def run_ap_wpa2_gtk_initial_rsc(dev, apdev, cipher):
if cipher not in dev[0].get_capability("pairwise") or \
cipher not in dev[0].get_capability("group"):
raise HwsimSkip("Cipher %s not supported" % cipher)
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
params["rsn_pairwise"] = cipher
params["group_cipher"] = cipher
params["gtk_rsc_override"] = "341200000000"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk",
psk="12345678",
proto="WPA2",
pairwise=cipher,
group=cipher,
scan_freq="2412")
hapd.wait_sta()
# Verify that unicast traffic works, but broadcast traffic does not.
hwsim_utils.test_connectivity(dev[0], hapd, broadcast=False)
hwsim_utils.test_connectivity(dev[0], hapd, success_expected=False)
hwsim_utils.test_connectivity(dev[0], hapd, success_expected=False)
def test_ap_pmf_required(dev, apdev):
"""WPA2-PSK AP with PMF required"""
ssid = "test-pmf-required"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256";
params["ieee80211w"] = "2";
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
key_mgmt = hapd.get_config()['key_mgmt']
if key_mgmt.split(' ')[0] != "WPA-PSK-SHA256":
raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
dev[1].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1].ifname, apdev[0]['ifname'])
hapd = hostapd.Hostapd(apdev[0]['ifname'])
hapd.request("SA_QUERY " + dev[0].p2p_interface_addr())
hapd.request("SA_QUERY " + dev[1].p2p_interface_addr())
wt.require_ap_pmf_mandatory(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_pmf_mandatory(apdev[0]['bssid'], dev[1].p2p_interface_addr())
time.sleep(0.1)
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[1].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
def test_peerkey_pairwise_mismatch(dev, apdev):
"""RSN TKIP+CCMP AP and PeerKey between two STAs using different ciphers"""
skip_with_fips(dev[0])
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
ssid = "test-peerkey"
passphrase = "12345678"
params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase)
params['peerkey'] = "1"
params['rsn_pairwise'] = "TKIP CCMP"
hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid,
psk=passphrase,
scan_freq="2412",
peerkey=True,
pairwise="CCMP")
dev[1].connect(ssid,
psk=passphrase,
scan_freq="2412",
peerkey=True,
pairwise="TKIP")
hwsim_utils.test_connectivity_sta(dev[0], dev[1])
dev[0].request("STKSTART " + dev[1].p2p_interface_addr())
time.sleep(0.5)
dev[1].request("STKSTART " + dev[0].p2p_interface_addr())
time.sleep(0.5)
def test_ap_wpa2_delayed_m1_m3_zero_tk(dev, apdev):
"""Delayed M1+M3 retransmission and zero TK"""
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk", psk="12345678", scan_freq="2412")
hwsim_utils.test_connectivity(dev[0], hapd)
addr = dev[0].own_addr()
if "OK" not in hapd.request("RESEND_M1 " + addr + " change-anonce"):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M1 " + addr):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M3 " + addr):
raise Exception("RESEND_M3 failed")
if "OK" not in hapd.request("SET_KEY 3 %s %d %d %s %s" % (addr, 0, 1, 6*"00", 16*"00")):
raise Exception("SET_KEY failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1, broadcast=False,
success_expected=False)
dev[0].request("DISCONNECT")
dev[0].wait_disconnected()
def test_ap_pmf_assoc_comeback(dev, apdev):
"""WPA2-PSK AP with PMF association comeback"""
ssid = "assoc-comeback"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hapd.set("ext_mgmt_frame_handling", "1")
dev[0].request("DISCONNECT")
dev[0].wait_disconnected(timeout=10)
hapd.set("ext_mgmt_frame_handling", "0")
dev[0].request("REASSOCIATE")
dev[0].wait_connected(timeout=10, error="Timeout on re-connection")
if wt.get_sta_counter("assocresp_comeback", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("AP did not use association comeback request")
def run_ap_pmf_beacon_protection_mismatch(dev, apdev, clear):
ssid = "test-beacon-prot"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["beacon_prot"] = "1"
params["group_mgmt_cipher"] = "AES-128-CMAC"
try:
hapd = hostapd.add_ap(apdev[0], params)
except Exception as e:
if "Failed to enable hostapd interface" in str(e):
raise HwsimSkip("Beacon protection not supported")
raise
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="2",
beacon_prot="1",
key_mgmt="WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
WPA_ALG_NONE = 0
WPA_ALG_IGTK = 4
KEY_FLAG_DEFAULT = 0x02
KEY_FLAG_TX = 0x08
KEY_FLAG_GROUP = 0x10
KEY_FLAG_GROUP_TX_DEFAULT = KEY_FLAG_GROUP | KEY_FLAG_TX | KEY_FLAG_DEFAULT
addr = "ff:ff:ff:ff:ff:ff"
if clear:
res = hapd.request(
"SET_KEY %d %s %d %d %s %s %d" %
(WPA_ALG_NONE, addr, 6, 1, 6 * "00", "", KEY_FLAG_GROUP))
else:
res = hapd.request("SET_KEY %d %s %d %d %s %s %d" %
(WPA_ALG_IGTK, addr, 6, 1, 6 * "00", 16 * "00",
KEY_FLAG_GROUP_TX_DEFAULT))
if "OK" not in res:
raise Exception("SET_KEY failed")
ev = dev[0].wait_event(["CTRL-EVENT-UNPROT-BEACON"], timeout=5)
if ev is None:
raise Exception("Unprotected Beacon frame not reported")
ev = dev[0].wait_event(["CTRL-EVENT-BEACON-LOSS"], timeout=5)
if ev is None:
raise Exception("Beacon loss not reported")
ev = hapd.wait_event(["CTRL-EVENT-UNPROT-BEACON"], timeout=5)
if ev is None:
raise Exception("WNM-Notification Request frame not reported")
def run_ap_pmf_valid(dev, apdev, disassociate, broadcast):
ssid = "pmf"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK-SHA256", proto="WPA2", scan_freq="2412")
addr0 = dev[0].own_addr()
dev[0].dump_monitor()
hapd.wait_sta()
cmd = "DISASSOCIATE " if disassociate else "DEAUTHENTICATE "
cmd += "ff:ff:ff:ff:ff:ff" if broadcast else addr0
cmd += " test=1"
if "OK" not in hapd.request(cmd):
raise Exception("hostapd command failed")
sta = hapd.get_sta(addr0)
if not sta:
raise Exception("STA entry lost")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=5)
if ev is None:
raise Exception("Disconnection not reported")
if "locally_generated=1" in ev:
raise Exception("Unexpected locally generated disconnection")
# Wait for SA Query procedure to fail and association comeback to succeed
dev[0].wait_connected()
def test_ap_pmf_negative(dev, apdev):
"""WPA2-PSK AP without PMF (negative test)"""
ssid = "test-pmf-negative"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[0], hapd)
try:
dev[1].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1], hapd)
