tests/hwsim/test_ap_ft.py

   1 # Fast BSS Transition tests
   2 # Copyright (c) 2013-2017, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 from remotehost import remote_compatible
   8 import binascii
   9 import os
  10 import time
  11 import logging
  12 logger = logging.getLogger()
  13 import struct
  14
  15 import hwsim_utils
  16 import hostapd
  17 from tshark import run_tshark
  18 from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
  19 from wlantest import Wlantest
  20 from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
  21 from test_rrm import check_beacon_req
  22
  23 def ft_base_rsn():
  24     params = { "wpa": "2",
  25                "wpa_key_mgmt": "FT-PSK",
  26                "rsn_pairwise": "CCMP" }
  27     return params
  28
  29 def ft_base_mixed():
  30     params = { "wpa": "3",
  31                "wpa_key_mgmt": "WPA-PSK FT-PSK",
  32                "wpa_pairwise": "TKIP",
  33                "rsn_pairwise": "CCMP" }
  34     return params
  35
  36 def ft_params(rsn=True, ssid=None, passphrase=None):
  37     if rsn:
  38         params = ft_base_rsn()
  39     else:
  40         params = ft_base_mixed()
  41     if ssid:
  42         params["ssid"] = ssid
  43     if passphrase:
  44         params["wpa_passphrase"] = passphrase
  45
  46     params["mobility_domain"] = "a1b2"
  47     params["r0_key_lifetime"] = "10000"
  48     params["pmk_r1_push"] = "1"
  49     params["reassociation_deadline"] = "1000"
  50     return params
  51
  52 def ft_params1a(rsn=True, ssid=None, passphrase=None):
  53     params = ft_params(rsn, ssid, passphrase)
  54     params['nas_identifier'] = "nas1.w1.fi"
  55     params['r1_key_holder'] = "000102030405"
  56     return params
  57
  58 def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
  59     params = ft_params1a(rsn, ssid, passphrase)
  60     if discovery:
  61         params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  62         params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  63     else:
  64         params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
  65                            "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
  66         params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
  67     return params
  68
  69 def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
  70     params = ft_params1a(rsn, ssid, passphrase)
  71     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
  72                        "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
  73     params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
  74     return params
  75
  76 def ft_params2a(rsn=True, ssid=None, passphrase=None):
  77     params = ft_params(rsn, ssid, passphrase)
  78     params['nas_identifier'] = "nas2.w1.fi"
  79     params['r1_key_holder'] = "000102030406"
  80     return params
  81
  82 def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
  83     params = ft_params2a(rsn, ssid, passphrase)
  84     if discovery:
  85         params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  86         params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
  87     else:
  88         params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
  89                            "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
  90         params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
  91     return params
  92
  93 def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
  94     params = ft_params2a(rsn, ssid, passphrase)
  95     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
  96                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
  97     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
  98     return params
  99
 100 def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
 101     params = ft_params(rsn, ssid, passphrase)
 102     params['nas_identifier'] = "nas1.w1.fi"
 103     params['r1_key_holder'] = "000102030405"
 104     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
 105                        "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
 106     params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
 107     return params
 108
 109 def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
 110     params = ft_params(rsn, ssid, passphrase)
 111     params['nas_identifier'] = "nas2.w1.fi"
 112     params['r1_key_holder'] = "000102030406"
 113     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
 114                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
 115     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
 116     return params
 117
 118 def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
 119     params = ft_params(rsn, ssid, passphrase)
 120     params['nas_identifier'] = "nas2.w1.fi"
 121     params['r1_key_holder'] = "000102030406"
 122     params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
 123                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
 124     params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
 125     return params
 126
 127 def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
 128               sae=False, eap=False, fail_test=False, roams=1,
 129               pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
 130               test_connectivity=True, eap_identity="gpsk user", conndev=False,
 131               force_initial_conn_to_first_ap=False, sha384=False,
 132               group_mgmt=None, ocv=None):
 133     logger.info("Connect to first AP")
 134
 135     copts = {}
 136     copts["proto"] = "WPA2"
 137     copts["ieee80211w"] = "1"
 138     copts["scan_freq"] = "2412"
 139     copts["pairwise"] = pairwise_cipher
 140     copts["group"]  = group_cipher
 141     copts["wpa_ptk_rekey"] = ptk_rekey
 142     if group_mgmt:
 143         copts["group_mgmt"] = group_mgmt
 144     if ocv:
 145         copts["ocv"] = ocv
 146     if eap:
 147         copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
 148         copts["eap"] = "GPSK"
 149         copts["identity"] = eap_identity
 150         copts["password"] = "abcdefghijklmnop0123456789abcdef"
 151     else:
 152         if sae:
 153             copts["key_mgmt"] = "FT-SAE"
 154         else:
 155             copts["key_mgmt"] = "FT-PSK"
 156         copts["psk"] = passphrase
 157     if force_initial_conn_to_first_ap:
 158         copts["bssid"] = apdev[0]['bssid']
 159     dev.connect(ssid, **copts)
 160
 161     if dev.get_status_field('bssid') == apdev[0]['bssid']:
 162         ap1 = apdev[0]
 163         ap2 = apdev[1]
 164         hapd1ap = hapd0
 165         hapd2ap = hapd1
 166     else:
 167         ap1 = apdev[1]
 168         ap2 = apdev[0]
 169         hapd1ap = hapd1
 170         hapd2ap = hapd0
 171     if test_connectivity:
 172         if conndev:
 173             hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
 174         else:
 175             hwsim_utils.test_connectivity(dev, hapd1ap)
 176
 177     dev.scan_for_bss(ap2['bssid'], freq="2412")
 178
 179     for i in range(0, roams):
 180         # Roaming artificially fast can make data test fail because the key is
 181         # set later.
 182         time.sleep(0.01)
 183         logger.info("Roam to the second AP")
 184         if over_ds:
 185             dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
 186         else:
 187             dev.roam(ap2['bssid'], fail_test=fail_test)
 188         if fail_test:
 189             return
 190         if dev.get_status_field('bssid') != ap2['bssid']:
 191             raise Exception("Did not connect to correct AP")
 192         if (i == 0 or i == roams - 1) and test_connectivity:
 193             if conndev:
 194                 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
 195             else:
 196                 hwsim_utils.test_connectivity(dev, hapd2ap)
 197
 198         # Roaming artificially fast can make data test fail because the key is
 199         # set later.
 200         time.sleep(0.01)
 201         logger.info("Roam back to the first AP")
 202         if over_ds:
 203             dev.roam_over_ds(ap1['bssid'])
 204         else:
 205             dev.roam(ap1['bssid'])
 206         if dev.get_status_field('bssid') != ap1['bssid']:
 207             raise Exception("Did not connect to correct AP")
 208         if (i == 0 or i == roams - 1) and test_connectivity:
 209             if conndev:
 210                 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
 211             else:
 212                 hwsim_utils.test_connectivity(dev, hapd1ap)
 213
 214 def test_ap_ft(dev, apdev):
 215     """WPA2-PSK-FT AP"""
 216     ssid = "test-ft"
 217     passphrase="12345678"
 218
 219     params = ft_params1(ssid=ssid, passphrase=passphrase)
 220     hapd0 = hostapd.add_ap(apdev[0], params)
 221     params = ft_params2(ssid=ssid, passphrase=passphrase)
 222     hapd1 = hostapd.add_ap(apdev[1], params)
 223
 224     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 225     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 226         raise Exception("Scan results missing RSN element info")
 227
 228 def test_ap_ft_old_key(dev, apdev):
 229     """WPA2-PSK-FT AP (old key)"""
 230     ssid = "test-ft"
 231     passphrase="12345678"
 232
 233     params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
 234     hapd0 = hostapd.add_ap(apdev[0], params)
 235     params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
 236     hapd1 = hostapd.add_ap(apdev[1], params)
 237
 238     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 239
 240 def test_ap_ft_multi_akm(dev, apdev):
 241     """WPA2-PSK-FT AP with non-FT AKMs enabled"""
 242     ssid = "test-ft"
 243     passphrase="12345678"
 244
 245     params = ft_params1(ssid=ssid, passphrase=passphrase)
 246     params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
 247     hapd0 = hostapd.add_ap(apdev[0], params)
 248     params = ft_params2(ssid=ssid, passphrase=passphrase)
 249     params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
 250     hapd1 = hostapd.add_ap(apdev[1], params)
 251
 252     Wlantest.setup(hapd0)
 253     wt = Wlantest()
 254     wt.flush()
 255     wt.add_passphrase(passphrase)
 256
 257     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 258     if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 259         raise Exception("Scan results missing RSN element info")
 260     dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
 261     dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
 262                    scan_freq="2412")
 263
 264 def test_ap_ft_local_key_gen(dev, apdev):
 265     """WPA2-PSK-FT AP with local key generation (without pull/push)"""
 266     ssid = "test-ft"
 267     passphrase="12345678"
 268
 269     params = ft_params1a(ssid=ssid, passphrase=passphrase)
 270     params['ft_psk_generate_local'] = "1";
 271     del params['pmk_r1_push']
 272     hapd0 = hostapd.add_ap(apdev[0], params)
 273     params = ft_params2a(ssid=ssid, passphrase=passphrase)
 274     params['ft_psk_generate_local'] = "1";
 275     del params['pmk_r1_push']
 276     hapd1 = hostapd.add_ap(apdev[1], params)
 277
 278     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 279     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 280         raise Exception("Scan results missing RSN element info")
 281
 282 def test_ap_ft_vlan(dev, apdev):
 283     """WPA2-PSK-FT AP with VLAN"""
 284     ssid = "test-ft"
 285     passphrase="12345678"
 286
 287     params = ft_params1(ssid=ssid, passphrase=passphrase)
 288     params['dynamic_vlan'] = "1";
 289     params['accept_mac_file'] = "hostapd.accept";
 290     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 291
 292     params = ft_params2(ssid=ssid, passphrase=passphrase)
 293     params['dynamic_vlan'] = "1";
 294     params['accept_mac_file'] = "hostapd.accept";
 295     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 296
 297     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
 298     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 299         raise Exception("Scan results missing RSN element info")
 300
 301 def test_ap_ft_vlan_disconnected(dev, apdev):
 302     """WPA2-PSK-FT AP with VLAN and local key generation"""
 303     ssid = "test-ft"
 304     passphrase="12345678"
 305
 306     params = ft_params1a(ssid=ssid, passphrase=passphrase)
 307     params['dynamic_vlan'] = "1";
 308     params['accept_mac_file'] = "hostapd.accept";
 309     params['ft_psk_generate_local'] = "1";
 310     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 311
 312     params = ft_params2a(ssid=ssid, passphrase=passphrase)
 313     params['dynamic_vlan'] = "1";
 314     params['accept_mac_file'] = "hostapd.accept";
 315     params['ft_psk_generate_local'] = "1";
 316     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 317
 318     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
 319     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 320         raise Exception("Scan results missing RSN element info")
 321
 322 def test_ap_ft_vlan_2(dev, apdev):
 323     """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
 324     ssid = "test-ft"
 325     passphrase="12345678"
 326
 327     params = ft_params1(ssid=ssid, passphrase=passphrase)
 328     params['dynamic_vlan'] = "1";
 329     params['accept_mac_file'] = "hostapd.accept";
