tests: EAP-TEAP with client certificate in Phase 1

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/tests/hwsim/auth_serv/eap_user.conf b/tests/hwsim/auth_serv/eap_user.conf
index 7343f40a3656739c1cf88e33491018f794d313db..b5c65f17866da8a7010bdfb07e5d5ac716a4104a 100644 (file)
--- a/tests/hwsim/auth_serv/eap_user.conf
+++ b/tests/hwsim/auth_serv/eap_user.conf
@@ -83,6 +83,8 @@ radius_accept_attr=27:d:3
 
 "phase1-user"  MSCHAPV2,MD5,GTC        "password"
 
+"/C=FI/O=w1.fi/CN=Test User"   TLS     [2]
+
 "020000000000" MACACL  "020000000000"
 
 "020000000100" MACACL  "020000000100"

diff --git a/tests/hwsim/test_eap.py b/tests/hwsim/test_eap.py
index f1bf904bdc3f829fb8d0562eea7ab372bea9e45b..144e4d314070c7bfdb314d40a3b9f11e6c9cd4c9 100644 (file)
--- a/tests/hwsim/test_eap.py
+++ b/tests/hwsim/test_eap.py
@@ -574,3 +574,29 @@ def test_eap_teap_eap_vendor(dev, apdev):
                 anonymous_identity="TEAP",
                 ca_cert="auth_serv/ca.pem", phase2="auth=VENDOR-TEST",
                 pac_file="blob://teap_pac")
+
+def test_eap_teap_client_cert(dev, apdev):
+    """EAP-TEAP with client certificate in Phase 1"""
+    check_eap_capa(dev[0], "TEAP")
+    params = int_teap_server_params(eap_teap_auth="2")
+    hapd = hostapd.add_ap(apdev[0], params)
+
+    # verify server accept a client with certificate, but no Phase 2
+    # configuration
+    eap_connect(dev[0], hapd, "TEAP", "user",
+                anonymous_identity="TEAP",
+                phase1="teap_provisioning=2",
+                client_cert="auth_serv/user.pem",
+                private_key="auth_serv/user.key",
+                ca_cert="auth_serv/ca.pem",
+                pac_file="blob://teap_pac")
+    dev[0].dump_monitor()
+    res = eap_reauth(dev[0], "TEAP")
+    if res['tls_session_reused'] != '1':
+        raise Exception("EAP-TEAP could not use PAC session ticket")
+
+    # verify server accepts a client without certificate
+    eap_connect(dev[1], hapd, "TEAP", "user",
+                anonymous_identity="TEAP", password="password",
+                ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
+                pac_file="blob://teap_pac")