tests/hwsim/test_ap_ft.py

   1 # Fast BSS Transition tests
   2 # Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 import binascii
   8 import os
   9 import time
  10 import logging
  11 logger = logging.getLogger()
  12
  13 import hwsim_utils
  14 import hostapd
  15 from utils import HwsimSkip, alloc_fail, fail_test, skip_with_fips
  16 from wlantest import Wlantest
  17 from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
  18
  19 def ft_base_rsn():
  20     params = { "wpa": "2",
  21                "wpa_key_mgmt": "FT-PSK",
  22                "rsn_pairwise": "CCMP" }
  23     return params
  24
  25 def ft_base_mixed():
  26     params = { "wpa": "3",
  27                "wpa_key_mgmt": "WPA-PSK FT-PSK",
  28                "wpa_pairwise": "TKIP",
  29                "rsn_pairwise": "CCMP" }
  30     return params
  31
  32 def ft_params(rsn=True, ssid=None, passphrase=None):
  33     if rsn:
  34         params = ft_base_rsn()
  35     else:
  36         params = ft_base_mixed()
  37     if ssid:
  38         params["ssid"] = ssid
  39     if passphrase:
  40         params["wpa_passphrase"] = passphrase
  41
  42     params["mobility_domain"] = "a1b2"
  43     params["r0_key_lifetime"] = "10000"
  44     params["pmk_r1_push"] = "1"
  45     params["reassociation_deadline"] = "1000"
  46     return params
  47
  48 def ft_params1(rsn=True, ssid=None, passphrase=None):
  49     params = ft_params(rsn, ssid, passphrase)
  50     params['nas_identifier'] = "nas1.w1.fi"
  51     params['r1_key_holder'] = "000102030405"
  52     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
  53                        "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
  54     params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
  55     return params
  56
  57 def ft_params2(rsn=True, ssid=None, passphrase=None):
  58     params = ft_params(rsn, ssid, passphrase)
  59     params['nas_identifier'] = "nas2.w1.fi"
  60     params['r1_key_holder'] = "000102030406"
  61     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
  62                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
  63     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
  64     return params
  65
  66 def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
  67     params = ft_params(rsn, ssid, passphrase)
  68     params['nas_identifier'] = "nas1.w1.fi"
  69     params['r1_key_holder'] = "000102030405"
  70     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
  71                        "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
  72     params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
  73     return params
  74
  75 def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
  76     params = ft_params(rsn, ssid, passphrase)
  77     params['nas_identifier'] = "nas2.w1.fi"
  78     params['r1_key_holder'] = "000102030406"
  79     params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1",
  80                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2" ]
  81     params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3"
  82     return params
  83
  84 def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
  85     params = ft_params(rsn, ssid, passphrase)
  86     params['nas_identifier'] = "nas2.w1.fi"
  87     params['r1_key_holder'] = "000102030406"
  88     params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
  89                        "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
  90     params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
  91     return params
  92
  93 def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
  94               sae=False, eap=False, fail_test=False, roams=1,
  95               pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0"):
  96     logger.info("Connect to first AP")
  97     if eap:
  98         dev.connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
  99                     eap="GPSK", identity="gpsk user",
 100                     password="abcdefghijklmnop0123456789abcdef",
 101                     scan_freq="2412",
 102                     pairwise=pairwise_cipher, group=group_cipher,
 103                     wpa_ptk_rekey=ptk_rekey)
 104     else:
 105         if sae:
 106             key_mgmt="FT-SAE"
 107         else:
 108             key_mgmt="FT-PSK"
 109         dev.connect(ssid, psk=passphrase, key_mgmt=key_mgmt, proto="WPA2",
 110                     ieee80211w="1", scan_freq="2412",
 111                     pairwise=pairwise_cipher, group=group_cipher,
 112                     wpa_ptk_rekey=ptk_rekey)
 113     if dev.get_status_field('bssid') == apdev[0]['bssid']:
 114         ap1 = apdev[0]
 115         ap2 = apdev[1]
 116         hapd1ap = hapd0
 117         hapd2ap = hapd1
 118     else:
 119         ap1 = apdev[1]
 120         ap2 = apdev[0]
 121         hapd1ap = hapd1
 122         hapd2ap = hapd0
 123     hwsim_utils.test_connectivity(dev, hapd1ap)
 124
 125     dev.scan_for_bss(ap2['bssid'], freq="2412")
 126
 127     for i in range(0, roams):
 128         logger.info("Roam to the second AP")
 129         if over_ds:
 130             dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
 131         else:
 132             dev.roam(ap2['bssid'], fail_test=fail_test)
 133         if fail_test:
 134             return
 135         if dev.get_status_field('bssid') != ap2['bssid']:
 136             raise Exception("Did not connect to correct AP")
 137         if i == 0 or i == roams - 1:
 138             hwsim_utils.test_connectivity(dev, hapd2ap)
 139