 330     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 331
 332     params = ft_params2(ssid=ssid, passphrase=passphrase)
 333     params['dynamic_vlan'] = "1";
 334     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 335
 336     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
 337               force_initial_conn_to_first_ap=True)
 338     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 339         raise Exception("Scan results missing RSN element info")
 340
 341 def test_ap_ft_many(dev, apdev):
 342     """WPA2-PSK-FT AP multiple times"""
 343     ssid = "test-ft"
 344     passphrase="12345678"
 345
 346     params = ft_params1(ssid=ssid, passphrase=passphrase)
 347     hapd0 = hostapd.add_ap(apdev[0], params)
 348     params = ft_params2(ssid=ssid, passphrase=passphrase)
 349     hapd1 = hostapd.add_ap(apdev[1], params)
 350
 351     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
 352
 353 def test_ap_ft_many_vlan(dev, apdev):
 354     """WPA2-PSK-FT AP with VLAN multiple times"""
 355     ssid = "test-ft"
 356     passphrase="12345678"
 357
 358     params = ft_params1(ssid=ssid, passphrase=passphrase)
 359     params['dynamic_vlan'] = "1";
 360     params['accept_mac_file'] = "hostapd.accept";
 361     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 362
 363     params = ft_params2(ssid=ssid, passphrase=passphrase)
 364     params['dynamic_vlan'] = "1";
 365     params['accept_mac_file'] = "hostapd.accept";
 366     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 367
 368     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
 369               conndev="brvlan1")
 370
 371 def test_ap_ft_mixed(dev, apdev):
 372     """WPA2-PSK-FT mixed-mode AP"""
 373     ssid = "test-ft-mixed"
 374     passphrase="12345678"
 375
 376     params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
 377     hapd = hostapd.add_ap(apdev[0], params)
 378     key_mgmt = hapd.get_config()['key_mgmt']
 379     vals = key_mgmt.split(' ')
 380     if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
 381         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 382     params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
 383     hapd1 = hostapd.add_ap(apdev[1], params)
 384
 385     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
 386
 387 def test_ap_ft_pmf(dev, apdev):
 388     """WPA2-PSK-FT AP with PMF"""
 389     ssid = "test-ft"
 390     passphrase="12345678"
 391
 392     params = ft_params1(ssid=ssid, passphrase=passphrase)
 393     params["ieee80211w"] = "2"
 394     hapd0 = hostapd.add_ap(apdev[0], params)
 395     params = ft_params2(ssid=ssid, passphrase=passphrase)
 396     params["ieee80211w"] = "2"
 397     hapd1 = hostapd.add_ap(apdev[1], params)
 398
 399     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 400
 401 def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
 402     """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
 403     run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
 404
 405 def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
 406     """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
 407     run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
 408
 409 def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
 410     """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
 411     run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
 412
 413 def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
 414     """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
 415     run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
 416
 417 def run_ap_ft_pmf_bip(dev, apdev, cipher):
 418     if cipher not in dev[0].get_capability("group_mgmt"):
 419         raise HwsimSkip("Cipher %s not supported" % cipher)
 420
 421     ssid = "test-ft"
 422     passphrase="12345678"
 423
 424     params = ft_params1(ssid=ssid, passphrase=passphrase)
 425     params["ieee80211w"] = "2"
 426     params["group_mgmt_cipher"] = cipher
 427     hapd0 = hostapd.add_ap(apdev[0], params)
 428     params = ft_params2(ssid=ssid, passphrase=passphrase)
 429     params["ieee80211w"] = "2"
 430     params["group_mgmt_cipher"] = cipher
 431     hapd1 = hostapd.add_ap(apdev[1], params)
 432
 433     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
 434               group_mgmt=cipher)
 435
 436 def test_ap_ft_ocv(dev, apdev):
 437     """WPA2-PSK-FT AP with OCV"""
 438     ssid = "test-ft"
 439     passphrase="12345678"
 440
 441     params = ft_params1(ssid=ssid, passphrase=passphrase)
 442     params["ieee80211w"] = "2"
 443     params["ocv"] = "1"
 444     try:
 445         hapd0 = hostapd.add_ap(apdev[0], params)
 446     except Exception, e:
 447         if "Failed to set hostapd parameter ocv" in str(e):
 448             raise HwsimSkip("OCV not supported")
 449         raise
 450     params = ft_params2(ssid=ssid, passphrase=passphrase)
 451     params["ieee80211w"] = "2"
 452     params["ocv"] = "1"
 453     hapd1 = hostapd.add_ap(apdev[1], params)
 454
 455     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
 456
 457 def test_ap_ft_over_ds(dev, apdev):
 458     """WPA2-PSK-FT AP over DS"""
 459     ssid = "test-ft"
 460     passphrase="12345678"
 461
 462     params = ft_params1(ssid=ssid, passphrase=passphrase)
 463     hapd0 = hostapd.add_ap(apdev[0], params)
 464     params = ft_params2(ssid=ssid, passphrase=passphrase)
 465     hapd1 = hostapd.add_ap(apdev[1], params)
 466
 467     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 468     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
 469                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
 470
 471 def test_ap_ft_over_ds_ocv(dev, apdev):
 472     """WPA2-PSK-FT AP over DS"""
 473     ssid = "test-ft"
 474     passphrase="12345678"
 475
 476     params = ft_params1(ssid=ssid, passphrase=passphrase)
 477     params["ieee80211w"] = "2"
 478     params["ocv"] = "1"
 479     try:
 480         hapd0 = hostapd.add_ap(apdev[0], params)
 481     except Exception, e:
 482         if "Failed to set hostapd parameter ocv" in str(e):
 483             raise HwsimSkip("OCV not supported")
 484         raise
 485     params = ft_params2(ssid=ssid, passphrase=passphrase)
 486     params["ieee80211w"] = "2"
 487     params["ocv"] = "1"
 488     hapd1 = hostapd.add_ap(apdev[1], params)
 489
 490     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 491               ocv="1")
 492
 493 def test_ap_ft_over_ds_disabled(dev, apdev):
 494     """WPA2-PSK-FT AP over DS disabled"""
 495     ssid = "test-ft"
 496     passphrase="12345678"
 497
 498     params = ft_params1(ssid=ssid, passphrase=passphrase)
 499     params['ft_over_ds'] = '0'
 500     hapd0 = hostapd.add_ap(apdev[0], params)
 501     params = ft_params2(ssid=ssid, passphrase=passphrase)
 502     params['ft_over_ds'] = '0'
 503     hapd1 = hostapd.add_ap(apdev[1], params)
 504
 505     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 506               fail_test=True)
 507
 508 def test_ap_ft_vlan_over_ds(dev, apdev):
 509     """WPA2-PSK-FT AP over DS with VLAN"""
 510     ssid = "test-ft"
 511     passphrase="12345678"
 512
 513     params = ft_params1(ssid=ssid, passphrase=passphrase)
 514     params['dynamic_vlan'] = "1";
 515     params['accept_mac_file'] = "hostapd.accept";
 516     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 517     params = ft_params2(ssid=ssid, passphrase=passphrase)
 518     params['dynamic_vlan'] = "1";
 519     params['accept_mac_file'] = "hostapd.accept";
 520     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 521
 522     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 523               conndev="brvlan1")
 524     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
 525                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
 526
 527 def test_ap_ft_over_ds_many(dev, apdev):
 528     """WPA2-PSK-FT AP over DS multiple times"""
 529     ssid = "test-ft"
 530     passphrase="12345678"
 531
 532     params = ft_params1(ssid=ssid, passphrase=passphrase)
 533     hapd0 = hostapd.add_ap(apdev[0], params)
 534     params = ft_params2(ssid=ssid, passphrase=passphrase)
 535     hapd1 = hostapd.add_ap(apdev[1], params)
 536
 537     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 538               roams=50)
 539
 540 def test_ap_ft_vlan_over_ds_many(dev, apdev):
 541     """WPA2-PSK-FT AP over DS with VLAN multiple times"""
 542     ssid = "test-ft"
 543     passphrase="12345678"
 544
 545     params = ft_params1(ssid=ssid, passphrase=passphrase)
 546     params['dynamic_vlan'] = "1";
 547     params['accept_mac_file'] = "hostapd.accept";
 548     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 549     params = ft_params2(ssid=ssid, passphrase=passphrase)
 550     params['dynamic_vlan'] = "1";
 551     params['accept_mac_file'] = "hostapd.accept";
 552     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 553
 554     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 555               roams=50, conndev="brvlan1")
 556
 557 @remote_compatible
 558 def test_ap_ft_over_ds_unknown_target(dev, apdev):
 559     """WPA2-PSK-FT AP"""
 560     ssid = "test-ft"
 561     passphrase="12345678"
 562
 563     params = ft_params1(ssid=ssid, passphrase=passphrase)
 564     hapd0 = hostapd.add_ap(apdev[0], params)
 565
 566     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 567                    scan_freq="2412")
 568     dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
 569
 570 @remote_compatible
 571 def test_ap_ft_over_ds_unexpected(dev, apdev):
 572     """WPA2-PSK-FT AP over DS and unexpected response"""
 573     ssid = "test-ft"
 574     passphrase="12345678"
 575
 576     params = ft_params1(ssid=ssid, passphrase=passphrase)
 577     hapd0 = hostapd.add_ap(apdev[0], params)
 578     params = ft_params2(ssid=ssid, passphrase=passphrase)
 579     hapd1 = hostapd.add_ap(apdev[1], params)
 580
 581     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 582                    scan_freq="2412")
 583     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 584         ap1 = apdev[0]
 585         ap2 = apdev[1]
 586         hapd1ap = hapd0
 587         hapd2ap = hapd1
 588     else:
 589         ap1 = apdev[1]
 590         ap2 = apdev[0]
 591         hapd1ap = hapd1
 592         hapd2ap = hapd0
 593
 594     addr = dev[0].own_addr()
 595     hapd1ap.set("ext_mgmt_frame_handling", "1")
 596     logger.info("Foreign STA address")
 597     msg = {}
 598     msg['fc'] = 13 << 4
 599     msg['da'] = addr
 600     msg['sa'] = ap1['bssid']
 601     msg['bssid'] = ap1['bssid']
 602     msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
 603     hapd1ap.mgmt_tx(msg)
 604
 605     logger.info("No over-the-DS in progress")
 606     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 607     hapd1ap.mgmt_tx(msg)
 608
 609     logger.info("Non-zero status code")
 610     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
 611     hapd1ap.mgmt_tx(msg)
 612
 613     hapd1ap.dump_monitor()
 614
 615     dev[0].scan_for_bss(ap2['bssid'], freq="2412")
 616     if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
 617             raise Exception("FT_DS failed")
 618
 619     req = hapd1ap.mgmt_rx()
 620
 621     logger.info("Foreign Target AP")
 622     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 623     hapd1ap.mgmt_tx(msg)
 624
 625     addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
 626
 627     logger.info("No IEs")
 628     msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
 629     hapd1ap.mgmt_tx(msg)
 630
 631     logger.info("Invalid IEs (trigger parsing failure)")
 632     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
 633     hapd1ap.mgmt_tx(msg)
 634
 635     logger.info("Too short MDIE")
 636     msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
 637     hapd1ap.mgmt_tx(msg)
 638
 639     logger.info("Mobility domain mismatch")
 640     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
 641     hapd1ap.mgmt_tx(msg)
 642
 643     logger.info("No FTIE")
 644     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
 645     hapd1ap.mgmt_tx(msg)
 646
 647     logger.info("FTIE SNonce mismatch")
 648     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
 649     hapd1ap.mgmt_tx(msg)
 650
 651     logger.info("No R0KH-ID subelem in FTIE")
 652     snonce = binascii.hexlify(req['payload'][111:111+32])
 653     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
 654     hapd1ap.mgmt_tx(msg)
 655
 656     logger.info("No R0KH-ID subelem mismatch in FTIE")
 657     snonce = binascii.hexlify(req['payload'][111:111+32])
 658     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
 659     hapd1ap.mgmt_tx(msg)
 660
 661     logger.info("No R1KH-ID subelem in FTIE")
 662     r0khid = binascii.hexlify(req['payload'][145:145+10])
 663     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
 664     hapd1ap.mgmt_tx(msg)
 665
 666     logger.info("No RSNE")
 667     r0khid = binascii.hexlify(req['payload'][145:145+10])
 668     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
 669     hapd1ap.mgmt_tx(msg)
 670
 671 def test_ap_ft_pmf_over_ds(dev, apdev):
 672     """WPA2-PSK-FT AP over DS with PMF"""
 673     ssid = "test-ft"
 674     passphrase="12345678"
 675
 676     params = ft_params1(ssid=ssid, passphrase=passphrase)
 677     params["ieee80211w"] = "2"
 678     hapd0 = hostapd.add_ap(apdev[0], params)