raise Exception("PMF required STA connected to no PMF AP")
except Exception as e:
logger.debug("Ignore expected exception: " + str(e))
wt.require_ap_no_pmf(apdev[0]['bssid'])
def check_group_mgmt_cipher(dev, ap, cipher, sta_req_cipher=None):
if cipher not in dev.get_capability("group_mgmt"):
raise HwsimSkip("Cipher %s not supported" % cipher)
params = { "ssid": "test-wpa2-psk-pmf",
"wpa_passphrase": "12345678",
"wpa": "2",
"ieee80211w": "2",
"wpa_key_mgmt": "WPA-PSK-SHA256",
"rsn_pairwise": "CCMP",
"group_mgmt_cipher": cipher }
hapd = hostapd.add_ap(ap, params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev.connect("test-wpa2-psk-pmf", psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK-SHA256", group_mgmt=sta_req_cipher,
pairwise="CCMP", group="CCMP", scan_freq="2412")
hwsim_utils.test_connectivity(dev, hapd)
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff")
dev.wait_disconnected()
if wt.get_bss_counter('valid_bip_mmie', ap['bssid']) < 1:
raise Exception("No valid BIP MMIE seen")
if wt.get_bss_counter('bip_deauth', ap['bssid']) < 1:
raise Exception("No valid BIP deauth seen")
if cipher == "AES-128-CMAC":
group_mgmt = "BIP"
else:
group_mgmt = cipher
res = wt.info_bss('group_mgmt', ap['bssid']).strip()
if res != group_mgmt:
raise Exception("Unexpected group mgmt cipher: " + res)
def test_ap_pmf_ap_dropping_sa(dev, apdev):
"""WPA2-PSK PMF AP dropping SA"""
ssid = "pmf"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK-SHA256", proto="WPA2", scan_freq="2412")
addr0 = dev[0].own_addr()
dev[0].dump_monitor()
hapd.wait_sta()
# Drop SA and association at the AP locally without notifying the STA. This
# results in the STA getting unprotected Deauthentication frames when trying
# to transmit the next Class 3 frame.
if "OK" not in hapd.request("DEAUTHENTICATE " + addr0 + " tx=0"):
raise Exception("DEAUTHENTICATE command failed")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection event after DEAUTHENTICATE tx=0: " + ev)
dev[0].request("DATA_TEST_CONFIG 1")
dev[0].request("DATA_TEST_TX " + bssid + " " + addr0)
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=5)
dev[0].request("DATA_TEST_CONFIG 0")
if ev is None or "locally_generated=1" not in ev:
raise Exception("Locally generated disconnection not reported")
def test_ap_pmf_optional_2akm(dev, apdev):
"""WPA2-PSK AP with PMF optional (2 AKMs)"""
ssid = "test-pmf-optional-2akm"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK WPA-PSK-SHA256"
params["ieee80211w"] = "1"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[0], hapd)
dev[1].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1], hapd)
wt.require_ap_pmf_optional(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_key_mgmt(apdev[0]['bssid'], dev[0].p2p_interface_addr(),
"PSK-SHA256")
wt.require_sta_pmf_mandatory(apdev[0]['bssid'],
dev[1].p2p_interface_addr())
wt.require_sta_key_mgmt(apdev[0]['bssid'], dev[1].p2p_interface_addr(),
"PSK-SHA256")
def test_wnm_sleep_mode_rsn_pmf(dev, apdev):
"""WNM Sleep Mode - RSN with PMF"""
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params("test-wnm-rsn", "12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["time_advertisement"] = "2"
params["time_zone"] = "EST5"
params["wnm_sleep_mode"] = "1"
params["bss_transition"] = "1"
hostapd.add_ap(apdev[0]['ifname'], params)
hapd = hostapd.Hostapd(apdev[0]['ifname'])
dev[0].connect("test-wnm-rsn",
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
ev = hapd.wait_event(["AP-STA-CONNECTED"], timeout=5)
if ev is None:
raise Exception("No connection event received from hostapd")
check_wnm_sleep_mode_enter_exit(hapd, dev[0])
def test_ap_pmf_assoc_comeback(dev, apdev):
"""WPA2-PSK AP with PMF association comeback"""
ssid = "assoc-comeback"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256";
params["ieee80211w"] = "2";
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hapd.set("ext_mgmt_frame_handling", "1")
dev[0].request("DISCONNECT")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"])
if ev is None:
raise Exception("Timeout on disconnection")
hapd.set("ext_mgmt_frame_handling", "0")
dev[0].request("REASSOCIATE")
ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"])
if ev is None:
raise Exception("Timeout on re-connection")
if wt.get_sta_counter("assocresp_comeback", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("AP did not use association comeback request")
def test_ap_wpa2_delayed_m1_m3_zero_tk(dev, apdev):
"""Delayed M1+M3 retransmission and zero TK"""
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk", psk="12345678", scan_freq="2412")
hwsim_utils.test_connectivity(dev[0], hapd)
addr = dev[0].own_addr()
if "OK" not in hapd.request("RESEND_M1 " + addr + " change-anonce"):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M1 " + addr):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M3 " + addr):
raise Exception("RESEND_M3 failed")
if "OK" not in hapd.request("SET_KEY 3 %s %d %d %s %s" % (addr, 0, 1, 6*"00", 16*"00")):
raise Exception("SET_KEY failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1, broadcast=False,
success_expected=False)
dev[0].request("DISCONNECT")
dev[0].wait_disconnected()
def test_ap_pmf_required(dev, apdev):
"""WPA2-PSK AP with PMF required"""
ssid = "test-pmf-required"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256";
params["ieee80211w"] = "2";
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
key_mgmt = hapd.get_config()['key_mgmt']
if key_mgmt.split(' ')[0] != "WPA-PSK-SHA256":
raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
dev[1].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1].ifname, apdev[0]['ifname'])
hapd = hostapd.Hostapd(apdev[0]['ifname'])
hapd.request("SA_QUERY " + dev[0].p2p_interface_addr())
hapd.request("SA_QUERY " + dev[1].p2p_interface_addr())
wt.require_ap_pmf_mandatory(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_pmf_mandatory(apdev[0]['bssid'], dev[1].p2p_interface_addr())
time.sleep(0.1)
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[1].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
def test_ap_pmf_optional(dev, apdev):
"""WPA2-PSK AP with PMF optional"""
ssid = "test-pmf-optional"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK"
params["ieee80211w"] = "1"
hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2")
hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
dev[1].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2")
hwsim_utils.test_connectivity(dev[1].ifname, apdev[0]['ifname'])
wt.require_ap_pmf_optional(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_pmf_mandatory(apdev[0]['bssid'],
dev[1].p2p_interface_addr())
def test_ap_pmf_optional_2akm(dev, apdev):
"""WPA2-PSK AP with PMF optional (2 AKMs)"""
ssid = "test-pmf-optional-2akm"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK WPA-PSK-SHA256";
params["ieee80211w"] = "1";
hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
dev[1].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1].ifname, apdev[0]['ifname'])
wt.require_ap_pmf_optional(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_key_mgmt(apdev[0]['bssid'], dev[0].p2p_interface_addr(),
"PSK-SHA256")
wt.require_sta_pmf_mandatory(apdev[0]['bssid'], dev[1].p2p_interface_addr())
wt.require_sta_key_mgmt(apdev[0]['bssid'], dev[1].p2p_interface_addr(),
"PSK-SHA256")
def test_peerkey_pairwise_mismatch(dev, apdev):
"""RSN TKIP+CCMP AP and PeerKey between two STAs using different ciphers"""
skip_with_fips(dev[0])
ssid = "test-peerkey"
passphrase = "12345678"
params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase)
params['peerkey'] = "1"
params['rsn_pairwise'] = "TKIP CCMP"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk=passphrase, scan_freq="2412", peerkey=True,
pairwise="CCMP")
dev[1].connect(ssid, psk=passphrase, scan_freq="2412", peerkey=True,
pairwise="TKIP")
hwsim_utils.test_connectivity_sta(dev[0], dev[1])
dev[0].request("STKSTART " + dev[1].p2p_interface_addr())
time.sleep(0.5)
dev[1].request("STKSTART " + dev[0].p2p_interface_addr())
time.sleep(0.5)
def test_ap_pmf_sta_sa_query_no_response_hostapd(dev, apdev):
"""WPA2-PSK AP with station using SA Query and getting no response (hostapd)"""
ssid = "assoc-comeback"
passphrase = "12345678"
addr = dev[0].own_addr()
params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase,
wpa_key_mgmt="WPA-PSK-SHA256",
ieee80211w="2")
hapd = hostapd.add_ap(apdev[0], params)
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk=passphrase, ieee80211w="2",
key_mgmt="WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hapd.wait_sta()
hapd.set("ext_mgmt_frame_handling", "1")
if "OK" not in hapd.request("DEAUTHENTICATE " + addr + " reason=6 test=0") or \
"OK" not in hapd.request("DISASSOCIATE " + addr + " reason=7 test=0"):
raise Exception("Failed to send unprotected disconnection messages")
dev[0].wait_disconnected()
hapd.set("ext_mgmt_frame_handling", "0")
if wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr) < 1:
raise Exception("STA did not send SA Query")
if wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr) > 0:
raise Exception("AP replied to SA Query")
dev[0].wait_connected()
def test_ap_pmf_assoc_comeback2(dev, apdev):
"""WPA2-PSK AP with PMF association comeback (using DROP_SA)"""
ssid = "assoc-comeback"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK"
params["ieee80211w"] = "1"
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK",
proto="WPA2",
scan_freq="2412")
if "OK" not in dev[0].request("DROP_SA"):
raise Exception("DROP_SA failed")
dev[0].request("REASSOCIATE")
ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"])
if ev is None:
raise Exception("Timeout on re-connection")
if wt.get_sta_counter("reassocresp_comeback", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("AP did not use reassociation comeback request")
def check_group_mgmt_cipher(dev, ap, cipher):
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
if cipher not in dev.get_capability("group_mgmt"):
raise HwsimSkip("Cipher %s not supported" % cipher)
params = { "ssid": "test-wpa2-psk-pmf",
"wpa_passphrase": "12345678",
"wpa": "2",
"ieee80211w": "2",
"wpa_key_mgmt": "WPA-PSK-SHA256",
"rsn_pairwise": "CCMP",
"group_mgmt_cipher": cipher }
hapd = hostapd.add_ap(ap['ifname'], params)
dev.connect("test-wpa2-psk-pmf", psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK-SHA256",
pairwise="CCMP", group="CCMP", scan_freq="2412")
hwsim_utils.test_connectivity(dev, hapd)
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff")
dev.wait_disconnected()
if wt.get_bss_counter('valid_bip_mmie', ap['bssid']) < 1:
raise Exception("No valid BIP MMIE seen")
if wt.get_bss_counter('bip_deauth', ap['bssid']) < 1:
raise Exception("No valid BIP deauth seen")
if cipher == "AES-128-CMAC":
group_mgmt = "BIP"
else:
group_mgmt = cipher
res = wt.info_bss('group_mgmt', ap['bssid']).strip()
if res != group_mgmt:
raise Exception("Unexpected group mgmt cipher: " + res)
def test_ocv_sa_query_csa(dev, apdev):
"""Test SA Query with OCV after channel switch"""
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["ocv"] = "1"
try:
hapd = hostapd.add_ap(apdev[0], params)
except Exception as e:
if "Failed to set hostapd parameter ocv" in str(e):
raise HwsimSkip("OCV not supported")
raise
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
ocv="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hapd.request("CHAN_SWITCH 5 2437")
time.sleep(1)
if wt.get_sta_counter("valid_saqueryreq_tx", apdev[0]['bssid'],
dev[0].own_addr()) < 1:
raise Exception("STA did not start SA Query after channel switch")
def test_ocv_sa_query_csa(dev, apdev):
"""Test SA Query with OCV after channel switch"""
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["ocv"] = "1"
try:
hapd = hostapd.add_ap(apdev[0], params)
except Exception as e:
if "Failed to set hostapd parameter ocv" in str(e):
raise HwsimSkip("OCV not supported")
raise
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="1", ocv="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hapd.request("CHAN_SWITCH 5 2437")
time.sleep(1)
if wt.get_sta_counter("valid_saqueryreq_tx", apdev[0]['bssid'],
dev[0].own_addr()) < 1:
raise Exception("STA did not start SA Query after channel switch")
def test_ocv_sa_query(dev, apdev):
"""Test SA Query with OCV"""
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["ocv"] = "1"
try:
hapd = hostapd.add_ap(apdev[0], params)
except Exception as e:
if "Failed to set hostapd parameter ocv" in str(e):
raise HwsimSkip("OCV not supported")
raise
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="1", ocv="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
