Beispiel #1
0
def test_tnc_fast(dev, apdev):
    """TNC FAST"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["pac_opaque_encr_key"] ="000102030405060708090a0b0c0d0e00"
    params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
    params["eap_fast_a_id_info"] = "test server2"

    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        logger.info("No IMC installed - skip")
        return "skip"

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="FAST", identity="user",
                   anonymous_identity="FAST", password="******",
                   phase2="auth=GTC",
                   phase1="fast_provisioning=2",
                   pac_file="blob://fast_pac_auth_tnc",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
def test_tnc_fast(dev, apdev):
    """TNC FAST"""
    check_eap_capa(dev[0], "FAST")
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["pac_opaque_encr_key"] = "000102030405060708090a0b0c0d0e00"
    params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
    params["eap_fast_a_id_info"] = "test server2"

    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")

    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="FAST",
                   identity="user",
                   anonymous_identity="FAST",
                   password="******",
                   phase2="auth=GTC",
                   phase1="fast_provisioning=2",
                   pac_file="blob://fast_pac_auth_tnc",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    dev[0].wait_connected(timeout=10)
Beispiel #3
0
def test_tnc_peap_soh(dev, apdev):
    """TNC PEAP-SoH"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh cryptobinding=0",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")

    dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh1 cryptobinding=1",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")

    dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh2 cryptobinding=2",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[2].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
Beispiel #4
0
def test_erp_server_no_match(dev, apdev):
    """ERP enabled on server and peer, but server has no key match"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].request("ERP_FLUSH")
    id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                        eap="PSK", identity="*****@*****.**",
                        password_hex="0123456789abcdef0123456789abcdef",
                        erp="1", scan_freq="2412")
    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)
    hapd.request("ERP_FLUSH")
    dev[0].request("RECONNECT")
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
                            "CTRL-EVENT-EAP-FAILURE"], timeout=15)
    if ev is None:
        raise Exception("EAP result timed out")
    if "CTRL-EVENT-EAP-SUCCESS" in ev:
        raise Exception("Unexpected EAP success")
    dev[0].request("DISCONNECT")
    dev[0].select_network(id)
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
    if ev is None:
        raise Exception("EAP success timed out")
    if "EAP re-authentication completed successfully" in ev:
        raise Exception("Unexpected use of ERP")
    dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #5
0
def test_tnc_peap_soh_errors(dev, apdev):
    """TNC PEAP-SoH local error cases"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0], params)

    tests = [ (1, "tncc_build_soh"),
              (1, "eap_msg_alloc;=eap_peap_phase2_request") ]
    for count, func in tests:
        with alloc_fail(dev[0], count, func):
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                           eap="PEAP", identity="user", password="******",
                           ca_cert="auth_serv/ca.pem",
                           phase1="peapver=0 tnc=soh cryptobinding=0",
                           phase2="auth=MSCHAPV2",
                           scan_freq="2412", wait_connect=False)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    with fail_test(dev[0], 1, "os_get_random;tncc_build_soh"):
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                       eap="PEAP", identity="user", password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase1="peapver=0 tnc=soh cryptobinding=0",
                       phase2="auth=MSCHAPV2",
                       scan_freq="2412", wait_connect=False)
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()
Beispiel #6
0
def test_tnc_peap_soh(dev, apdev):
    """TNC PEAP-SoH"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0], params)

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh cryptobinding=0",
                   phase2="auth=MSCHAPV2",
                   scan_freq="2412", wait_connect=False)
    dev[0].wait_connected(timeout=10)

    dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh1 cryptobinding=1",
                   phase2="auth=MSCHAPV2",
                   scan_freq="2412", wait_connect=False)
    dev[1].wait_connected(timeout=10)

    dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh2 cryptobinding=2",
                   phase2="auth=MSCHAPV2",
                   scan_freq="2412", wait_connect=False)
    dev[2].wait_connected(timeout=10)
Beispiel #7
0
def test_erp_server_no_match(dev, apdev):
    """ERP enabled on server and peer, but server has no key match"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].request("ERP_FLUSH")
    id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                        eap="PSK", identity="*****@*****.**",
                        password_hex="0123456789abcdef0123456789abcdef",
                        erp="1", scan_freq="2412")
    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)
    hapd.request("ERP_FLUSH")
    dev[0].request("RECONNECT")
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS",
                            "CTRL-EVENT-EAP-FAILURE"], timeout=15)
    if ev is None:
        raise Exception("EAP result timed out")
    if "CTRL-EVENT-EAP-SUCCESS" in ev:
        raise Exception("Unexpected EAP success")
    dev[0].request("DISCONNECT")
    dev[0].select_network(id)
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
    if ev is None:
        raise Exception("EAP success timed out")
    if "EAP re-authentication completed successfully" in ev:
        raise Exception("Unexpected use of ERP")
    dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #8
0
def test_erp(dev, apdev):
    """ERP enabled on server and peer"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="PSK",
                   identity="*****@*****.**",
                   password_hex="0123456789abcdef0123456789abcdef",
                   erp="1",
                   scan_freq="2412")
    for i in range(3):
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
        if ev is None:
            raise Exception("EAP success timed out")
        if "EAP re-authentication completed successfully" not in ev:
            raise Exception("Did not use ERP")
        dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #9
0
def test_erp(dev, apdev):
    """ERP enabled on server and peer"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PSK", identity="*****@*****.**",
                   password_hex="0123456789abcdef0123456789abcdef",
                   erp="1", scan_freq="2412")
    for i in range(3):
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
        if ev is None:
            raise Exception("EAP success timed out")
        if "EAP re-authentication completed successfully" not in ev:
            raise Exception("Did not use ERP")
        dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #10
0
def test_erp_anonymous_identity(dev, apdev):
    """ERP and anonymous identity"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="TTLS",
                   identity="erp-ttls",
                   anonymous_identity="*****@*****.**",
                   password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase2="auth=PAP",
                   erp="1",
                   scan_freq="2412")
    for i in range(3):
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
        if ev is None:
            raise Exception("EAP success timed out")
        if "EAP re-authentication completed successfully" not in ev:
            raise Exception("Did not use ERP")
        dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #11
0
def test_tnc_peap_soh(dev, apdev):
    """TNC PEAP-SoH"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh cryptobinding=0",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    dev[0].wait_connected(timeout=10)

    dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh1 cryptobinding=1",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    dev[1].wait_connected(timeout=10)

    dev[2].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PEAP", identity="user", password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh2 cryptobinding=2",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    dev[2].wait_connected(timeout=10)
Beispiel #12
0
def test_tnc_fast(dev, apdev):
    """TNC FAST"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["pac_opaque_encr_key"] = "000102030405060708090a0b0c0d0e00"
    params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
    params["eap_fast_a_id_info"] = "test server2"

    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        logger.info("No IMC installed - skip")
        return "skip"

    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="FAST",
                   identity="user",
                   anonymous_identity="FAST",
                   password="******",
                   phase2="auth=GTC",
                   phase1="fast_provisioning=2",
                   pac_file="blob://fast_pac_auth_tnc",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
Beispiel #13
0
def test_erp_anonymous_identity(dev, apdev):
    """ERP and anonymous identity"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                   identity="erp-ttls",
                   anonymous_identity="*****@*****.**",
                   password="******",
                   ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                   erp="1", scan_freq="2412")
    for i in range(3):
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
        if ev is None:
            raise Exception("EAP success timed out")
        if "EAP re-authentication completed successfully" not in ev:
            raise Exception("Did not use ERP")
        dev[0].wait_connected(timeout=15, error="Reconnection timed out")
Beispiel #14
0
def test_tnc_ttls_errors(dev, apdev):
    """TNC TTLS local error cases"""
    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")
    check_eap_capa(dev[0], "MSCHAPV2")

    params = int_eap_server_params()
    params["tnc"] = "1"
    params["fragment_size"] = "150"
    hostapd.add_ap(apdev[0], params)

