password
172 copts
["sae_password_id"] = sae_password_id
173 if force_initial_conn_to_first_ap
:
174 copts
["bssid"] = apdev
[0]['bssid']
175 netw
= dev
.connect(ssid
, **copts
)
177 dev
.request("DISCONNECT")
178 dev
.wait_disconnected()
179 dev
.request("RECONNECT")
180 ev
= dev
.wait_event(["CTRL-EVENT-CONNECTED",
181 "CTRL-EVENT-DISCONNECTED",
182 "CTRL-EVENT-EAP-STARTED"],
185 raise Exception("Reconnect timed out")
186 if "CTRL-EVENT-DISCONNECTED" in ev
:
187 raise Exception("Unexpected disconnection after RECONNECT")
188 if "CTRL-EVENT-EAP-STARTED" in ev
:
189 raise Exception("Unexpected EAP start after RECONNECT")
191 if dev
.get_status_field('bssid') == apdev
[0]['bssid']:
201 if test_connectivity
:
203 hwsim_utils
.test_connectivity_iface(dev
, hapd1ap
, conndev
)
205 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
207 dev
.scan_for_bss(ap2
['bssid'], freq
="2412")
209 for i
in range(0, roams
):
210 # Roaming artificially fast can make data test fail because the key is
213 logger
.info("Roam to the second AP")
214 if roam_with_reassoc
:
215 dev
.set_network(netw
, "bssid", ap2
['bssid'])
216 dev
.request("REASSOCIATE")
219 dev
.roam_over_ds(ap2
['bssid'], fail_test
=fail_test
)
221 dev
.roam(ap2
['bssid'], fail_test
=fail_test
)
224 if dev
.get_status_field('bssid') != ap2
['bssid']:
225 raise Exception("Did not connect to correct AP")
226 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
228 hwsim_utils
.test_connectivity_iface(dev
, hapd2ap
, conndev
)
230 hwsim_utils
.test_connectivity(dev
, hapd2ap
)
234 # Roaming artificially fast can make data test fail because the key is
237 logger
.info("Roam back to the first AP")
238 if roam_with_reassoc
:
239 dev
.set_network(netw
, "bssid", ap1
['bssid'])
240 dev
.request("REASSOCIATE")
243 dev
.roam_over_ds(ap1
['bssid'])
245 dev
.roam(ap1
['bssid'])
246 if dev
.get_status_field('bssid') != ap1
['bssid']:
247 raise Exception("Did not connect to correct AP")
248 if (i
== 0 or i
== roams
- 1) and test_connectivity
:
250 hwsim_utils
.test_connectivity_iface(dev
, hapd1ap
, conndev
)
252 hwsim_utils
.test_connectivity(dev
, hapd1ap
)
254 def test_ap_ft(dev
, apdev
):
257 passphrase
= "12345678"
259 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
260 hapd0
= hostapd
.add_ap(apdev
[0], params
)
261 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
262 hapd1
= hostapd
.add_ap(apdev
[1], params
)
264 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
265 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
266 raise Exception("Scan results missing RSN element info")
268 def test_ap_ft_old_key(dev
, apdev
):
269 """WPA2-PSK-FT AP (old key)"""
271 passphrase
= "12345678"
273 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
274 hapd0
= hostapd
.add_ap(apdev
[0], params
)
275 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
276 hapd1
= hostapd
.add_ap(apdev
[1], params
)
278 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
280 def test_ap_ft_multi_akm(dev
, apdev
):
281 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
283 passphrase
= "12345678"
285 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
286 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
287 hapd0
= hostapd
.add_ap(apdev
[0], params
)
288 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
289 params
["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
290 hapd1
= hostapd
.add_ap(apdev
[1], params
)
292 Wlantest
.setup(hapd0
)
295 wt
.add_passphrase(passphrase
)
297 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
298 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
299 raise Exception("Scan results missing RSN element info")
300 dev
[1].connect(ssid
, psk
=passphrase
, scan_freq
="2412")
301 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK-SHA256",
304 def test_ap_ft_local_key_gen(dev
, apdev
):
305 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
307 passphrase
= "12345678"
309 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
310 params
['ft_psk_generate_local'] = "1"
311 del params
['pmk_r1_push']
312 hapd0
= hostapd
.add_ap(apdev
[0], params
)
313 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
314 params
['ft_psk_generate_local'] = "1"
315 del params
['pmk_r1_push']
316 hapd1
= hostapd
.add_ap(apdev
[1], params
)
318 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
319 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
320 raise Exception("Scan results missing RSN element info")
322 def test_ap_ft_vlan(dev
, apdev
):
323 """WPA2-PSK-FT AP with VLAN"""
325 passphrase
= "12345678"
327 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
328 params
['dynamic_vlan'] = "1"
329 params
['accept_mac_file'] = "hostapd.accept"
330 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
332 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
333 params
['dynamic_vlan'] = "1"
334 params
['accept_mac_file'] = "hostapd.accept"
335 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
337 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1")
338 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
339 raise Exception("Scan results missing RSN element info")
341 def test_ap_ft_vlan_disconnected(dev
, apdev
):
342 """WPA2-PSK-FT AP with VLAN and local key generation"""
344 passphrase
= "12345678"
346 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
347 params
['dynamic_vlan'] = "1"
348 params
['accept_mac_file'] = "hostapd.accept"
349 params
['ft_psk_generate_local'] = "1"
350 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
352 params
= ft_params2a(ssid
=ssid
, passphrase
=passphrase
)
353 params
['dynamic_vlan'] = "1"
354 params
['accept_mac_file'] = "hostapd.accept"
355 params
['ft_psk_generate_local'] = "1"
356 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
358 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1")
359 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
360 raise Exception("Scan results missing RSN element info")
362 def test_ap_ft_vlan_2(dev
, apdev
):
363 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
365 passphrase
= "12345678"
367 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
368 params
['dynamic_vlan'] = "1"
369 params
['accept_mac_file'] = "hostapd.accept"
370 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
372 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
373 params
['dynamic_vlan'] = "1"
374 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
376 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, conndev
="brvlan1",
377 force_initial_conn_to_first_ap
=True)
378 if "[WPA2-FT/PSK-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
379 raise Exception("Scan results missing RSN element info")
381 def test_ap_ft_many(dev
, apdev
):
382 """WPA2-PSK-FT AP multiple times"""
384 passphrase
= "12345678"
386 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
387 hapd0
= hostapd
.add_ap(apdev
[0], params
)
388 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
389 hapd1
= hostapd
.add_ap(apdev
[1], params
)
391 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50)
393 def test_ap_ft_many_vlan(dev
, apdev
):
394 """WPA2-PSK-FT AP with VLAN multiple times"""
396 passphrase
= "12345678"
398 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
399 params
['dynamic_vlan'] = "1"
400 params
['accept_mac_file'] = "hostapd.accept"
401 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
403 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
404 params
['dynamic_vlan'] = "1"
405 params
['accept_mac_file'] = "hostapd.accept"
406 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
408 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, roams
=50,
411 def test_ap_ft_mixed(dev
, apdev
):
412 """WPA2-PSK-FT mixed-mode AP"""
413 ssid
= "test-ft-mixed"
414 passphrase
= "12345678"
416 params
= ft_params1(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
417 hapd
= hostapd
.add_ap(apdev
[0], params
)
418 key_mgmt
= hapd
.get_config()['key_mgmt']
419 vals
= key_mgmt
.split(' ')
420 if vals
[0] != "WPA-PSK" or vals
[1] != "FT-PSK":
421 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
422 params
= ft_params2(rsn
=False, ssid
=ssid
, passphrase
=passphrase
)
423 hapd1
= hostapd
.add_ap(apdev
[1], params
)
425 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
)
427 def test_ap_ft_pmf(dev
, apdev
):
428 """WPA2-PSK-FT AP with PMF"""
430 passphrase
= "12345678"
432 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
433 params
["ieee80211w"] = "2"
434 hapd0
= hostapd
.add_ap(apdev
[0], params
)
435 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
436 params
["ieee80211w"] = "2"
437 hapd1
= hostapd
.add_ap(apdev
[1], params
)
439 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
)
441 def test_ap_ft_pmf_bip_cmac_128(dev
, apdev
):
442 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
443 run_ap_ft_pmf_bip(dev
, apdev
, "AES-128-CMAC")
445 def test_ap_ft_pmf_bip_gmac_128(dev
, apdev
):
446 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
447 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-GMAC-128")
449 def test_ap_ft_pmf_bip_gmac_256(dev
, apdev
):
450 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
451 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-GMAC-256")
453 def test_ap_ft_pmf_bip_cmac_256(dev
, apdev
):
454 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
455 run_ap_ft_pmf_bip(dev
, apdev
, "BIP-CMAC-256")
457 def run_ap_ft_pmf_bip(dev
, apdev
, cipher
):
458 if cipher
not in dev
[0].get_capability("group_mgmt"):
459 raise HwsimSkip("Cipher %s not supported" % cipher
)
462 passphrase
= "12345678"
464 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
465 params
["ieee80211w"] = "2"
466 params
["group_mgmt_cipher"] = cipher
467 hapd0
= hostapd
.add_ap(apdev
[0], params
)
468 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
469 params
["ieee80211w"] = "2"
470 params
["group_mgmt_cipher"] = cipher
471 hapd1
= hostapd
.add_ap(apdev
[1], params
)
473 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
476 def test_ap_ft_ocv(dev
, apdev
):
477 """WPA2-PSK-FT AP with OCV"""
479 passphrase
= "12345678"
481 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
482 params
["ieee80211w"] = "2"
485 hapd0
= hostapd
.add_ap(apdev
[0], params
)
486 except Exception as e
:
487 if "Failed to set hostapd parameter ocv" in str(e
):
488 raise HwsimSkip("OCV not supported")
490 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
491 params
["ieee80211w"] = "2"
493 hapd1
= hostapd
.add_ap(apdev
[1], params
)
495 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, ocv
="1")
497 def test_ap_ft_over_ds(dev
, apdev
):
498 """WPA2-PSK-FT AP over DS"""
500 passphrase
= "12345678"
502 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
503 hapd0
= hostapd
.add_ap(apdev
[0], params
)
504 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
505 hapd1
= hostapd
.add_ap(apdev
[1], params
)
507 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
508 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
509 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
511 def cleanup_ap_ft_separate_hostapd():
512 subprocess
.call(["brctl", "delif", "br0ft", "veth0"],
513 stderr
=open('/dev/null', 'w'))
514 subprocess
.call(["brctl", "delif", "br1ft", "veth1"],
515 stderr
=open('/dev/null', 'w'))
516 subprocess
.call(["ip", "link", "del", "veth0"],
517 stderr
=open('/dev/null', 'w'))
518 subprocess
.call(["ip", "link", "del", "veth1"],
519 stderr
=open('/dev/null', 'w'))
520 for ifname
in ['br0ft', 'br1ft', 'br-ft']:
521 subprocess
.call(['ip', 'link', 'set', 'dev', ifname
, 'down'],
522 stderr
=open('/dev/null', 'w'))
523 subprocess
.call(['brctl', 'delbr', ifname
],
524 stderr
=open('/dev/null', 'w'))
526 def test_ap_ft_separate_hostapd(dev
, apdev
, params
):
527 """WPA2-PSK-FT AP and separate hostapd process"""
529 run_ap_ft_separate_hostapd(dev
, apdev
, params
, False)
531 cleanup_ap_ft_separate_hostapd()
533 def test_ap_ft_over_ds_separate_hostapd(dev
, apdev
, params
):
534 """WPA2-PSK-FT AP over DS and separate hostapd process"""
536 run_ap_ft_separate_hostapd(dev
, apdev
, params
, True)
538 cleanup_ap_ft_separate_hostapd()
540 def run_ap_ft_separate_hostapd(dev
, apdev