 679     params = ft_params2(ssid=ssid, passphrase=passphrase)
 680     params["ieee80211w"] = "2"
 681     hapd1 = hostapd.add_ap(apdev[1], params)
 682
 683 def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
 684     """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
 685     run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
 686
 687 def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
 688     """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
 689     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
 690
 691 def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
 692     """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
 693     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
 694
 695 def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
 696     """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
 697     run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
 698
 699 def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
 700     if cipher not in dev[0].get_capability("group_mgmt"):
 701         raise HwsimSkip("Cipher %s not supported" % cipher)
 702
 703     ssid = "test-ft"
 704     passphrase="12345678"
 705
 706     params = ft_params1(ssid=ssid, passphrase=passphrase)
 707     params["ieee80211w"] = "2"
 708     params["group_mgmt_cipher"] = cipher
 709     hapd0 = hostapd.add_ap(apdev[0], params)
 710     params = ft_params2(ssid=ssid, passphrase=passphrase)
 711     params["ieee80211w"] = "2"
 712     params["group_mgmt_cipher"] = cipher
 713     hapd1 = hostapd.add_ap(apdev[1], params)
 714
 715     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 716               group_mgmt=cipher)
 717
 718 def test_ap_ft_over_ds_pull(dev, apdev):
 719     """WPA2-PSK-FT AP over DS (pull PMK)"""
 720     ssid = "test-ft"
 721     passphrase="12345678"
 722
 723     params = ft_params1(ssid=ssid, passphrase=passphrase)
 724     params["pmk_r1_push"] = "0"
 725     hapd0 = hostapd.add_ap(apdev[0], params)
 726     params = ft_params2(ssid=ssid, passphrase=passphrase)
 727     params["pmk_r1_push"] = "0"
 728     hapd1 = hostapd.add_ap(apdev[1], params)
 729
 730     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 731
 732 def test_ap_ft_over_ds_pull_old_key(dev, apdev):
 733     """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
 734     ssid = "test-ft"
 735     passphrase="12345678"
 736
 737     params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
 738     params["pmk_r1_push"] = "0"
 739     hapd0 = hostapd.add_ap(apdev[0], params)
 740     params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
 741     params["pmk_r1_push"] = "0"
 742     hapd1 = hostapd.add_ap(apdev[1], params)
 743
 744     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 745
 746 def test_ap_ft_over_ds_pull_vlan(dev, apdev):
 747     """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
 748     ssid = "test-ft"
 749     passphrase="12345678"
 750
 751     params = ft_params1(ssid=ssid, passphrase=passphrase)
 752     params["pmk_r1_push"] = "0"
 753     params['dynamic_vlan'] = "1";
 754     params['accept_mac_file'] = "hostapd.accept";
 755     hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
 756     params = ft_params2(ssid=ssid, passphrase=passphrase)
 757     params["pmk_r1_push"] = "0"
 758     params['dynamic_vlan'] = "1";
 759     params['accept_mac_file'] = "hostapd.accept";
 760     hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
 761
 762     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 763               conndev="brvlan1")
 764
 765 def test_ap_ft_sae(dev, apdev):
 766     """WPA2-PSK-FT-SAE AP"""
 767     if "SAE" not in dev[0].get_capability("auth_alg"):
 768         raise HwsimSkip("SAE not supported")
 769     ssid = "test-ft"
 770     passphrase="12345678"
 771
 772     params = ft_params1(ssid=ssid, passphrase=passphrase)
 773     params['wpa_key_mgmt'] = "FT-SAE"
 774     hapd0 = hostapd.add_ap(apdev[0], params)
 775     params = ft_params2(ssid=ssid, passphrase=passphrase)
 776     params['wpa_key_mgmt'] = "FT-SAE"
 777     hapd = hostapd.add_ap(apdev[1], params)
 778     key_mgmt = hapd.get_config()['key_mgmt']
 779     if key_mgmt.split(' ')[0] != "FT-SAE":
 780         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 781
 782     dev[0].request("SET sae_groups ")
 783     run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
 784
 785 def test_ap_ft_sae_over_ds(dev, apdev):
 786     """WPA2-PSK-FT-SAE AP over DS"""
 787     if "SAE" not in dev[0].get_capability("auth_alg"):
 788         raise HwsimSkip("SAE not supported")
 789     ssid = "test-ft"
 790     passphrase="12345678"
 791
 792     params = ft_params1(ssid=ssid, passphrase=passphrase)
 793     params['wpa_key_mgmt'] = "FT-SAE"
 794     hapd0 = hostapd.add_ap(apdev[0], params)
 795     params = ft_params2(ssid=ssid, passphrase=passphrase)
 796     params['wpa_key_mgmt'] = "FT-SAE"
 797     hapd1 = hostapd.add_ap(apdev[1], params)
 798
 799     dev[0].request("SET sae_groups ")
 800     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
 801               over_ds=True)
 802
 803 def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
 804                       discovery=False, roams=1):
 805     ssid = "test-ft"
 806     passphrase="12345678"
 807     if vlan:
 808         identity="gpsk-vlan1"
 809         conndev="brvlan1"
 810     elif cui:
 811         identity="gpsk-cui"
 812         conndev=False
 813     else:
 814         identity="gpsk user"
 815         conndev=False
 816
 817     radius = hostapd.radius_params()
 818     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
 819     params['wpa_key_mgmt'] = "FT-EAP"
 820     params["ieee8021x"] = "1"
 821     if vlan:
 822         params["dynamic_vlan"] = "1"
 823     params = dict(radius.items() + params.items())
 824     hapd = hostapd.add_ap(apdev[0], params)
 825     key_mgmt = hapd.get_config()['key_mgmt']
 826     if key_mgmt.split(' ')[0] != "FT-EAP":
 827         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 828     params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
 829     params['wpa_key_mgmt'] = "FT-EAP"
 830     params["ieee8021x"] = "1"
 831     if vlan:
 832         params["dynamic_vlan"] = "1"
 833     params = dict(radius.items() + params.items())
 834     hapd1 = hostapd.add_ap(apdev[1], params)
 835
 836     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
 837               over_ds=over_ds, roams=roams, eap_identity=identity,
 838               conndev=conndev)
 839     if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 840         raise Exception("Scan results missing RSN element info")
 841     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
 842                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
 843
 844     # Verify EAPOL reauthentication after FT protocol
 845     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 846         ap = hapd
 847     else:
 848         ap = hapd1
 849     ap.request("EAPOL_REAUTH " + dev[0].own_addr())
 850     ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
 851     if ev is None:
 852         raise Exception("EAP authentication did not start")
 853     ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
 854     if ev is None:
 855         raise Exception("EAP authentication did not succeed")
 856     time.sleep(0.1)
 857     if conndev:
 858         hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
 859     else:
 860         hwsim_utils.test_connectivity(dev[0], ap)
 861
 862 def test_ap_ft_eap(dev, apdev):
 863     """WPA2-EAP-FT AP"""
 864     generic_ap_ft_eap(dev, apdev)
 865
 866 def test_ap_ft_eap_cui(dev, apdev):
 867     """WPA2-EAP-FT AP with CUI"""
 868     generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
 869
 870 def test_ap_ft_eap_vlan(dev, apdev):
 871     """WPA2-EAP-FT AP with VLAN"""
 872     generic_ap_ft_eap(dev, apdev, vlan=True)
 873
 874 def test_ap_ft_eap_vlan_multi(dev, apdev):
 875     """WPA2-EAP-FT AP with VLAN"""
 876     generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
 877
 878 def test_ap_ft_eap_over_ds(dev, apdev):
 879     """WPA2-EAP-FT AP using over-the-DS"""
 880     generic_ap_ft_eap(dev, apdev, over_ds=True)
 881
 882 def test_ap_ft_eap_dis(dev, apdev):
 883     """WPA2-EAP-FT AP with AP discovery"""
 884     generic_ap_ft_eap(dev, apdev, discovery=True)
 885
 886 def test_ap_ft_eap_dis_over_ds(dev, apdev):
 887     """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
 888     generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
 889
 890 def test_ap_ft_eap_vlan(dev, apdev):
 891     """WPA2-EAP-FT AP with VLAN"""
 892     generic_ap_ft_eap(dev, apdev, vlan=True)
 893
 894 def test_ap_ft_eap_vlan_multi(dev, apdev):
 895     """WPA2-EAP-FT AP with VLAN"""
 896     generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
 897
 898 def test_ap_ft_eap_vlan_over_ds(dev, apdev):
 899     """WPA2-EAP-FT AP with VLAN + over_ds"""
 900     generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
 901
 902 def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
 903     """WPA2-EAP-FT AP with VLAN + over_ds"""
 904     generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
 905
 906 def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
 907     """WPA2-EAP-FT AP (pull PMK)"""
 908     ssid = "test-ft"
 909     passphrase="12345678"
 910     if vlan:
 911         identity="gpsk-vlan1"
 912         conndev="brvlan1"
 913     else:
 914         identity="gpsk user"
 915         conndev=False
 916
 917     radius = hostapd.radius_params()
 918     params = ft_params1(ssid=ssid, passphrase=passphrase)
 919     params['wpa_key_mgmt'] = "FT-EAP"
 920     params["ieee8021x"] = "1"
 921     params["pmk_r1_push"] = "0"
 922     if vlan:
 923         params["dynamic_vlan"] = "1"
 924     params = dict(radius.items() + params.items())
 925     hapd = hostapd.add_ap(apdev[0], params)
 926     key_mgmt = hapd.get_config()['key_mgmt']
 927     if key_mgmt.split(' ')[0] != "FT-EAP":
 928         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 929     params = ft_params2(ssid=ssid, passphrase=passphrase)
 930     params['wpa_key_mgmt'] = "FT-EAP"
 931     params["ieee8021x"] = "1"
 932     params["pmk_r1_push"] = "0"
 933     if vlan:
 934         params["dynamic_vlan"] = "1"
 935     params = dict(radius.items() + params.items())
 936     hapd1 = hostapd.add_ap(apdev[1], params)
 937
 938     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
 939               eap_identity=identity, conndev=conndev)
 940
 941 def test_ap_ft_eap_pull(dev, apdev):
 942     """WPA2-EAP-FT AP (pull PMK)"""
 943     generic_ap_ft_eap_pull(dev, apdev)
 944
 945 def test_ap_ft_eap_pull_vlan(dev, apdev):
 946     generic_ap_ft_eap_pull(dev, apdev, vlan=True)
 947
 948 def test_ap_ft_eap_pull_wildcard(dev, apdev):
 949     """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
 950     ssid = "test-ft"
 951     passphrase="12345678"
 952
 953     radius = hostapd.radius_params()
 954     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
 955     params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
 956     params["ieee8021x"] = "1"
 957     params["pmk_r1_push"] = "0"
 958     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 959     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 960     params["ft_psk_generate_local"] = "1"
 961     params["eap_server"] = "0"
 962     params = dict(radius.items() + params.items())
 963     hapd = hostapd.add_ap(apdev[0], params)
 964     params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
 965     params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
 966     params["ieee8021x"] = "1"
 967     params["pmk_r1_push"] = "0"
 968     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 969     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
 970     params["ft_psk_generate_local"] = "1"
 971     params["eap_server"] = "0"
 972     params = dict(radius.items() + params.items())
 973     hapd1 = hostapd.add_ap(apdev[1], params)
 974
 975     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
 976
 977 @remote_compatible
 978 def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
 979     """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
 980     ssid = "test-ft"
 981     passphrase="12345678"
 982
 983     params = ft_params1(ssid=ssid, passphrase=passphrase)
 984     params["ieee80211w"] = "2"
 985     hapd0 = hostapd.add_ap(apdev[0], params)
 986     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
 987     params["ieee80211w"] = "2"
 988     hapd1 = hostapd.add_ap(apdev[1], params)
 989
 990     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 991               fail_test=True)
 992
 993 @remote_compatible
 994 def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
 995     """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
 996     ssid = "test-ft"
 997     passphrase="12345678"
 998
 999     params = ft_params1(ssid=ssid, passphrase=passphrase)
1000     params["pmk_r1_push"] = "0"
1001     hapd0 = hostapd.add_ap(apdev[0], params)
1002     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1003     params["pmk_r1_push"] = "0"
1004     hapd1 = hostapd.add_ap(apdev[1], params)
1005
1006     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1007               fail_test=True)
1008
1009 @remote_compatible
1010 def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1011     """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1012     ssid = "test-ft"