    tests = [(1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
              "DOMAIN\mschapv2 user", "auth=MSCHAPV2"),
             (1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
              "mschap user", "auth=MSCHAP"),
             (1, "=eap_tnc_init", "chap user", "auth=CHAP"),
             (1, "tncc_init;eap_tnc_init", "pap user", "auth=PAP"),
             (1, "eap_msg_alloc;eap_tnc_build_frag_ack",
              "pap user", "auth=PAP"),
             (1, "eap_msg_alloc;eap_tnc_build_msg",
              "pap user", "auth=PAP"),
             (1, "wpabuf_alloc;=eap_tnc_process_fragment",
              "pap user", "auth=PAP"),
             (1, "eap_msg_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
             (1, "wpabuf_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
             (1, "dup_binstr;tncc_process_if_tnccs", "pap user", "auth=PAP"),
             (1, "tncc_get_base64;tncc_process_if_tnccs",
              "pap user", "auth=PAP"),
             (1, "tncc_if_tnccs_start", "pap user", "auth=PAP"),
             (1, "tncc_if_tnccs_end", "pap user", "auth=PAP"),
             (1, "tncc_parse_imc", "pap user", "auth=PAP"),
             (2, "tncc_parse_imc", "pap user", "auth=PAP"),
             (3, "tncc_parse_imc", "pap user", "auth=PAP"),
             (1, "os_readfile;tncc_read_config", "pap user", "auth=PAP"),
             (1, "tncc_init", "pap user", "auth=PAP"),
             (1, "TNC_TNCC_ReportMessageTypes", "pap user", "auth=PAP"),
             (1, "base64_gen_encode;?base64_encode;TNC_TNCC_SendMessage",
              "pap user", "auth=PAP"),
             (1, "=TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
             (1, "tncc_get_base64;tncc_process_if_tnccs",
              "pap user", "auth=PAP")]
    for count, func, identity, phase2 in tests:
        with alloc_fail(dev[0], count, func):
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                           scan_freq="2412",
                           eap="TTLS", anonymous_identity="ttls",
                           identity=identity, password="******",
                           ca_cert="auth_serv/ca.pem", phase2=phase2,
                           fragment_size="150", wait_connect=False)
            ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"],
                                   timeout=15)
            if ev is None:
                raise Exception("Timeout on EAP start")
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL",
                              note="Allocation failure not triggered for: %d:%s" % (count, func))
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()
            dev[0].dump_monitor()
Beispiel #15
0
def test_erp_home_realm_oom(dev, apdev):
    """ERP and home realm OOM"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    for count in range(1, 3):
        with alloc_fail(dev[0], count, "eap_get_realm"):
            dev[0].request("ERP_FLUSH")
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                           identity="*****@*****.**",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                           erp="1", scan_freq="2412", wait_connect=False)
            dev[0].wait_connected(timeout=10)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    for count in range(1, 3):
        with alloc_fail(dev[0], count, "eap_get_realm"):
            dev[0].request("ERP_FLUSH")
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                           identity="erp-ttls",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                           erp="1", scan_freq="2412", wait_connect=False)
            dev[0].wait_connected(timeout=10)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    for count in range(1, 3):
        dev[0].request("ERP_FLUSH")
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412", wait_connect=False)
        dev[0].wait_connected(timeout=10)
        if range > 1:
            continue
        with alloc_fail(dev[0], count, "eap_get_realm"):
            dev[0].request("DISCONNECT")
            dev[0].wait_disconnected(timeout=15)
            dev[0].request("RECONNECT")
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()
Beispiel #16
0
def test_erp_home_realm_oom(dev, apdev):
    """ERP and home realm OOM"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    for count in range(1, 3):
        with alloc_fail(dev[0], count, "eap_home_realm"):
            dev[0].request("ERP_FLUSH")
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                           identity="*****@*****.**",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                           erp="1", scan_freq="2412", wait_connect=False)
            dev[0].wait_connected(timeout=10)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    for count in range(1, 3):
        with alloc_fail(dev[0], count, "eap_home_realm"):
            dev[0].request("ERP_FLUSH")
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                           identity="erp-ttls",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                           erp="1", scan_freq="2412", wait_connect=False)
            dev[0].wait_connected(timeout=10)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    for count in range(1, 3):
        dev[0].request("ERP_FLUSH")
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412", wait_connect=False)
        dev[0].wait_connected(timeout=10)
        if range > 1:
            continue
        with alloc_fail(dev[0], count, "eap_home_realm"):
            dev[0].request("DISCONNECT")
            dev[0].wait_disconnected(timeout=15)
            dev[0].request("RECONNECT")
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()
Beispiel #17
0
def int_teap_server_params(eap_teap_auth=None, eap_teap_pac_no_inner=None):
    params = int_eap_server_params()
    params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff00"
    params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff00"
    params['eap_fast_a_id_info'] = "test server 0"
    if eap_teap_auth:
        params['eap_teap_auth'] = eap_teap_auth
    if eap_teap_pac_no_inner:
        params['eap_teap_pac_no_inner'] = eap_teap_pac_no_inner
    return params
Beispiel #18
0
def test_erp_enabled_on_server(dev, apdev):
    """ERP enabled on internal EAP server, but disabled on peer"""
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PAX", identity="*****@*****.**",
                   password_hex="0123456789abcdef0123456789abcdef",
                   scan_freq="2412")
Beispiel #19
0
def test_erp_enabled_on_server(dev, apdev):
    """ERP enabled on internal EAP server, but disabled on peer"""
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="PAX", identity="*****@*****.**",
                   password_hex="0123456789abcdef0123456789abcdef",
                   scan_freq="2412")
Beispiel #20
0
def test_tnc_ttls(dev, apdev):
    """TNC TTLS"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="TTLS", identity="DOMAIN\mschapv2 user",
                   anonymous_identity="ttls", password="******",
                   phase2="auth=MSCHAPV2",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    dev[0].wait_connected(timeout=10)
Beispiel #21
0
def test_tnc_peap_soh(dev, apdev):
    """TNC PEAP-SoH"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="PEAP",
                   identity="user",
                   password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh cryptobinding=0",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")

