From: Jouni Malinen Date: Sun, 29 Dec 2013 17:25:42 +0000 (+0200) Subject: tests: Verify PMKSA caching X-Git-Tag: hostap_2_1~285 X-Git-Url: http://www.project-moonshot.org/gitweb/?a=commitdiff_plain;h=0fab9ce67a2fc00518af33d5f6b2294a0174886e;p=mech_eap.git tests: Verify PMKSA caching Signed-hostap: Jouni Malinen --- diff --git a/tests/hwsim/test_pmksa_cache.py b/tests/hwsim/test_pmksa_cache.py new file mode 100644 index 0000000..cbd8d8e --- /dev/null +++ b/tests/hwsim/test_pmksa_cache.py @@ -0,0 +1,186 @@ +#!/usr/bin/python +# +# WPA2-Enterprise PMKSA caching tests +# Copyright (c) 2013, Jouni Malinen +# +# This software may be distributed under the terms of the BSD license. +# See README for more details. + +import logging +logger = logging.getLogger() + +import hostapd + +def test_pmksa_cache_on_roam_back(dev, apdev): + """PMKSA cache to skip EAP on reassociation back to same AP""" + params = hostapd.wpa2_eap_params(ssid="test-pmksa-cache") + hostapd.add_ap(apdev[0]['ifname'], params) + bssid = apdev[0]['bssid'] + dev[0].connect("test-pmksa-cache", proto="RSN", key_mgmt="WPA-EAP", + eap="GPSK", identity="gpsk user", + password="abcdefghijklmnop0123456789abcdef", + scan_freq="2412") + pmksa = dev[0].get_pmksa(bssid) + if pmksa is None: + raise Exception("No PMKSA cache entry created") + if pmksa['opportunistic'] != '0': + raise Exception("Unexpected opportunistic PMKSA cache entry") + + hostapd.add_ap(apdev[1]['ifname'], params) + bssid2 = apdev[1]['bssid'] + + dev[0].dump_monitor() + logger.info("Roam to AP2") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid2) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) + if ev is None: + raise Exception("EAP success timed out") + ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + pmksa2 = dev[0].get_pmksa(bssid2) + if pmksa2 is None: + raise Exception("No PMKSA cache entry found") + if pmksa2['opportunistic'] != '0': + raise Exception("Unexpected opportunistic PMKSA cache entry") + + dev[0].dump_monitor() + logger.info("Roam back to AP1") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED", + "CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + if "CTRL-EVENT-EAP-STARTED" in ev: + raise Exception("Unexpected EAP exchange") + pmksa1b = dev[0].get_pmksa(bssid) + if pmksa1b is None: + raise Exception("No PMKSA cache entry found") + if pmksa['pmkid'] != pmksa1b['pmkid']: + raise Exception("Unexpected PMKID change for AP1") + +def test_pmksa_cache_opportunistic_only_on_sta(dev, apdev): + """Opportunistic PMKSA caching enabled only on station""" + params = hostapd.wpa2_eap_params(ssid="test-pmksa-cache") + hostapd.add_ap(apdev[0]['ifname'], params) + bssid = apdev[0]['bssid'] + dev[0].connect("test-pmksa-cache", proto="RSN", key_mgmt="WPA-EAP", + eap="GPSK", identity="gpsk user", + password="abcdefghijklmnop0123456789abcdef", okc=True, + scan_freq="2412") + pmksa = dev[0].get_pmksa(bssid) + if pmksa is None: + raise Exception("No PMKSA cache entry created") + if pmksa['opportunistic'] != '0': + raise Exception("Unexpected opportunistic PMKSA cache entry") + + hostapd.add_ap(apdev[1]['ifname'], params) + bssid2 = apdev[1]['bssid'] + + dev[0].dump_monitor() + logger.info("Roam to AP2") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid2) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=10) + if ev is None: + raise Exception("EAP success timed out") + ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + pmksa2 = dev[0].get_pmksa(bssid2) + if pmksa2 is None: + raise Exception("No PMKSA cache entry found") + if pmksa2['opportunistic'] != '0': + raise Exception("Unexpected opportunistic PMKSA cache entry") + + dev[0].dump_monitor() + logger.info("Roam back to AP1") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED", + "CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + if "CTRL-EVENT-EAP-STARTED" in ev: + raise Exception("Unexpected EAP exchange") + pmksa1b = dev[0].get_pmksa(bssid) + if pmksa1b is None: + raise Exception("No PMKSA cache entry found") + if pmksa['pmkid'] != pmksa1b['pmkid']: + raise Exception("Unexpected PMKID change for AP1") + +def test_pmksa_cache_opportunistic(dev, apdev): + """Opportunistic PMKSA caching""" + params = hostapd.wpa2_eap_params(ssid="test-pmksa-cache") + params['okc'] = "1" + hostapd.add_ap(apdev[0]['ifname'], params) + bssid = apdev[0]['bssid'] + dev[0].connect("test-pmksa-cache", proto="RSN", key_mgmt="WPA-EAP", + eap="GPSK", identity="gpsk user", + password="abcdefghijklmnop0123456789abcdef", okc=True, + scan_freq="2412") + pmksa = dev[0].get_pmksa(bssid) + if pmksa is None: + raise Exception("No PMKSA cache entry created") + if pmksa['opportunistic'] != '0': + raise Exception("Unexpected opportunistic PMKSA cache entry") + + hostapd.add_ap(apdev[1]['ifname'], params) + bssid2 = apdev[1]['bssid'] + + dev[0].dump_monitor() + logger.info("Roam to AP2") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid2) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED", + "CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + if "CTRL-EVENT-EAP-STARTED" in ev: + raise Exception("Unexpected EAP exchange") + pmksa2 = dev[0].get_pmksa(bssid2) + if pmksa2 is None: + raise Exception("No PMKSA cache entry created") + + dev[0].dump_monitor() + logger.info("Roam back to AP1") + dev[0].scan(freq="2412") + dev[0].request("ROAM " + bssid) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED", + "CTRL-EVENT-CONNECTED"], timeout=10) + if ev is None: + raise Exception("Roaming with the AP timed out") + if "CTRL-EVENT-EAP-STARTED" in ev: + raise Exception("Unexpected EAP exchange") + + pmksa1b = dev[0].get_pmksa(bssid) + if pmksa1b is None: + raise Exception("No PMKSA cache entry found") + if pmksa['pmkid'] != pmksa1b['pmkid']: + raise Exception("Unexpected PMKID change for AP1") + +def test_pmksa_cache_expiration(dev, apdev): + """PMKSA cache entry expiration""" + params = hostapd.wpa2_eap_params(ssid="test-pmksa-cache") + hostapd.add_ap(apdev[0]['ifname'], params) + bssid = apdev[0]['bssid'] + dev[0].request("SET dot11RSNAConfigPMKLifetime 10") + dev[0].connect("test-pmksa-cache", proto="RSN", key_mgmt="WPA-EAP", + eap="GPSK", identity="gpsk user", + password="abcdefghijklmnop0123456789abcdef", + scan_freq="2412") + pmksa = dev[0].get_pmksa(bssid) + if pmksa is None: + raise Exception("No PMKSA cache entry created") + logger.info("Wait for PMKSA cache entry to expire") + ev = dev[0].wait_event(["WPA: Key negotiation completed", + "CTRL-EVENT-DISCONNECTED"], timeout=15) + if ev is None: + raise Exception("No EAP reauthentication seen") + if "CTRL-EVENT-DISCONNECTED" in ev: + raise Exception("Unexpected disconnection") + pmksa2 = dev[0].get_pmksa(bssid) + if pmksa['pmkid'] == pmksa2['pmkid']: + raise Exception("PMKID did not change") diff --git a/tests/hwsim/wpasupplicant.py b/tests/hwsim/wpasupplicant.py index 2ce964b..cd7af48 100644 --- a/tests/hwsim/wpasupplicant.py +++ b/tests/hwsim/wpasupplicant.py @@ -532,7 +532,7 @@ class WpaSupplicant: eap=None, identity=None, anonymous_identity=None, password=None, phase1=None, phase2=None, ca_cert=None, domain_suffix_match=None, password_hex=None, - client_cert=None, private_key=None, peerkey=False, + client_cert=None, private_key=None, peerkey=False, okc=False, wait_connect=True, only_add_network=False): logger.info("Connect STA " + self.ifname + " to AP") id = self.add_network() @@ -579,6 +579,8 @@ class WpaSupplicant: domain_suffix_match) if peerkey: self.set_network(id, "peerkey", "1") + if okc: + self.set_network(id, "proactive_key_caching", "1") if only_add_network: return id if wait_connect: @@ -666,3 +668,18 @@ class WpaSupplicant: [name,value] = l.split('=', 1) vals[name] = value return vals + + def get_pmksa(self, bssid): + res = self.request("PMKSA") + lines = res.splitlines() + for l in lines: + if bssid not in l: + continue + vals = dict() + [index,aa,pmkid,expiration,opportunistic] = l.split(' ') + vals['index'] = index + vals['pmkid'] = pmkid + vals['expiration'] = expiration + vals['opportunistic'] = opportunistic + return vals + return None