# Test that client can handle SA Query with OCI element
if "OK" not in hapd.request("SA_QUERY " + dev[0].own_addr()):
raise Exception("SA_QUERY failed")
time.sleep(0.1)
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[0].own_addr()) < 1:
raise Exception("STA did not reply to SA Query")
# Test that AP can handle SA Query with OCI element
if "OK" not in dev[0].request("UNPROT_DEAUTH"):
raise Exception("Triggering SA Query from the STA failed")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=3)
if ev is not None:
raise Exception("SA Query from the STA failed")
def test_ap_pmf_sta_unprot_deauth_burst(dev, apdev):
"""WPA2-PSK AP with station receiving burst of unprotected Deauthentication frames"""
ssid = "deauth-attack"
addr = dev[0].own_addr()
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
wpas.interface_add("wlan5", drv_params="use_monitor=1")
id = wpas.add_network()
wpas.set_network(id, "mode", "2")
wpas.set_network_quoted(id, "ssid", ssid)
wpas.set_network(id, "proto", "WPA2")
wpas.set_network(id, "key_mgmt", "WPA-PSK-SHA256")
wpas.set_network(id, "ieee80211w", "2")
wpas.set_network_quoted(id, "psk", "12345678")
wpas.set_network(id, "pairwise", "CCMP")
wpas.set_network(id, "group", "CCMP")
wpas.set_network(id, "frequency", "2412")
wpas.connect_network(id)
bssid = wpas.p2p_dev_addr()
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
for i in range(0, 10):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req < 1:
raise Exception("STA did not send SA Query")
if num_resp < 1:
raise Exception("AP did not reply to SA Query")
if num_req > 1:
raise Exception("STA initiated too many SA Query procedures (%d)" %
num_req)
time.sleep(10)
for i in range(0, 5):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req != 2 or num_resp != 2:
raise Exception(
"Unexpected number of SA Query procedures (req=%d resp=%d)" %
(num_req, num_resp))
def run_ap_wpa2_delayed_m1_m3_retransmission(dev,
apdev,
change_m1_anonce=False):
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
phy = dev[0].get_driver_status_field("phyname")
dev[0].connect("test-wpa2-psk", psk="12345678", scan_freq="2412")
hapd.wait_sta()
for i in range(5):
hwsim_utils.test_connectivity(dev[0], hapd)
time.sleep(0.1)
before_tk = get_rx_spec(phy, gtk=False).splitlines()
before_gtk = get_rx_spec(phy, gtk=True).splitlines()
addr = dev[0].own_addr()
if change_m1_anonce:
if "OK" not in hapd.request("RESEND_M1 " + addr + " change-anonce"):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M1 " + addr):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M3 " + addr):
raise Exception("RESEND_M3 failed")
time.sleep(0.1)
after_tk = get_rx_spec(phy, gtk=False).splitlines()
after_gtk = get_rx_spec(phy, gtk=True).splitlines()
if "OK" not in hapd.request("RESET_PN " + addr):
raise Exception("RESET_PN failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0],
hapd,
timeout=1,
success_expected=False)
dev[0].request("DISCONNECT")
dev[0].wait_disconnected()
for i in range(len(before_tk)):
b = int(before_tk[i], 16)
a = int(after_tk[i], 16)
if a < b:
raise Exception(
"TK RX counter decreased: idx=%d before=%d after=%d" %
(i, b, a))
for i in range(len(before_gtk)):
b = int(before_gtk[i], 16)
a = int(after_gtk[i], 16)
if a < b:
raise Exception(
"GTK RX counter decreased: idx=%d before=%d after=%d" %
(i, b, a))
def test_ap_pmf_sta_unprot_deauth_burst_hostapd(dev, apdev):
"""WPA2-PSK AP with station receiving burst of unprotected Deauthentication frames (hostapd)"""
ssid = "deauth-attack"
passphrase = "12345678"
addr = dev[0].own_addr()
params = hostapd.wpa2_params(ssid=ssid,
passphrase=passphrase,
wpa_key_mgmt="WPA-PSK-SHA256",
ieee80211w="2")
hapd = hostapd.add_ap(apdev[0], params)
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk=passphrase,
ieee80211w="2",
key_mgmt="WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hapd.wait_sta()
for i in range(10):
if "OK" not in hapd.request("DEAUTHENTICATE " + addr + " reason=6 test=0") or \
"OK" not in hapd.request("DISASSOCIATE " + addr + " reason=7 test=0"):
raise Exception(
"Failed to send unprotected disconnection messages")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req < 1:
raise Exception("STA did not send SA Query")
if num_resp < 1:
raise Exception("AP did not reply to SA Query")
if num_req > 1:
raise Exception("STA initiated too many SA Query procedures (%d)" %
num_req)
time.sleep(10)
for i in range(5):
if "OK" not in hapd.request("DEAUTHENTICATE " + addr + " reason=6 test=0") or \
"OK" not in hapd.request("DISASSOCIATE " + addr + " reason=7 test=0"):
raise Exception(
"Failed to send unprotected disconnection messages")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req != 2 or num_resp != 2:
raise Exception(
"Unexpected number of SA Query procedures (req=%d resp=%d)" %
(num_req, num_resp))
def test_ap_pmf_sta_sa_query(dev, apdev):
"""WPA2-PSK AP with station using SA Query"""
ssid = "assoc-comeback"
addr = dev[0].own_addr()
wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
wpas.interface_add("wlan5", drv_params="use_monitor=1")
id = wpas.add_network()
wpas.set_network(id, "mode", "2")
wpas.set_network_quoted(id, "ssid", ssid)
wpas.set_network(id, "proto", "WPA2")
wpas.set_network(id, "key_mgmt", "WPA-PSK-SHA256")
wpas.set_network(id, "ieee80211w", "2")
wpas.set_network_quoted(id, "psk", "12345678")
wpas.set_network(id, "pairwise", "CCMP")
wpas.set_network(id, "group", "CCMP")
wpas.set_network(id, "frequency", "2412")
wpas.connect_network(id)
bssid = wpas.own_addr()
wpas.dump_monitor()
Wlantest.setup(wpas)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
wpas.dump_monitor()
wpas.request("DEAUTHENTICATE " + addr + " test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
if wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr) < 1:
raise Exception("STA did not send SA Query")
if wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr) < 1:
raise Exception("AP did not reply to SA Query")
wpas.dump_monitor()
def test_ap_pmf_sta_unprot_deauth_burst(dev, apdev):
"""WPA2-PSK AP with station receiving burst of unprotected Deauthentication frames"""
ssid = "deauth-attack"
addr = dev[0].p2p_dev_addr()
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
wpas.interface_add("wlan5", drv_params="use_monitor=1")