, params
, over_ds
):
542 passphrase
= "12345678"
543 logdir
= params
['logdir']
544 pidfile
= os
.path
.join(logdir
, 'ap_ft_over_ds_separate_hostapd.pid')
545 logfile
= os
.path
.join(logdir
, 'ap_ft_over_ds_separate_hostapd.hapd')
546 global_ctrl
= '/var/run/hostapd-ft'
550 subprocess
.check_call(['brctl', 'addbr', br_ifname
])
551 subprocess
.check_call(['brctl', 'setfd', br_ifname
, '0'])
552 subprocess
.check_call(['ip', 'link', 'set', 'dev', br_ifname
, 'up'])
554 subprocess
.check_call(["ip", "link", "add", "veth0", "type", "veth",
555 "peer", "name", "veth0br"])
556 subprocess
.check_call(["ip", "link", "add", "veth1", "type", "veth",
557 "peer", "name", "veth1br"])
558 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
559 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
560 subprocess
.check_call(['brctl', 'addif', br_ifname
, 'veth0br'])
561 subprocess
.check_call(['brctl', 'addif', br_ifname
, 'veth1br'])
563 subprocess
.check_call(['brctl', 'addbr', 'br0ft'])
564 subprocess
.check_call(['brctl', 'setfd', 'br0ft', '0'])
565 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
566 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
567 subprocess
.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
568 subprocess
.check_call(['brctl', 'addbr', 'br1ft'])
569 subprocess
.check_call(['brctl', 'setfd', 'br1ft', '0'])
570 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
571 subprocess
.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
572 subprocess
.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
573 except subprocess
.CalledProcessError
:
574 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
576 with
HWSimRadio() as (radio
, iface
):
577 prg
= os
.path
.join(logdir
, 'alt-hostapd/hostapd/hostapd')
578 if not os
.path
.exists(prg
):
579 prg
= '../../hostapd/hostapd'
580 cmd
= [prg
, '-B', '-ddKt',
581 '-P', pidfile
, '-f', logfile
, '-g', global_ctrl
]
582 subprocess
.check_call(cmd
)
584 hglobal
= hostapd
.HostapdGlobal(global_ctrl_override
=global_ctrl
)
585 apdev_ft
= {'ifname': iface
}
586 apdev2
= [apdev_ft
, apdev
[1]]
588 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
589 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
590 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
591 params
['bridge'] = 'br0ft'
592 hapd0
= hostapd
.add_ap(apdev2
[0], params
,
593 global_ctrl_override
=global_ctrl
)
594 apdev2
[0]['bssid'] = hapd0
.own_addr()
595 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
596 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
597 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
598 params
['bridge'] = 'br1ft'
599 hapd1
= hostapd
.add_ap(apdev2
[1], params
)
601 run_roams(dev
[0], apdev2
, hapd0
, hapd1
, ssid
, passphrase
,
602 over_ds
=over_ds
, test_connectivity
=False)
606 if os
.path
.exists(pidfile
):
607 with
open(pidfile
, 'r') as f
:
610 os
.kill(pid
, signal
.SIGTERM
)
612 def test_ap_ft_over_ds_ocv(dev
, apdev
):
613 """WPA2-PSK-FT AP over DS"""
615 passphrase
= "12345678"
617 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
618 params
["ieee80211w"] = "2"
621 hapd0
= hostapd
.add_ap(apdev
[0], params
)
622 except Exception as e
:
623 if "Failed to set hostapd parameter ocv" in str(e
):
624 raise HwsimSkip("OCV not supported")
626 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
627 params
["ieee80211w"] = "2"
629 hapd1
= hostapd
.add_ap(apdev
[1], params
)
631 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
634 def test_ap_ft_over_ds_disabled(dev
, apdev
):
635 """WPA2-PSK-FT AP over DS disabled"""
637 passphrase
= "12345678"
639 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
640 params
['ft_over_ds'] = '0'
641 hapd0
= hostapd
.add_ap(apdev
[0], params
)
642 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
643 params
['ft_over_ds'] = '0'
644 hapd1
= hostapd
.add_ap(apdev
[1], params
)
646 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
649 def test_ap_ft_vlan_over_ds(dev
, apdev
):
650 """WPA2-PSK-FT AP over DS with VLAN"""
652 passphrase
= "12345678"
654 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
655 params
['dynamic_vlan'] = "1"
656 params
['accept_mac_file'] = "hostapd.accept"
657 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
658 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
659 params
['dynamic_vlan'] = "1"
660 params
['accept_mac_file'] = "hostapd.accept"
661 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
663 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
665 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
666 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4")])
668 def test_ap_ft_over_ds_many(dev
, apdev
):
669 """WPA2-PSK-FT AP over DS multiple times"""
671 passphrase
= "12345678"
673 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
674 hapd0
= hostapd
.add_ap(apdev
[0], params
)
675 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
676 hapd1
= hostapd
.add_ap(apdev
[1], params
)
678 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
681 def test_ap_ft_vlan_over_ds_many(dev
, apdev
):
682 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
684 passphrase
= "12345678"
686 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
687 params
['dynamic_vlan'] = "1"
688 params
['accept_mac_file'] = "hostapd.accept"
689 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
690 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
691 params
['dynamic_vlan'] = "1"
692 params
['accept_mac_file'] = "hostapd.accept"
693 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
695 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
696 roams
=50, conndev
="brvlan1")
699 def test_ap_ft_over_ds_unknown_target(dev
, apdev
):
702 passphrase
= "12345678"
704 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
705 hapd0
= hostapd
.add_ap(apdev
[0], params
)
707 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
709 dev
[0].roam_over_ds("02:11:22:33:44:55", fail_test
=True)
712 def test_ap_ft_over_ds_unexpected(dev
, apdev
):
713 """WPA2-PSK-FT AP over DS and unexpected response"""
715 passphrase
= "12345678"
717 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
718 hapd0
= hostapd
.add_ap(apdev
[0], params
)
719 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
720 hapd1
= hostapd
.add_ap(apdev
[1], params
)
722 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
724 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
735 addr
= dev
[0].own_addr()
736 hapd1ap
.set("ext_mgmt_frame_handling", "1")
737 logger
.info("Foreign STA address")
741 msg
['sa'] = ap1
['bssid']
742 msg
['bssid'] = ap1
['bssid']
743 msg
['payload'] = binascii
.unhexlify("06021122334455660102030405060000")
746 logger
.info("No over-the-DS in progress")
747 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
750 logger
.info("Non-zero status code")
751 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060100")
754 hapd1ap
.dump_monitor()
756 dev
[0].scan_for_bss(ap2
['bssid'], freq
="2412")
757 if "OK" not in dev
[0].request("FT_DS " + ap2
['bssid']):
758 raise Exception("FT_DS failed")
760 req
= hapd1ap
.mgmt_rx()
762 logger
.info("Foreign Target AP")
763 msg
['payload'] = binascii
.unhexlify("0602" + addr
.replace(':', '') + "0102030405060000")
766 addrs
= addr
.replace(':', '') + ap2
['bssid'].replace(':', '')
768 logger
.info("No IEs")
769 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "0000")
772 logger
.info("Invalid IEs (trigger parsing failure)")
773 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003700")
776 logger
.info("Too short MDIE")
777 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "000036021122")
780 logger
.info("Mobility domain mismatch")
781 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603112201")
784 logger
.info("No FTIE")
785 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201")
788 logger
.info("FTIE SNonce mismatch")
789 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
792 logger
.info("No R0KH-ID subelem in FTIE")
793 snonce
= binascii
.hexlify(req
['payload'][111:111+32]).decode()
794 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
)
797 logger
.info("No R0KH-ID subelem mismatch in FTIE")
798 snonce
= binascii
.hexlify(req
['payload'][111:111+32]).decode()
799 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a11223344556677889900")
802 logger
.info("No R1KH-ID subelem in FTIE")
803 r0khid
= binascii
.hexlify(req
['payload'][145:145+10]).decode()
804 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
)
807 logger
.info("No RSNE")
808 r0khid
= binascii
.hexlify(req
['payload'][145:145+10]).decode()
809 msg
['payload'] = binascii
.unhexlify("0602" + addrs
+ "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce
+ "030a" + r0khid
+ "0106000102030405")
812 def test_ap_ft_pmf_over_ds(dev
, apdev
):
813 """WPA2-PSK-FT AP over DS with PMF"""
814 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, None)
816 def test_ap_ft_pmf_bip_cmac_128_over_ds(dev
, apdev
):
817 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
818 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "AES-128-CMAC")
820 def test_ap_ft_pmf_bip_gmac_128_over_ds(dev
, apdev
):
821 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
822 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-GMAC-128")
824 def test_ap_ft_pmf_bip_gmac_256_over_ds(dev
, apdev
):
825 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
826 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-GMAC-256")
828 def test_ap_ft_pmf_bip_cmac_256_over_ds(dev
, apdev
):
829 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
830 run_ap_ft_pmf_bip_over_ds(dev
, apdev
, "BIP-CMAC-256")
832 def run_ap_ft_pmf_bip_over_ds(dev
, apdev
, cipher
):
833 if cipher
and cipher
not in dev
[0].get_capability("group_mgmt"):
834 raise HwsimSkip("Cipher %s not supported" % cipher
)
837 passphrase
= "12345678"
839 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
840 params
["ieee80211w"] = "2"
842 params
["group_mgmt_cipher"] = cipher
843 hapd0
= hostapd
.add_ap(apdev
[0], params
)
844 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
845 params
["ieee80211w"] = "2"
847 params
["group_mgmt_cipher"] = cipher
848 hapd1
= hostapd
.add_ap(apdev
[1], params
)
850 Wlantest
.setup(hapd0
)
853 wt
.add_passphrase(passphrase
)
855 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
858 def test_ap_ft_over_ds_pull(dev
, apdev
):
859 """WPA2-PSK-FT AP over DS (pull PMK)"""
861 passphrase
= "12345678"
863 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
864 params
["pmk_r1_push"] = "0"
865 hapd0
= hostapd
.add_ap(apdev
[0], params
)
866 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
867 params
["pmk_r1_push"] = "0"
868 hapd1
= hostapd
.add_ap(apdev
[1], params
)
870 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
872 def test_ap_ft_over_ds_pull_old_key(dev
, apdev
):
873 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
875 passphrase
= "12345678"
877 params
= ft_params1_old_key(ssid
=ssid
, passphrase
=passphrase
)
878 params
["pmk_r1_push"] = "0"
879 hapd0
= hostapd
.add_ap(apdev
[0], params
)
880 params
= ft_params2_old_key(ssid
=ssid
, passphrase
=passphrase
)
881 params
["pmk_r1_push"] = "0"
882 hapd1
= hostapd
.add_ap(apdev
[1], params
)
884 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True)
886 def test_ap_ft_over_ds_pull_vlan(dev
, apdev
):
887 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
889 passphrase
= "12345678"
891 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
892 params
["pmk_r1_push"] = "0"
893 params
['dynamic_vlan'] = "1"
894 params
['accept_mac_file'] = "hostapd.accept"
895 hapd0
= hostapd
.add_ap(apdev
[0]['ifname'], params
)
896 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
897 params
["pmk_r1_push"] = "0"
898 params
['dynamic_vlan'] = "1"
899 params
['accept_mac_file'] = "hostapd.accept"
900 hapd1
= hostapd
.add_ap(apdev
[1]['ifname'], params
)
902 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
905 def start_ft_sae(dev
, apdev
, wpa_ptk_rekey
=None):
906 if "SAE" not in dev
.get_capability("auth_alg"):
907 raise HwsimSkip("SAE not supported")
909 passphrase
= "12345678"
911 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
912 params
