def test_tnc_ttls_errors(dev, apdev):
"""TNC TTLS local error cases"""
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
check_eap_capa(dev[0], "MSCHAPV2")
params = int_eap_server_params()
params["tnc"] = "1"
params["fragment_size"] = "150"
hostapd.add_ap(apdev[0], params)
tests = [(1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
"DOMAIN\mschapv2 user", "auth=MSCHAPV2"),
(1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
"mschap user", "auth=MSCHAP"),
(1, "=eap_tnc_init", "chap user", "auth=CHAP"),
(1, "tncc_init;eap_tnc_init", "pap user", "auth=PAP"),
(1, "eap_msg_alloc;eap_tnc_build_frag_ack",
"pap user", "auth=PAP"),
(1, "eap_msg_alloc;eap_tnc_build_msg",
"pap user", "auth=PAP"),
(1, "wpabuf_alloc;=eap_tnc_process_fragment",
"pap user", "auth=PAP"),
(1, "eap_msg_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
(1, "wpabuf_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
(1, "dup_binstr;tncc_process_if_tnccs", "pap user", "auth=PAP"),
(1, "tncc_get_base64;tncc_process_if_tnccs",
"pap user", "auth=PAP"),
(1, "tncc_if_tnccs_start", "pap user", "auth=PAP"),
(1, "tncc_if_tnccs_end", "pap user", "auth=PAP"),
(1, "tncc_parse_imc", "pap user", "auth=PAP"),
(2, "tncc_parse_imc", "pap user", "auth=PAP"),
(3, "tncc_parse_imc", "pap user", "auth=PAP"),
(1, "os_readfile;tncc_read_config", "pap user", "auth=PAP"),
(1, "tncc_init", "pap user", "auth=PAP"),
(1, "TNC_TNCC_ReportMessageTypes", "pap user", "auth=PAP"),
(1, "base64_gen_encode;?base64_encode;TNC_TNCC_SendMessage",
"pap user", "auth=PAP"),
(1, "=TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
(1, "tncc_get_base64;tncc_process_if_tnccs",
"pap user", "auth=PAP")]
for count, func, identity, phase2 in tests:
with alloc_fail(dev[0], count, func):
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TTLS", anonymous_identity="ttls",
identity=identity, password="******",
ca_cert="auth_serv/ca.pem", phase2=phase2,
fragment_size="150", wait_connect=False)
ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"],
timeout=15)
if ev is None:
raise Exception("Timeout on EAP start")
wait_fail_trigger(dev[0], "GET_ALLOC_FAIL",
note="Allocation failure not triggered for: %d:%s" % (count, func))
dev[0].request("REMOVE_NETWORK all")
dev[0].wait_disconnected()
dev[0].dump_monitor()
def test_tnc_ttls(dev, apdev):
"""TNC TTLS"""
check_eap_capa(dev[0], "MSCHAPV2")
params = int_eap_server_params()
params["tnc"] = "1"
hostapd.add_ap(apdev[0], params)
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
eap="TTLS", identity="DOMAIN\mschapv2 user",
anonymous_identity="ttls", password="******",
phase2="auth=MSCHAPV2",
ca_cert="auth_serv/ca.pem",
scan_freq="2412", wait_connect=False)
dev[0].wait_connected(timeout=10)
def test_hs20_pps_mo_1(dev, apdev):
"""Hotspot 2.0 PPS MO with username/password credential"""
check_hs20_osu_client()
check_eap_capa(dev[0], "MSCHAPV2")
bssid = apdev[0]['bssid']
params = hs20_ap_params()
params['hessid'] = bssid
params['nai_realm'] = ["0,w1.fi,13[5:6],21[2:4][5:7]",
"0,another.example.com"]
params['domain_name'] = "w1.fi"
hapd = hostapd.add_ap(apdev[0], params)
dev[0].hs20_enable()
set_pps("pps-mo-1.xml")
interworking_select(dev[0], bssid, "home", freq="2412")
interworking_connect(dev[0], bssid, "TTLS")
check_sp_type(dev[0], "home")
def test_tnc_ttls(dev, apdev):
"""TNC TTLS"""
check_eap_capa(dev[0], "MSCHAPV2")
params = int_eap_server_params()
params["tnc"] = "1"
hostapd.add_ap(apdev[0]['ifname'], params)
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