1013     passphrase="12345678"
1014
1015     params = ft_params1(ssid=ssid, passphrase=passphrase)
1016     params["pmk_r1_push"] = "0"
1017     params["nas_identifier"] = "nas0.w1.fi"
1018     hostapd.add_ap(apdev[0], params)
1019     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1020                    scan_freq="2412")
1021
1022     params = ft_params2(ssid=ssid, passphrase=passphrase)
1023     params["pmk_r1_push"] = "0"
1024     hostapd.add_ap(apdev[1], params)
1025
1026     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1027     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1028
1029 @remote_compatible
1030 def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1031     """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1032     ssid = "test-ft"
1033     passphrase="12345678"
1034
1035     params = ft_params1(ssid=ssid, passphrase=passphrase)
1036     params["ieee80211w"] = "2"
1037     hapd0 = hostapd.add_ap(apdev[0], params)
1038     params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1039     params["ieee80211w"] = "2"
1040     hapd1 = hostapd.add_ap(apdev[1], params)
1041
1042     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1043               fail_test=True)
1044
1045 @remote_compatible
1046 def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1047     """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1048     ssid = "test-ft"
1049     passphrase="12345678"
1050
1051     params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1052     params["pmk_r1_push"] = "0"
1053     hapd0 = hostapd.add_ap(apdev[0], params)
1054     params = ft_params2(ssid=ssid, passphrase=passphrase)
1055     params["pmk_r1_push"] = "0"
1056     hapd1 = hostapd.add_ap(apdev[1], params)
1057
1058     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1059               fail_test=True)
1060
1061 def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1062     """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1063     ssid = "test-ft"
1064     passphrase="12345678"
1065
1066     radius = hostapd.radius_params()
1067     params = ft_params1(ssid=ssid, passphrase=passphrase)
1068     params["ieee80211w"] = "2";
1069     params['wpa_key_mgmt'] = "FT-EAP"
1070     params["ieee8021x"] = "1"
1071     params = dict(radius.items() + params.items())
1072     hapd0 = hostapd.add_ap(apdev[0], params)
1073     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1074     params["ieee80211w"] = "2";
1075     params['wpa_key_mgmt'] = "FT-EAP"
1076     params["ieee8021x"] = "1"
1077     params = dict(radius.items() + params.items())
1078     hapd1 = hostapd.add_ap(apdev[1], params)
1079
1080     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1081               fail_test=True, eap=True)
1082
1083 def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1084     """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1085     ssid = "test-ft"
1086     passphrase="12345678"
1087
1088     radius = hostapd.radius_params()
1089     params = ft_params1(ssid=ssid, passphrase=passphrase)
1090     params["pmk_r1_push"] = "0"
1091     params['wpa_key_mgmt'] = "FT-EAP"
1092     params["ieee8021x"] = "1"
1093     params = dict(radius.items() + params.items())
1094     hapd0 = hostapd.add_ap(apdev[0], params)
1095     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1096     params["pmk_r1_push"] = "0"
1097     params['wpa_key_mgmt'] = "FT-EAP"
1098     params["ieee8021x"] = "1"
1099     params = dict(radius.items() + params.items())
1100     hapd1 = hostapd.add_ap(apdev[1], params)
1101
1102     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1103               fail_test=True, eap=True)
1104
1105 def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1106     """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1107     ssid = "test-ft"
1108     passphrase="12345678"
1109
1110     radius = hostapd.radius_params()
1111     params = ft_params1(ssid=ssid, passphrase=passphrase)
1112     params["pmk_r1_push"] = "0"
1113     params["nas_identifier"] = "nas0.w1.fi"
1114     params['wpa_key_mgmt'] = "FT-EAP"
1115     params["ieee8021x"] = "1"
1116     params = dict(radius.items() + params.items())
1117     hostapd.add_ap(apdev[0], params)
1118     dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1119                    eap="GPSK", identity="gpsk user",
1120                    password="abcdefghijklmnop0123456789abcdef",
1121                    scan_freq="2412")
1122
1123     params = ft_params2(ssid=ssid, passphrase=passphrase)
1124     params["pmk_r1_push"] = "0"
1125     params['wpa_key_mgmt'] = "FT-EAP"
1126     params["ieee8021x"] = "1"
1127     params = dict(radius.items() + params.items())
1128     hostapd.add_ap(apdev[1], params)
1129
1130     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1131     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1132
1133 def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1134     """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1135     ssid = "test-ft"
1136     passphrase="12345678"
1137
1138     radius = hostapd.radius_params()
1139     params = ft_params1(ssid=ssid, passphrase=passphrase)
1140     params["ieee80211w"] = "2";
1141     params['wpa_key_mgmt'] = "FT-EAP"
1142     params["ieee8021x"] = "1"
1143     params = dict(radius.items() + params.items())
1144     hapd0 = hostapd.add_ap(apdev[0], params)
1145     params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1146     params["ieee80211w"] = "2";
1147     params['wpa_key_mgmt'] = "FT-EAP"
1148     params["ieee8021x"] = "1"
1149     params = dict(radius.items() + params.items())
1150     hapd1 = hostapd.add_ap(apdev[1], params)
1151
1152     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1153               fail_test=True, eap=True)
1154
1155 def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1156     """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1157     ssid = "test-ft"
1158     passphrase="12345678"
1159
1160     radius = hostapd.radius_params()
1161     params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1162     params["pmk_r1_push"] = "0"
1163     params['wpa_key_mgmt'] = "FT-EAP"
1164     params["ieee8021x"] = "1"
1165     params = dict(radius.items() + params.items())
1166     hapd0 = hostapd.add_ap(apdev[0], params)
1167     params = ft_params2(ssid=ssid, passphrase=passphrase)
1168     params["pmk_r1_push"] = "0"
1169     params['wpa_key_mgmt'] = "FT-EAP"
1170     params["ieee8021x"] = "1"
1171     params = dict(radius.items() + params.items())
1172     hapd1 = hostapd.add_ap(apdev[1], params)
1173
1174     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1175               fail_test=True, eap=True)
1176
1177 def test_ap_ft_gtk_rekey(dev, apdev):
1178     """WPA2-PSK-FT AP and GTK rekey"""
1179     ssid = "test-ft"
1180     passphrase="12345678"
1181
1182     params = ft_params1(ssid=ssid, passphrase=passphrase)
1183     params['wpa_group_rekey'] = '1'
1184     hapd = hostapd.add_ap(apdev[0], params)
1185
1186     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1187                    ieee80211w="1", scan_freq="2412")
1188
1189     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1190     if ev is None:
1191         raise Exception("GTK rekey timed out after initial association")
1192     hwsim_utils.test_connectivity(dev[0], hapd)
1193
1194     params = ft_params2(ssid=ssid, passphrase=passphrase)
1195     params['wpa_group_rekey'] = '1'
1196     hapd1 = hostapd.add_ap(apdev[1], params)
1197
1198     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1199     dev[0].roam(apdev[1]['bssid'])
1200     if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1201         raise Exception("Did not connect to correct AP")
1202     hwsim_utils.test_connectivity(dev[0], hapd1)
1203
1204     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1205     if ev is None:
1206         raise Exception("GTK rekey timed out after FT protocol")
1207     hwsim_utils.test_connectivity(dev[0], hapd1)
1208
1209 def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1210     """WPA2-PSK-FT and key lifetime in memory"""
1211     ssid = "test-ft"
1212     passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1213     psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1214     pmk = binascii.unhexlify(psk)
1215     p = ft_params1(ssid=ssid, passphrase=passphrase)
1216     hapd0 = hostapd.add_ap(apdev[0], p)
1217     p = ft_params2(ssid=ssid, passphrase=passphrase)
1218     hapd1 = hostapd.add_ap(apdev[1], p)
1219
1220     pid = find_wpas_process(dev[0])
1221
1222     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1223                    scan_freq="2412")
1224     # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1225     # event has been delivered, so verify that wpa_supplicant has returned to
1226     # eloop before reading process memory.
1227     time.sleep(1)
1228     dev[0].ping()
1229
1230     buf = read_process_memory(pid, pmk)
1231
1232     dev[0].request("DISCONNECT")
1233     dev[0].wait_disconnected()
1234
1235     dev[0].relog()
1236     pmkr0 = None
1237     pmkr1 = None
1238     ptk = None
1239     gtk = None
1240     with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1241         for l in f.readlines():
1242             if "FT: PMK-R0 - hexdump" in l:
1243                 val = l.strip().split(':')[3].replace(' ', '')
1244                 pmkr0 = binascii.unhexlify(val)
1245             if "FT: PMK-R1 - hexdump" in l:
1246                 val = l.strip().split(':')[3].replace(' ', '')
1247                 pmkr1 = binascii.unhexlify(val)
1248             if "FT: KCK - hexdump" in l:
1249                 val = l.strip().split(':')[3].replace(' ', '')
1250                 kck = binascii.unhexlify(val)
1251             if "FT: KEK - hexdump" in l:
1252                 val = l.strip().split(':')[3].replace(' ', '')
1253                 kek = binascii.unhexlify(val)
1254             if "FT: TK - hexdump" in l:
1255                 val = l.strip().split(':')[3].replace(' ', '')
1256                 tk = binascii.unhexlify(val)
1257             if "WPA: Group Key - hexdump" in l:
1258                 val = l.strip().split(':')[3].replace(' ', '')
1259                 gtk = binascii.unhexlify(val)
1260     if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
1261         raise Exception("Could not find keys from debug log")
1262     if len(gtk) != 16:
1263         raise Exception("Unexpected GTK length")
1264
1265     logger.info("Checking keys in memory while associated")
1266     get_key_locations(buf, pmk, "PMK")
1267     get_key_locations(buf, pmkr0, "PMK-R0")
1268     get_key_locations(buf, pmkr1, "PMK-R1")
1269     if pmk not in buf:
1270         raise HwsimSkip("PMK not found while associated")
1271     if pmkr0 not in buf:
1272         raise HwsimSkip("PMK-R0 not found while associated")
1273     if pmkr1 not in buf:
1274         raise HwsimSkip("PMK-R1 not found while associated")
1275     if kck not in buf:
1276         raise Exception("KCK not found while associated")
1277     if kek not in buf:
1278         raise Exception("KEK not found while associated")
1279     #if tk in buf:
1280     #    raise Exception("TK found from memory")
1281
1282     logger.info("Checking keys in memory after disassociation")
1283     buf = read_process_memory(pid, pmk)
1284     get_key_locations(buf, pmk, "PMK")
1285     get_key_locations(buf, pmkr0, "PMK-R0")
1286     get_key_locations(buf, pmkr1, "PMK-R1")
1287
1288     # Note: PMK/PSK is still present in network configuration
1289
1290     fname = os.path.join(params['logdir'],
1291                          'ft_psk_key_lifetime_in_memory.memctx-')
1292     verify_not_present(buf, pmkr0, fname, "PMK-R0")
1293     verify_not_present(buf, pmkr1, fname, "PMK-R1")
1294     verify_not_present(buf, kck, fname, "KCK")
1295     verify_not_present(buf, kek, fname, "KEK")
1296     verify_not_present(buf, tk, fname, "TK")
1297     if gtk in buf:
1298         get_key_locations(buf, gtk, "GTK")
1299     verify_not_present(buf, gtk, fname, "GTK")
1300
1301     dev[0].request("REMOVE_NETWORK all")
1302
1303     logger.info("Checking keys in memory after network profile removal")
1304     buf = read_process_memory(pid, pmk)
1305     get_key_locations(buf, pmk, "PMK")
1306     get_key_locations(buf, pmkr0, "PMK-R0")
1307     get_key_locations(buf, pmkr1, "PMK-R1")
1308
1309     verify_not_present(buf, pmk, fname, "PMK")
1310     verify_not_present(buf, pmkr0, fname, "PMK-R0")
1311     verify_not_present(buf, pmkr1, fname, "PMK-R1")
1312     verify_not_present(buf, kck, fname, "KCK")
1313     verify_not_present(buf, kek, fname, "KEK")
1314     verify_not_present(buf, tk, fname, "TK")
1315     verify_not_present(buf, gtk, fname, "GTK")
1316
1317 @remote_compatible
1318 def test_ap_ft_invalid_resp(dev, apdev):
1319     """WPA2-PSK-FT AP and invalid response IEs"""
1320     ssid = "test-ft"
1321     passphrase="12345678"
1322
1323     params = ft_params1(ssid=ssid, passphrase=passphrase)
1324     hapd0 = hostapd.add_ap(apdev[0], params)
1325     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1326                    scan_freq="2412")
1327
1328     params = ft_params2(ssid=ssid, passphrase=passphrase)
1329     hapd1 = hostapd.add_ap(apdev[1], params)
1330
1331     tests = [
1332         # Various IEs for test coverage. The last one is FTIE with invalid
1333         # R1KH-ID subelement.
