libeap/tests/hwsim/test_ap_ciphers.py

   1 # Cipher suite tests
   2 # Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 from remotehost import remote_compatible
   8 import time
   9 import logging
  10 logger = logging.getLogger()
  11 import os.path
  12
  13 import hwsim_utils
  14 import hostapd
  15 from utils import HwsimSkip, skip_with_fips
  16 from wlantest import Wlantest
  17
  18 def check_cipher(dev, ap, cipher):
  19     if cipher not in dev.get_capability("pairwise"):
  20         raise HwsimSkip("Cipher %s not supported" % cipher)
  21     params = { "ssid": "test-wpa2-psk",
  22                "wpa_passphrase": "12345678",
  23                "wpa": "2",
  24                "wpa_key_mgmt": "WPA-PSK",
  25                "rsn_pairwise": cipher }
  26     hapd = hostapd.add_ap(ap, params)
  27     dev.connect("test-wpa2-psk", psk="12345678",
  28                 pairwise=cipher, group=cipher, scan_freq="2412")
  29     hwsim_utils.test_connectivity(dev, hapd)
  30
  31 def check_group_mgmt_cipher(dev, ap, cipher):
  32     if cipher not in dev.get_capability("group_mgmt"):
  33         raise HwsimSkip("Cipher %s not supported" % cipher)
  34     params = { "ssid": "test-wpa2-psk-pmf",
  35                "wpa_passphrase": "12345678",
  36                "wpa": "2",
  37                "ieee80211w": "2",
  38                "wpa_key_mgmt": "WPA-PSK-SHA256",
  39                "rsn_pairwise": "CCMP",
  40                "group_mgmt_cipher": cipher }
  41     hapd = hostapd.add_ap(ap, params)
  42
  43     Wlantest.setup(hapd)
  44     wt = Wlantest()
  45     wt.flush()
  46     wt.add_passphrase("12345678")
  47
  48     dev.connect("test-wpa2-psk-pmf", psk="12345678", ieee80211w="2",
  49                 key_mgmt="WPA-PSK-SHA256",
  50                 pairwise="CCMP", group="CCMP", scan_freq="2412")
  51     hwsim_utils.test_connectivity(dev, hapd)
  52     hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff")
  53     dev.wait_disconnected()
  54     if wt.get_bss_counter('valid_bip_mmie', ap['bssid']) < 1:
  55         raise Exception("No valid BIP MMIE seen")
  56     if wt.get_bss_counter('bip_deauth', ap['bssid']) < 1:
  57         raise Exception("No valid BIP deauth seen")
  58
  59     if cipher == "AES-128-CMAC":
  60         group_mgmt = "BIP"
  61     else:
  62         group_mgmt = cipher
  63     res =  wt.info_bss('group_mgmt', ap['bssid']).strip()
  64     if res != group_mgmt:
  65         raise Exception("Unexpected group mgmt cipher: " + res)
  66
  67 @remote_compatible
  68 def test_ap_cipher_tkip(dev, apdev):
  69     """WPA2-PSK/TKIP connection"""
  70     skip_with_fips(dev[0])
  71     check_cipher(dev[0], apdev[0], "TKIP")
  72
  73 @remote_compatible
  74 def test_ap_cipher_tkip_countermeasures_ap(dev, apdev):
  75     """WPA-PSK/TKIP countermeasures (detected by AP)"""
  76     skip_with_fips(dev[0])
  77     testfile = "/sys/kernel/debug/ieee80211/%s/netdev:%s/tkip_mic_test" % (dev[0].get_driver_status_field("phyname"), dev[0].ifname)
  78     if dev[0].cmd_execute([ "ls", testfile ])[0] != 0:
  79         raise HwsimSkip("tkip_mic_test not supported in mac80211")
  80
  81     params = { "ssid": "tkip-countermeasures",
  82                "wpa_passphrase": "12345678",
  83                "wpa": "1",
  84                "wpa_key_mgmt": "WPA-PSK",
  85                "wpa_pairwise": "TKIP" }
  86     hapd = hostapd.add_ap(apdev[0], params)
  87
  88     dev[0].connect("tkip-countermeasures", psk="12345678",
  89                    pairwise="TKIP", group="TKIP", scan_freq="2412")
  90
  91     dev[0].dump_monitor()
  92     dev[0].cmd_execute([ "echo", "-n", apdev[0]['bssid'], ">", testfile ],
  93                        shell=True)
  94     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
  95     if ev is not None:
  96         raise Exception("Unexpected disconnection on first Michael MIC failure")
  97
  98     dev[0].cmd_execute([ "echo", "-n", "ff:ff:ff:ff:ff:ff", ">", testfile ],
  99                        shell=True)
 100     ev = dev[0].wait_disconnected(timeout=10,
 101                                   error="No disconnection after two Michael MIC failures")
 102     if "reason=14" not in ev:
 103         raise Exception("Unexpected disconnection reason: " + ev)
 104     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