 140         logger.info("Roam back to the first AP")
 141         if over_ds:
 142             dev.roam_over_ds(ap1['bssid'])
 143         else:
 144             dev.roam(ap1['bssid'])
 145         if dev.get_status_field('bssid') != ap1['bssid']:
 146             raise Exception("Did not connect to correct AP")
 147         if i == 0 or i == roams - 1:
 148             hwsim_utils.test_connectivity(dev, hapd1ap)
 149
 150 def test_ap_ft(dev, apdev):
 151     """WPA2-PSK-FT AP"""
 152     ssid = "test-ft"
 153     passphrase="12345678"
 154
 155     params = ft_params1(ssid=ssid, passphrase=passphrase)
 156     hapd0 = hostapd.add_ap(apdev[0], params)
 157     params = ft_params2(ssid=ssid, passphrase=passphrase)
 158     hapd1 = hostapd.add_ap(apdev[1], params)
 159
 160     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 161     if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 162         raise Exception("Scan results missing RSN element info")
 163
 164 def test_ap_ft_many(dev, apdev):
 165     """WPA2-PSK-FT AP multiple times"""
 166     ssid = "test-ft"
 167     passphrase="12345678"
 168
 169     params = ft_params1(ssid=ssid, passphrase=passphrase)
 170     hapd0 = hostapd.add_ap(apdev[0], params)
 171     params = ft_params2(ssid=ssid, passphrase=passphrase)
 172     hapd1 = hostapd.add_ap(apdev[1], params)
 173
 174     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
 175
 176 def test_ap_ft_mixed(dev, apdev):
 177     """WPA2-PSK-FT mixed-mode AP"""
 178     ssid = "test-ft-mixed"
 179     passphrase="12345678"
 180
 181     params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
 182     hapd = hostapd.add_ap(apdev[0], params)
 183     key_mgmt = hapd.get_config()['key_mgmt']
 184     vals = key_mgmt.split(' ')
 185     if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
 186         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 187     params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
 188     hapd1 = hostapd.add_ap(apdev[1], params)
 189
 190     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
 191
 192 def test_ap_ft_pmf(dev, apdev):
 193     """WPA2-PSK-FT AP with PMF"""
 194     ssid = "test-ft"
 195     passphrase="12345678"
 196
 197     params = ft_params1(ssid=ssid, passphrase=passphrase)
 198     params["ieee80211w"] = "2";
 199     hapd0 = hostapd.add_ap(apdev[0], params)
 200     params = ft_params2(ssid=ssid, passphrase=passphrase)
 201     params["ieee80211w"] = "2";
 202     hapd1 = hostapd.add_ap(apdev[1], params)
 203
 204     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
 205
 206 def test_ap_ft_over_ds(dev, apdev):
 207     """WPA2-PSK-FT AP over DS"""
 208     ssid = "test-ft"
 209     passphrase="12345678"
 210
 211     params = ft_params1(ssid=ssid, passphrase=passphrase)
 212     hapd0 = hostapd.add_ap(apdev[0], params)
 213     params = ft_params2(ssid=ssid, passphrase=passphrase)
 214     hapd1 = hostapd.add_ap(apdev[1], params)
 215
 216     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 217     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
 218                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
 219
 220 def test_ap_ft_over_ds_many(dev, apdev):
 221     """WPA2-PSK-FT AP over DS multiple times"""
 222     ssid = "test-ft"
 223     passphrase="12345678"
 224
 225     params = ft_params1(ssid=ssid, passphrase=passphrase)
 226     hapd0 = hostapd.add_ap(apdev[0], params)
 227     params = ft_params2(ssid=ssid, passphrase=passphrase)
 228     hapd1 = hostapd.add_ap(apdev[1], params)
 229
 230     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 231               roams=50)
 232
 233 def test_ap_ft_over_ds_unknown_target(dev, apdev):
 234     """WPA2-PSK-FT AP"""
 235     ssid = "test-ft"
 236     passphrase="12345678"
 237
 238     params = ft_params1(ssid=ssid, passphrase=passphrase)
 239     hapd0 = hostapd.add_ap(apdev[0], params)
 240
 241     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 242                    scan_freq="2412")
 243     dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
 244
 245 def test_ap_ft_over_ds_unexpected(dev, apdev):
 246     """WPA2-PSK-FT AP over DS and unexpected response"""
 247     ssid = "test-ft"
 248     passphrase="12345678"
 249
 250     params = ft_params1(ssid=ssid, passphrase=passphrase)
 251     hapd0 = hostapd.add_ap(apdev[0], params)
 252     params = ft_params2(ssid=ssid, passphrase=passphrase)
 253     hapd1 = hostapd.add_ap(apdev[1], params)
 254
 255     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 256                    scan_freq="2412")
 257     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 258         ap1 = apdev[0]
 259         ap2 = apdev[1]
 260         hapd1ap = hapd0
 261         hapd2ap = hapd1
 262     else:
 263         ap1 = apdev[1]
 264         ap2 = apdev[0]
 265         hapd1ap = hapd1
 266         hapd2ap = hapd0
 267
 268     addr = dev[0].own_addr()
 269     hapd1ap.set("ext_mgmt_frame_handling", "1")
 270     logger.info("Foreign STA address")
 271     msg = {}
 272     msg['fc'] = 13 << 4
 273     msg['da'] = addr
 274     msg['sa'] = ap1['bssid']
 275     msg['bssid'] = ap1['bssid']
 276     msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
 277     hapd1ap.mgmt_tx(msg)
 278
 279     logger.info("No over-the-DS in progress")
 280     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 281     hapd1ap.mgmt_tx(msg)
 282
 283     logger.info("Non-zero status code")
 284     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
 285     hapd1ap.mgmt_tx(msg)
 286
 287     hapd1ap.dump_monitor()
 288