    dev[1].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="PEAP",
                   identity="user",
                   password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh1 cryptobinding=1",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[1].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")

    dev[2].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="PEAP",
                   identity="user",
                   password="******",
                   ca_cert="auth_serv/ca.pem",
                   phase1="peapver=0 tnc=soh2 cryptobinding=2",
                   phase2="auth=MSCHAPV2",
                   wait_connect=False)
    ev = dev[2].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
Beispiel #22
0
def test_tnc_ttls(dev, apdev):
    """TNC TTLS"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        logger.info("No IMC installed - skip")
        return "skip"

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="TTLS", identity="DOMAIN\mschapv2 user",
                   anonymous_identity="ttls", password="******",
                   phase2="auth=MSCHAPV2",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
Beispiel #23
0
def test_tnc_ttls_fragmentation(dev, apdev):
    """TNC TTLS with fragmentation"""
    check_eap_capa(dev[0], "MSCHAPV2")
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["fragment_size"] = "150"
    hostapd.add_ap(apdev[0], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="TTLS", identity="DOMAIN\mschapv2 user",
                   anonymous_identity="ttls", password="******",
                   phase2="auth=MSCHAPV2",
                   ca_cert="auth_serv/ca.pem",
                   fragment_size="150",
                   scan_freq="2412", wait_connect=False)
    dev[0].wait_connected(timeout=10)
Beispiel #24
0
def test_tnc_ttls(dev, apdev):
    """TNC TTLS"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        logger.info("No IMC installed - skip")
        return "skip"

    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="TTLS",
                   identity="DOMAIN\mschapv2 user",
                   anonymous_identity="ttls",
                   password="******",
                   phase2="auth=MSCHAPV2",
                   ca_cert="auth_serv/ca.pem",
                   wait_connect=False)
    ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10)
    if ev is None:
        raise Exception("Connection timed out")
Beispiel #25
0
def test_tnc_peap_soh_errors(dev, apdev):
    """TNC PEAP-SoH local error cases"""
    params = int_eap_server_params()
    params["tnc"] = "1"
    hostapd.add_ap(apdev[0]['ifname'], params)

    tests = [(1, "tncc_build_soh"),
             (1, "eap_msg_alloc;=eap_peap_phase2_request")]
    for count, func in tests:
        with alloc_fail(dev[0], count, func):
            dev[0].connect("test-wpa2-eap",
                           key_mgmt="WPA-EAP",
                           eap="PEAP",
                           identity="user",
                           password="******",
                           ca_cert="auth_serv/ca.pem",
                           phase1="peapver=0 tnc=soh cryptobinding=0",
                           phase2="auth=MSCHAPV2",
                           scan_freq="2412",
                           wait_connect=False)
            wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    with fail_test(dev[0], 1, "os_get_random;tncc_build_soh"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="PEAP",
                       identity="user",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase1="peapver=0 tnc=soh cryptobinding=0",
                       phase2="auth=MSCHAPV2",
                       scan_freq="2412",
                       wait_connect=False)
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()
Beispiel #26
0
def test_tnc_ttls_fragmentation(dev, apdev):
    """TNC TTLS with fragmentation"""
    check_eap_capa(dev[0], "MSCHAPV2")
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["fragment_size"] = "150"
    hostapd.add_ap(apdev[0], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")