['wpa_key_mgmt'] = "FT-SAE"
914 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
915 hapd0
= hostapd
.add_ap(apdev
[0], params
)
916 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
917 params
['wpa_key_mgmt'] = "FT-SAE"
919 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
920 hapd1
= hostapd
.add_ap(apdev
[1], params
)
921 key_mgmt
= hapd1
.get_config()['key_mgmt']
922 if key_mgmt
.split(' ')[0] != "FT-SAE":
923 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
925 dev
.request("SET sae_groups ")
928 def test_ap_ft_sae(dev
, apdev
):
929 """WPA2-PSK-FT-SAE AP"""
930 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
931 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True)
933 def test_ap_ft_sae_ptk_rekey0(dev
, apdev
):
934 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
935 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
936 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
937 ptk_rekey
="1", roams
=0)
938 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
940 def test_ap_ft_sae_ptk_rekey1(dev
, apdev
):
941 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by station"""
942 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
943 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
944 ptk_rekey
="1", only_one_way
=True)
945 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
947 def test_ap_ft_sae_ptk_rekey_ap(dev
, apdev
):
948 """WPA2-PSK-FT-SAE AP and PTK rekey triggered by AP"""
949 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
, wpa_ptk_rekey
=2)
950 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
952 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
954 def test_ap_ft_sae_over_ds(dev
, apdev
):
955 """WPA2-PSK-FT-SAE AP over DS"""
956 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
957 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
960 def test_ap_ft_sae_over_ds_ptk_rekey0(dev
, apdev
):
961 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
962 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
963 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
964 over_ds
=True, ptk_rekey
="1", roams
=0)
965 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
967 def test_ap_ft_sae_over_ds_ptk_rekey1(dev
, apdev
):
968 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by station"""
969 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
)
970 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
971 over_ds
=True, ptk_rekey
="1", only_one_way
=True)
972 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
974 def test_ap_ft_sae_over_ds_ptk_rekey_ap(dev
, apdev
):
975 """WPA2-PSK-FT-SAE AP over DS and PTK rekey triggered by AP"""
976 hapd0
, hapd1
= start_ft_sae(dev
[0], apdev
, wpa_ptk_rekey
=2)
977 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", sae
=True,
978 over_ds
=True, only_one_way
=True)
979 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
981 def test_ap_ft_sae_pw_id(dev
, apdev
):
982 """FT-SAE with Password Identifier"""
983 if "SAE" not in dev
[0].get_capability("auth_alg"):
984 raise HwsimSkip("SAE not supported")
987 params
= ft_params1(ssid
=ssid
)
988 params
["ieee80211w"] = "2"
989 params
['wpa_key_mgmt'] = "FT-SAE"
990 params
['sae_password'] = 'secret|id=pwid'
991 hapd0
= hostapd
.add_ap(apdev
[0], params
)
992 params
= ft_params2(ssid
=ssid
)
993 params
["ieee80211w"] = "2"
994 params
['wpa_key_mgmt'] = "FT-SAE"
995 params
['sae_password'] = 'secret|id=pwid'
996 hapd
= hostapd
.add_ap(apdev
[1], params
)
998 dev
[0].request("SET sae_groups ")
999 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
=None, sae
=True,
1000 sae_password
="secret", sae_password_id
="pwid")
1002 def test_ap_ft_sae_with_both_akms(dev
, apdev
):
1003 """SAE + FT-SAE configuration"""
1004 if "SAE" not in dev
[0].get_capability("auth_alg"):
1005 raise HwsimSkip("SAE not supported")
1007 passphrase
= "12345678"
1009 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1010 params
['wpa_key_mgmt'] = "FT-SAE SAE"
1011 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1012 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1013 params
['wpa_key_mgmt'] = "FT-SAE SAE"
1014 hapd
= hostapd
.add_ap(apdev
[1], params
)
1015 key_mgmt
= hapd
.get_config()['key_mgmt']
1016 if key_mgmt
.split(' ')[0] != "FT-SAE":
1017 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1019 dev
[0].request("SET sae_groups ")
1020 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True,
1023 def test_ap_ft_sae_pmksa_caching(dev
, apdev
):
1024 """WPA2-FT-SAE AP and PMKSA caching for initial mobility domain association"""
1025 if "SAE" not in dev
[0].get_capability("auth_alg"):
1026 raise HwsimSkip("SAE not supported")
1028 passphrase
= "12345678"
1030 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1031 params
['wpa_key_mgmt'] = "FT-SAE"
1032 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1033 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1034 params
['wpa_key_mgmt'] = "FT-SAE"
1035 hapd
= hostapd
.add_ap(apdev
[1], params
)
1036 key_mgmt
= hapd
.get_config()['key_mgmt']
1037 if key_mgmt
.split(' ')[0] != "FT-SAE":
1038 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1040 dev
[0].request("SET sae_groups ")
1041 run_roams(dev
[0], apdev
, hapd0
, hapd
, ssid
, passphrase
, sae
=True,
1044 def generic_ap_ft_eap(dev
, apdev
, vlan
=False, cui
=False, over_ds
=False,
1045 discovery
=False, roams
=1, wpa_ptk_rekey
=0,
1046 only_one_way
=False):
1048 passphrase
= "12345678"
1050 identity
= "gpsk-vlan1"
1053 identity
= "gpsk-cui"
1056 identity
= "gpsk user"
1059 radius
= hostapd
.radius_params()
1060 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=discovery
)
1061 params
['wpa_key_mgmt'] = "FT-EAP"
1062 params
["ieee8021x"] = "1"
1064 params
["dynamic_vlan"] = "1"
1065 params
= dict(list(radius
.items()) + list(params
.items()))
1066 hapd
= hostapd
.add_ap(apdev
[0], params
)
1067 key_mgmt
= hapd
.get_config()['key_mgmt']
1068 if key_mgmt
.split(' ')[0] != "FT-EAP":
1069 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1070 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
, discovery
=discovery
)
1071 params
['wpa_key_mgmt'] = "FT-EAP"
1072 params
["ieee8021x"] = "1"
1074 params
["dynamic_vlan"] = "1"
1076 params
["wpa_ptk_rekey"] = str(wpa_ptk_rekey
)
1077 params
= dict(list(radius
.items()) + list(params
.items()))
1078 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1080 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True,
1081 over_ds
=over_ds
, roams
=roams
, eap_identity
=identity
,
1082 conndev
=conndev
, only_one_way
=only_one_way
)
1083 if "[WPA2-FT/EAP-CCMP]" not in dev
[0].request("SCAN_RESULTS"):
1084 raise Exception("Scan results missing RSN element info")
1085 check_mib(dev
[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
1086 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3")])
1090 # Verify EAPOL reauthentication after FT protocol
1091 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1095 ap
.request("EAPOL_REAUTH " + dev
[0].own_addr())
1096 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout
=5)
1098 raise Exception("EAP authentication did not start")
1099 ev
= dev
[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout
=5)
1101 raise Exception("EAP authentication did not succeed")
1104 hwsim_utils
.test_connectivity_iface(dev
[0], ap
, conndev
)
1106 hwsim_utils
.test_connectivity(dev
[0], ap
)
1108 def test_ap_ft_eap(dev
, apdev
):
1109 """WPA2-EAP-FT AP"""
1110 generic_ap_ft_eap(dev
, apdev
)
1112 def test_ap_ft_eap_cui(dev
, apdev
):
1113 """WPA2-EAP-FT AP with CUI"""
1114 generic_ap_ft_eap(dev
, apdev
, vlan
=False, cui
=True)
1116 def test_ap_ft_eap_vlan(dev
, apdev
):
1117 """WPA2-EAP-FT AP with VLAN"""
1118 generic_ap_ft_eap(dev
, apdev
, vlan
=True)
1120 def test_ap_ft_eap_vlan_multi(dev
, apdev
):
1121 """WPA2-EAP-FT AP with VLAN"""
1122 generic_ap_ft_eap(dev
, apdev
, vlan
=True, roams
=50)
1124 def test_ap_ft_eap_over_ds(dev
, apdev
):
1125 """WPA2-EAP-FT AP using over-the-DS"""
1126 generic_ap_ft_eap(dev
, apdev
, over_ds
=True)
1128 def test_ap_ft_eap_dis(dev
, apdev
):
1129 """WPA2-EAP-FT AP with AP discovery"""
1130 generic_ap_ft_eap(dev
, apdev
, discovery
=True)
1132 def test_ap_ft_eap_dis_over_ds(dev
, apdev
):
1133 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1134 generic_ap_ft_eap(dev
, apdev
, over_ds
=True, discovery
=True)
1136 def test_ap_ft_eap_vlan(dev
, apdev
):
1137 """WPA2-EAP-FT AP with VLAN"""
1138 generic_ap_ft_eap(dev
, apdev
, vlan
=True)
1140 def test_ap_ft_eap_vlan_multi(dev
, apdev
):
1141 """WPA2-EAP-FT AP with VLAN"""
1142 generic_ap_ft_eap(dev
, apdev
, vlan
=True, roams
=50)
1144 def test_ap_ft_eap_vlan_over_ds(dev
, apdev
):
1145 """WPA2-EAP-FT AP with VLAN + over_ds"""
1146 generic_ap_ft_eap(dev
, apdev
, vlan
=True, over_ds
=True)
1148 def test_ap_ft_eap_vlan_over_ds_multi(dev
, apdev
):
1149 """WPA2-EAP-FT AP with VLAN + over_ds"""
1150 generic_ap_ft_eap(dev
, apdev
, vlan
=True, over_ds
=True, roams
=50)
1152 def generic_ap_ft_eap_pull(dev
, apdev
, vlan
=False):
1153 """WPA2-EAP-FT AP (pull PMK)"""
1155 passphrase
= "12345678"
1157 identity
= "gpsk-vlan1"
1160 identity
= "gpsk user"
1163 radius
= hostapd
.radius_params()
1164 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1165 params
['wpa_key_mgmt'] = "FT-EAP"
1166 params
["ieee8021x"] = "1"
1167 params
["pmk_r1_push"] = "0"
1169 params
["dynamic_vlan"] = "1"
1170 params
= dict(list(radius
.items()) + list(params
.items()))
1171 hapd
= hostapd
.add_ap(apdev
[0], params
)
1172 key_mgmt
= hapd
.get_config()['key_mgmt']
1173 if key_mgmt
.split(' ')[0] != "FT-EAP":
1174 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
1175 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1176 params
['wpa_key_mgmt'] = "FT-EAP"
1177 params
["ieee8021x"] = "1"
1178 params
["pmk_r1_push"] = "0"
1180 params
["dynamic_vlan"] = "1"
1181 params
= dict(list(radius
.items()) + list(params
.items()))
1182 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1184 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True,
1185 eap_identity
=identity
, conndev
=conndev
)
1187 def test_ap_ft_eap_pull(dev
, apdev
):
1188 """WPA2-EAP-FT AP (pull PMK)"""
1189 generic_ap_ft_eap_pull(dev
, apdev
)
1191 def test_ap_ft_eap_pull_vlan(dev
, apdev
):
1192 generic_ap_ft_eap_pull(dev
, apdev
, vlan
=True)
1194 def test_ap_ft_eap_pull_wildcard(dev
, apdev
):
1195 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1197 passphrase
= "12345678"
1199 radius
= hostapd
.radius_params()
1200 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
1201 params
['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1202 params
["ieee8021x"] = "1"
1203 params
["pmk_r1_push"] = "0"
1204 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1205 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1206 params
["ft_psk_generate_local"] = "1"
1207 params
["eap_server"] = "0"
1208 params
= dict(list(radius
.items()) + list(params
.items()))
1209 hapd
= hostapd
.add_ap(apdev
[0], params
)
1210 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
1211 params
['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1212 params
["ieee8021x"] = "1"
1213 params
["pmk_r1_push"] = "0"
1214 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1215 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1216 params
["ft_psk_generate_local"] = "1"
1217 params
["eap_server"] = "0"
1218 params
= dict(list(radius
.items()) + list(params
.items()))
1219 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1221 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, passphrase
, eap
=True)
1224 def test_ap_ft_mismatching_rrb_key_push(dev
, apdev
):
1225 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1227 passphrase
= "12345678"
1229 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1230 params
["ieee80211w"] = "2"
1231 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1232 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1233 params
["ieee80211w"] = "2"
1234 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1236 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1240 def test_ap_ft_mismatching_rrb_key_pull(dev
, apdev
):
1241 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1243 passphrase