 289     dev[0].scan_for_bss(ap2['bssid'], freq="2412")
 290     if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
 291             raise Exception("FT_DS failed")
 292
 293     req = hapd1ap.mgmt_rx()
 294
 295     logger.info("Foreign Target AP")
 296     msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
 297     hapd1ap.mgmt_tx(msg)
 298
 299     addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
 300
 301     logger.info("No IEs")
 302     msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
 303     hapd1ap.mgmt_tx(msg)
 304
 305     logger.info("Invalid IEs (trigger parsing failure)")
 306     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
 307     hapd1ap.mgmt_tx(msg)
 308
 309     logger.info("Too short MDIE")
 310     msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
 311     hapd1ap.mgmt_tx(msg)
 312
 313     logger.info("Mobility domain mismatch")
 314     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
 315     hapd1ap.mgmt_tx(msg)
 316
 317     logger.info("No FTIE")
 318     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
 319     hapd1ap.mgmt_tx(msg)
 320
 321     logger.info("FTIE SNonce mismatch")
 322     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
 323     hapd1ap.mgmt_tx(msg)
 324
 325     logger.info("No R0KH-ID subelem in FTIE")
 326     snonce = binascii.hexlify(req['payload'][111:111+32])
 327     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
 328     hapd1ap.mgmt_tx(msg)
 329
 330     logger.info("No R0KH-ID subelem mismatch in FTIE")
 331     snonce = binascii.hexlify(req['payload'][111:111+32])
 332     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
 333     hapd1ap.mgmt_tx(msg)
 334
 335     logger.info("No R1KH-ID subelem in FTIE")
 336     r0khid = binascii.hexlify(req['payload'][145:145+10])
 337     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
 338     hapd1ap.mgmt_tx(msg)
 339
 340     logger.info("No RSNE")
 341     r0khid = binascii.hexlify(req['payload'][145:145+10])
 342     msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
 343     hapd1ap.mgmt_tx(msg)
 344
 345 def test_ap_ft_pmf_over_ds(dev, apdev):
 346     """WPA2-PSK-FT AP over DS with PMF"""
 347     ssid = "test-ft"
 348     passphrase="12345678"
 349
 350     params = ft_params1(ssid=ssid, passphrase=passphrase)
 351     params["ieee80211w"] = "2";
 352     hapd0 = hostapd.add_ap(apdev[0], params)
 353     params = ft_params2(ssid=ssid, passphrase=passphrase)
 354     params["ieee80211w"] = "2";
 355     hapd1 = hostapd.add_ap(apdev[1], params)
 356
 357     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 358
 359 def test_ap_ft_over_ds_pull(dev, apdev):
 360     """WPA2-PSK-FT AP over DS (pull PMK)"""
 361     ssid = "test-ft"
 362     passphrase="12345678"
 363
 364     params = ft_params1(ssid=ssid, passphrase=passphrase)
 365     params["pmk_r1_push"] = "0"
 366     hapd0 = hostapd.add_ap(apdev[0], params)
 367     params = ft_params2(ssid=ssid, passphrase=passphrase)
 368     params["pmk_r1_push"] = "0"
 369     hapd1 = hostapd.add_ap(apdev[1], params)
 370
 371     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
 372
 373 def test_ap_ft_sae(dev, apdev):
 374     """WPA2-PSK-FT-SAE AP"""
 375     if "SAE" not in dev[0].get_capability("auth_alg"):
 376         raise HwsimSkip("SAE not supported")
 377     ssid = "test-ft"
 378     passphrase="12345678"
 379
 380     params = ft_params1(ssid=ssid, passphrase=passphrase)
 381     params['wpa_key_mgmt'] = "FT-SAE"
 382     hapd0 = hostapd.add_ap(apdev[0], params)
 383     params = ft_params2(ssid=ssid, passphrase=passphrase)
 384     params['wpa_key_mgmt'] = "FT-SAE"
 385     hapd = hostapd.add_ap(apdev[1], params)
 386     key_mgmt = hapd.get_config()['key_mgmt']
 387     if key_mgmt.split(' ')[0] != "FT-SAE":
 388         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 389
 390     dev[0].request("SET sae_groups ")
 391     run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
 392
 393 def test_ap_ft_sae_over_ds(dev, apdev):
 394     """WPA2-PSK-FT-SAE AP over DS"""
 395     if "SAE" not in dev[0].get_capability("auth_alg"):
 396         raise HwsimSkip("SAE not supported")
 397     ssid = "test-ft"
 398     passphrase="12345678"
 399
 400     params = ft_params1(ssid=ssid, passphrase=passphrase)
 401     params['wpa_key_mgmt'] = "FT-SAE"
 402     hapd0 = hostapd.add_ap(apdev[0], params)
 403     params = ft_params2(ssid=ssid, passphrase=passphrase)
 404     params['wpa_key_mgmt'] = "FT-SAE"
 405     hapd1 = hostapd.add_ap(apdev[1], params)
 406
 407     dev[0].request("SET sae_groups ")
 408     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
 409               over_ds=True)
 410
 411 def test_ap_ft_eap(dev, apdev):
 412     """WPA2-EAP-FT AP"""
 413     ssid = "test-ft"
 414     passphrase="12345678"
 415
 416     radius = hostapd.radius_params()
 417     params = ft_params1(ssid=ssid, passphrase=passphrase)
 418     params['wpa_key_mgmt'] = "FT-EAP"
 419     params["ieee8021x"] = "1"
 420     params = dict(radius.items() + params.items())
 421     hapd = hostapd.add_ap(apdev[0], params)
 422     key_mgmt = hapd.get_config()['key_mgmt']
 423     if key_mgmt.split(' ')[0] != "FT-EAP":
 424         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 425     params = ft_params2(ssid=ssid, passphrase=passphrase)
 426     params['wpa_key_mgmt'] = "FT-EAP"
 427     params["ieee8021x"] = "1"
 428     params = dict(radius.items() + params.items())
 429     hapd1 = hostapd.add_ap(apdev[1], params)
 430
 431     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
 432     if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