    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="TTLS",
                   identity="DOMAIN\mschapv2 user",
                   anonymous_identity="ttls",
                   password="******",
                   phase2="auth=MSCHAPV2",
                   ca_cert="auth_serv/ca.pem",
                   fragment_size="150",
                   scan_freq="2412",
                   wait_connect=False)
    dev[0].wait_connected(timeout=10)
Beispiel #27
0
def test_tnc_fast(dev, apdev):
    """TNC FAST"""
    check_eap_capa(dev[0], "FAST")
    params = int_eap_server_params()
    params["tnc"] = "1"
    params["pac_opaque_encr_key"] ="000102030405060708090a0b0c0d0e00"
    params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
    params["eap_fast_a_id_info"] = "test server2"

    hostapd.add_ap(apdev[0], params)

    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")

    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
                   eap="FAST", identity="user",
                   anonymous_identity="FAST", password="******",
                   phase2="auth=GTC",
                   phase1="fast_provisioning=2",
                   pac_file="blob://fast_pac_auth_tnc",
                   ca_cert="auth_serv/ca.pem",
                   scan_freq="2412", wait_connect=False)
    dev[0].wait_connected(timeout=10)
Beispiel #28
0
def test_tnc_ttls_errors(dev, apdev):
    """TNC TTLS local error cases"""
    if not os.path.exists("tnc/libhostap_imc.so"):
        raise HwsimSkip("No IMC installed")
    check_eap_capa(dev[0], "MSCHAPV2")

    params = int_eap_server_params()
    params["tnc"] = "1"
    params["fragment_size"] = "150"
    hostapd.add_ap(apdev[0]['ifname'], params)

    tests = [
        (1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
         "DOMAIN\mschapv2 user", "auth=MSCHAPV2"),
        (1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
         "mschap user", "auth=MSCHAP"),
        (1, "=eap_tnc_init", "chap user", "auth=CHAP"),
        (1, "tncc_init;eap_tnc_init", "pap user", "auth=PAP"),
        (1, "eap_msg_alloc;eap_tnc_build_frag_ack", "pap user", "auth=PAP"),
        (1, "eap_msg_alloc;eap_tnc_build_msg", "pap user", "auth=PAP"),
        (1, "wpabuf_alloc;=eap_tnc_process_fragment", "pap user", "auth=PAP"),
        (1, "eap_msg_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
        (1, "wpabuf_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
        (1, "dup_binstr;tncc_process_if_tnccs", "pap user", "auth=PAP"),
        (1, "tncc_get_base64;tncc_process_if_tnccs", "pap user", "auth=PAP"),
        (1, "tncc_if_tnccs_start", "pap user", "auth=PAP"),
        (1, "tncc_if_tnccs_end", "pap user", "auth=PAP"),
        (1, "tncc_parse_imc", "pap user", "auth=PAP"),
        (2, "tncc_parse_imc", "pap user", "auth=PAP"),
        (3, "tncc_parse_imc", "pap user", "auth=PAP"),
        (1, "os_readfile;tncc_read_config", "pap user", "auth=PAP"),
        (1, "tncc_init", "pap user", "auth=PAP"),
        (1, "TNC_TNCC_ReportMessageTypes", "pap user", "auth=PAP"),
        (1, "base64_encode;TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
        (1, "=TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
        (1, "tncc_get_base64;tncc_process_if_tnccs", "pap user", "auth=PAP")
    ]
    for count, func, identity, phase2 in tests:
        with alloc_fail(dev[0], count, func):
            dev[0].connect("test-wpa2-eap",
                           key_mgmt="WPA-EAP",
                           scan_freq="2412",
                           eap="TTLS",
                           anonymous_identity="ttls",
                           identity=identity,
                           password="******",
                           ca_cert="auth_serv/ca.pem",
                           phase2=phase2,
                           fragment_size="150",
                           wait_connect=False)
            ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"],
                                   timeout=15)
            if ev is None:
                raise Exception("Timeout on EAP start")
            wait_fail_trigger(
                dev[0],
                "GET_ALLOC_FAIL",
                note="Allocation failure not triggered for: %d:%s" %
                (count, func))
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()
            dev[0].dump_monitor()
Beispiel #29
0
def test_erp_local_errors(dev, apdev):
    """ERP and local error cases"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], params)