id = wpas.add_network()
wpas.set_network(id, "mode", "2")
wpas.set_network_quoted(id, "ssid", ssid)
wpas.set_network(id, "proto", "WPA2")
wpas.set_network(id, "key_mgmt", "WPA-PSK-SHA256")
wpas.set_network(id, "ieee80211w", "2")
wpas.set_network_quoted(id, "psk", "12345678")
wpas.set_network(id, "pairwise", "CCMP")
wpas.set_network(id, "group", "CCMP")
wpas.set_network(id, "frequency", "2412")
wpas.connect_network(id)
bssid = wpas.p2p_dev_addr()
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
for i in range(0, 10):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req < 1:
raise Exception("STA did not send SA Query")
if num_resp < 1:
raise Exception("AP did not reply to SA Query")
if num_req > 1:
raise Exception("STA initiated too many SA Query procedures (%d)" % num_req)
time.sleep(10)
for i in range(0, 5):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req != 2 or num_resp != 2:
raise Exception("Unexpected number of SA Query procedures (req=%d resp=%d)" % (num_req, num_resp))
def _test_ap_pmf_toggle(dev, apdev):
ssid = "test-pmf-optional"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK"
params["ieee80211w"] = "1"
params["assoc_sa_query_max_timeout"] = "1"
params["assoc_sa_query_retry_timeout"] = "1"
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
bssid = apdev[0]['bssid']
addr = dev[0].own_addr()
dev[0].request("SET reassoc_same_bss_optim 1")
id = dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
wt.require_ap_pmf_optional(bssid)
wt.require_sta_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' not in sta['flags']:
raise Exception("MFP flag not present for STA")
dev[0].set_network(id, "ieee80211w", "0")
dev[0].request("REASSOCIATE")
dev[0].wait_connected()
wt.require_sta_no_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' in sta['flags']:
raise Exception("MFP flag unexpectedly present for STA")
cmd = subprocess.Popen(
['iw', 'dev', apdev[0]['ifname'], 'station', 'get', addr],
stdout=subprocess.PIPE)
(data, err) = cmd.communicate()
if "yes" in [l for l in data.splitlines() if "MFP" in l][0]:
raise Exception("Kernel STA entry had MFP enabled")
dev[0].set_network(id, "ieee80211w", "1")
dev[0].request("REASSOCIATE")
dev[0].wait_connected()
wt.require_sta_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' not in sta['flags']:
raise Exception("MFP flag not present for STA")
cmd = subprocess.Popen(
['iw', 'dev', apdev[0]['ifname'], 'station', 'get', addr],
stdout=subprocess.PIPE)
(data, err) = cmd.communicate()
if "yes" not in [l for l in data.splitlines() if "MFP" in l][0]:
raise Exception("Kernel STA entry did not have MFP enabled")
def test_autogo_tdls(dev):
"""P2P autonomous GO and two clients using TDLS"""
go = dev[0]
logger.info("Start autonomous GO with fixed parameters " + go.ifname)
id = go.add_network()
go.set_network_quoted(id, "ssid", "DIRECT-tdls")
go.set_network_quoted(id, "psk", "12345678")
go.set_network(id, "mode", "3")
go.set_network(id, "disabled", "2")
res = go.p2p_start_go(persistent=id, freq="2462")
logger.debug("res: " + str(res))
Wlantest.setup(go, True)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
connect_cli(go, dev[1], social=True, freq=2462)
connect_cli(go, dev[2], social=True, freq=2462)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
bssid = dev[0].p2p_interface_addr()
addr1 = dev[1].p2p_interface_addr()
addr2 = dev[2].p2p_interface_addr()
dev[1].tdls_setup(addr2)
time.sleep(1)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
conf = wt.get_tdls_counter("setup_conf_ok", bssid, addr1, addr2)
if conf == 0:
raise Exception("No TDLS Setup Confirm (success) seen")
dl = wt.get_tdls_counter("valid_direct_link", bssid, addr1, addr2)
if dl == 0:
raise Exception("No valid frames through direct link")
wt.tdls_clear(bssid, addr1, addr2)
dev[1].tdls_teardown(addr2)
time.sleep(1)
teardown = wt.get_tdls_counter("teardown", bssid, addr1, addr2)
if teardown == 0:
raise Exception("No TDLS Setup Teardown seen")
wt.tdls_clear(bssid, addr1, addr2)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
ap_path = wt.get_tdls_counter("valid_ap_path", bssid, addr1, addr2)
if ap_path == 0:
raise Exception("No valid frames via AP path")
direct_link = wt.get_tdls_counter("valid_direct_link", bssid, addr1, addr2)
if direct_link > 0:
raise Exception("Unexpected frames through direct link")
idirect_link = wt.get_tdls_counter("invalid_direct_link", bssid, addr1,
addr2)
if idirect_link > 0:
raise Exception("Unexpected frames through direct link (invalid)")
dev[2].remove_group()
dev[1].remove_group()
dev[0].remove_group()
def test_autogo_tdls(dev):
"""P2P autonomous GO and two clients using TDLS"""
go = dev[0]
logger.info("Start autonomous GO with fixed parameters " + go.ifname)
id = go.add_network()
go.set_network_quoted(id, "ssid", "DIRECT-tdls")
go.set_network_quoted(id, "psk", "12345678")
go.set_network(id, "mode", "3")
go.set_network(id, "disabled", "2")
res = go.p2p_start_go(persistent=id, freq="2462")
logger.debug("res: " + str(res))
Wlantest.setup(go, True)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
connect_cli(go, dev[1], social=True, freq=2462)
connect_cli(go, dev[2], social=True, freq=2462)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
bssid = dev[0].p2p_interface_addr()
addr1 = dev[1].p2p_interface_addr()
addr2 = dev[2].p2p_interface_addr()
dev[1].tdls_setup(addr2)
time.sleep(1)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
conf = wt.get_tdls_counter("setup_conf_ok", bssid, addr1, addr2)
if conf == 0:
raise Exception("No TDLS Setup Confirm (success) seen")
dl = wt.get_tdls_counter("valid_direct_link", bssid, addr1, addr2)
if dl == 0:
raise Exception("No valid frames through direct link")
wt.tdls_clear(bssid, addr1, addr2)
dev[1].tdls_teardown(addr2)
time.sleep(1)
teardown = wt.get_tdls_counter("teardown", bssid, addr1, addr2)
if teardown == 0:
raise Exception("No TDLS Setup Teardown seen")
wt.tdls_clear(bssid, addr1, addr2)
hwsim_utils.test_connectivity_p2p(dev[1], dev[2])
ap_path = wt.get_tdls_counter("valid_ap_path", bssid, addr1, addr2)
if ap_path == 0:
raise Exception("No valid frames via AP path")
direct_link = wt.get_tdls_counter("valid_direct_link", bssid, addr1, addr2)
if direct_link > 0:
raise Exception("Unexpected frames through direct link")