 433         raise Exception("Scan results missing RSN element info")
 434     check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
 435                         ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
 436
 437     # Verify EAPOL reauthentication after FT protocol
 438     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 439         ap = hapd
 440     else:
 441         ap = hapd1
 442     ap.request("EAPOL_REAUTH " + dev[0].own_addr())
 443     ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
 444     if ev is None:
 445         raise Exception("EAP authentication did not start")
 446     ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
 447     if ev is None:
 448         raise Exception("EAP authentication did not succeed")
 449     time.sleep(0.1)
 450     hwsim_utils.test_connectivity(dev[0], ap)
 451
 452 def test_ap_ft_eap_pull(dev, apdev):
 453     """WPA2-EAP-FT AP (pull PMK)"""
 454     ssid = "test-ft"
 455     passphrase="12345678"
 456
 457     radius = hostapd.radius_params()
 458     params = ft_params1(ssid=ssid, passphrase=passphrase)
 459     params['wpa_key_mgmt'] = "FT-EAP"
 460     params["ieee8021x"] = "1"
 461     params["pmk_r1_push"] = "0"
 462     params = dict(radius.items() + params.items())
 463     hapd = hostapd.add_ap(apdev[0], params)
 464     key_mgmt = hapd.get_config()['key_mgmt']
 465     if key_mgmt.split(' ')[0] != "FT-EAP":
 466         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
 467     params = ft_params2(ssid=ssid, passphrase=passphrase)
 468     params['wpa_key_mgmt'] = "FT-EAP"
 469     params["ieee8021x"] = "1"
 470     params["pmk_r1_push"] = "0"
 471     params = dict(radius.items() + params.items())
 472     hapd1 = hostapd.add_ap(apdev[1], params)
 473
 474     run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
 475
 476 def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
 477     """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
 478     ssid = "test-ft"
 479     passphrase="12345678"
 480
 481     params = ft_params1(ssid=ssid, passphrase=passphrase)
 482     params["ieee80211w"] = "2";
 483     hapd0 = hostapd.add_ap(apdev[0], params)
 484     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
 485     params["ieee80211w"] = "2";
 486     hapd1 = hostapd.add_ap(apdev[1], params)
 487
 488     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 489               fail_test=True)
 490
 491 def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
 492     """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
 493     ssid = "test-ft"
 494     passphrase="12345678"
 495
 496     params = ft_params1(ssid=ssid, passphrase=passphrase)
 497     params["pmk_r1_push"] = "0"
 498     hapd0 = hostapd.add_ap(apdev[0], params)
 499     params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
 500     params["pmk_r1_push"] = "0"
 501     hapd1 = hostapd.add_ap(apdev[1], params)
 502
 503     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 504               fail_test=True)
 505
 506 def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
 507     """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
 508     ssid = "test-ft"
 509     passphrase="12345678"
 510
 511     params = ft_params1(ssid=ssid, passphrase=passphrase)
 512     params["pmk_r1_push"] = "0"
 513     params["nas_identifier"] = "nas0.w1.fi"
 514     hostapd.add_ap(apdev[0], params)
 515     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 516                    scan_freq="2412")
 517
 518     params = ft_params2(ssid=ssid, passphrase=passphrase)
 519     params["pmk_r1_push"] = "0"
 520     hostapd.add_ap(apdev[1], params)
 521
 522     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
 523     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
 524
 525 def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
 526     """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
 527     ssid = "test-ft"
 528     passphrase="12345678"
 529
 530     params = ft_params1(ssid=ssid, passphrase=passphrase)
 531     params["ieee80211w"] = "2";
 532     hapd0 = hostapd.add_ap(apdev[0], params)
 533     params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
 534     params["ieee80211w"] = "2";
 535     hapd1 = hostapd.add_ap(apdev[1], params)
 536
 537     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 538               fail_test=True)
 539
 540 def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
 541     """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
 542     ssid = "test-ft"
 543     passphrase="12345678"
 544
 545     params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
 546     params["pmk_r1_push"] = "0"
 547     hapd0 = hostapd.add_ap(apdev[0], params)
 548     params = ft_params2(ssid=ssid, passphrase=passphrase)
 549     params["pmk_r1_push"] = "0"
 550     hapd1 = hostapd.add_ap(apdev[1], params)
 551
 552     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
 553               fail_test=True)
 554
 555 def test_ap_ft_gtk_rekey(dev, apdev):
 556     """WPA2-PSK-FT AP and GTK rekey"""
 557     ssid = "test-ft"
 558     passphrase="12345678"
 559
 560     params = ft_params1(ssid=ssid, passphrase=passphrase)
 561     params['wpa_group_rekey'] = '1'
 562     hapd = hostapd.add_ap(apdev[0], params)
 563
 564     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 565                    ieee80211w="1", scan_freq="2412")
 566
 567     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
 568     if ev is None:
 569         raise Exception("GTK rekey timed out after initial association")