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_peer_erp_init"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    for count in range(1, 6):
        dev[0].request("ERP_FLUSH")
        with fail_test(dev[0], count, "hmac_sha256_kdf;eap_peer_erp_init"):
            dev[0].connect("test-wpa2-eap",
                           key_mgmt="WPA-EAP",
                           eap="TTLS",
                           identity="*****@*****.**",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem",
                           phase2="auth=PAP",
                           erp="1",
                           scan_freq="2412")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_msg_alloc;eap_peer_erp_reauth_start"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with fail_test(dev[0], 1, "hmac_sha256;eap_peer_erp_reauth_start"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with fail_test(dev[0], 1, "hmac_sha256;eap_peer_finish"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_peer_erp_init"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_peer_finish"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with fail_test(dev[0], 1, "hmac_sha256_kdf;eap_peer_finish"):
        dev[0].connect("test-wpa2-eap",
                       key_mgmt="WPA-EAP",
                       eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem",
                       phase2="auth=PAP",
                       erp="1",
                       scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()
Beispiel #30
0
def test_erp_local_errors(dev, apdev):
    """ERP and local error cases"""
    check_erp_capa(dev[0])
    params = int_eap_server_params()
    params['erp_send_reauth_start'] = '1'
    params['erp_domain'] = 'example.com'
    params['eap_server_erp'] = '1'
    params['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], params)

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_peer_erp_init"):
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    for count in range(1, 6):
        dev[0].request("ERP_FLUSH")
        with fail_test(dev[0], count, "hmac_sha256_kdf;eap_peer_erp_init"):
            dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                           identity="*****@*****.**",
                           anonymous_identity="*****@*****.**",
                           password="******",
                           ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                           erp="1", scan_freq="2412")
            dev[0].request("REMOVE_NETWORK all")
            dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with alloc_fail(dev[0], 1, "eap_msg_alloc;eap_peer_erp_reauth_start"):
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_ALLOC_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with fail_test(dev[0], 1, "hmac_sha256;eap_peer_erp_reauth_start"):
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()

    dev[0].request("ERP_FLUSH")
    with fail_test(dev[0], 1, "hmac_sha256;eap_peer_finish"):
        dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                       identity="*****@*****.**",
                       anonymous_identity="*****@*****.**",
                       password="******",
                       ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                       erp="1", scan_freq="2412")
        dev[0].request("DISCONNECT")
        dev[0].wait_disconnected(timeout=15)
        dev[0].request("RECONNECT")
        wait_fail_trigger(dev[0], "GET_FAIL")
        dev[0].request("REMOVE_NETWORK all")
        dev[0].wait_disconnected()
Beispiel #31
0
def test_erp_key_lifetime_in_memory(dev, apdev, params):
    """ERP and key lifetime in memory"""
    check_erp_capa(dev[0])
    p = int_eap_server_params()
    p['erp_send_reauth_start'] = '1'
    p['erp_domain'] = 'example.com'
    p['eap_server_erp'] = '1'
    p['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0], p)
    password = "******"

    pid = find_wpas_process(dev[0])

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap",
                   key_mgmt="WPA-EAP",
                   eap="TTLS",
                   identity="*****@*****.**",
                   password=password,
                   ca_cert="auth_serv/ca.pem",
                   phase2="auth=PAP",
                   erp="1",
                   scan_freq="2412")

    # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
    # event has been delivered, so verify that wpa_supplicant has returned to
    # eloop before reading process memory.
    time.sleep(1)
    dev[0].ping()
    password = password.encode()
    buf = read_process_memory(pid, password)