idirect_link = wt.get_tdls_counter("invalid_direct_link", bssid, addr1,
addr2)
if idirect_link > 0:
raise Exception("Unexpected frames through direct link (invalid)")
dev[2].remove_group()
dev[1].remove_group()
dev[0].remove_group()
def run_ap_pmf_beacon_protection(dev, apdev, cipher):
ssid = "test-beacon-prot"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["beacon_prot"] = "1"
params["group_mgmt_cipher"] = cipher
try:
hapd = hostapd.add_ap(apdev[0], params)
except Exception as e:
if "Failed to enable hostapd interface" in str(e):
raise HwsimSkip("Beacon protection not supported")
raise
bssid = hapd.own_addr()
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
# STA with Beacon protection enabled
dev[0].connect(ssid,
psk="12345678",
ieee80211w="2",
beacon_prot="1",
key_mgmt="WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
# STA with Beacon protection disabled
dev[1].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
time.sleep(1)
check_mac80211_bigtk(dev[0], hapd)
valid_bip = wt.get_bss_counter('valid_bip_mmie', bssid)
invalid_bip = wt.get_bss_counter('invalid_bip_mmie', bssid)
missing_bip = wt.get_bss_counter('missing_bip_mmie', bssid)
logger.info("wlantest BIP counters: valid=%d invalid=%d missing=%d" %
(valid_bip, invalid_bip, missing_bip))
if valid_bip < 0 or invalid_bip > 0 or missing_bip > 0:
raise Exception(
"Unexpected wlantest BIP counters: valid=%d invalid=%d missing=%d"
% (valid_bip, invalid_bip, missing_bip))
def run_ap_wpa2_delayed_m1_m3_retransmission(dev, apdev,
change_m1_anonce=False):
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
phy = dev[0].get_driver_status_field("phyname")
dev[0].connect("test-wpa2-psk", psk="12345678", scan_freq="2412")
for i in range(5):
hwsim_utils.test_connectivity(dev[0], hapd)
time.sleep(0.1)
before_tk = get_rx_spec(phy, gtk=False).splitlines()
before_gtk = get_rx_spec(phy, gtk=True).splitlines()
addr = dev[0].own_addr()
if change_m1_anonce:
if "OK" not in hapd.request("RESEND_M1 " + addr + " change-anonce"):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M1 " + addr):
raise Exception("RESEND_M1 failed")
if "OK" not in hapd.request("RESEND_M3 " + addr):
raise Exception("RESEND_M3 failed")
time.sleep(0.1)
after_tk = get_rx_spec(phy, gtk=False).splitlines()
after_gtk = get_rx_spec(phy, gtk=True).splitlines()
if "OK" not in hapd.request("RESET_PN " + addr):
raise Exception("RESET_PN failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1,
success_expected=False)
dev[0].request("DISCONNECT")
dev[0].wait_disconnected()
for i in range(len(before_tk)):
b = int(before_tk[i], 16)
a = int(after_tk[i], 16)
if a < b:
raise Exception("TK RX counter decreased: idx=%d before=%d after=%d" % (i, b, a))
for i in range(len(before_gtk)):
b = int(before_gtk[i], 16)
a = int(after_gtk[i], 16)
if a < b:
raise Exception("GTK RX counter decreased: idx=%d before=%d after=%d" % (i, b, a))
def run_ap_cipher_replay_protection_sta(dev, apdev, cipher, gtk=False):
params = {
"ssid": "test-wpa2-psk",
"wpa_passphrase": "12345678",
"wpa": "2",
"wpa_key_mgmt": "WPA-PSK",
"rsn_pairwise": cipher
}
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
phy = dev[0].get_driver_status_field("phyname")
dev[0].connect("test-wpa2-psk",
psk="12345678",
pairwise=cipher,
group=cipher,
scan_freq="2412")
hapd.wait_sta()
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays != 0:
raise Exception("Unexpected replay reported (1)")
for i in range(5):
hwsim_utils.test_connectivity(dev[0], hapd)
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays != 0:
raise Exception("Unexpected replay reported (2)")
addr = "ff:ff:ff:ff:ff:ff" if gtk else dev[0].own_addr()
if "OK" not in hapd.request("RESET_PN " + addr):
raise Exception("RESET_PN failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0],
hapd,
timeout=1,
success_expected=False)
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays < 1:
raise Exception("Replays not reported")
def test_ap_wpa2_delayed_group_m1_retransmission_igtk(dev, apdev):
"""Delayed group M1 retransmission (check IGTK protection)"""
params = hostapd.wpa2_params(ssid="test-wpa2-psk",
passphrase="12345678",
ieee80211w="2")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
phy = dev[0].get_driver_status_field("phyname")
dev[0].connect("test-wpa2-psk",
psk="12345678",
scan_freq="2412",
ieee80211w="1")
hapd.wait_sta()
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1)
# deauth once to see that works OK
addr = dev[0].own_addr()
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff")
dev[0].wait_disconnected(timeout=10)
# now to check the protection
dev[0].request("RECONNECT")
dev[0].wait_connected()
hapd.wait_sta()
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1)
if "OK" not in hapd.request("RESEND_GROUP_M1 " + addr):
raise Exception("RESEND_GROUP_M1 failed")
if "OK" not in hapd.request("RESET_PN ff:ff:ff:ff:ff:ff IGTK"):
raise Exception("RESET_PN failed")
time.sleep(0.1)
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff test=1")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=0.1)
if ev is not None:
raise Exception("Unexpected disconnection")
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1)
dev[0].request("DISCONNECT")
dev[0].wait_disconnected()
def run_ap_wpa2_igtk_initial_rsc(dev, apdev, cipher):
if cipher not in dev[0].get_capability("group_mgmt"):
raise HwsimSkip("Cipher %s not supported" % cipher)
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
params["ieee80211w"] = "2"
params["rsn_pairwise"] = "CCMP"
params["group_cipher"] = "CCMP"
params["group_mgmt_cipher"] = cipher
params["igtk_rsc_override"] = "341200000000"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk",
psk="12345678",
proto="WPA2",
ieee80211w="2",
pairwise="CCMP",
group="CCMP",
group_mgmt=cipher,
scan_freq="2412")
hapd.wait_sta()
# Verify that broadcast robust management frames are dropped.
dev[0].note(
"Sending broadcast Deauthentication and Disassociation frames with too small IPN"
)
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff test=1")
hapd.request("DISASSOCIATE ff:ff:ff:ff:ff:ff test=1")
hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff test=1")
hapd.request("DISASSOCIATE ff:ff:ff:ff:ff:ff test=1")
dev[0].note(
"Done sending broadcast Deauthentication and Disassociation frames with too small IPN"
)