 570     hwsim_utils.test_connectivity(dev[0], hapd)
 571
 572     params = ft_params2(ssid=ssid, passphrase=passphrase)
 573     params['wpa_group_rekey'] = '1'
 574     hapd1 = hostapd.add_ap(apdev[1], params)
 575
 576     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
 577     dev[0].roam(apdev[1]['bssid'])
 578     if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
 579         raise Exception("Did not connect to correct AP")
 580     hwsim_utils.test_connectivity(dev[0], hapd1)
 581
 582     ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
 583     if ev is None:
 584         raise Exception("GTK rekey timed out after FT protocol")
 585     hwsim_utils.test_connectivity(dev[0], hapd1)
 586
 587 def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
 588     """WPA2-PSK-FT and key lifetime in memory"""
 589     ssid = "test-ft"
 590     passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
 591     psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
 592     pmk = binascii.unhexlify(psk)
 593     p = ft_params1(ssid=ssid, passphrase=passphrase)
 594     hapd0 = hostapd.add_ap(apdev[0], p)
 595     p = ft_params2(ssid=ssid, passphrase=passphrase)
 596     hapd1 = hostapd.add_ap(apdev[1], p)
 597
 598     pid = find_wpas_process(dev[0])
 599
 600     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 601                    scan_freq="2412")
 602     # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
 603     # event has been delivered, so verify that wpa_supplicant has returned to
 604     # eloop before reading process memory.
 605     time.sleep(1)
 606     dev[0].ping()
 607
 608     buf = read_process_memory(pid, pmk)
 609
 610     dev[0].request("DISCONNECT")
 611     dev[0].wait_disconnected()
 612
 613     dev[0].relog()
 614     pmkr0 = None
 615     pmkr1 = None
 616     ptk = None
 617     gtk = None
 618     with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
 619         for l in f.readlines():
 620             if "FT: PMK-R0 - hexdump" in l:
 621                 val = l.strip().split(':')[3].replace(' ', '')
 622                 pmkr0 = binascii.unhexlify(val)
 623             if "FT: PMK-R1 - hexdump" in l:
 624                 val = l.strip().split(':')[3].replace(' ', '')
 625                 pmkr1 = binascii.unhexlify(val)
 626             if "FT: KCK - hexdump" in l:
 627                 val = l.strip().split(':')[3].replace(' ', '')
 628                 kck = binascii.unhexlify(val)
 629             if "FT: KEK - hexdump" in l:
 630                 val = l.strip().split(':')[3].replace(' ', '')
 631                 kek = binascii.unhexlify(val)
 632             if "FT: TK - hexdump" in l:
 633                 val = l.strip().split(':')[3].replace(' ', '')
 634                 tk = binascii.unhexlify(val)
 635             if "WPA: Group Key - hexdump" in l:
 636                 val = l.strip().split(':')[3].replace(' ', '')
 637                 gtk = binascii.unhexlify(val)
 638     if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
 639         raise Exception("Could not find keys from debug log")
 640     if len(gtk) != 16:
 641         raise Exception("Unexpected GTK length")
 642
 643     logger.info("Checking keys in memory while associated")
 644     get_key_locations(buf, pmk, "PMK")
 645     get_key_locations(buf, pmkr0, "PMK-R0")
 646     get_key_locations(buf, pmkr1, "PMK-R1")
 647     if pmk not in buf:
 648         raise HwsimSkip("PMK not found while associated")
 649     if pmkr0 not in buf:
 650         raise HwsimSkip("PMK-R0 not found while associated")
 651     if pmkr1 not in buf:
 652         raise HwsimSkip("PMK-R1 not found while associated")
 653     if kck not in buf:
 654         raise Exception("KCK not found while associated")
 655     if kek not in buf:
 656         raise Exception("KEK not found while associated")
 657     if tk in buf:
 658         raise Exception("TK found from memory")
 659     if gtk in buf:
 660         get_key_locations(buf, gtk, "GTK")
 661         raise Exception("GTK found from memory")
 662
 663     logger.info("Checking keys in memory after disassociation")
 664     buf = read_process_memory(pid, pmk)
 665     get_key_locations(buf, pmk, "PMK")
 666     get_key_locations(buf, pmkr0, "PMK-R0")
 667     get_key_locations(buf, pmkr1, "PMK-R1")
 668
 669     # Note: PMK/PSK is still present in network configuration
 670
 671     fname = os.path.join(params['logdir'],
 672                          'ft_psk_key_lifetime_in_memory.memctx-')
 673     verify_not_present(buf, pmkr0, fname, "PMK-R0")
 674     verify_not_present(buf, pmkr1, fname, "PMK-R1")
 675     verify_not_present(buf, kck, fname, "KCK")
 676     verify_not_present(buf, kek, fname, "KEK")
 677     verify_not_present(buf, tk, fname, "TK")
 678     verify_not_present(buf, gtk, fname, "GTK")
 679
 680     dev[0].request("REMOVE_NETWORK all")
 681
 682     logger.info("Checking keys in memory after network profile removal")
 683     buf = read_process_memory(pid, pmk)
 684     get_key_locations(buf, pmk, "PMK")
 685     get_key_locations(buf, pmkr0, "PMK-R0")
 686     get_key_locations(buf, pmkr1, "PMK-R1")
 687
 688     verify_not_present(buf, pmk, fname, "PMK")
 689     verify_not_present(buf, pmkr0, fname, "PMK-R0")
 690     verify_not_present(buf, pmkr1, fname, "PMK-R1")
 691     verify_not_present(buf, kck, fname, "KCK")
 692     verify_not_present(buf, kek, fname, "KEK")
 693     verify_not_present(buf, tk, fname, "TK")
 694     verify_not_present(buf, gtk, fname, "GTK")
 695
 696 def test_ap_ft_invalid_resp(dev, apdev):