= "12345678"
1245 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1246 params
["pmk_r1_push"] = "0"
1247 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1248 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1249 params
["pmk_r1_push"] = "0"
1250 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1252 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1256 def test_ap_ft_mismatching_r0kh_id_pull(dev
, apdev
):
1257 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1259 passphrase
= "12345678"
1261 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1262 params
["pmk_r1_push"] = "0"
1263 params
["nas_identifier"] = "nas0.w1.fi"
1264 hostapd
.add_ap(apdev
[0], params
)
1265 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1268 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1269 params
["pmk_r1_push"] = "0"
1270 hostapd
.add_ap(apdev
[1], params
)
1272 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1273 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1276 def test_ap_ft_mismatching_rrb_r0kh_push(dev
, apdev
):
1277 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1279 passphrase
= "12345678"
1281 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1282 params
["ieee80211w"] = "2"
1283 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1284 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1285 params
["ieee80211w"] = "2"
1286 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1288 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1292 def test_ap_ft_mismatching_rrb_r0kh_pull(dev
, apdev
):
1293 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1295 passphrase
= "12345678"
1297 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1298 params
["pmk_r1_push"] = "0"
1299 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1300 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1301 params
["pmk_r1_push"] = "0"
1302 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1304 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1307 def test_ap_ft_mismatching_rrb_key_push_eap(dev
, apdev
):
1308 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1310 passphrase
= "12345678"
1312 radius
= hostapd
.radius_params()
1313 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1314 params
["ieee80211w"] = "2"
1315 params
['wpa_key_mgmt'] = "FT-EAP"
1316 params
["ieee8021x"] = "1"
1317 params
= dict(list(radius
.items()) + list(params
.items()))
1318 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1319 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1320 params
["ieee80211w"] = "2"
1321 params
['wpa_key_mgmt'] = "FT-EAP"
1322 params
["ieee8021x"] = "1"
1323 params
= dict(list(radius
.items()) + list(params
.items()))
1324 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1326 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1327 fail_test
=True, eap
=True)
1329 def test_ap_ft_mismatching_rrb_key_pull_eap(dev
, apdev
):
1330 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1332 passphrase
= "12345678"
1334 radius
= hostapd
.radius_params()
1335 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1336 params
["pmk_r1_push"] = "0"
1337 params
['wpa_key_mgmt'] = "FT-EAP"
1338 params
["ieee8021x"] = "1"
1339 params
= dict(list(radius
.items()) + list(params
.items()))
1340 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1341 params
= ft_params2_incorrect_rrb_key(ssid
=ssid
, passphrase
=passphrase
)
1342 params
["pmk_r1_push"] = "0"
1343 params
['wpa_key_mgmt'] = "FT-EAP"
1344 params
["ieee8021x"] = "1"
1345 params
= dict(list(radius
.items()) + list(params
.items()))
1346 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1348 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1349 fail_test
=True, eap
=True)
1351 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev
, apdev
):
1352 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1354 passphrase
= "12345678"
1356 radius
= hostapd
.radius_params()
1357 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1358 params
["pmk_r1_push"] = "0"
1359 params
["nas_identifier"] = "nas0.w1.fi"
1360 params
['wpa_key_mgmt'] = "FT-EAP"
1361 params
["ieee8021x"] = "1"
1362 params
= dict(list(radius
.items()) + list(params
.items()))
1363 hostapd
.add_ap(apdev
[0], params
)
1364 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
1365 eap
="GPSK", identity
="gpsk user",
1366 password
="abcdefghijklmnop0123456789abcdef",
1369 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1370 params
["pmk_r1_push"] = "0"
1371 params
['wpa_key_mgmt'] = "FT-EAP"
1372 params
["ieee8021x"] = "1"
1373 params
= dict(list(radius
.items()) + list(params
.items()))
1374 hostapd
.add_ap(apdev
[1], params
)
1376 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1377 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
1379 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev
, apdev
):
1380 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1382 passphrase
= "12345678"
1384 radius
= hostapd
.radius_params()
1385 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1386 params
["ieee80211w"] = "2"
1387 params
['wpa_key_mgmt'] = "FT-EAP"
1388 params
["ieee8021x"] = "1"
1389 params
= dict(list(radius
.items()) + list(params
.items()))
1390 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1391 params
= ft_params2_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1392 params
["ieee80211w"] = "2"
1393 params
['wpa_key_mgmt'] = "FT-EAP"
1394 params
["ieee8021x"] = "1"
1395 params
= dict(list(radius
.items()) + list(params
.items()))
1396 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1398 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1399 fail_test
=True, eap
=True)
1401 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev
, apdev
):
1402 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1404 passphrase
= "12345678"
1406 radius
= hostapd
.radius_params()
1407 params
= ft_params1_r0kh_mismatch(ssid
=ssid
, passphrase
=passphrase
)
1408 params
["pmk_r1_push"] = "0"
1409 params
['wpa_key_mgmt'] = "FT-EAP"
1410 params
["ieee8021x"] = "1"
1411 params
= dict(list(radius
.items()) + list(params
.items()))
1412 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1413 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1414 params
["pmk_r1_push"] = "0"
1415 params
['wpa_key_mgmt'] = "FT-EAP"
1416 params
["ieee8021x"] = "1"
1417 params
= dict(list(radius
.items()) + list(params
.items()))
1418 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1420 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
1421 fail_test
=True, eap
=True)
1423 def test_ap_ft_gtk_rekey(dev
, apdev
):
1424 """WPA2-PSK-FT AP and GTK rekey"""
1426 passphrase
= "12345678"
1428 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1429 params
['wpa_group_rekey'] = '1'
1430 hapd
= hostapd
.add_ap(apdev
[0], params
)
1432 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1433 ieee80211w
="1", scan_freq
="2412")
1435 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
1437 raise Exception("GTK rekey timed out after initial association")
1438 hwsim_utils
.test_connectivity(dev
[0], hapd
)
1440 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1441 params
['wpa_group_rekey'] = '1'
1442 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1444 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1445 dev
[0].roam(apdev
[1]['bssid'])
1446 if dev
[0].get_status_field('bssid') != apdev
[1]['bssid']:
1447 raise Exception("Did not connect to correct AP")
1448 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
1450 ev
= dev
[0].wait_event(["WPA: Group rekeying completed"], timeout
=2)
1452 raise Exception("GTK rekey timed out after FT protocol")
1453 hwsim_utils
.test_connectivity(dev
[0], hapd1
)
1455 def test_ft_psk_key_lifetime_in_memory(dev
, apdev
, params
):
1456 """WPA2-PSK-FT and key lifetime in memory"""
1458 passphrase
= "04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1459 psk
= '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1460 pmk
= binascii
.unhexlify(psk
)
1461 p
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1462 hapd0
= hostapd
.add_ap(apdev
[0], p
)
1463 p
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1464 hapd1
= hostapd
.add_ap(apdev
[1], p
)
1466 pid
= find_wpas_process(dev
[0])
1468 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1470 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1471 # event has been delivered, so verify that wpa_supplicant has returned to
1472 # eloop before reading process memory.
1476 buf
= read_process_memory(pid
, pmk
)
1478 dev
[0].request("DISCONNECT")
1479 dev
[0].wait_disconnected()
1486 with
open(os
.path
.join(params
['logdir'], 'log0'), 'r') as f
:
1487 for l
in f
.readlines():
1488 if "FT: PMK-R0 - hexdump" in l
:
1489 val
= l
.strip().split(':')[3].replace(' ', '')
1490 pmkr0
= binascii
.unhexlify(val
)
1491 if "FT: PMK-R1 - hexdump" in l
:
1492 val
= l
.strip().split(':')[3].replace(' ', '')
1493 pmkr1
= binascii
.unhexlify(val
)
1494 if "FT: KCK - hexdump" in l
:
1495 val
= l
.strip().split(':')[3].replace(' ', '')
1496 kck
= binascii
.unhexlify(val
)
1497 if "FT: KEK - hexdump" in l
:
1498 val
= l
.strip().split(':')[3].replace(' ', '')
1499 kek
= binascii
.unhexlify(val
)
1500 if "FT: TK - hexdump" in l
:
1501 val
= l
.strip().split(':')[3].replace(' ', '')
1502 tk
= binascii
.unhexlify(val
)
1503 if "WPA: Group Key - hexdump" in l
:
1504 val
= l
.strip().split(':')[3].replace(' ', '')
1505 gtk
= binascii
.unhexlify(val
)
1506 if not pmkr0
or not pmkr1
or not kck
or not kek
or not tk
or not gtk
:
1507 raise Exception("Could not find keys from debug log")
1509 raise Exception("Unexpected GTK length")
1511 logger
.info("Checking keys in memory while associated")
1512 get_key_locations(buf
, pmk
, "PMK")
1513 get_key_locations(buf
, pmkr0
, "PMK-R0")
1514 get_key_locations(buf
, pmkr1
, "PMK-R1")
1516 raise HwsimSkip("PMK not found while associated")
1517 if pmkr0
not in buf
:
1518 raise HwsimSkip("PMK-R0 not found while associated")
1519 if pmkr1
not in buf
:
1520 raise HwsimSkip("PMK-R1 not found while associated")
1522 raise Exception("KCK not found while associated")
1524 raise Exception("KEK not found while associated")
1526 # raise Exception("TK found from memory")
1528 logger
.info("Checking keys in memory after disassociation")
1529 buf
= read_process_memory(pid
, pmk
)
1530 get_key_locations(buf
, pmk
, "PMK")
1531 get_key_locations(buf
, pmkr0
, "PMK-R0")
1532 get_key_locations(buf
, pmkr1
, "PMK-R1")
1534 # Note: PMK/PSK is still present in network configuration
1536 fname
= os
.path
.join(params
['logdir'],
1537 'ft_psk_key_lifetime_in_memory.memctx-')
1538 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
1539 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
1540 verify_not_present(buf
, kck
, fname
, "KCK")
1541 verify_not_present(buf
, kek
, fname
, "KEK")
1542 verify_not_present(buf
, tk
, fname
, "TK")
1544 get_key_locations(buf
, gtk
, "GTK")
1545 verify_not_present(buf
, gtk
, fname
, "GTK")
1547 dev
[0].request("REMOVE_NETWORK all")
1549 logger
.info("Checking keys in memory after network profile removal")
1550 buf
= read_process_memory(pid
, pmk
)
1551 get_key_locations(buf
, pmk
, "PMK")
1552 get_key_locations(buf
, pmkr0
, "PMK-R0")
1553 get_key_locations(buf
, pmkr1
, "PMK-R1")
1555 verify_not_present(buf
, pmk
, fname
, "PMK")
1556 verify_not_present(buf
, pmkr0
, fname
, "PMK-R0")
1557 verify_not_present(buf
, pmkr1
, fname
, "PMK-R1")
1558 verify_not_present(buf
, kck
, fname
, "KCK")
1559 verify_not_present(buf
, kek
, fname
, "KEK")
1560 verify_not_present(buf
, tk
, fname
, "TK")
1561 verify_not_present(buf
, gtk
, fname
, "GTK")
1564 def test_ap_ft_invalid_resp(dev
, apdev
):
1565 """WPA2-PSK-FT AP and invalid response IEs"""
1567 passphrase
= "12345678"
1569 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1570 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1571 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1574 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1575 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1578 # Various IEs for test coverage. The last one is FTIE with invalid
1579 # R1KH-ID subelement.