1334         "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1335         # FTIE with invalid R0KH-ID subelement (len=0).
1336         "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1337         # FTIE with invalid R0KH-ID subelement (len=49).
1338         "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1339         # Invalid RSNE.
1340         "020002000000" + "3000",
1341         # Required IEs missing from protected IE count.
1342         "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1343         # RIC missing from protected IE count.
1344         "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1345         # Protected IE missing.
1346         "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1347     for t in tests:
1348         dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1349         hapd1.set("ext_mgmt_frame_handling", "1")
1350         hapd1.dump_monitor()
1351         if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1352             raise Exception("ROAM failed")
1353         auth = None
1354         for i in range(20):
1355             msg = hapd1.mgmt_rx()
1356             if msg['subtype'] == 11:
1357                 auth = msg
1358                 break
1359         if not auth:
1360             raise Exception("Authentication frame not seen")
1361
1362         resp = {}
1363         resp['fc'] = auth['fc']
1364         resp['da'] = auth['sa']
1365         resp['sa'] = auth['da']
1366         resp['bssid'] = auth['bssid']
1367         resp['payload'] = binascii.unhexlify(t)
1368         hapd1.mgmt_tx(resp)
1369         hapd1.set("ext_mgmt_frame_handling", "0")
1370         dev[0].wait_disconnected()
1371
1372         dev[0].request("RECONNECT")
1373         dev[0].wait_connected()
1374
1375 def test_ap_ft_gcmp_256(dev, apdev):
1376     """WPA2-PSK-FT AP with GCMP-256 cipher"""
1377     if "GCMP-256" not in dev[0].get_capability("pairwise"):
1378         raise HwsimSkip("Cipher GCMP-256 not supported")
1379     ssid = "test-ft"
1380     passphrase="12345678"
1381
1382     params = ft_params1(ssid=ssid, passphrase=passphrase)
1383     params['rsn_pairwise'] = "GCMP-256"
1384     hapd0 = hostapd.add_ap(apdev[0], params)
1385     params = ft_params2(ssid=ssid, passphrase=passphrase)
1386     params['rsn_pairwise'] = "GCMP-256"
1387     hapd1 = hostapd.add_ap(apdev[1], params)
1388
1389     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1390               pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
1391
1392 def test_ap_ft_oom(dev, apdev):
1393     """WPA2-PSK-FT and OOM"""
1394     skip_with_fips(dev[0])
1395     ssid = "test-ft"
1396     passphrase="12345678"
1397
1398     params = ft_params1(ssid=ssid, passphrase=passphrase)
1399     hapd0 = hostapd.add_ap(apdev[0], params)
1400     params = ft_params2(ssid=ssid, passphrase=passphrase)
1401     hapd1 = hostapd.add_ap(apdev[1], params)
1402
1403     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1404                    scan_freq="2412")
1405     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1406         dst = apdev[1]['bssid']
1407     else:
1408         dst = apdev[0]['bssid']
1409
1410     dev[0].scan_for_bss(dst, freq="2412")
1411     with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1412         dev[0].roam(dst)
1413     with fail_test(dev[0], 1, "wpa_ft_mic"):
1414         dev[0].roam(dst, fail_test=True)
1415     with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
1416         dev[0].roam(dst, fail_test=True)
1417
1418     dev[0].request("REMOVE_NETWORK all")
1419     with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1420         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1421                        scan_freq="2412")
1422
1423 def test_ap_ft_ap_oom(dev, apdev):
1424     """WPA2-PSK-FT and AP OOM"""
1425     ssid = "test-ft"
1426     passphrase="12345678"
1427
1428     params = ft_params1(ssid=ssid, passphrase=passphrase)
1429     hapd0 = hostapd.add_ap(apdev[0], params)
1430     bssid0 = hapd0.own_addr()
1431
1432     dev[0].scan_for_bss(bssid0, freq="2412")
1433     with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1434         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1435                        scan_freq="2412")
1436
1437     params = ft_params2(ssid=ssid, passphrase=passphrase)
1438     hapd1 = hostapd.add_ap(apdev[1], params)
1439     bssid1 = hapd1.own_addr()
1440     dev[0].scan_for_bss(bssid1, freq="2412")
1441     # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1442     dev[0].roam(bssid1)
1443
1444 def test_ap_ft_ap_oom2(dev, apdev):
1445     """WPA2-PSK-FT and AP OOM 2"""
1446     ssid = "test-ft"
1447     passphrase="12345678"
1448
1449     params = ft_params1(ssid=ssid, passphrase=passphrase)
1450     hapd0 = hostapd.add_ap(apdev[0], params)
1451     bssid0 = hapd0.own_addr()
1452
1453     dev[0].scan_for_bss(bssid0, freq="2412")
1454     with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1455         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1456                        scan_freq="2412")
1457
1458     params = ft_params2(ssid=ssid, passphrase=passphrase)
1459     hapd1 = hostapd.add_ap(apdev[1], params)
1460     bssid1 = hapd1.own_addr()
1461     dev[0].scan_for_bss(bssid1, freq="2412")
1462     dev[0].roam(bssid1)
1463     if dev[0].get_status_field('bssid') != bssid1:
1464         raise Exception("Did not roam to AP1")
1465     # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1466     dev[0].roam(bssid0)
1467
1468 def test_ap_ft_ap_oom3(dev, apdev):
1469     """WPA2-PSK-FT and AP OOM 3"""
1470     ssid = "test-ft"
1471     passphrase="12345678"
1472
1473     params = ft_params1(ssid=ssid, passphrase=passphrase)
1474     hapd0 = hostapd.add_ap(apdev[0], params)
1475     bssid0 = hapd0.own_addr()
1476
1477     dev[0].scan_for_bss(bssid0, freq="2412")
1478     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1479                    scan_freq="2412")
1480
1481     params = ft_params2(ssid=ssid, passphrase=passphrase)
1482     hapd1 = hostapd.add_ap(apdev[1], params)
1483     bssid1 = hapd1.own_addr()
1484     dev[0].scan_for_bss(bssid1, freq="2412")
1485     with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1486         # This will fail due to not being able to send out PMK-R1 pull request
1487         dev[0].roam(bssid1)
1488
1489     with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
1490         # This will fail due to not being able to send out PMK-R1 pull request
1491         dev[0].roam(bssid1)
1492
1493     with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1494         # This will fail due to not being able to send out PMK-R1 pull request
1495         dev[0].roam(bssid1)
1496
1497 def test_ap_ft_ap_oom3b(dev, apdev):
1498     """WPA2-PSK-FT and AP OOM 3b"""
1499     ssid = "test-ft"
1500     passphrase="12345678"
1501
1502     params = ft_params1(ssid=ssid, passphrase=passphrase)
1503     hapd0 = hostapd.add_ap(apdev[0], params)
1504     bssid0 = hapd0.own_addr()
1505
1506     dev[0].scan_for_bss(bssid0, freq="2412")
1507     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1508                    scan_freq="2412")
1509
1510     params = ft_params2(ssid=ssid, passphrase=passphrase)
1511     hapd1 = hostapd.add_ap(apdev[1], params)
1512     bssid1 = hapd1.own_addr()
1513     dev[0].scan_for_bss(bssid1, freq="2412")
1514     with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
1515         # This will fail due to not being able to send out PMK-R1 pull request
1516         dev[0].roam(bssid1)
1517
1518 def test_ap_ft_ap_oom4(dev, apdev):
1519     """WPA2-PSK-FT and AP OOM 4"""
1520     ssid = "test-ft"
1521     passphrase="12345678"
1522
1523     params = ft_params1(ssid=ssid, passphrase=passphrase)
1524     hapd0 = hostapd.add_ap(apdev[0], params)
1525     bssid0 = hapd0.own_addr()
1526
1527     dev[0].scan_for_bss(bssid0, freq="2412")
1528     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1529                    scan_freq="2412")
1530
1531     params = ft_params2(ssid=ssid, passphrase=passphrase)
1532     hapd1 = hostapd.add_ap(apdev[1], params)
1533     bssid1 = hapd1.own_addr()
1534     dev[0].scan_for_bss(bssid1, freq="2412")
1535     with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1536         dev[0].roam(bssid1)
1537         if dev[0].get_status_field('bssid') != bssid1:
1538             raise Exception("Did not roam to AP1")
1539
1540     with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1541         dev[0].roam(bssid0)
1542         if dev[0].get_status_field('bssid') != bssid0:
1543             raise Exception("Did not roam to AP0")
1544
1545     with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1546         dev[0].roam(bssid1)
1547         if dev[0].get_status_field('bssid') != bssid1:
1548             raise Exception("Did not roam to AP1")
1549
1550 def test_ap_ft_ap_oom5(dev, apdev):
1551     """WPA2-PSK-FT and AP OOM 5"""
1552     ssid = "test-ft"
1553     passphrase="12345678"
1554
1555     params = ft_params1(ssid=ssid, passphrase=passphrase)
1556     hapd0 = hostapd.add_ap(apdev[0], params)
1557     bssid0 = hapd0.own_addr()
1558
1559     dev[0].scan_for_bss(bssid0, freq="2412")
1560     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1561                    scan_freq="2412")
1562
1563     params = ft_params2(ssid=ssid, passphrase=passphrase)
1564     hapd1 = hostapd.add_ap(apdev[1], params)
1565     bssid1 = hapd1.own_addr()
1566     dev[0].scan_for_bss(bssid1, freq="2412")
1567     with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1568         # This will fail to roam
1569         dev[0].roam(bssid1)
1570
1571     with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1572         # This will fail to roam
1573         dev[0].roam(bssid1)
1574
1575     with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1576         # This will fail to roam
1577         dev[0].roam(bssid1)
1578
1579     with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1580         # This will fail to roam
1581         dev[0].roam(bssid1)
1582
1583     with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1584         # This will fail to roam
1585         dev[0].roam(bssid1)
1586
1587 def test_ap_ft_ap_oom6(dev, apdev):
1588     """WPA2-PSK-FT and AP OOM 6"""
1589     ssid = "test-ft"
1590     passphrase="12345678"
1591
1592     params = ft_params1(ssid=ssid, passphrase=passphrase)
1593     hapd0 = hostapd.add_ap(apdev[0], params)
1594     bssid0 = hapd0.own_addr()
1595
1596     dev[0].scan_for_bss(bssid0, freq="2412")
1597     with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1598         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1599                        scan_freq="2412")
1600     dev[0].request("REMOVE_NETWORK all")
1601     dev[0].wait_disconnected()
1602     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1603         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1604                        scan_freq="2412")
1605     dev[0].request("REMOVE_NETWORK all")
1606     dev[0].wait_disconnected()
1607     with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1608         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1609                        scan_freq="2412")
1610
1611 def test_ap_ft_ap_oom7a(dev, apdev):
1612     """WPA2-PSK-FT and AP OOM 7a"""
1613     ssid = "test-ft"
1614     passphrase="12345678"
1615
1616     params = ft_params1(ssid=ssid, passphrase=passphrase)
1617     params["ieee80211w"] = "2"
1618     hapd0 = hostapd.add_ap(apdev[0], params)
1619     bssid0 = hapd0.own_addr()
1620
1621     dev[0].scan_for_bss(bssid0, freq="2412")
1622     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1623                    ieee80211w="2", scan_freq="2412")
1624