 697     """WPA2-PSK-FT AP and invalid response IEs"""
 698     ssid = "test-ft"
 699     passphrase="12345678"
 700
 701     params = ft_params1(ssid=ssid, passphrase=passphrase)
 702     hapd0 = hostapd.add_ap(apdev[0], params)
 703     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 704                    scan_freq="2412")
 705
 706     params = ft_params2(ssid=ssid, passphrase=passphrase)
 707     hapd1 = hostapd.add_ap(apdev[1], params)
 708
 709     tests = [
 710         # Various IEs for test coverage. The last one is FTIE with invalid
 711         # R1KH-ID subelement.
 712         "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
 713         # FTIE with invalid R0KH-ID subelement (len=0).
 714         "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
 715         # FTIE with invalid R0KH-ID subelement (len=49).
 716         "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
 717         # Invalid RSNE.
 718         "020002000000" + "3000",
 719         # Required IEs missing from protected IE count.
 720         "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
 721         # RIC missing from protected IE count.
 722         "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
 723         # Protected IE missing.
 724         "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
 725     for t in tests:
 726         dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
 727         hapd1.set("ext_mgmt_frame_handling", "1")
 728         hapd1.dump_monitor()
 729         if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
 730             raise Exception("ROAM failed")
 731         auth = None
 732         for i in range(20):
 733             msg = hapd1.mgmt_rx()
 734             if msg['subtype'] == 11:
 735                 auth = msg
 736                 break
 737         if not auth:
 738             raise Exception("Authentication frame not seen")
 739
 740         resp = {}
 741         resp['fc'] = auth['fc']
 742         resp['da'] = auth['sa']
 743         resp['sa'] = auth['da']
 744         resp['bssid'] = auth['bssid']
 745         resp['payload'] = binascii.unhexlify(t)
 746         hapd1.mgmt_tx(resp)
 747         hapd1.set("ext_mgmt_frame_handling", "0")
 748         dev[0].wait_disconnected()
 749
 750         dev[0].request("RECONNECT")
 751         dev[0].wait_connected()
 752
 753 def test_ap_ft_gcmp_256(dev, apdev):
 754     """WPA2-PSK-FT AP with GCMP-256 cipher"""
 755     if "GCMP-256" not in dev[0].get_capability("pairwise"):
 756         raise HwsimSkip("Cipher GCMP-256 not supported")
 757     ssid = "test-ft"
 758     passphrase="12345678"
 759
 760     params = ft_params1(ssid=ssid, passphrase=passphrase)
 761     params['rsn_pairwise'] = "GCMP-256"
 762     hapd0 = hostapd.add_ap(apdev[0], params)
 763     params = ft_params2(ssid=ssid, passphrase=passphrase)
 764     params['rsn_pairwise'] = "GCMP-256"
 765     hapd1 = hostapd.add_ap(apdev[1], params)
 766
 767     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
 768               pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
 769
 770 def test_ap_ft_oom(dev, apdev):
 771     """WPA2-PSK-FT and OOM"""
 772     skip_with_fips(dev[0])
 773     ssid = "test-ft"
 774     passphrase="12345678"
 775
 776     params = ft_params1(ssid=ssid, passphrase=passphrase)
 777     hapd0 = hostapd.add_ap(apdev[0], params)
 778     params = ft_params2(ssid=ssid, passphrase=passphrase)
 779     hapd1 = hostapd.add_ap(apdev[1], params)
 780
 781     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 782                    scan_freq="2412")
 783     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
 784         dst = apdev[1]['bssid']
 785     else:
 786         dst = apdev[0]['bssid']
 787
 788     dev[0].scan_for_bss(dst, freq="2412")
 789     with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
 790         dev[0].roam(dst)
 791     with fail_test(dev[0], 1, "wpa_ft_mic"):
 792         dev[0].roam(dst, fail_test=True)
 793     with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
 794         dev[0].roam(dst, fail_test=True)
 795
 796 def test_ap_ft_over_ds_proto(dev, apdev):
 797     """WPA2-PSK-FT AP over DS protocol testing"""
 798     ssid = "test-ft"
 799     passphrase="12345678"
 800
 801     params = ft_params1(ssid=ssid, passphrase=passphrase)
 802     hapd0 = hostapd.add_ap(apdev[0], params)
 803     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 804                    scan_freq="2412")
 805
 806     # FT Action Response while no FT-over-DS in progress
 807     msg = {}
 808     msg['fc'] = 13 << 4
 809     msg['da'] = dev[0].own_addr()
 810     msg['sa'] = apdev[0]['bssid']
 811     msg['bssid'] = apdev[0]['bssid']
 812     msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
 813     hapd0.mgmt_tx(msg)
 814
 815     params = ft_params2(ssid=ssid, passphrase=passphrase)
 816     hapd1 = hostapd.add_ap(apdev[1], params)
 817     dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
 818     hapd0.set("ext_mgmt_frame_handling", "1")
 819     hapd0.dump_monitor()
 820     dev[0].request("FT_DS " + apdev[1]['bssid'])
 821     for i in range(0, 10):
 822         req = hapd0.mgmt_rx()
 823         if req is None:
 824             raise Exception("MGMT RX wait timed out")
 825         if req['subtype'] == 13:
 826             break
 827         req = None
 828     if not req:
 829         raise Exception("FT Action frame not received")
 830
 831     # FT Action Response for unexpected Target AP
 832     msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
 833     hapd0.mgmt_tx(msg)
 834