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
# Verify thar unicast robust management frames go through.
hapd.request("DEAUTHENTICATE " + dev[0].own_addr() + " reason=123 test=1")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is None:
raise Exception("Disconnection not reported")
if "reason=123" not in ev:
raise Exception("Unexpected disconnection reason: " + ev)
def test_ap_pmf_sta_sa_query(dev, apdev):
"""WPA2-PSK AP with station using SA Query"""
ssid = "assoc-comeback"
addr = dev[0].own_addr()
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
wpas = WpaSupplicant(global_iface='/tmp/wpas-wlan5')
wpas.interface_add("wlan5", drv_params="use_monitor=1")
id = wpas.add_network()
wpas.set_network(id, "mode", "2")
wpas.set_network_quoted(id, "ssid", ssid)
wpas.set_network(id, "proto", "WPA2")
wpas.set_network(id, "key_mgmt", "WPA-PSK-SHA256")
wpas.set_network(id, "ieee80211w", "2")
wpas.set_network_quoted(id, "psk", "12345678")
wpas.set_network(id, "pairwise", "CCMP")
wpas.set_network(id, "group", "CCMP")
wpas.set_network(id, "frequency", "2412")
wpas.connect_network(id)
bssid = wpas.own_addr()
wpas.dump_monitor()
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
wpas.dump_monitor()
wpas.request("DEAUTHENTICATE " + addr + " test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
if wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr) < 1:
raise Exception("STA did not send SA Query")
if wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr) < 1:
raise Exception("AP did not reply to SA Query")
wpas.dump_monitor()
def _test_ap_pmf_toggle(dev, apdev):
ssid = "test-pmf-optional"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK";
params["ieee80211w"] = "1";
params["assoc_sa_query_max_timeout"] = "1"
params["assoc_sa_query_retry_timeout"] = "1"
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
bssid = apdev[0]['bssid']
addr = dev[0].own_addr()
dev[0].request("SET reassoc_same_bss_optim 1")
id = dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
wt.require_ap_pmf_optional(bssid)
wt.require_sta_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' not in sta['flags']:
raise Exception("MFP flag not present for STA")
dev[0].set_network(id, "ieee80211w", "0")
dev[0].request("REASSOCIATE")
dev[0].wait_connected()
wt.require_sta_no_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' in sta['flags']:
raise Exception("MFP flag unexpectedly present for STA")
cmd = subprocess.Popen(['iw', 'dev', apdev[0]['ifname'], 'station', 'get',
addr], stdout=subprocess.PIPE)
(data,err) = cmd.communicate()
if "yes" in [l for l in data.splitlines() if "MFP" in l][0]:
raise Exception("Kernel STA entry had MFP enabled")
dev[0].set_network(id, "ieee80211w", "1")
dev[0].request("REASSOCIATE")
dev[0].wait_connected()
wt.require_sta_pmf(bssid, addr)
sta = hapd.get_sta(addr)
if '[MFP]' not in sta['flags']:
raise Exception("MFP flag not present for STA")
cmd = subprocess.Popen(['iw', 'dev', apdev[0]['ifname'], 'station', 'get',
addr], stdout=subprocess.PIPE)
(data,err) = cmd.communicate()
if "yes" not in [l for l in data.splitlines() if "MFP" in l][0]:
raise Exception("Kernel STA entry did not have MFP enabled")
def test_ap_pmf_required(dev, apdev):
"""WPA2-PSK AP with PMF required"""
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
key_mgmt = hapd.get_config()['key_mgmt']
if key_mgmt.split(' ')[0] != "WPA-PSK-SHA256":
raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
dev[0].connect(ssid,
psk="12345678",
ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
if "[WPA2-PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
raise Exception("Scan results missing RSN element info")
hwsim_utils.test_connectivity(dev[0], hapd)
dev[1].connect(ssid,
psk="12345678",
ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256",
proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1], hapd)
if "OK" not in hapd.request("SA_QUERY " + dev[0].own_addr()):
raise Exception("SA_QUERY failed")
if "OK" not in hapd.request("SA_QUERY " + dev[1].own_addr()):
raise Exception("SA_QUERY failed")
if "FAIL" not in hapd.request("SA_QUERY foo"):
raise Exception("Invalid SA_QUERY accepted")
wt.require_ap_pmf_mandatory(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_pmf_mandatory(apdev[0]['bssid'],
dev[1].p2p_interface_addr())
time.sleep(0.1)
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[1].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
def test_ap_pmf_negative(dev, apdev):
"""WPA2-PSK AP without PMF (negative test)"""
ssid = "test-pmf-negative"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2")
hwsim_utils.test_connectivity(dev[0].ifname, apdev[0]['ifname'])
try:
dev[1].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2")
hwsim_utils.test_connectivity(dev[1].ifname, apdev[0]['ifname'])
raise Exception("PMF required STA connected to no PMF AP")
except Exception, e:
logger.debug("Ignore expected exception: " + str(e))
def test_ap_pmf_required_sha1(dev, apdev):
"""WPA2-PSK AP with PMF required with SHA1 AKM"""
ssid = "test-pmf-required-sha1"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK";
params["ieee80211w"] = "2";
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
key_mgmt = hapd.get_config()['key_mgmt']
if key_mgmt.split(' ')[0] != "WPA-PSK":
raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
dev[0].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK", proto="WPA2", scan_freq="2412")
if "[WPA2-PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
raise Exception("Scan results missing RSN element info")
hwsim_utils.test_connectivity(dev[0], hapd)
def test_wnm_sleep_mode_rsn_pmf(dev, apdev):
"""WNM Sleep Mode - RSN with PMF"""
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params("test-wnm-rsn", "12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256";
params["ieee80211w"] = "2";
params["time_advertisement"] = "2"
params["time_zone"] = "EST5"
params["wnm_sleep_mode"] = "1"
params["bss_transition"] = "1"
hostapd.add_ap(apdev[0]['ifname'], params)
hapd = hostapd.Hostapd(apdev[0]['ifname'])
dev[0].connect("test-wnm-rsn", psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK-SHA256", proto="WPA2", scan_freq="2412")
check_wnm_sleep_mode_enter_exit(hapd, dev[0])
def test_ap_pmf_sta_unprot_deauth_burst(dev, apdev):
"""WPA2-PSK AP with station receiving burst of unprotected Deauthentication frames"""
ssid = "deauth-attack"
addr = dev[0].own_addr()
wpas = start_wpas_ap(ssid)
bssid = wpas.own_addr()
Wlantest.setup(wpas)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
for i in range(0, 10):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req < 1:
raise Exception("STA did not send SA Query")
if num_resp < 1:
raise Exception("AP did not reply to SA Query")
if num_req > 1:
raise Exception("STA initiated too many SA Query procedures (%d)" % num_req)
time.sleep(10)
for i in range(0, 5):
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
num_req = wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr)
num_resp = wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr)
if num_req != 2 or num_resp != 2:
raise Exception("Unexpected number of SA Query procedures (req=%d resp=%d)" % (num_req, num_resp))
def test_ap_pmf_assoc_comeback2(dev, apdev):
"""WPA2-PSK AP with PMF association comeback (using DROP_SA)"""
ssid = "assoc-comeback"
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK";
params["ieee80211w"] = "1";
hapd = hostapd.add_ap(apdev[0]['ifname'], params)
dev[0].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK", proto="WPA2", scan_freq="2412")
if "OK" not in dev[0].request("DROP_SA"):
raise Exception("DROP_SA failed")
dev[0].request("REASSOCIATE")
dev[0].wait_connected(timeout=10, error="Timeout on re-connection")
if wt.get_sta_counter("reassocresp_comeback", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("AP did not use reassociation comeback request")
def start_ocv_ap(apdev):
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
params["ocv"] = "1"
try:
hapd = hostapd.add_ap(apdev, params)
except Exception as e:
if "Failed to set hostapd parameter ocv" in str(e):
raise HwsimSkip("OCV not supported")
raise
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
return hapd, ssid, wt
def test_peerkey_sniffer_check(dev, apdev, params):
"""RSN AP and PeerKey between two STAs with sniffer check"""
ssid = "test-peerkey"
passphrase = "12345678"
hparams = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase)
hparams['peerkey'] = "1"
hapd = hostapd.add_ap(apdev[0], hparams)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk=passphrase, scan_freq="2412", peerkey=True)
dev[1].connect(ssid, psk=passphrase, scan_freq="2412", peerkey=True)
hwsim_utils.test_connectivity_sta(dev[0], dev[1])
dev[0].request("STKSTART " + dev[1].p2p_interface_addr())
time.sleep(1)