dev[0].connect("test-wpa2-eap",
key_mgmt="WPA-EAP",
eap="TTLS",
identity="DOMAIN\mschapv2 user",
anonymous_identity="ttls",
password="******",
phase2="auth=MSCHAPV2",
ca_cert="auth_serv/ca.pem",
scan_freq="2412",
wait_connect=False)
dev[0].wait_connected(timeout=10)
def test_tnc_fast(dev, apdev):
"""TNC FAST"""
check_eap_capa(dev[0], "FAST")
params = int_eap_server_params()
params["tnc"] = "1"
params["pac_opaque_encr_key"] ="000102030405060708090a0b0c0d0e00"
params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
params["eap_fast_a_id_info"] = "test server2"
hostapd.add_ap(apdev[0], params)
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
eap="FAST", identity="user",
anonymous_identity="FAST", password="******",
phase2="auth=GTC",
phase1="fast_provisioning=2",
pac_file="blob://fast_pac_auth_tnc",
ca_cert="auth_serv/ca.pem",
scan_freq="2412", wait_connect=False)
dev[0].wait_connected(timeout=10)
def test_tnc_fast(dev, apdev):
"""TNC FAST"""
check_eap_capa(dev[0], "FAST")
params = int_eap_server_params()
params["tnc"] = "1"
params["pac_opaque_encr_key"] ="000102030405060708090a0b0c0d0e00"
params["eap_fast_a_id"] = "101112131415161718191a1b1c1d1e00"
params["eap_fast_a_id_info"] = "test server2"
hostapd.add_ap(apdev[0]['ifname'], params)
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
eap="FAST", identity="user",
anonymous_identity="FAST", password="******",
phase2="auth=GTC",
phase1="fast_provisioning=2",
pac_file="blob://fast_pac_auth_tnc",
ca_cert="auth_serv/ca.pem",
wait_connect=False)
dev[0].wait_connected(timeout=10)
def test_eap_teap_eap_mschapv2_user_and_eap_tls_machine(dev, apdev):
"""EAP-TEAP with inner EAP-MSCHAPv2 user and EAP-TLS machine credentials"""
check_eap_capa(dev[0], "TEAP")
check_eap_capa(dev[0], "MSCHAPV2")
check_eap_capa(dev[0], "TLS")
params = int_teap_server_params(eap_teap_id="5")
hapd = hostapd.add_ap(apdev[0], params)
eap_connect(dev[0], hapd, "TEAP", "user", password="******",
anonymous_identity="TEAP",
machine_identity="cert user",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
machine_phase2="auth=TLS",
machine_ca_cert="auth_serv/ca.pem",
machine_client_cert="auth_serv/user.pem",
machine_private_key="auth_serv/user.key",
pac_file="blob://teap_pac")
def test_eap_teap_errors(dev, apdev):
"""EAP-TEAP local errors"""
check_eap_capa(dev[0], "TEAP")
check_eap_capa(dev[0], "MSCHAPV2")
params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
hapd = hostapd.add_ap(apdev[0], params)
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TEAP", identity="user", password="******",
anonymous_identity="TEAP",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
wait_connect=False)
wait_eap_proposed(dev[0])
dev[0].set("blob", "teap_broken_pac 11")
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TEAP", identity="user", password="******",
anonymous_identity="TEAP",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
pac_file="blob://teap_broken_pac", wait_connect=False)
wait_eap_proposed(dev[0])
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TEAP", identity="user", password="******",
anonymous_identity="TEAP",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
phase1="teap_pac_format=binary",
pac_file="blob://teap_broken_pac", wait_connect=False)
wait_eap_proposed(dev[0])
tests = [(1, "eap_teap_tlv_eap_payload"),
(1, "eap_teap_process_eap_payload_tlv"),
(1, "eap_teap_compound_mac"),
(1, "eap_teap_tlv_result"),
(1, "eap_peer_select_phase2_methods"),
(1, "eap_peer_tls_ssl_init"),
(1, "eap_teap_session_id"),