1580 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1581 # FTIE with invalid R0KH-ID subelement (len=0).
1582 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1583 # FTIE with invalid R0KH-ID subelement (len=49).
1584 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1586 "020002000000" + "3000",
1587 # Required IEs missing from protected IE count.
1588 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1589 # RIC missing from protected IE count.
1590 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1591 # Protected IE missing.
1592 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000"]
1594 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
1595 hapd1
.set("ext_mgmt_frame_handling", "1")
1596 hapd1
.dump_monitor()
1597 if "OK" not in dev
[0].request("ROAM " + apdev
[1]['bssid']):
1598 raise Exception("ROAM failed")
1601 msg
= hapd1
.mgmt_rx()
1602 if msg
['subtype'] == 11:
1606 raise Exception("Authentication frame not seen")
1609 resp
['fc'] = auth
['fc']
1610 resp
['da'] = auth
['sa']
1611 resp
['sa'] = auth
['da']
1612 resp
['bssid'] = auth
['bssid']
1613 resp
['payload'] = binascii
.unhexlify(t
)
1615 hapd1
.set("ext_mgmt_frame_handling", "0")
1616 dev
[0].wait_disconnected()
1618 dev
[0].request("RECONNECT")
1619 dev
[0].wait_connected()
1621 def test_ap_ft_gcmp_256(dev
, apdev
):
1622 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1623 if "GCMP-256" not in dev
[0].get_capability("pairwise"):
1624 raise HwsimSkip("Cipher GCMP-256 not supported")
1626 passphrase
= "12345678"
1628 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1629 params
['rsn_pairwise'] = "GCMP-256"
1630 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1631 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1632 params
['rsn_pairwise'] = "GCMP-256"
1633 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1635 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
1636 pairwise_cipher
="GCMP-256", group_cipher
="GCMP-256")
1638 def setup_ap_ft_oom(dev
, apdev
):
1639 skip_with_fips(dev
[0])
1641 passphrase
= "12345678"
1643 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1644 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1645 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1646 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1648 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1650 if dev
[0].get_status_field('bssid') == apdev
[0]['bssid']:
1651 dst
= apdev
[1]['bssid']
1653 dst
= apdev
[0]['bssid']
1655 dev
[0].scan_for_bss(dst
, freq
="2412")
1659 def test_ap_ft_oom(dev
, apdev
):
1660 """WPA2-PSK-FT and OOM"""
1661 dst
= setup_ap_ft_oom(dev
, apdev
)
1662 with
alloc_fail(dev
[0], 1, "wpa_ft_gen_req_ies"):
1665 def test_ap_ft_oom2(dev
, apdev
):
1666 """WPA2-PSK-FT and OOM (2)"""
1667 dst
= setup_ap_ft_oom(dev
, apdev
)
1668 with
fail_test(dev
[0], 1, "wpa_ft_mic"):
1669 dev
[0].roam(dst
, fail_test
=True, assoc_reject_ok
=True)
1671 def test_ap_ft_oom3(dev
, apdev
):
1672 """WPA2-PSK-FT and OOM (3)"""
1673 dst
= setup_ap_ft_oom(dev
, apdev
)
1674 with
fail_test(dev
[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1677 def test_ap_ft_oom4(dev
, apdev
):
1678 """WPA2-PSK-FT and OOM (4)"""
1680 passphrase
= "12345678"
1681 dst
= setup_ap_ft_oom(dev
, apdev
)
1682 dev
[0].request("REMOVE_NETWORK all")
1683 with
alloc_fail(dev
[0], 1, "=sme_update_ft_ies"):
1684 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1687 def test_ap_ft_ap_oom(dev
, apdev
):
1688 """WPA2-PSK-FT and AP OOM"""
1690 passphrase
= "12345678"
1692 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1693 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1694 bssid0
= hapd0
.own_addr()
1696 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1697 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r0"):
1698 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1701 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1702 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1703 bssid1
= hapd1
.own_addr()
1704 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1705 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1708 def test_ap_ft_ap_oom2(dev
, apdev
):
1709 """WPA2-PSK-FT and AP OOM 2"""
1711 passphrase
= "12345678"
1713 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1714 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1715 bssid0
= hapd0
.own_addr()
1717 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1718 with
alloc_fail(hapd0
, 1, "wpa_ft_store_pmk_r1"):
1719 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1722 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1723 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1724 bssid1
= hapd1
.own_addr()
1725 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1727 if dev
[0].get_status_field('bssid') != bssid1
:
1728 raise Exception("Did not roam to AP1")
1729 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1732 def test_ap_ft_ap_oom3(dev
, apdev
):
1733 """WPA2-PSK-FT and AP OOM 3"""
1735 passphrase
= "12345678"
1737 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1738 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1739 bssid0
= hapd0
.own_addr()
1741 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1742 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1745 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1746 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1747 bssid1
= hapd1
.own_addr()
1748 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1749 with
alloc_fail(hapd1
, 1, "wpa_ft_pull_pmk_r1"):
1750 # This will fail due to not being able to send out PMK-R1 pull request
1753 with
fail_test(hapd1
, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1754 # This will fail due to not being able to send out PMK-R1 pull request
1757 with
fail_test(hapd1
, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1758 # This will fail due to not being able to send out PMK-R1 pull request
1761 def test_ap_ft_ap_oom3b(dev
, apdev
):
1762 """WPA2-PSK-FT and AP OOM 3b"""
1764 passphrase
= "12345678"
1766 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1767 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1768 bssid0
= hapd0
.own_addr()
1770 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1771 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1774 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1775 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1776 bssid1
= hapd1
.own_addr()
1777 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1778 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1779 # This will fail due to not being able to send out PMK-R1 pull request
1782 def test_ap_ft_ap_oom4(dev
, apdev
):
1783 """WPA2-PSK-FT and AP OOM 4"""
1785 passphrase
= "12345678"
1787 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1788 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1789 bssid0
= hapd0
.own_addr()
1791 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1792 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1795 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1796 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1797 bssid1
= hapd1
.own_addr()
1798 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1799 with
alloc_fail(hapd1
, 1, "wpa_ft_gtk_subelem"):
1801 if dev
[0].get_status_field('bssid') != bssid1
:
1802 raise Exception("Did not roam to AP1")
1804 with
fail_test(hapd0
, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1806 if dev
[0].get_status_field('bssid') != bssid0
:
1807 raise Exception("Did not roam to AP0")
1809 with
fail_test(hapd0
, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1811 if dev
[0].get_status_field('bssid') != bssid1
:
1812 raise Exception("Did not roam to AP1")
1814 def test_ap_ft_ap_oom5(dev
, apdev
):
1815 """WPA2-PSK-FT and AP OOM 5"""
1817 passphrase
= "12345678"
1819 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1820 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1821 bssid0
= hapd0
.own_addr()
1823 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1824 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1827 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1828 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1829 bssid1
= hapd1
.own_addr()
1830 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1831 with
alloc_fail(hapd1
, 1, "=wpa_ft_process_auth_req"):
1832 # This will fail to roam
1835 with
fail_test(hapd1
, 1, "os_get_random;wpa_ft_process_auth_req"):
1836 # This will fail to roam
1839 with
fail_test(hapd1
, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1840 # This will fail to roam
1843 with
fail_test(hapd1
, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1844 # This will fail to roam
1847 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1848 # This will fail to roam
1851 def test_ap_ft_ap_oom6(dev
, apdev
):
1852 """WPA2-PSK-FT and AP OOM 6"""
1854 passphrase
= "12345678"
1856 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1857 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1858 bssid0
= hapd0
.own_addr()
1860 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1861 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1862 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1864 dev
[0].request("REMOVE_NETWORK all")
1865 dev
[0].wait_disconnected()
1866 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1867 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1869 dev
[0].request("REMOVE_NETWORK all")
1870 dev
[0].wait_disconnected()
1871 with
fail_test(hapd0
, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1872 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1875 def test_ap_ft_ap_oom7a(dev
, apdev
):
1876 """WPA2-PSK-FT and AP OOM 7a"""
1878 passphrase
= "12345678"
1880 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1881 params
["ieee80211w"] = "2"
1882 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1883 bssid0
= hapd0
.own_addr()
1885 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1886 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1887 ieee80211w
="2", scan_freq
="2412")
1889 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1890 params
["ieee80211w"] = "2"
1891 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1892 bssid1
= hapd1
.own_addr()
1893 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1894 with
alloc_fail(hapd1
, 1, "wpa_ft_igtk_subelem"):
1895 # This will fail to roam
1898 def test_ap_ft_ap_oom7b(dev
, apdev
):
1899 """WPA2-PSK-FT and AP OOM 7b"""
1901 passphrase
= "12345678"
1903 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1904 params
["ieee80211w"] = "2"
1905 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1906 bssid0
= hapd0
.own_addr()
1908 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1909 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1910 ieee80211w
="2", scan_freq
="2412")
1912 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1913 params
["ieee80211w"] = "2"
1914 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1915 bssid1
= hapd1
.own_addr()
1916 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1917 with
fail_test(hapd1
, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1918 # This will fail to roam
1921 def test_ap_ft_ap_oom7c(dev
, apdev
):
1922 """WPA2-PSK-FT and AP OOM 7c"""
1924 passphrase
= "12345678"
1926 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1927 params
["ieee80211w"] = "2"
1928 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1929 bssid0
= hapd0
.own_addr()
1931 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1932 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1933 ieee80211w