    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)

    dev[0].relog()
    msk = None
    emsk = None
    rRK = None
    rIK = None
    pmk = None
    ptk = None
    gtk = None
    with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
        for l in f.readlines():
            if "EAP-TTLS: Derived key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                msk = binascii.unhexlify(val)
            if "EAP-TTLS: Derived EMSK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                emsk = binascii.unhexlify(val)
            if "EAP: ERP rRK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                rRK = binascii.unhexlify(val)
            if "EAP: ERP rIK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                rIK = binascii.unhexlify(val)
            if "WPA: PMK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                pmk = binascii.unhexlify(val)
            if "WPA: PTK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                ptk = binascii.unhexlify(val)
            if "WPA: Group Key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                gtk = binascii.unhexlify(val)
    if not msk or not emsk or not rIK or not rRK or not pmk or not ptk or not gtk:
        raise Exception("Could not find keys from debug log")
    if len(gtk) != 16:
        raise Exception("Unexpected GTK length")

    kck = ptk[0:16]
    kek = ptk[16:32]
    tk = ptk[32:48]

    fname = os.path.join(params['logdir'],
                         'erp_key_lifetime_in_memory.memctx-')

    logger.info("Checking keys in memory while associated")
    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    if password not in buf:
        raise HwsimSkip("Password not found while associated")
    if pmk not in buf:
        raise HwsimSkip("PMK not found while associated")
    if kck not in buf:
        raise Exception("KCK not found while associated")
    if kek not in buf:
        raise Exception("KEK not found while associated")
    #if tk in buf:
    #    raise Exception("TK found from memory")

    logger.info("Checking keys in memory after disassociation")
    buf = read_process_memory(pid, password)

    # Note: Password is still present in network configuration
    # Note: PMK is in EAP fast re-auth data

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    if gtk in buf:
        get_key_locations(buf, gtk, "GTK")
    verify_not_present(buf, gtk, fname, "GTK")

    dev[0].request("RECONNECT")
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
    if ev is None:
        raise Exception("EAP success timed out")
    if "EAP re-authentication completed successfully" not in ev:
        raise Exception("Did not use ERP")
    dev[0].wait_connected(timeout=15, error="Reconnection timed out")

    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)

    dev[0].relog()
    pmk = None
    ptk = None
    gtk = None
    with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
        for l in f.readlines():
            if "WPA: PMK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                pmk = binascii.unhexlify(val)
            if "WPA: PTK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                ptk = binascii.unhexlify(val)
            if "WPA: GTK in EAPOL-Key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                gtk = binascii.unhexlify(val)
    if not pmk or not ptk or not gtk:
        raise Exception("Could not find keys from debug log")

    kck = ptk[0:16]
    kek = ptk[16:32]
    tk = ptk[32:48]

    logger.info("Checking keys in memory after ERP and disassociation")
    buf = read_process_memory(pid, password)

    # Note: Password is still present in network configuration

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    verify_not_present(buf, gtk, fname, "GTK")

    dev[0].request("REMOVE_NETWORK all")

    logger.info("Checking keys in memory after network profile removal")
    buf = read_process_memory(pid, password)

    # Note: rRK and rIK are still in memory

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, password, fname, "password")
    verify_not_present(buf, pmk, fname, "PMK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    verify_not_present(buf, gtk, fname, "GTK")
    verify_not_present(buf, msk, fname, "MSK")
    verify_not_present(buf, emsk, fname, "EMSK")

    dev[0].request("ERP_FLUSH")
    logger.info("Checking keys in memory after ERP_FLUSH")
    buf = read_process_memory(pid, password)
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, rRK, fname, "rRK")
    verify_not_present(buf, rIK, fname, "rIK")
Beispiel #32
0
def test_erp_key_lifetime_in_memory(dev, apdev, params):
    """ERP and key lifetime in memory"""
    check_erp_capa(dev[0])
    p = int_eap_server_params()
    p['erp_send_reauth_start'] = '1'
    p['erp_domain'] = 'example.com'
    p['eap_server_erp'] = '1'
    p['disable_pmksa_caching'] = '1'
    hapd = hostapd.add_ap(apdev[0]['ifname'], p)
    password = "******"

    pid = find_wpas_process(dev[0])

    dev[0].request("ERP_FLUSH")
    dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS",
                   identity="*****@*****.**", password=password,
                   ca_cert="auth_serv/ca.pem", phase2="auth=PAP",
                   erp="1", scan_freq="2412")

    # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
    # event has been delivered, so verify that wpa_supplicant has returned to
    # eloop before reading process memory.
    time.sleep(1)
    dev[0].ping()
    buf = read_process_memory(pid, password)