# NOTE: Actual use of the direct link (DLS) is not supported in
# mac80211_hwsim, so this operation fails at setting the keys after
# successfully completed 4-way handshake. This test case does allow the
# key negotiation part to be tested for coverage, though. Use sniffer to
# verify that all the SMK and STK handshake messages were transmitted.
bssid = hapd.own_addr()
addr0 = dev[0].own_addr()
addr1 = dev[1].own_addr()
# Wireshark renamed the EAPOL-Key key_info field, so need to try both the
# new and the old name to work with both versions.
try_other = False
try:
out = run_tshark(os.path.join(params['logdir'], "hwsim0.pcapng"),
"eapol.type == 3",
display=["wlan.sa", "wlan.da",
"wlan_rsna_eapol.keydes.key_info"])
except Exception, e:
if "Unknown tshark field" in str(e):
try_other = True
pass
else:
raise
def test_ap_wpa2_plaintext_group_m1(dev, apdev):
"""Plaintext group M1"""
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk", psk="12345678", scan_freq="2412")
time.sleep(0.1)
addr = dev[0].own_addr()
if "OK" not in hapd.request("RESEND_GROUP_M1 " + addr + " plaintext"):
raise Exception("RESEND_GROUP_M1 failed")
time.sleep(0.2)
if "OK" not in hapd.request("RESEND_GROUP_M1 " + addr):
raise Exception("RESEND_GROUP_M1 failed")
time.sleep(0.1)
def run_ap_cipher_replay_protection_sta(dev, apdev, cipher, gtk=False):
params = { "ssid": "test-wpa2-psk",
"wpa_passphrase": "12345678",
"wpa": "2",
"wpa_key_mgmt": "WPA-PSK",
"rsn_pairwise": cipher }
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
phy = dev[0].get_driver_status_field("phyname")
dev[0].connect("test-wpa2-psk", psk="12345678",
pairwise=cipher, group=cipher, scan_freq="2412")
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays != 0:
raise Exception("Unexpected replay reported (1)")
for i in range(5):
hwsim_utils.test_connectivity(dev[0], hapd)
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays != 0:
raise Exception("Unexpected replay reported (2)")
addr = "ff:ff:ff:ff:ff:ff" if gtk else dev[0].own_addr()
if "OK" not in hapd.request("RESET_PN " + addr):
raise Exception("RESET_PN failed")
time.sleep(0.1)
hwsim_utils.test_connectivity(dev[0], hapd, timeout=1,
success_expected=False)
if cipher != "TKIP":
replays = get_tk_replay_counter(phy, gtk)
if replays < 1:
raise Exception("Replays not reported")
def test_ap_pmf_required(dev, apdev):
"""WPA2-PSK AP with PMF required"""
ssid = "test-pmf-required"
params = hostapd.wpa2_params(ssid=ssid, passphrase="12345678")
params["wpa_key_mgmt"] = "WPA-PSK-SHA256"
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
key_mgmt = hapd.get_config()['key_mgmt']
if key_mgmt.split(' ')[0] != "WPA-PSK-SHA256":
raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
if "[WPA2-PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
raise Exception("Scan results missing RSN element info")
hwsim_utils.test_connectivity(dev[0], hapd)
dev[1].connect(ssid, psk="12345678", ieee80211w="2",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
hwsim_utils.test_connectivity(dev[1], hapd)
if "OK" not in hapd.request("SA_QUERY " + dev[0].own_addr()):
raise Exception("SA_QUERY failed")
if "OK" not in hapd.request("SA_QUERY " + dev[1].own_addr()):
raise Exception("SA_QUERY failed")
if "FAIL" not in hapd.request("SA_QUERY foo"):
raise Exception("Invalid SA_QUERY accepted")
wt.require_ap_pmf_mandatory(apdev[0]['bssid'])
wt.require_sta_pmf(apdev[0]['bssid'], dev[0].p2p_interface_addr())
wt.require_sta_pmf_mandatory(apdev[0]['bssid'], dev[1].p2p_interface_addr())
time.sleep(0.1)
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[0].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
if wt.get_sta_counter("valid_saqueryresp_tx", apdev[0]['bssid'],
dev[1].p2p_interface_addr()) < 1:
raise Exception("STA did not reply to SA Query")
def test_ap_wpa2_plaintext_m1_m3_pmf(dev, apdev):
"""Plaintext M1/M3 during PTK rekey (PMF)"""
params = hostapd.wpa2_params(ssid="test-wpa2-psk", passphrase="12345678")
params["ieee80211w"] = "2"
hapd = hostapd.add_ap(apdev[0], params)
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect("test-wpa2-psk", psk="12345678", ieee80211w="2",
scan_freq="2412")
time.sleep(0.1)
addr = dev[0].own_addr()
if "OK" not in hapd.request("RESEND_M1 " + addr + " plaintext"):
raise Exception("RESEND_M1 failed")
time.sleep(0.1)
if "OK" not in hapd.request("RESEND_M3 " + addr + " plaintext"):
raise Exception("RESEND_M3 failed")
time.sleep(0.1)
def test_ap_pmf_sta_sa_query(dev, apdev):
"""WPA2-PSK AP with station using SA Query"""
ssid = "assoc-comeback"
addr = dev[0].own_addr()
wpas = start_wpas_ap(ssid)
bssid = wpas.own_addr()
Wlantest.setup(wpas)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
dev[0].connect(ssid, psk="12345678", ieee80211w="1",
key_mgmt="WPA-PSK WPA-PSK-SHA256", proto="WPA2",
scan_freq="2412")
wpas.dump_monitor()
wpas.request("DEAUTHENTICATE " + addr + " test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
wpas.request("DEAUTHENTICATE " + addr + " reason=6 test=0")
wpas.dump_monitor()
wpas.request("DISASSOCIATE " + addr + " reason=7 test=0")
wpas.dump_monitor()
ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
if ev is not None:
raise Exception("Unexpected disconnection")
if wt.get_sta_counter("valid_saqueryreq_tx", bssid, addr) < 1:
raise Exception("STA did not send SA Query")
if wt.get_sta_counter("valid_saqueryresp_rx", bssid, addr) < 1:
raise Exception("AP did not reply to SA Query")
wpas.dump_monitor()
def wlantest_setup(hapd):
Wlantest.setup(hapd)
wt = Wlantest()
wt.flush()
wt.add_passphrase("12345678")
wt.add_wepkey("68656c6c6f")