(1, "wpabuf_alloc;=eap_teap_process_crypto_binding"),
(1, "eap_peer_tls_encrypt"),
(1, "eap_peer_tls_decrypt"),
(1, "eap_teap_getKey"),
(1, "eap_teap_session_id"),
(1, "eap_teap_init")]
for count, func in tests:
with alloc_fail(dev[0], count, func):
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TEAP", identity="user", password="******",
anonymous_identity="TEAP",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
pac_file="blob://teap_pac", wait_connect=False)
wait_eap_proposed(dev[0], wait_trigger="GET_ALLOC_FAIL")
tests = [(1, "eap_teap_derive_eap_msk"),
(1, "eap_teap_derive_eap_emsk"),
(1, "eap_teap_write_crypto_binding"),
(1, "eap_teap_process_crypto_binding"),
(1, "eap_teap_derive_msk;eap_teap_process_crypto_binding"),
(1, "eap_teap_compound_mac;eap_teap_process_crypto_binding"),
(1, "eap_teap_derive_imck")]
for count, func in tests:
with fail_test(dev[0], count, func):
dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TEAP", identity="user", password="******",
anonymous_identity="TEAP",
ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2",
pac_file="blob://teap_pac", wait_connect=False)
wait_eap_proposed(dev[0], wait_trigger="GET_FAIL")
def test_tnc_ttls_errors(dev, apdev):
"""TNC TTLS local error cases"""
if not os.path.exists("tnc/libhostap_imc.so"):
raise HwsimSkip("No IMC installed")
check_eap_capa(dev[0], "MSCHAPV2")
params = int_eap_server_params()
params["tnc"] = "1"
params["fragment_size"] = "150"
hostapd.add_ap(apdev[0]['ifname'], params)
tests = [
(1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
"DOMAIN\mschapv2 user", "auth=MSCHAPV2"),
(1, "eap_ttls_process_phase2_eap;eap_ttls_process_tnc_start",
"mschap user", "auth=MSCHAP"),
(1, "=eap_tnc_init", "chap user", "auth=CHAP"),
(1, "tncc_init;eap_tnc_init", "pap user", "auth=PAP"),
(1, "eap_msg_alloc;eap_tnc_build_frag_ack", "pap user", "auth=PAP"),
(1, "eap_msg_alloc;eap_tnc_build_msg", "pap user", "auth=PAP"),
(1, "wpabuf_alloc;=eap_tnc_process_fragment", "pap user", "auth=PAP"),
(1, "eap_msg_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
(1, "wpabuf_alloc;=eap_tnc_process", "pap user", "auth=PAP"),
(1, "dup_binstr;tncc_process_if_tnccs", "pap user", "auth=PAP"),
(1, "tncc_get_base64;tncc_process_if_tnccs", "pap user", "auth=PAP"),
(1, "tncc_if_tnccs_start", "pap user", "auth=PAP"),
(1, "tncc_if_tnccs_end", "pap user", "auth=PAP"),
(1, "tncc_parse_imc", "pap user", "auth=PAP"),
(2, "tncc_parse_imc", "pap user", "auth=PAP"),
(3, "tncc_parse_imc", "pap user", "auth=PAP"),
(1, "os_readfile;tncc_read_config", "pap user", "auth=PAP"),
(1, "tncc_init", "pap user", "auth=PAP"),
(1, "TNC_TNCC_ReportMessageTypes", "pap user", "auth=PAP"),
(1, "base64_encode;TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
(1, "=TNC_TNCC_SendMessage", "pap user", "auth=PAP"),
(1, "tncc_get_base64;tncc_process_if_tnccs", "pap user", "auth=PAP")
]
for count, func, identity, phase2 in tests:
with alloc_fail(dev[0], count, func):
dev[0].connect("test-wpa2-eap",
key_mgmt="WPA-EAP",
scan_freq="2412",
eap="TTLS",
anonymous_identity="ttls",
identity=identity,
password="******",
ca_cert="auth_serv/ca.pem",
phase2=phase2,
fragment_size="150",
wait_connect=False)
ev = dev[0].wait_event(["CTRL-EVENT-EAP-PROPOSED-METHOD"],
timeout=15)
if ev is None:
raise Exception("Timeout on EAP start")
wait_fail_trigger(
dev[0],
"GET_ALLOC_FAIL",
note="Allocation failure not triggered for: %d:%s" %
(count, func))
dev[0].request("REMOVE_NETWORK all")
dev[0].wait_disconnected()
dev[0].dump_monitor()