    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)

    dev[0].relog()
    msk = None
    emsk = None
    rRK = None
    rIK = None
    pmk = None
    ptk = None
    gtk = None
    with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
        for l in f.readlines():
            if "EAP-TTLS: Derived key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                msk = binascii.unhexlify(val)
            if "EAP-TTLS: Derived EMSK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                emsk = binascii.unhexlify(val)
            if "EAP: ERP rRK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                rRK = binascii.unhexlify(val)
            if "EAP: ERP rIK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                rIK = binascii.unhexlify(val)
            if "WPA: PMK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                pmk = binascii.unhexlify(val)
            if "WPA: PTK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                ptk = binascii.unhexlify(val)
            if "WPA: Group Key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                gtk = binascii.unhexlify(val)
    if not msk or not emsk or not rIK or not rRK or not pmk or not ptk or not gtk:
        raise Exception("Could not find keys from debug log")
    if len(gtk) != 16:
        raise Exception("Unexpected GTK length")

    kck = ptk[0:16]
    kek = ptk[16:32]
    tk = ptk[32:48]

    fname = os.path.join(params['logdir'],
                         'erp_key_lifetime_in_memory.memctx-')

    logger.info("Checking keys in memory while associated")
    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    if password not in buf:
        raise HwsimSkip("Password not found while associated")
    if pmk not in buf:
        raise HwsimSkip("PMK not found while associated")
    if kck not in buf:
        raise Exception("KCK not found while associated")
    if kek not in buf:
        raise Exception("KEK not found while associated")
    if tk in buf:
        raise Exception("TK found from memory")
    if gtk in buf:
        get_key_locations(buf, gtk, "GTK")
        raise Exception("GTK found from memory")

    logger.info("Checking keys in memory after disassociation")
    buf = read_process_memory(pid, password)

    # Note: Password is still present in network configuration
    # Note: PMK is in EAP fast re-auth data

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    verify_not_present(buf, gtk, fname, "GTK")

    dev[0].request("RECONNECT")
    ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=15)
    if ev is None:
        raise Exception("EAP success timed out")
    if "EAP re-authentication completed successfully" not in ev:
        raise Exception("Did not use ERP")
    dev[0].wait_connected(timeout=15, error="Reconnection timed out")

    dev[0].request("DISCONNECT")
    dev[0].wait_disconnected(timeout=15)

    dev[0].relog()
    pmk = None
    ptk = None
    gtk = None
    with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
        for l in f.readlines():
            if "WPA: PMK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                pmk = binascii.unhexlify(val)
            if "WPA: PTK - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                ptk = binascii.unhexlify(val)
            if "WPA: GTK in EAPOL-Key - hexdump" in l:
                val = l.strip().split(':')[3].replace(' ', '')
                gtk = binascii.unhexlify(val)
    if not pmk or not ptk or not gtk:
        raise Exception("Could not find keys from debug log")

    kck = ptk[0:16]
    kek = ptk[16:32]
    tk = ptk[32:48]

    logger.info("Checking keys in memory after ERP and disassociation")
    buf = read_process_memory(pid, password)

    # Note: Password is still present in network configuration

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    verify_not_present(buf, gtk, fname, "GTK")

    dev[0].request("REMOVE_NETWORK all")

    logger.info("Checking keys in memory after network profile removal")
    buf = read_process_memory(pid, password)

    # Note: rRK and rIK are still in memory

    get_key_locations(buf, password, "Password")
    get_key_locations(buf, pmk, "PMK")
    get_key_locations(buf, msk, "MSK")
    get_key_locations(buf, emsk, "EMSK")
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, password, fname, "password")
    verify_not_present(buf, pmk, fname, "PMK")
    verify_not_present(buf, kck, fname, "KCK")
    verify_not_present(buf, kek, fname, "KEK")
    verify_not_present(buf, tk, fname, "TK")
    verify_not_present(buf, gtk, fname, "GTK")
    verify_not_present(buf, msk, fname, "MSK")
    verify_not_present(buf, emsk, fname, "EMSK")

    dev[0].request("ERP_FLUSH")
    logger.info("Checking keys in memory after ERP_FLUSH")
    buf = read_process_memory(pid, password)
    get_key_locations(buf, rRK, "rRK")
    get_key_locations(buf, rIK, "rIK")
    verify_not_present(buf, rRK, fname, "rRK")
    verify_not_present(buf, rIK, fname, "rIK")