="2", scan_freq
="2412")
1935 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1936 params
["ieee80211w"] = "2"
1937 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1938 bssid1
= hapd1
.own_addr()
1939 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1940 with
alloc_fail(hapd1
, 1, "=wpa_sm_write_assoc_resp_ies"):
1941 # This will fail to roam
1944 def test_ap_ft_ap_oom7d(dev
, apdev
):
1945 """WPA2-PSK-FT and AP OOM 7d"""
1947 passphrase
= "12345678"
1949 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1950 params
["ieee80211w"] = "2"
1951 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1952 bssid0
= hapd0
.own_addr()
1954 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1955 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1956 ieee80211w
="2", scan_freq
="2412")
1958 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1959 params
["ieee80211w"] = "2"
1960 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1961 bssid1
= hapd1
.own_addr()
1962 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1963 with
fail_test(hapd1
, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1964 # This will fail to roam
1967 def test_ap_ft_ap_oom8(dev
, apdev
):
1968 """WPA2-PSK-FT and AP OOM 8"""
1970 passphrase
= "12345678"
1972 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1973 params
['ft_psk_generate_local'] = "1"
1974 hapd0
= hostapd
.add_ap(apdev
[0], params
)
1975 bssid0
= hapd0
.own_addr()
1977 dev
[0].scan_for_bss(bssid0
, freq
="2412")
1978 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
1981 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
1982 params
['ft_psk_generate_local'] = "1"
1983 hapd1
= hostapd
.add_ap(apdev
[1], params
)
1984 bssid1
= hapd1
.own_addr()
1985 dev
[0].scan_for_bss(bssid1
, freq
="2412")
1986 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1987 # This will fail to roam
1989 with
fail_test(hapd1
, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1990 # This will fail to roam
1993 def test_ap_ft_ap_oom9(dev
, apdev
):
1994 """WPA2-PSK-FT and AP OOM 9"""
1996 passphrase
= "12345678"
1998 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
1999 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2000 bssid0
= hapd0
.own_addr()
2002 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2003 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2006 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2007 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2008 bssid1
= hapd1
.own_addr()
2009 dev
[0].scan_for_bss(bssid1
, freq
="2412")
2011 with
alloc_fail(hapd0
, 1, "wpa_ft_action_rx"):
2012 # This will fail to roam
2013 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2014 raise Exception("FT_DS failed")
2015 wait_fail_trigger(hapd0
, "GET_ALLOC_FAIL")
2017 with
alloc_fail(hapd1
, 1, "wpa_ft_rrb_rx_request"):
2018 # This will fail to roam
2019 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2020 raise Exception("FT_DS failed")
2021 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
2023 with
alloc_fail(hapd1
, 1, "wpa_ft_send_rrb_auth_resp"):
2024 # This will fail to roam
2025 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2026 raise Exception("FT_DS failed")
2027 wait_fail_trigger(hapd1
, "GET_ALLOC_FAIL")
2029 def test_ap_ft_ap_oom10(dev
, apdev
):
2030 """WPA2-PSK-FT and AP OOM 10"""
2032 passphrase
= "12345678"
2034 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2035 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2036 bssid0
= hapd0
.own_addr()
2038 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2039 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2042 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2043 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2044 bssid1
= hapd1
.own_addr()
2045 dev
[0].scan_for_bss(bssid1
, freq
="2412")
2047 with
fail_test(hapd0
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
2048 # This will fail to roam
2049 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2050 raise Exception("FT_DS failed")
2051 wait_fail_trigger(hapd0
, "GET_FAIL")
2053 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
2054 # This will fail to roam
2055 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2056 raise Exception("FT_DS failed")
2057 wait_fail_trigger(hapd0
, "GET_FAIL")
2059 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
2060 # This will fail to roam
2061 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2062 raise Exception("FT_DS failed")
2063 wait_fail_trigger(hapd0
, "GET_FAIL")
2065 with
fail_test(hapd1
, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
2066 # This will fail to roam
2067 if "OK" not in dev
[0].request("FT_DS " + bssid1
):
2068 raise Exception("FT_DS failed")
2069 wait_fail_trigger(hapd1
, "GET_FAIL")
2071 def test_ap_ft_ap_oom11(dev
, apdev
):
2072 """WPA2-PSK-FT and AP OOM 11"""
2074 passphrase
= "12345678"
2076 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2077 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2078 bssid0
= hapd0
.own_addr()
2080 dev
[0].scan_for_bss(bssid0
, freq
="2412")
2081 with
fail_test(hapd0
, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
2082 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2084 wait_fail_trigger(hapd0
, "GET_FAIL")
2086 dev
[1].scan_for_bss(bssid0
, freq
="2412")
2087 with
fail_test(hapd0
, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
2088 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2090 wait_fail_trigger(hapd0
, "GET_FAIL")
2092 def test_ap_ft_over_ds_proto_ap(dev
, apdev
):
2093 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
2095 passphrase
= "12345678"
2097 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2098 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2099 bssid0
= hapd0
.own_addr()
2100 _bssid0
= bssid0
.replace(':', '')
2101 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2103 addr
= dev
[0].own_addr()
2104 _addr
= addr
.replace(':', '')
2106 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2107 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2108 bssid1
= hapd1
.own_addr()
2109 _bssid1
= bssid1
.replace(':', '')
2111 hapd0
.set("ext_mgmt_frame_handling", "1")
2112 hdr
= "d0003a01" + _bssid0
+ _addr
+ _bssid0
+ "1000"
2113 valid
= "0601" + _addr
+ _bssid1
2116 "0601" + _addr
+ _bssid0
,
2117 "0601" + _addr
+ "ffffffffffff",
2118 "0601" + _bssid0
+ _bssid0
,
2123 valid
+ "3603ffffff",
2124 valid
+ "3603a1b2ff",
2125 valid
+ "3603a1b2ff" + "3700",
2126 valid
+ "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2127 valid
+ "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2128 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2129 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2130 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2131 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2132 valid
+ "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2135 hapd0
.dump_monitor()
2136 if "OK" not in hapd0
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ t
):
2137 raise Exception("MGMT_RX_PROCESS failed")
2139 hapd0
.set("ext_mgmt_frame_handling", "0")
2141 def test_ap_ft_over_ds_proto(dev
, apdev
):
2142 """WPA2-PSK-FT AP over DS protocol testing"""
2144 passphrase
= "12345678"
2146 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2147 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2148 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2151 # FT Action Response while no FT-over-DS in progress
2154 msg
['da'] = dev
[0].own_addr()
2155 msg
['sa'] = apdev
[0]['bssid']
2156 msg
['bssid'] = apdev
[0]['bssid']
2157 msg
['payload'] = binascii
.unhexlify("06020200000000000200000004000000")
2160 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2161 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2162 dev
[0].scan_for_bss(apdev
[1]['bssid'], freq
="2412")
2163 hapd0
.set("ext_mgmt_frame_handling", "1")
2164 hapd0
.dump_monitor()
2165 dev
[0].request("FT_DS " + apdev
[1]['bssid'])
2166 for i
in range(0, 10):
2167 req
= hapd0
.mgmt_rx()
2169 raise Exception("MGMT RX wait timed out")
2170 if req
['subtype'] == 13:
2174 raise Exception("FT Action frame not received")
2176 # FT Action Response for unexpected Target AP
2177 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "f20000000400" + "0000")
2180 # FT Action Response without MDIE
2181 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000")
2184 # FT Action Response without FTIE
2185 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2188 # FT Action Response with FTIE SNonce mismatch
2189 msg
['payload'] = binascii
.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2193 def test_ap_ft_rrb(dev
, apdev
):
2194 """WPA2-PSK-FT RRB protocol testing"""
2196 passphrase
= "12345678"
2198 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2199 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2201 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2204 _dst_ll
= binascii
.unhexlify(apdev
[0]['bssid'].replace(':', ''))
2205 _src_ll
= binascii
.unhexlify(dev
[0].own_addr().replace(':', ''))
2207 ehdr
= _dst_ll
+ _src_ll
+ proto
2209 # Too short RRB frame
2210 pkt
= ehdr
+ b
'\x01'
2211 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2212 raise Exception("DATA_TEST_FRAME failed")
2214 # RRB discarded frame wikth unrecognized type
2215 pkt
= ehdr
+ b
'\x02' + b
'\x02' + b
'\x01\x00' + _src_ll
2216 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2217 raise Exception("DATA_TEST_FRAME failed")
2219 # RRB frame too short for action frame
2220 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x01\x00' + _src_ll
2221 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2222 raise Exception("DATA_TEST_FRAME failed")
2224 # Too short RRB frame (not enough room for Action Frame body)
2225 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x00\x00' + _src_ll
2226 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2227 raise Exception("DATA_TEST_FRAME failed")
2229 # Unexpected Action frame category
2230 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x0e\x00' + _src_ll
+ b
'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2231 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2232 raise Exception("DATA_TEST_FRAME failed")
2234 # Unexpected Action in RRB Request
2235 pkt
= ehdr
+ b
'\x01' + b
'\x00' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2236 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2237 raise Exception("DATA_TEST_FRAME failed")
2239 # Target AP address in RRB Request does not match with own address
2240 pkt
= ehdr
+ b
'\x01' + b
'\x00' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2241 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2242 raise Exception("DATA_TEST_FRAME failed")
2244 # Not enough room for status code in RRB Response
2245 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2246 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2247 raise Exception("DATA_TEST_FRAME failed")
2249 # RRB discarded frame with unknown packet_type
2250 pkt
= ehdr
+ b
'\x01' + b
'\x02' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2251 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2252 raise Exception("DATA_TEST_FRAME failed")
2254 # RRB Response with non-zero status code; no STA match
2255 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x10\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b
'\xff\xff'
2256 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2257 raise Exception("DATA_TEST_FRAME failed")
2259 # RRB Response with zero status code and extra data; STA match
2260 pkt
= ehdr
+ b
'\x01' + b
'\x01' + b
'\x11\x00' + _src_ll