 835     # FT Action Response without MDIE
 836     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
 837     hapd0.mgmt_tx(msg)
 838
 839     # FT Action Response without FTIE
 840     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
 841     hapd0.mgmt_tx(msg)
 842
 843     # FT Action Response with FTIE SNonce mismatch
 844     msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
 845     hapd0.mgmt_tx(msg)
 846
 847 def test_ap_ft_rrb(dev, apdev):
 848     """WPA2-PSK-FT RRB protocol testing"""
 849     ssid = "test-ft"
 850     passphrase="12345678"
 851
 852     params = ft_params1(ssid=ssid, passphrase=passphrase)
 853     hapd0 = hostapd.add_ap(apdev[0], params)
 854
 855     dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 856                    scan_freq="2412")
 857
 858     _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
 859     _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
 860     proto = '\x89\x0d'
 861     ehdr = _dst_ll + _src_ll + proto
 862
 863     # Too short RRB frame
 864     pkt = ehdr + '\x01'
 865     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 866         raise Exception("DATA_TEST_FRAME failed")
 867
 868     # RRB discarded frame wikth unrecognized type
 869     pkt = ehdr + '\x02' + '\x02' + '\x01\x00' + _src_ll
 870     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 871         raise Exception("DATA_TEST_FRAME failed")
 872
 873     # RRB frame too short for action frame
 874     pkt = ehdr + '\x01' + '\x02' + '\x01\x00' + _src_ll
 875     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 876         raise Exception("DATA_TEST_FRAME failed")
 877
 878     # Too short RRB frame (not enough room for Action Frame body)
 879     pkt = ehdr + '\x01' + '\x02' + '\x00\x00' + _src_ll
 880     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 881         raise Exception("DATA_TEST_FRAME failed")
 882
 883     # Unexpected Action frame category
 884     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 885     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 886         raise Exception("DATA_TEST_FRAME failed")
 887
 888     # Unexpected Action in RRB Request
 889     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 890     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 891         raise Exception("DATA_TEST_FRAME failed")
 892
 893     # Target AP address in RRB Request does not match with own address
 894     pkt = ehdr + '\x01' + '\x00' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 895     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 896         raise Exception("DATA_TEST_FRAME failed")
 897
 898     # Not enough room for status code in RRB Response
 899     pkt = ehdr + '\x01' + '\x01' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 900     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 901         raise Exception("DATA_TEST_FRAME failed")
 902
 903     # RRB discarded frame with unknown packet_type
 904     pkt = ehdr + '\x01' + '\x02' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 905     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 906         raise Exception("DATA_TEST_FRAME failed")
 907
 908     # RRB Response with non-zero status code; no STA match
 909     pkt = ehdr + '\x01' + '\x01' + '\x10\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + '\xff\xff'
 910     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 911         raise Exception("DATA_TEST_FRAME failed")
 912
 913     # RRB Response with zero status code and extra data; STA match
 914     pkt = ehdr + '\x01' + '\x01' + '\x11\x00' + _src_ll + '\x06\x01' + _src_ll + '\x00\x00\x00\x00\x00\x00' + '\x00\x00' + '\x00'
 915     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 916         raise Exception("DATA_TEST_FRAME failed")
 917
 918     # Too short PMK-R1 pull
 919     pkt = ehdr + '\x01' + '\xc8' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 920     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 921         raise Exception("DATA_TEST_FRAME failed")
 922
 923     # Too short PMK-R1 resp
 924     pkt = ehdr + '\x01' + '\xc9' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 925     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 926         raise Exception("DATA_TEST_FRAME failed")
 927
 928     # Too short PMK-R1 push
 929     pkt = ehdr + '\x01' + '\xca' + '\x0e\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
 930     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 931         raise Exception("DATA_TEST_FRAME failed")
 932
 933     # No matching R0KH address found for PMK-R0 pull response
 934     pkt = ehdr + '\x01' + '\xc9' + '\x5a\x00' + _src_ll + '\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76*'\00'
 935     if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt)):
 936         raise Exception("DATA_TEST_FRAME failed")
 937
 938 def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
 939     """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
 940     bssid = apdev[0]['bssid']
 941     ssid = "test-ft"
 942     passphrase="12345678"
 943
 944     params = ft_params1(ssid=ssid, passphrase=passphrase)
 945     params["ieee80211w"] = "1";
 946     # This is the RSN element used normally by hostapd
 947     params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
 948     hapd = hostapd.add_ap(apdev[0], params)
 949     id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
 950                         ieee80211w="1", scan_freq="2412",
 951                         pairwise="CCMP", group="CCMP")
 952
 953     tests = [ ('PMKIDCount field included',