1625     params = ft_params2(ssid=ssid, passphrase=passphrase)
1626     params["ieee80211w"] = "2"
1627     hapd1 = hostapd.add_ap(apdev[1], params)
1628     bssid1 = hapd1.own_addr()
1629     dev[0].scan_for_bss(bssid1, freq="2412")
1630     with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1631         # This will fail to roam
1632         dev[0].roam(bssid1)
1633
1634 def test_ap_ft_ap_oom7b(dev, apdev):
1635     """WPA2-PSK-FT and AP OOM 7b"""
1636     ssid = "test-ft"
1637     passphrase="12345678"
1638
1639     params = ft_params1(ssid=ssid, passphrase=passphrase)
1640     params["ieee80211w"] = "2"
1641     hapd0 = hostapd.add_ap(apdev[0], params)
1642     bssid0 = hapd0.own_addr()
1643
1644     dev[0].scan_for_bss(bssid0, freq="2412")
1645     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1646                    ieee80211w="2", scan_freq="2412")
1647
1648     params = ft_params2(ssid=ssid, passphrase=passphrase)
1649     params["ieee80211w"] = "2"
1650     hapd1 = hostapd.add_ap(apdev[1], params)
1651     bssid1 = hapd1.own_addr()
1652     dev[0].scan_for_bss(bssid1, freq="2412")
1653     with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1654         # This will fail to roam
1655         dev[0].roam(bssid1)
1656
1657 def test_ap_ft_ap_oom7c(dev, apdev):
1658     """WPA2-PSK-FT and AP OOM 7c"""
1659     ssid = "test-ft"
1660     passphrase="12345678"
1661
1662     params = ft_params1(ssid=ssid, passphrase=passphrase)
1663     params["ieee80211w"] = "2"
1664     hapd0 = hostapd.add_ap(apdev[0], params)
1665     bssid0 = hapd0.own_addr()
1666
1667     dev[0].scan_for_bss(bssid0, freq="2412")
1668     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1669                    ieee80211w="2", scan_freq="2412")
1670
1671     params = ft_params2(ssid=ssid, passphrase=passphrase)
1672     params["ieee80211w"] = "2"
1673     hapd1 = hostapd.add_ap(apdev[1], params)
1674     bssid1 = hapd1.own_addr()
1675     dev[0].scan_for_bss(bssid1, freq="2412")
1676     with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1677         # This will fail to roam
1678         dev[0].roam(bssid1)
1679
1680 def test_ap_ft_ap_oom7d(dev, apdev):
1681     """WPA2-PSK-FT and AP OOM 7d"""
1682     ssid = "test-ft"
1683     passphrase="12345678"
1684
1685     params = ft_params1(ssid=ssid, passphrase=passphrase)
1686     params["ieee80211w"] = "2"
1687     hapd0 = hostapd.add_ap(apdev[0], params)
1688     bssid0 = hapd0.own_addr()
1689
1690     dev[0].scan_for_bss(bssid0, freq="2412")
1691     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1692                    ieee80211w="2", scan_freq="2412")
1693
1694     params = ft_params2(ssid=ssid, passphrase=passphrase)
1695     params["ieee80211w"] = "2"
1696     hapd1 = hostapd.add_ap(apdev[1], params)
1697     bssid1 = hapd1.own_addr()
1698     dev[0].scan_for_bss(bssid1, freq="2412")
1699     with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1700         # This will fail to roam
1701         dev[0].roam(bssid1)
1702
1703 def test_ap_ft_ap_oom8(dev, apdev):
1704     """WPA2-PSK-FT and AP OOM 8"""
1705     ssid = "test-ft"
1706     passphrase="12345678"
1707
1708     params = ft_params1(ssid=ssid, passphrase=passphrase)
1709     params['ft_psk_generate_local'] = "1";
1710     hapd0 = hostapd.add_ap(apdev[0], params)
1711     bssid0 = hapd0.own_addr()
1712
1713     dev[0].scan_for_bss(bssid0, freq="2412")
1714     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1715                    scan_freq="2412")
1716
1717     params = ft_params2(ssid=ssid, passphrase=passphrase)
1718     params['ft_psk_generate_local'] = "1";
1719     hapd1 = hostapd.add_ap(apdev[1], params)
1720     bssid1 = hapd1.own_addr()
1721     dev[0].scan_for_bss(bssid1, freq="2412")
1722     with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1723         # This will fail to roam
1724         dev[0].roam(bssid1)
1725     with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1726         # This will fail to roam
1727         dev[0].roam(bssid1)
1728
1729 def test_ap_ft_ap_oom9(dev, apdev):
1730     """WPA2-PSK-FT and AP OOM 9"""
1731     ssid = "test-ft"
1732     passphrase="12345678"
1733
1734     params = ft_params1(ssid=ssid, passphrase=passphrase)
1735     hapd0 = hostapd.add_ap(apdev[0], params)
1736     bssid0 = hapd0.own_addr()
1737
1738     dev[0].scan_for_bss(bssid0, freq="2412")
1739     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1740                    scan_freq="2412")
1741
1742     params = ft_params2(ssid=ssid, passphrase=passphrase)
1743     hapd1 = hostapd.add_ap(apdev[1], params)
1744     bssid1 = hapd1.own_addr()
1745     dev[0].scan_for_bss(bssid1, freq="2412")
1746
1747     with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1748         # This will fail to roam
1749         if "OK" not in dev[0].request("FT_DS " + bssid1):
1750             raise Exception("FT_DS failed")
1751         wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1752
1753     with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1754         # This will fail to roam
1755         if "OK" not in dev[0].request("FT_DS " + bssid1):
1756             raise Exception("FT_DS failed")
1757         wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1758
1759     with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1760         # This will fail to roam
1761         if "OK" not in dev[0].request("FT_DS " + bssid1):
1762             raise Exception("FT_DS failed")
1763         wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1764
1765 def test_ap_ft_ap_oom10(dev, apdev):
1766     """WPA2-PSK-FT and AP OOM 10"""
1767     ssid = "test-ft"
1768     passphrase="12345678"
1769
1770     params = ft_params1(ssid=ssid, passphrase=passphrase)
1771     hapd0 = hostapd.add_ap(apdev[0], params)
1772     bssid0 = hapd0.own_addr()
1773
1774     dev[0].scan_for_bss(bssid0, freq="2412")
1775     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1776                    scan_freq="2412")
1777
1778     params = ft_params2(ssid=ssid, passphrase=passphrase)
1779     hapd1 = hostapd.add_ap(apdev[1], params)
1780     bssid1 = hapd1.own_addr()
1781     dev[0].scan_for_bss(bssid1, freq="2412")
1782
1783     with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
1784         # This will fail to roam
1785         if "OK" not in dev[0].request("FT_DS " + bssid1):
1786             raise Exception("FT_DS failed")
1787         wait_fail_trigger(hapd0, "GET_FAIL")
1788
1789     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1790         # This will fail to roam
1791         if "OK" not in dev[0].request("FT_DS " + bssid1):
1792             raise Exception("FT_DS failed")
1793         wait_fail_trigger(hapd0, "GET_FAIL")
1794
1795     with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
1796         # This will fail to roam
1797         if "OK" not in dev[0].request("FT_DS " + bssid1):
1798             raise Exception("FT_DS failed")
1799         wait_fail_trigger(hapd0, "GET_FAIL")
1800
1801     with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
1802         # This will fail to roam
1803         if "OK" not in dev[0].request("FT_DS " + bssid1):
1804             raise Exception("FT_DS failed")
1805         wait_fail_trigger(hapd1, "GET_FAIL")
1806
1807 def test_ap_ft_ap_oom11(dev, apdev):
1808     """WPA2-PSK-FT and AP OOM 11"""
1809     ssid = "test-ft"
1810     passphrase="12345678"
1811
1812     params = ft_params1(ssid=ssid, passphrase=passphrase)
1813     hapd0 = hostapd.add_ap(apdev[0], params)
1814     bssid0 = hapd0.own_addr()
1815
1816     dev[0].scan_for_bss(bssid0, freq="2412")
1817     with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1818         dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1819                        scan_freq="2412")
1820         wait_fail_trigger(hapd0, "GET_FAIL")
1821
1822     dev[1].scan_for_bss(bssid0, freq="2412")
1823     with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
1824         dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1825                        scan_freq="2412")
1826         wait_fail_trigger(hapd0, "GET_FAIL")
1827
1828 def test_ap_ft_over_ds_proto_ap(dev, apdev):
1829     """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1830     ssid = "test-ft"
1831     passphrase="12345678"
1832
1833     params = ft_params1(ssid=ssid, passphrase=passphrase)
1834     hapd0 = hostapd.add_ap(apdev[0], params)
1835     bssid0 = hapd0.own_addr()
1836     _bssid0 = bssid0.replace(':', '')
1837     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1838                    scan_freq="2412")
1839     addr = dev[0].own_addr()
1840     _addr = addr.replace(':', '')
1841
1842     params = ft_params2(ssid=ssid, passphrase=passphrase)
1843     hapd1 = hostapd.add_ap(apdev[1], params)
1844     bssid1 = hapd1.own_addr()
1845     _bssid1 = bssid1.replace(':', '')
1846
1847     hapd0.set("ext_mgmt_frame_handling", "1")
1848     hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1849     valid = "0601" + _addr + _bssid1
1850     tests = [ "0601",
1851               "0601" + _addr,
1852               "0601" + _addr + _bssid0,
1853               "0601" + _addr + "ffffffffffff",
1854               "0601" + _bssid0 + _bssid0,
1855               valid,
1856               valid + "01",
1857               valid + "3700",
1858               valid + "3600",
1859               valid + "3603ffffff",
1860               valid + "3603a1b2ff",
1861               valid + "3603a1b2ff" + "3700",
1862               valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
1863               valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
1864               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
1865               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
1866               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
1867               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1868               valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
1869               valid + "0001" ]
1870     for t in tests:
1871         hapd0.dump_monitor()
1872         if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
1873             raise Exception("MGMT_RX_PROCESS failed")
1874
1875     hapd0.set("ext_mgmt_frame_handling", "0")
1876
1877 def test_ap_ft_over_ds_proto(dev, apdev):
1878     """WPA2-PSK-FT AP over DS protocol testing"""
1879     ssid = "test-ft"
1880     passphrase="12345678"
1881
1882     params = ft_params1(ssid=ssid, passphrase=passphrase)
1883     hapd0 = hostapd.add_ap(apdev[0], params)
1884     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1885                    scan_freq="2412")
1886
1887     # FT Action Response while no FT-over-DS in progress
1888     msg = {}
1889     msg['fc'] = 13 << 4
1890     msg['da'] = dev[0].own_addr()
1891     msg['sa'] = apdev[0]['bssid']
1892     msg['bssid'] = apdev[0]['bssid']
1893     msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
1894     hapd0.mgmt_tx(msg)
1895
1896     params = ft_params2(ssid=ssid, passphrase=passphrase)
1897     hapd1 = hostapd.add_ap(apdev[1], params)
1898     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1899     hapd0.set("ext_mgmt_frame_handling", "1")
1900     hapd0.dump_monitor()
1901     dev[0].request("FT_DS " + apdev[1]['bssid'])
1902     for i in range(0, 10):
1903         req = hapd0.mgmt_rx()
1904         if req is None:
1905             raise Exception("MGMT RX wait timed out")
1906         if req['subtype'] == 13:
1907             break
1908         req = None
1909     if not req:
1910         raise Exception("FT Action frame not received")
1911
1912     # FT Action Response for unexpected Target AP
1913     msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
1914     hapd0.mgmt_tx(msg)