+ b
'\x06\x01' + _src_ll
+ b
'\x00\x00\x00\x00\x00\x00' + b
'\x00\x00' + b
'\x00'
2261 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2262 raise Exception("DATA_TEST_FRAME failed")
2264 # Too short PMK-R1 pull
2265 pkt
= ehdr
+ b
'\x01' + b
'\xc8' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2266 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2267 raise Exception("DATA_TEST_FRAME failed")
2269 # Too short PMK-R1 resp
2270 pkt
= ehdr
+ b
'\x01' + b
'\xc9' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2271 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2272 raise Exception("DATA_TEST_FRAME failed")
2274 # Too short PMK-R1 push
2275 pkt
= ehdr
+ b
'\x01' + b
'\xca' + b
'\x0e\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2276 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2277 raise Exception("DATA_TEST_FRAME failed")
2279 # No matching R0KH address found for PMK-R0 pull response
2280 pkt
= ehdr
+ b
'\x01' + b
'\xc9' + b
'\x5a\x00' + _src_ll
+ b
'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b
'\00'
2281 if "OK" not in dev
[0].request("DATA_TEST_FRAME " + binascii
.hexlify(pkt
).decode()):
2282 raise Exception("DATA_TEST_FRAME failed")
2285 def test_rsn_ie_proto_ft_psk_sta(dev
, apdev
):
2286 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2287 bssid
= apdev
[0]['bssid']
2289 passphrase
= "12345678"
2291 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2292 params
["ieee80211w"] = "1"
2293 # This is the RSN element used normally by hostapd
2294 params
['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
2295 hapd
= hostapd
.add_ap(apdev
[0], params
)
2296 id = dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2297 ieee80211w
="1", scan_freq
="2412",
2298 pairwise
="CCMP", group
="CCMP")
2300 tests
= [('PMKIDCount field included',
2301 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2302 ('Extra IE before RSNE',
2303 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2304 ('PMKIDCount and Group Management Cipher suite fields included',
2305 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2306 ('Extra octet after defined fields (future extensibility)',
2307 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2308 ('No RSN Capabilities field (PMF disabled in practice)',
2309 '30120100000fac040100000fac040100000fac04' + '3603a1b201')]
2310 for txt
, ie
in tests
:
2311 dev
[0].request("DISCONNECT")
2312 dev
[0].wait_disconnected()
2315 hapd
.set('own_ie_override', ie
)
2317 dev
[0].request("BSS_FLUSH 0")
2318 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2319 dev
[0].select_network(id, freq
=2412)
2320 dev
[0].wait_connected()
2322 dev
[0].request("DISCONNECT")
2323 dev
[0].wait_disconnected()
2325 logger
.info('Invalid RSNE causing internal hostapd error')
2327 hapd
.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2329 dev
[0].request("BSS_FLUSH 0")
2330 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2331 dev
[0].select_network(id, freq
=2412)
2332 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2334 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
2336 raise Exception("Unexpected connection")
2337 dev
[0].request("DISCONNECT")
2339 logger
.info('Unexpected PMKID causing internal hostapd error')
2341 hapd
.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2343 dev
[0].request("BSS_FLUSH 0")
2344 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2345 dev
[0].select_network(id, freq
=2412)
2346 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2348 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout
=1)
2350 raise Exception("Unexpected connection")
2351 dev
[0].request("DISCONNECT")
2353 def start_ft(apdev
, wpa_ptk_rekey
=None):
2355 passphrase
= "12345678"
2357 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2359 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
2360 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2361 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2363 params
['wpa_ptk_rekey'] = str(wpa_ptk_rekey
)
2364 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2368 def check_ptk_rekey(dev
, hapd0
=None, hapd1
=None):
2369 ev
= dev
.wait_event(["CTRL-EVENT-DISCONNECTED",
2370 "WPA: Key negotiation completed"], timeout
=5)
2372 raise Exception("No event received after roam")
2373 if "CTRL-EVENT-DISCONNECTED" in ev
:
2374 raise Exception("Unexpected disconnection after roam")
2376 if not hapd0
or not hapd1
:
2378 if dev
.get_status_field('bssid') == hapd0
.own_addr():
2382 hwsim_utils
.test_connectivity(dev
, hapd
)
2384 def test_ap_ft_ptk_rekey(dev
, apdev
):
2385 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2386 hapd0
, hapd1
= start_ft(apdev
)
2387 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", ptk_rekey
="1")
2388 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2390 def test_ap_ft_ptk_rekey2(dev
, apdev
):
2391 """WPA2-PSK-FT PTK rekeying triggered by station after one roam"""
2392 hapd0
, hapd1
= start_ft(apdev
)
2393 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678", ptk_rekey
="1",
2395 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2397 def test_ap_ft_ptk_rekey_ap(dev
, apdev
):
2398 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2399 hapd0
, hapd1
= start_ft(apdev
, wpa_ptk_rekey
=2)
2400 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678")
2401 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2403 def test_ap_ft_ptk_rekey_ap2(dev
, apdev
):
2404 """WPA2-PSK-FT PTK rekeying triggered by AP after one roam"""
2405 hapd0
, hapd1
= start_ft(apdev
, wpa_ptk_rekey
=2)
2406 run_roams(dev
[0], apdev
, hapd0
, hapd1
, "test-ft", "12345678",
2408 check_ptk_rekey(dev
[0], hapd0
, hapd1
)
2410 def test_ap_ft_eap_ptk_rekey_ap(dev
, apdev
):
2411 """WPA2-EAP-FT PTK rekeying triggered by AP"""
2412 generic_ap_ft_eap(dev
, apdev
, only_one_way
=True, wpa_ptk_rekey
=2)
2413 check_ptk_rekey(dev
[0])
2415 def test_ap_ft_internal_rrb_check(dev
, apdev
):
2416 """RRB internal delivery only to WPA enabled BSS"""
2418 passphrase
= "12345678"
2420 radius
= hostapd
.radius_params()
2421 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2422 params
['wpa_key_mgmt'] = "FT-EAP"
2423 params
["ieee8021x"] = "1"
2424 params
= dict(list(radius
.items()) + list(params
.items()))
2425 hapd
= hostapd
.add_ap(apdev
[0], params
)
2426 key_mgmt
= hapd
.get_config()['key_mgmt']
2427 if key_mgmt
.split(' ')[0] != "FT-EAP":
2428 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt
)
2430 hapd1
= hostapd
.add_ap(apdev
[1], {"ssid": ssid
})
2432 # Connect to WPA enabled AP
2433 dev
[0].connect(ssid
, key_mgmt
="FT-EAP", proto
="WPA2", ieee80211w
="1",
2434 eap
="GPSK", identity
="gpsk user",
2435 password
="abcdefghijklmnop0123456789abcdef",
2438 # Try over_ds roaming to non-WPA-enabled AP.
2439 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2440 dev
[0].roam_over_ds(apdev
[1]['bssid'], fail_test
=True)
2442 def test_ap_ft_extra_ie(dev
, apdev
):
2443 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2445 passphrase
= "12345678"
2447 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2448 params
["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2449 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2450 dev
[1].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2452 dev
[2].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
2455 # Add Mobility Domain element to test AP validation code.
2456 dev
[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2457 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="WPA-PSK", proto
="WPA2",
2458 scan_freq
="2412", wait_connect
=False)
2459 ev
= dev
[0].wait_event(["CTRL-EVENT-CONNECTED",
2460 "CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
2462 raise Exception("No connection result")
2463 if "CTRL-EVENT-CONNECTED" in ev
:
2464 raise Exception("Non-FT association accepted with MDE")
2465 if "status_code=43" not in ev
:
2466 raise Exception("Unexpected status code: " + ev
)
2467 dev
[0].request("DISCONNECT")
2469 dev
[0].request("VENDOR_ELEM_REMOVE 13 *")
2471 def test_ap_ft_ric(dev
, apdev
):
2472 """WPA2-PSK-FT AP and RIC"""
2474 passphrase
= "12345678"
2476 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2477 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2478 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2479 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2481 dev
[0].set("ric_ies", "")
2482 dev
[0].set("ric_ies", '""')
2483 if "FAIL" not in dev
[0].request("SET ric_ies q"):
2484 raise Exception("Invalid ric_ies value accepted")
2489 "390400000000" + "390400000000",
2490 "390400000000" + "dd050050f20202",
2491 "390400000000" + "dd3d0050f2020201" + 55*"00",
2492 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2493 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000"]
2495 dev
[0].set("ric_ies", t
)
2496 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
,
2497 test_connectivity
=False)
2498 dev
[0].request("REMOVE_NETWORK all")
2499 dev
[0].wait_disconnected()
2500 dev
[0].dump_monitor()
2502 def ie_hex(ies
, id):
2503 return binascii
.hexlify(struct
.pack('BB', id, len(ies
[id])) + ies
[id]).decode()
2505 def test_ap_ft_reassoc_proto(dev
, apdev
):
2506 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2508 passphrase
= "12345678"
2510 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2511 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2512 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2513 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2515 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2516 ieee80211w
="1", scan_freq
="2412")
2517 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2524 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2525 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2526 dev
[0].request("ROAM " + hapd2ap
.own_addr())
2529 req
= hapd2ap
.mgmt_rx()
2530 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2531 if req
['subtype'] == 11:
2535 req
= hapd2ap
.mgmt_rx()
2536 if req
['subtype'] == 2:
2538 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2540 # IEEE 802.11 header + fixed fields before IEs
2541 hdr
= binascii
.hexlify(req
['frame'][0:34]).decode()
2542 ies
= parse_ie(binascii
.hexlify(req
['frame'][34:]))
2543 # First elements: SSID, Supported Rates, Extended Supported Rates
2544 ies1
= ie_hex(ies
, 0) + ie_hex(ies
, 1) + ie_hex(ies
, 50)
2546 rsne
= ie_hex(ies
, 48)
2547 mde
= ie_hex(ies
, 54)
2548 fte
= ie_hex(ies
, 55)
2550 # RSN: Trying to use FT, but MDIE not included
2552 # RSN: Attempted to use unknown MDIE
2553 tests
+= [rsne
+ "3603000000"]
2554 # Invalid RSN pairwise cipher
2555 tests
+= ["30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3"]
2556 # FT: No PMKID in RSNIE
2557 tests
+= ["30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies
, 54)]
2559 tests
+= [rsne
+ mde
]
2560 # FT: RIC IE(s) in the frame, but not included in protected IE count
2561 # FT: Failed to parse FT IEs
2562 tests
+= [rsne
+ mde
+ fte
+ "3900"]
2563 # FT: SNonce mismatch in FTIE
2564 tests
+= [rsne
+ mde
+ "37520000" + 16*"00" + 32*"00" + 32*"00"]
2565 # FT: ANonce mismatch in FTIE
2566 tests
+= [rsne
+ mde
+ fte
[0:40] + 32*"00" + fte
[104:]]
2567 # FT: No R0KH-ID subelem in FTIE
2568 tests
+= [rsne
+ mde
+ "3752" + fte
[4:168]]
2569 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2570 tests
+= [rsne
+ mde
+ "3755" + fte
[4:168] + "0301ff"]
2571 # FT: No R1KH-ID subelem in FTIE
2572 tests
+= [rsne
+ mde
+ "375e" + fte
[4:168] + "030a" + binascii
.hexlify(b
"nas1.w1.fi").decode()]
2573 # FT: Unknown R1KH-ID used in ReassocReq
2574 tests
+= [rsne
+ mde