 954                '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
 955               ('Extra IE before RSNE',
 956                'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
 957               ('PMKIDCount and Group Management Cipher suite fields included',
 958                '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
 959               ('Extra octet after defined fields (future extensibility)',
 960                '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
 961               ('No RSN Capabilities field (PMF disabled in practice)',
 962                '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
 963     for txt,ie in tests:
 964         dev[0].request("DISCONNECT")
 965         dev[0].wait_disconnected()
 966         logger.info(txt)
 967         hapd.disable()
 968         hapd.set('own_ie_override', ie)
 969         hapd.enable()
 970         dev[0].request("BSS_FLUSH 0")
 971         dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
 972         dev[0].select_network(id, freq=2412)
 973         dev[0].wait_connected()
 974
 975     dev[0].request("DISCONNECT")
 976     dev[0].wait_disconnected()
 977
 978     logger.info('Invalid RSNE causing internal hostapd error')
 979     hapd.disable()
 980     hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
 981     hapd.enable()
 982     dev[0].request("BSS_FLUSH 0")
 983     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
 984     dev[0].select_network(id, freq=2412)
 985     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
 986     # complete.
 987     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
 988     if ev is not None:
 989         raise Exception("Unexpected connection")
 990     dev[0].request("DISCONNECT")
 991
 992     logger.info('Unexpected PMKID causing internal hostapd error')
 993     hapd.disable()
 994     hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
 995     hapd.enable()
 996     dev[0].request("BSS_FLUSH 0")
 997     dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
 998     dev[0].select_network(id, freq=2412)
 999     # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
1000     # complete.
1001     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
1002     if ev is not None:
1003         raise Exception("Unexpected connection")
1004     dev[0].request("DISCONNECT")
1005
1006 def test_ap_ft_ptk_rekey(dev, apdev):
1007     """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
1008     ssid = "test-ft"
1009     passphrase="12345678"
1010
1011     params = ft_params1(ssid=ssid, passphrase=passphrase)
1012     hapd0 = hostapd.add_ap(apdev[0], params)
1013     params = ft_params2(ssid=ssid, passphrase=passphrase)
1014     hapd1 = hostapd.add_ap(apdev[1], params)
1015
1016     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
1017
1018     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1019                             "WPA: Key negotiation completed"], timeout=5)
1020     if ev is None:
1021         raise Exception("No event received after roam")
1022     if "CTRL-EVENT-DISCONNECTED" in ev:
1023         raise Exception("Unexpected disconnection after roam")
1024
1025     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1026         hapd = hapd0
1027     else:
1028         hapd = hapd1
1029     hwsim_utils.test_connectivity(dev[0], hapd)
1030
1031 def test_ap_ft_ptk_rekey_ap(dev, apdev):
1032     """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
1033     ssid = "test-ft"
1034     passphrase="12345678"
1035
1036     params = ft_params1(ssid=ssid, passphrase=passphrase)
1037     params['wpa_ptk_rekey'] = '2'
1038     hapd0 = hostapd.add_ap(apdev[0], params)
1039     params = ft_params2(ssid=ssid, passphrase=passphrase)
1040     params['wpa_ptk_rekey'] = '2'
1041     hapd1 = hostapd.add_ap(apdev[1], params)
1042
1043     run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
1044
1045     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
1046                             "WPA: Key negotiation completed"], timeout=5)
1047     if ev is None:
1048         raise Exception("No event received after roam")
1049     if "CTRL-EVENT-DISCONNECTED" in ev:
1050         raise Exception("Unexpected disconnection after roam")
1051
1052     if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1053         hapd = hapd0
1054     else:
1055         hapd = hapd1
1056     hwsim_utils.test_connectivity(dev[0], hapd)
1057
1058 def test_ap_ft_internal_rrb_check(dev, apdev):
1059     """RRB internal delivery only to WPA enabled BSS"""
1060     ssid = "test-ft"
1061     passphrase="12345678"
1062
1063     radius = hostapd.radius_params()
1064     params = ft_params1(ssid=ssid, passphrase=passphrase)
1065     params['wpa_key_mgmt'] = "FT-EAP"
1066     params["ieee8021x"] = "1"
1067     params = dict(radius.items() + params.items())
1068     hapd = hostapd.add_ap(apdev[0], params)
1069     key_mgmt = hapd.get_config()['key_mgmt']
1070     if key_mgmt.split(' ')[0] != "FT-EAP":
1071         raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1072
1073     hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
1074
1075     # Connect to WPA enabled AP
1076     dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1077                    eap="GPSK", identity="gpsk user",
1078                    password="abcdefghijklmnop0123456789abcdef",
1079                    scan_freq="2412")
1080
1081     # Try over_ds roaming to non-WPA-enabled AP.
1082     # If hostapd does not check hapd->wpa_auth internally, it will crash now.
1083     dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)