1915
1916     # FT Action Response without MDIE
1917     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
1918     hapd0.mgmt_tx(msg)
1919
1920     # FT Action Response without FTIE
1921     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
1922     hapd0.mgmt_tx(msg)
1923
1924     # FT Action Response with FTIE SNonce mismatch
1925     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
1926     hapd0.mgmt_tx(msg)
1927
1928 @remote_compatible
1929 def test_ap_ft_rrb(dev, apdev):
1930     """WPA2-PSK-FT RRB protocol testing"""
1931     ssid = "test-ft"
1932     passphrase="12345678"
1933
1934     params = ft_params1(ssid=ssid, passphrase=passphrase)
1935     hapd0 = hostapd.add_ap(apdev[0], params)
1936
1937     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1938                    scan_freq="2412")
1939
1940     _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
1941     _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
1942     proto = '\x89\x0d'
1943     ehdr = _dst_ll + _src_ll + proto
1944
1945     # Too short RRB frame
1946     pkt = ehdr + '\x01'
1947     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1948         raise Exception("DATA_TEST_FRAME failed")
1949
1950     # RRB discarded frame wikth unrecognized type
1951     pkt = ehdr + '\x02' + '\x02' + '\x01\x00' + _src_ll
1952     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1953         raise Exception("DATA_TEST_FRAME failed")
1954
1955     # RRB frame too short for action frame
1956     pkt = ehdr + '\x01' + '\x02' + '\x01\x00' + _src_ll
1957     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1958         raise Exception("DATA_TEST_FRAME failed")
1959
1960     # Too short RRB frame (not enough room for Action Frame body)
1961     pkt = ehdr + '\x01' + '\x02' + '\x00\x00' + _src_ll
1962     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1963         raise Exception("DATA_TEST_FRAME failed")
1964
1965     # Unexpected Action frame category
1966     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1967     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1968         raise Exception("DATA_TEST_FRAME failed")
1969
1970     # Unexpected Action in RRB Request
1971     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1972     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1973         raise Exception("DATA_TEST_FRAME failed")
1974
1975     # Target AP address in RRB Request does not match with own address
1976     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1977     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1978         raise Exception("DATA_TEST_FRAME failed")
1979
1980     # Not enough room for status code in RRB Response
1981     pkt = ehdr + '\x01' + '\x01' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1982     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1983         raise Exception("DATA_TEST_FRAME failed")
1984
1985     # RRB discarded frame with unknown packet_type
1986     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
1987     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1988         raise Exception("DATA_TEST_FRAME failed")
1989
1990     # RRB Response with non-zero status code; no STA match
1991     pkt = ehdr + '\x01' + '\x01' + '\x10\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
1992     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1993         raise Exception("DATA_TEST_FRAME failed")
1994
1995     # RRB Response with zero status code and extra data; STA match
1996     pkt = ehdr + '\x01' + '\x01' + '\x11\x00' + _src_ll + '\x06\x01' + _src_ll + '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
1997     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
1998         raise Exception("DATA_TEST_FRAME failed")
1999
2000     # Too short PMK-R1 pull
2001     pkt = ehdr + '\x01' + '\xc8' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2002     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2003         raise Exception("DATA_TEST_FRAME failed")
2004
2005     # Too short PMK-R1 resp
2006     pkt = ehdr + '\x01' + '\xc9' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2007     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2008         raise Exception("DATA_TEST_FRAME failed")
2009
2010     # Too short PMK-R1 push
2011     pkt = ehdr + '\x01' + '\xca' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
2012     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2013         raise Exception("DATA_TEST_FRAME failed")
2014
2015     # No matching R0KH address found for PMK-R0 pull response
2016     pkt = ehdr + '\x01' + '\xc9' + '\x5a\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
2017     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
2018         raise Exception("DATA_TEST_FRAME failed")
2019
2020 @remote_compatible
2021 def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2022     """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2023     bssid = apdev[0]['bssid']
2024     ssid = "test-ft"
2025     passphrase="12345678"
2026
2027     params = ft_params1(ssid=ssid, passphrase=passphrase)
2028     params["ieee80211w"] = "1"
2029     # This is the RSN element used normally by hostapd
2030     params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
2031     hapd = hostapd.add_ap(apdev[0], params)
2032     id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2033                         ieee80211w="1", scan_freq="2412",
2034                         pairwise="CCMP", group="CCMP")
2035
2036     tests = [ ('PMKIDCount field included',
2037                '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2038               ('Extra IE before RSNE',
2039                'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2040               ('PMKIDCount and Group Management Cipher suite fields included',
2041                '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2042               ('Extra octet after defined fields (future extensibility)',
2043                '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2044               ('No RSN Capabilities field (PMF disabled in practice)',
2045                '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2046     for txt,ie in tests:
2047         dev[0].request("DISCONNECT")
2048         dev[0].wait_disconnected()
2049         logger.info(txt)
2050         hapd.disable()
2051         hapd.set('own_ie_override', ie)
2052         hapd.enable()
2053         dev[0].request("BSS_FLUSH 0")
2054         dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2055         dev[0].select_network(id, freq=2412)
2056         dev[0].wait_connected()
2057
2058     dev[0].request("DISCONNECT")
2059     dev[0].wait_disconnected()
2060
2061     logger.info('Invalid RSNE causing internal hostapd error')
2062     hapd.disable()
2063     hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2064     hapd.enable()
2065     dev[0].request("BSS_FLUSH 0")
2066     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2067     dev[0].select_network(id, freq=2412)
2068     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2069     # complete.
2070     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2071     if ev is not None:
2072         raise Exception("Unexpected connection")
2073     dev[0].request("DISCONNECT")
2074
2075     logger.info('Unexpected PMKID causing internal hostapd error')
2076     hapd.disable()
2077     hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2078     hapd.enable()
2079     dev[0].request("BSS_FLUSH 0")
2080     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2081     dev[0].select_network(id, freq=2412)
2082     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2083     # complete.
2084     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2085     if ev is not None:
2086         raise Exception("Unexpected connection")
2087     dev[0].request("DISCONNECT")
2088
2089 def test_ap_ft_ptk_rekey(dev, apdev):
2090     """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2091     ssid = "test-ft"
2092     passphrase="12345678"
2093
2094     params = ft_params1(ssid=ssid, passphrase=passphrase)
2095     hapd0 = hostapd.add_ap(apdev[0], params)
2096     params = ft_params2(ssid=ssid, passphrase=passphrase)
2097     hapd1 = hostapd.add_ap(apdev[1], params)
2098
2099     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2100
2101     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2102                             "WPA: Key negotiation completed"], timeout=5)
2103     if ev is None:
2104         raise Exception("No event received after roam")
2105     if "CTRL-EVENT-DISCONNECTED" in ev:
2106         raise Exception("Unexpected disconnection after roam")
2107
2108     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2109         hapd = hapd0
2110     else:
2111         hapd = hapd1
2112     hwsim_utils.test_connectivity(dev[0], hapd)
2113
2114 def test_ap_ft_ptk_rekey_ap(dev, apdev):
2115     """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2116     ssid = "test-ft"
2117     passphrase="12345678"
2118
2119     params = ft_params1(ssid=ssid, passphrase=passphrase)
2120     params['wpa_ptk_rekey'] = '2'
2121     hapd0 = hostapd.add_ap(apdev[0], params)
2122     params = ft_params2(ssid=ssid, passphrase=passphrase)
2123     params['wpa_ptk_rekey'] = '2'
2124     hapd1 = hostapd.add_ap(apdev[1], params)
2125
2126     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2127
2128     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2129                             "WPA: Key negotiation completed"], timeout=5)
2130     if ev is None:
2131         raise Exception("No event received after roam")
2132     if "CTRL-EVENT-DISCONNECTED" in ev:
2133         raise Exception("Unexpected disconnection after roam")
2134
2135     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2136         hapd = hapd0
2137     else:
2138         hapd = hapd1
2139     hwsim_utils.test_connectivity(dev[0], hapd)
2140
2141 def test_ap_ft_internal_rrb_check(dev, apdev):
2142     """RRB internal delivery only to WPA enabled BSS"""
2143     ssid = "test-ft"
2144     passphrase="12345678"
2145
2146     radius = hostapd.radius_params()
2147     params = ft_params1(ssid=ssid, passphrase=passphrase)
2148     params['wpa_key_mgmt'] = "FT-EAP"
2149     params["ieee8021x"] = "1"
2150     params = dict(radius.items() + params.items())
2151     hapd = hostapd.add_ap(apdev[0], params)
2152     key_mgmt = hapd.get_config()['key_mgmt']
2153     if key_mgmt.split(' ')[0] != "FT-EAP":
2154         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2155
2156     hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
2157
2158     # Connect to WPA enabled AP
2159     dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2160                    eap="GPSK", identity="gpsk user",
2161                    password="abcdefghijklmnop0123456789abcdef",
2162                    scan_freq="2412")
2163
2164     # Try over_ds roaming to non-WPA-enabled AP.
2165     # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2166     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
2167
2168 def test_ap_ft_extra_ie(dev, apdev):
2169     """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2170     ssid = "test-ft"
2171     passphrase="12345678"
2172
2173     params = ft_params1(ssid=ssid, passphrase=passphrase)
2174     params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2175     hapd0 = hostapd.add_ap(apdev[0], params)
2176     dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2177                    scan_freq="2412")
2178     dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2179                    scan_freq="2412")
2180     try:
2181         # Add Mobility Domain element to test AP validation code.