+ "3766" + fte
[4:168] + "030a" + binascii
.hexlify(b
"nas1.w1.fi").decode() + "0106000000000000"]
2575 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2576 tests
+= [rsne
[:-32] + 16*"00" + mde
+ fte
]
2577 # Invalid MIC in FTIE
2578 tests
+= [rsne
+ mde
+ fte
[0:8] + 16*"00" + fte
[40:]]
2580 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr
+ ies1
+ t
)
2582 def test_ap_ft_reassoc_local_fail(dev
, apdev
):
2583 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2585 passphrase
= "12345678"
2587 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2588 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2589 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2590 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2592 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2593 ieee80211w
="1", scan_freq
="2412")
2594 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2601 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2602 # FT: Failed to calculate MIC
2603 with
fail_test(hapd2ap
, 1, "wpa_ft_validate_reassoc"):
2604 dev
[0].request("ROAM " + hapd2ap
.own_addr())
2605 ev
= dev
[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout
=10)
2606 dev
[0].request("DISCONNECT")
2608 raise Exception("Association reject not seen")
2610 def test_ap_ft_reassoc_replay(dev
, apdev
, params
):
2611 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2612 capfile
= os
.path
.join(params
['logdir'], "hwsim0.pcapng")
2614 passphrase
= "12345678"
2616 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2617 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2618 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2619 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2621 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2623 if dev
[0].get_status_field('bssid') == hapd0
.own_addr():
2630 dev
[0].scan_for_bss(hapd2ap
.own_addr(), freq
="2412")
2631 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2632 dev
[0].dump_monitor()
2633 if "OK" not in dev
[0].request("ROAM " + hapd2ap
.own_addr()):
2634 raise Exception("ROAM failed")
2639 req
= hapd2ap
.mgmt_rx()
2641 hapd2ap
.dump_monitor()
2642 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2643 if req
['subtype'] == 2:
2645 ev
= hapd2ap
.wait_event(["MGMT-TX-STATUS"], timeout
=5)
2647 raise Exception("No TX status seen")
2648 cmd
= "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev
.split(' ')[1:4]))
2649 if "OK" not in hapd2ap
.request(cmd
):
2650 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2652 hapd2ap
.set("ext_mgmt_frame_handling", "0")
2653 if reassocreq
is None:
2654 raise Exception("No Reassociation Request frame seen")
2655 dev
[0].wait_connected()
2656 dev
[0].dump_monitor()
2657 hapd2ap
.dump_monitor()
2659 hwsim_utils
.test_connectivity(dev
[0], hapd2ap
)
2661 logger
.info("Replay the last Reassociation Request frame")
2662 hapd2ap
.dump_monitor()
2663 hapd2ap
.set("ext_mgmt_frame_handling", "1")
2664 hapd2ap
.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii
.hexlify(req
['frame']).decode())
2665 ev
= hapd2ap
.wait_event(["MGMT-TX-STATUS"], timeout
=5)
2667 raise Exception("No TX status seen")
2668 cmd
= "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev
.split(' ')[1:4]))
2669 if "OK" not in hapd2ap
.request(cmd
):
2670 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2671 hapd2ap
.set("ext_mgmt_frame_handling", "0")
2674 hwsim_utils
.test_connectivity(dev
[0], hapd2ap
)
2679 ap
= hapd2ap
.own_addr()
2680 sta
= dev
[0].own_addr()
2681 filt
= "wlan.fc.type == 2 && " + \
2682 "wlan.da == " + sta
+ " && " + \
2684 fields
= ["wlan.ccmp.extiv"]
2685 res
= run_tshark(capfile
, filt
, fields
)
2686 vals
= res
.splitlines()
2687 logger
.info("CCMP PN: " + str(vals
))
2689 raise Exception("Could not find all CCMP protected frames from capture")
2690 if len(set(vals
)) < len(vals
):
2691 raise Exception("Duplicate CCMP PN used")
2694 raise Exception("The second hwsim connectivity test failed")
2696 def test_ap_ft_psk_file(dev
, apdev
):
2697 """WPA2-PSK-FT AP with PSK from a file"""
2699 passphrase
= "12345678"
2701 params
= ft_params1a(ssid
=ssid
, passphrase
=passphrase
)
2702 params
['wpa_psk_file'] = 'hostapd.wpa_psk'
2703 hapd
= hostapd
.add_ap(apdev
[0], params
)
2705 dev
[1].connect(ssid
, psk
="very secret",
2706 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2707 scan_freq
="2412", wait_connect
=False)
2708 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2709 ieee80211w
="1", scan_freq
="2412")
2710 dev
[0].request("REMOVE_NETWORK all")
2711 dev
[0].wait_disconnected()
2712 dev
[0].connect(ssid
, psk
="very secret", key_mgmt
="FT-PSK", proto
="WPA2",
2713 ieee80211w
="1", scan_freq
="2412")
2714 dev
[0].request("REMOVE_NETWORK all")
2715 dev
[0].wait_disconnected()
2716 dev
[0].connect(ssid
, psk
="secret passphrase",
2717 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2719 dev
[2].connect(ssid
, psk
="another passphrase for all STAs",
2720 key_mgmt
="FT-PSK", proto
="WPA2", ieee80211w
="1",
2722 ev
= dev
[1].wait_event(["WPA: 4-Way Handshake failed"], timeout
=10)
2724 raise Exception("Timed out while waiting for failure report")
2725 dev
[1].request("REMOVE_NETWORK all")
2727 def test_ap_ft_eap_ap_config_change(dev
, apdev
):
2728 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2730 passphrase
= "12345678"
2731 bssid
= apdev
[0]['bssid']
2733 radius
= hostapd
.radius_params()
2734 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
, discovery
=True)
2735 params
['wpa_key_mgmt'] = "WPA-EAP"
2736 params
["ieee8021x"] = "1"
2737 params
["pmk_r1_push"] = "0"
2738 params
["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2739 params
["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2740 params
["eap_server"] = "0"
2741 params
= dict(list(radius
.items()) + list(params
.items()))
2742 hapd
= hostapd
.add_ap(apdev
[0], params
)
2744 dev
[0].connect(ssid
, key_mgmt
="FT-EAP WPA-EAP", proto
="WPA2",
2745 eap
="GPSK", identity
="gpsk user",
2746 password
="abcdefghijklmnop0123456789abcdef",
2748 dev
[0].request("DISCONNECT")
2749 dev
[0].wait_disconnected()
2750 dev
[0].dump_monitor()
2753 hapd
.set('wpa_key_mgmt', "FT-EAP")
2756 dev
[0].request("BSS_FLUSH 0")
2757 dev
[0].scan_for_bss(bssid
, 2412, force_scan
=True, only_new
=True)
2759 dev
[0].request("RECONNECT")
2760 dev
[0].wait_connected()
2762 def test_ap_ft_eap_sha384(dev
, apdev
):
2763 """WPA2-EAP-FT with SHA384"""
2765 passphrase
= "12345678"
2767 radius
= hostapd
.radius_params()
2768 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2769 params
["ieee80211w"] = "2"
2770 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2771 params
["ieee8021x"] = "1"
2772 params
= dict(list(radius
.items()) + list(params
.items()))
2773 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2774 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2775 params
["ieee80211w"] = "2"
2776 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2777 params
["ieee8021x"] = "1"
2778 params
= dict(list(radius
.items()) + list(params
.items()))
2779 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2781 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, eap
=True,
2784 def test_ap_ft_eap_sha384_reassoc(dev
, apdev
):
2785 """WPA2-EAP-FT with SHA384 using REASSOCIATE"""
2786 check_suite_b_192_capa(dev
)
2788 passphrase
= "12345678"
2790 radius
= hostapd
.radius_params()
2791 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2792 params
["ieee80211w"] = "2"
2793 params
['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2794 params
["ieee8021x"] = "1"
2795 params
= dict(list(radius
.items()) + list(params
.items()))
2796 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2797 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2798 params
["ieee80211w"] = "2"
2799 params
['wpa_key_mgmt'] = "WPA-EAP-SUITE-B-192 FT-EAP-SHA384"
2800 params
["ieee8021x"] = "1"
2801 params
= dict(list(radius
.items()) + list(params
.items()))
2802 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2804 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, eap
=True,
2805 sha384
=True, also_non_ft
=True, roam_with_reassoc
=True)
2807 def test_ap_ft_eap_sha384_over_ds(dev
, apdev
):
2808 """WPA2-EAP-FT with SHA384 over DS"""
2810 passphrase
= "12345678"
2812 radius
= hostapd
.radius_params()
2813 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2814 params
["ieee80211w"] = "2"
2815 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2816 params
["ieee8021x"] = "1"
2817 params
= dict(list(radius
.items()) + list(params
.items()))
2818 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2819 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2820 params
["ieee80211w"] = "2"
2821 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2822 params
["ieee8021x"] = "1"
2823 params
= dict(list(radius
.items()) + list(params
.items()))
2824 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2826 run_roams(dev
[0], apdev
, hapd0
, hapd1
, ssid
, passphrase
, over_ds
=True,
2827 eap
=True, sha384
=True)
2829 def test_ap_ft_roam_rrm(dev
, apdev
):
2830 """WPA2-PSK-FT AP and radio measurement request"""
2832 passphrase
= "12345678"
2834 params
= ft_params1(ssid
=ssid
, passphrase
=passphrase
)
2835 params
["rrm_beacon_report"] = "1"
2836 hapd0
= hostapd
.add_ap(apdev
[0], params
)
2837 bssid0
= hapd0
.own_addr()
2839 addr
= dev
[0].own_addr()
2840 dev
[0].connect(ssid
, psk
=passphrase
, key_mgmt
="FT-PSK", proto
="WPA2",
2842 check_beacon_req(hapd0
, addr
, 1)
2844 params
= ft_params2(ssid
=ssid
, passphrase
=passphrase
)
2845 params
["rrm_beacon_report"] = "1"
2846 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2847 bssid1
= hapd1
.own_addr()
2849 dev
[0].scan_for_bss(bssid1
, freq
=2412)
2851 check_beacon_req(hapd1
, addr
, 2)
2853 dev
[0].scan_for_bss(bssid0
, freq
=2412)
2855 check_beacon_req(hapd0
, addr
, 3)
2857 def test_ap_ft_pmksa_caching(dev
, apdev
):
2858 """FT-EAP and PMKSA caching for initial mobility domain association"""
2860 identity
= "gpsk user"
2862 radius
= hostapd
.radius_params()
2863 params
= ft_params1(ssid
=ssid
)
2864 params
['wpa_key_mgmt'] = "FT-EAP"
2865 params
["ieee8021x"] = "1"
2866 params
["mobility_domain"] = "c3d4"
2867 params
= dict(list(radius
.items()) + list(params
.items()))
2868 hapd
= hostapd
.add_ap(apdev
[0], params
)
2870 params
= ft_params2(ssid
=ssid
)
2871 params
['wpa_key_mgmt'] = "FT-EAP"
2872 params
["ieee8021x"] = "1"
2873 params
["mobility_domain"] = "c3d4"
2874 params
= dict(list(radius
.items()) + list(params
.items()))
2875 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2877 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, None, eap
=True,
2878 eap_identity
=identity
, pmksa_caching
=True)
2880 def test_ap_ft_pmksa_caching_sha384(dev
, apdev
):
2881 """FT-EAP-SHA384 and PMKSA caching for initial mobility domain association"""
2883 identity
= "gpsk user"
2885 radius
= hostapd
.radius_params()
2886 params
= ft_params1(ssid
=ssid
)
2887 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2888 params
["ieee8021x"] = "1"
2889 params
["mobility_domain"] = "c3d4"
2890 params
= dict(list(radius
.items()) + list(params
.items()))
2891 hapd
= hostapd
.add_ap(apdev
[0], params
)
2893 params
= ft_params2(ssid
=ssid
)
2894 params
['wpa_key_mgmt'] = "FT-EAP-SHA384"
2895 params
["ieee8021x"] = "1"
2896 params
["mobility_domain"] = "c3d4"
2897 params
= dict(list(radius
.items()) + list(params
.items()))
2898 hapd1
= hostapd
.add_ap(apdev
[1], params
)
2900 run_roams(dev
[0], apdev
, hapd
, hapd1
, ssid
, None, eap
=True,
2901 eap_identity
=identity
, pmksa_caching
=True, sha384
=True)