2182         dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2183         dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2184                        scan_freq="2412", wait_connect=False)
2185         ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2186                                 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2187         if ev is None:
2188             raise Exception("No connection result")
2189         if "CTRL-EVENT-CONNECTED" in ev:
2190             raise Exception("Non-FT association accepted with MDE")
2191         if "status_code=43" not in ev:
2192             raise Exception("Unexpected status code: " + ev)
2193         dev[0].request("DISCONNECT")
2194     finally:
2195         dev[0].request("VENDOR_ELEM_REMOVE 13 *")
2196
2197 def test_ap_ft_ric(dev, apdev):
2198     """WPA2-PSK-FT AP and RIC"""
2199     ssid = "test-ft"
2200     passphrase="12345678"
2201
2202     params = ft_params1(ssid=ssid, passphrase=passphrase)
2203     hapd0 = hostapd.add_ap(apdev[0], params)
2204     params = ft_params2(ssid=ssid, passphrase=passphrase)
2205     hapd1 = hostapd.add_ap(apdev[1], params)
2206
2207     dev[0].set("ric_ies", "")
2208     dev[0].set("ric_ies", '""')
2209     if "FAIL" not in dev[0].request("SET ric_ies q"):
2210         raise Exception("Invalid ric_ies value accepted")
2211
2212     tests = [ "3900",
2213               "3900ff04eeeeeeee",
2214               "390400000000",
2215               "390400000000" + "390400000000",
2216               "390400000000" + "dd050050f20202",
2217               "390400000000" + "dd3d0050f2020201" + 55*"00",
2218               "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2219               "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2220     for t in tests:
2221         dev[0].set("ric_ies", t)
2222         run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2223                   test_connectivity=False)
2224         dev[0].request("REMOVE_NETWORK all")
2225         dev[0].wait_disconnected()
2226         dev[0].dump_monitor()
2227
2228 def ie_hex(ies, id):
2229     return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id])
2230
2231 def test_ap_ft_reassoc_proto(dev, apdev):
2232     """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2233     ssid = "test-ft"
2234     passphrase="12345678"
2235
2236     params = ft_params1(ssid=ssid, passphrase=passphrase)
2237     hapd0 = hostapd.add_ap(apdev[0], params)
2238     params = ft_params2(ssid=ssid, passphrase=passphrase)
2239     hapd1 = hostapd.add_ap(apdev[1], params)
2240
2241     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2242                    ieee80211w="1", scan_freq="2412")
2243     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2244         hapd1ap = hapd0
2245         hapd2ap = hapd1
2246     else:
2247         hapd1ap = hapd1
2248         hapd2ap = hapd0
2249
2250     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2251     hapd2ap.set("ext_mgmt_frame_handling", "1")
2252     dev[0].request("ROAM " + hapd2ap.own_addr())
2253
2254     while True:
2255         req = hapd2ap.mgmt_rx()
2256         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2257         if req['subtype'] == 11:
2258             break
2259
2260     while True:
2261         req = hapd2ap.mgmt_rx()
2262         if req['subtype'] == 2:
2263             break
2264         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2265
2266     # IEEE 802.11 header + fixed fields before IEs
2267     hdr = binascii.hexlify(req['frame'][0:34])
2268     ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2269     # First elements: SSID, Supported Rates, Extended Supported Rates
2270     ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2271
2272     rsne = ie_hex(ies, 48)
2273     mde = ie_hex(ies, 54)
2274     fte = ie_hex(ies, 55)
2275     tests = [ ]
2276     # RSN: Trying to use FT, but MDIE not included
2277     tests += [ rsne ]
2278     # RSN: Attempted to use unknown MDIE
2279     tests += [ rsne + "3603000000" ]
2280     # Invalid RSN pairwise cipher
2281     tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2282     # FT: No PMKID in RSNIE
2283     tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2284     # FT: Invalid FTIE
2285     tests += [ rsne + mde ]
2286     # FT: RIC IE(s) in the frame, but not included in protected IE count
2287     # FT: Failed to parse FT IEs
2288     tests += [ rsne + mde + fte + "3900" ]
2289     # FT: SNonce mismatch in FTIE
2290     tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2291     # FT: ANonce mismatch in FTIE
2292     tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2293     # FT: No R0KH-ID subelem in FTIE
2294     tests += [ rsne + mde + "3752" + fte[4:168] ]
2295     # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2296     tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2297     # FT: No R1KH-ID subelem in FTIE
2298     tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") ]
2299     # FT: Unknown R1KH-ID used in ReassocReq
2300     tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + "nas1.w1.fi".encode("hex") + "0106000000000000" ]
2301     # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2302     tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2303     # Invalid MIC in FTIE
2304     tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2305     for t in tests:
2306         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2307
2308 def test_ap_ft_reassoc_local_fail(dev, apdev):
2309     """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2310     ssid = "test-ft"
2311     passphrase="12345678"
2312
2313     params = ft_params1(ssid=ssid, passphrase=passphrase)
2314     hapd0 = hostapd.add_ap(apdev[0], params)
2315     params = ft_params2(ssid=ssid, passphrase=passphrase)
2316     hapd1 = hostapd.add_ap(apdev[1], params)
2317
2318     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2319                    ieee80211w="1", scan_freq="2412")
2320     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2321         hapd1ap = hapd0
2322         hapd2ap = hapd1
2323     else:
2324         hapd1ap = hapd1
2325         hapd2ap = hapd0
2326
2327     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2328     # FT: Failed to calculate MIC
2329     with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2330         dev[0].request("ROAM " + hapd2ap.own_addr())
2331         ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2332         dev[0].request("DISCONNECT")
2333         if ev is None:
2334             raise Exception("Association reject not seen")
2335
2336 def test_ap_ft_reassoc_replay(dev, apdev, params):
2337     """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2338     capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2339     ssid = "test-ft"
2340     passphrase="12345678"
2341
2342     params = ft_params1(ssid=ssid, passphrase=passphrase)
2343     hapd0 = hostapd.add_ap(apdev[0], params)
2344     params = ft_params2(ssid=ssid, passphrase=passphrase)
2345     hapd1 = hostapd.add_ap(apdev[1], params)
2346
2347     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2348                    scan_freq="2412")
2349     if dev[0].get_status_field('bssid') == hapd0.own_addr():
2350         hapd1ap = hapd0
2351         hapd2ap = hapd1
2352     else:
2353         hapd1ap = hapd1
2354         hapd2ap = hapd0
2355
2356     dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2357     hapd2ap.set("ext_mgmt_frame_handling", "1")
2358     dev[0].dump_monitor()
2359     if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2360         raise Exception("ROAM failed")
2361
2362     reassocreq = None
2363     count = 0
2364     while count < 100:
2365         req = hapd2ap.mgmt_rx()
2366         count += 1
2367         hapd2ap.dump_monitor()
2368         hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2369         if req['subtype'] == 2:
2370             reassocreq = req
2371             ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2372             if ev is None:
2373                 raise Exception("No TX status seen")
2374             cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2375             if "OK" not in hapd2ap.request(cmd):
2376                 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2377             break
2378     hapd2ap.set("ext_mgmt_frame_handling", "0")
2379     if reassocreq is None:
2380         raise Exception("No Reassociation Request frame seen")
2381     dev[0].wait_connected()
2382     dev[0].dump_monitor()
2383     hapd2ap.dump_monitor()
2384
2385     hwsim_utils.test_connectivity(dev[0], hapd2ap)
2386
2387     logger.info("Replay the last Reassociation Request frame")
2388     hapd2ap.dump_monitor()
2389     hapd2ap.set("ext_mgmt_frame_handling", "1")
2390     hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']))
2391     ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2392     if ev is None:
2393         raise Exception("No TX status seen")
2394     cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2395     if "OK" not in hapd2ap.request(cmd):
2396         raise Exception("MGMT_TX_STATUS_PROCESS failed")
2397     hapd2ap.set("ext_mgmt_frame_handling", "0")
2398
2399     try:
2400         hwsim_utils.test_connectivity(dev[0], hapd2ap)
2401         ok = True
2402     except:
2403         ok = False
2404
2405     ap = hapd2ap.own_addr()
2406     sta = dev[0].own_addr()
2407     filt = "wlan.fc.type == 2 && " + \
2408            "wlan.da == " + sta + " && " + \
2409            "wlan.sa == " + ap
2410     fields = [ "wlan.ccmp.extiv" ]
2411     res = run_tshark(capfile, filt, fields)
2412     vals = res.splitlines()
2413     logger.info("CCMP PN: " + str(vals))
2414     if len(vals) < 2:
2415         raise Exception("Could not find all CCMP protected frames from capture")
2416     if len(set(vals)) < len(vals):
2417         raise Exception("Duplicate CCMP PN used")
2418
2419     if not ok:
2420         raise Exception("The second hwsim connectivity test failed")
2421
2422 def test_ap_ft_psk_file(dev, apdev):
2423     """WPA2-PSK-FT AP with PSK from a file"""
2424     ssid = "test-ft"
2425     passphrase="12345678"
2426
2427     params = ft_params1a(ssid=ssid, passphrase=passphrase)
2428     params['wpa_psk_file'] = 'hostapd.wpa_psk'
2429     hapd = hostapd.add_ap(apdev[0], params)
2430
2431     dev[1].connect(ssid, psk="very secret",
2432                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2433                    scan_freq="2412", wait_connect=False)
2434     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2435                    ieee80211w="1", scan_freq="2412")
2436     dev[0].request("REMOVE_NETWORK all")
2437     dev[0].wait_disconnected()
2438     dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2439                    ieee80211w="1", scan_freq="2412")
2440     dev[0].request("REMOVE_NETWORK all")
2441     dev[0].wait_disconnected()
2442     dev[0].connect(ssid, psk="secret passphrase",
2443                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2444                    scan_freq="2412")
2445     dev[2].connect(ssid, psk="another passphrase for all STAs",
2446                    key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2447                    scan_freq="2412")
2448     ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2449     if ev is None:
2450         raise Exception("Timed out while waiting for failure report")
2451     dev[1].request("REMOVE_NETWORK all")
2452
2453 def test_ap_ft_eap_ap_config_change(dev, apdev):
2454     """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2455     ssid = "test-ft"
2456     passphrase="12345678"
2457     bssid = apdev[0]['bssid']
2458
2459     radius = hostapd.radius_params()
2460     params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2461     params['wpa_key_mgmt'] = "WPA-EAP"
2462     params["ieee8021x"] = "1"
2463     params["pmk_r1_push"] = "0"
2464     params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2465     params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2466     params["eap_server"] = "0"
2467     params = dict(radius.items() + params.items())
2468     hapd = hostapd.add_ap(apdev[0], params)
2469
2470     dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2471                    eap="GPSK", identity="gpsk user",
2472                    password="abcdefghijklmnop0123456789abcdef",
2473                    scan_freq="2412")
2474     dev[0].request("DISCONNECT")
2475     dev[0].wait_disconnected()
2476     dev[0].dump_monitor()
2477
2478     hapd.disable()
2479     hapd.set('wpa_key_mgmt', "FT-EAP")
2480     hapd.enable()
2481
2482     dev[0].request("BSS_FLUSH 0")
2483     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2484
2485     dev[0].request("RECONNECT")
2486     dev[0].wait_connected()
2487
2488 def test_ap_ft_eap_sha384(dev, apdev):
2489     """WPA2-EAP-FT with SHA384"""
2490     ssid = "test-ft"
2491     passphrase="12345678"
2492
2493     radius = hostapd.radius_params()
2494     params = ft_params1(ssid=ssid, passphrase=passphrase)
2495     params["ieee80211w"] = "2";
2496     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2497     params["ieee8021x"] = "1"
2498     params = dict(radius.items() + params.items())
2499     hapd0 = hostapd.add_ap(apdev[0], params)
2500     params = ft_params2(ssid=ssid, passphrase=passphrase)
2501     params["ieee80211w"] = "2";
2502     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2503     params["ieee8021x"] = "1"
2504     params = dict(radius.items() + params.items())
2505     hapd1 = hostapd.add_ap(apdev[1], params)
2506
2507     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2508               sha384=True)
2509
2510 def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2511     """WPA2-EAP-FT with SHA384 over DS"""
2512     ssid = "test-ft"
2513     passphrase="12345678"
2514
2515     radius = hostapd.radius_params()
2516     params = ft_params1(ssid=ssid, passphrase=passphrase)
2517     params["ieee80211w"] = "2";
2518     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2519     params["ieee8021x"] = "1"
2520     params = dict(radius.items() + params.items())
2521     hapd0 = hostapd.add_ap(apdev[0], params)
2522     params = ft_params2(ssid=ssid, passphrase=passphrase)
2523     params["ieee80211w"] = "2";
2524     params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2525     params["ieee8021x"] = "1"
2526     params = dict(radius.items() + params.items())
2527     hapd1 = hostapd.add_ap(apdev[1], params)
2528
2529     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2530               eap=True, sha384=True)
2531
2532 def test_ap_ft_roam_rrm(dev, apdev):
2533     """WPA2-PSK-FT AP and radio measurement request"""
2534     ssid = "test-ft"
2535     passphrase="12345678"
2536
2537     params = ft_params1(ssid=ssid, passphrase=passphrase)
2538     params["rrm_beacon_report"] = "1"
2539     hapd0 = hostapd.add_ap(apdev[0], params)
2540     bssid0 = hapd0.own_addr()
2541
2542     addr = dev[0].own_addr()
2543     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2544                    scan_freq="2412")
2545     check_beacon_req(hapd0, addr, 1)
2546
2547     params = ft_params2(ssid=ssid, passphrase=passphrase)
2548     params["rrm_beacon_report"] = "1"
2549     hapd1 = hostapd.add_ap(apdev[1], params)
2550     bssid1 = hapd1.own_addr()
2551
2552     dev[0].scan_for_bss(bssid1, freq=2412)
2553     dev[0].roam(bssid1)
2554     check_beacon_req(hapd1, addr, 2)
2555
2556     dev[0].scan_for_bss(bssid0, freq=2412)
2557     dev[0].roam(bssid0)
2558     check_beacon_req(hapd0, addr, 3)