 105     if ev is not None:
 106         raise Exception("Unexpected connection during TKIP countermeasures")
 107
 108 @remote_compatible
 109 def test_ap_cipher_tkip_countermeasures_sta(dev, apdev):
 110     """WPA-PSK/TKIP countermeasures (detected by STA)"""
 111     skip_with_fips(dev[0])
 112     params = { "ssid": "tkip-countermeasures",
 113                "wpa_passphrase": "12345678",
 114                "wpa": "1",
 115                "wpa_key_mgmt": "WPA-PSK",
 116                "wpa_pairwise": "TKIP" }
 117     hapd = hostapd.add_ap(apdev[0], params)
 118
 119     testfile = "/sys/kernel/debug/ieee80211/%s/netdev:%s/tkip_mic_test" % (hapd.get_driver_status_field("phyname"), apdev[0]['ifname'])
 120     if hapd.cmd_execute([ "ls", testfile ])[0] != 0:
 121         raise HwsimSkip("tkip_mic_test not supported in mac80211")
 122
 123     dev[0].connect("tkip-countermeasures", psk="12345678",
 124                    pairwise="TKIP", group="TKIP", scan_freq="2412")
 125
 126     dev[0].dump_monitor()
 127     hapd.cmd_execute([ "echo", "-n", dev[0].own_addr(), ">", testfile ],
 128                      shell=True)
 129     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
 130     if ev is not None:
 131         raise Exception("Unexpected disconnection on first Michael MIC failure")
 132
 133     hapd.cmd_execute([ "echo", "-n", "ff:ff:ff:ff:ff:ff", ">", testfile ],
 134                      shell=True)
 135     ev = dev[0].wait_disconnected(timeout=10,
 136                                   error="No disconnection after two Michael MIC failures")
 137     if "reason=14 locally_generated=1" not in ev:
 138         raise Exception("Unexpected disconnection reason: " + ev)
 139     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
 140     if ev is not None:
 141         raise Exception("Unexpected connection during TKIP countermeasures")
 142
 143 @remote_compatible
 144 def test_ap_cipher_ccmp(dev, apdev):
 145     """WPA2-PSK/CCMP connection"""
 146     check_cipher(dev[0], apdev[0], "CCMP")
 147
 148 def test_ap_cipher_gcmp(dev, apdev):
 149     """WPA2-PSK/GCMP connection"""
 150     check_cipher(dev[0], apdev[0], "GCMP")
 151
 152 def test_ap_cipher_ccmp_256(dev, apdev):
 153     """WPA2-PSK/CCMP-256 connection"""
 154     check_cipher(dev[0], apdev[0], "CCMP-256")
 155
 156 def test_ap_cipher_gcmp_256(dev, apdev):
 157     """WPA2-PSK/GCMP-256 connection"""
 158     check_cipher(dev[0], apdev[0], "GCMP-256")
 159
 160 @remote_compatible
 161 def test_ap_cipher_mixed_wpa_wpa2(dev, apdev):
 162     """WPA2-PSK/CCMP/ and WPA-PSK/TKIP mixed configuration"""
 163     skip_with_fips(dev[0])
 164     ssid = "test-wpa-wpa2-psk"
 165     passphrase = "12345678"
 166     params = { "ssid": ssid,
 167                "wpa_passphrase": passphrase,
 168                "wpa": "3",
 169                "wpa_key_mgmt": "WPA-PSK",
 170                "rsn_pairwise": "CCMP",
 171                "wpa_pairwise": "TKIP" }
 172     hapd = hostapd.add_ap(apdev[0], params)
 173     dev[0].connect(ssid, psk=passphrase, proto="WPA2",
 174                    pairwise="CCMP", group="TKIP", scan_freq="2412")
 175     status = dev[0].get_status()
 176     if status['key_mgmt'] != 'WPA2-PSK':
 177         raise Exception("Incorrect key_mgmt reported")
 178     if status['pairwise_cipher'] != 'CCMP':
 179         raise Exception("Incorrect pairwise_cipher reported")
 180     if status['group_cipher'] != 'TKIP':
 181         raise Exception("Incorrect group_cipher reported")
 182     bss = dev[0].get_bss(apdev[0]['bssid'])
 183     if bss['ssid'] != ssid:
 184         raise Exception("Unexpected SSID in the BSS entry")
 185     if "[WPA-PSK-TKIP]" not in bss['flags']:
 186         raise Exception("Missing BSS flag WPA-PSK-TKIP")
 187     if "[WPA2-PSK-CCMP]" not in bss['flags']:
 188         raise Exception("Missing BSS flag WPA2-PSK-CCMP")
 189     hwsim_utils.test_connectivity(dev[0], hapd)
 190
 191     dev[1].connect(ssid, psk=passphrase, proto="WPA",
 192                    pairwise="TKIP", group="TKIP", scan_freq="2412")
 193     status = dev[1].get_status()
 194     if status['key_mgmt'] != 'WPA-PSK':
 195         raise Exception("Incorrect key_mgmt reported")
 196     if status['pairwise_cipher'] != 'TKIP':
 197         raise Exception("Incorrect pairwise_cipher reported")
 198     if status['group_cipher'] != 'TKIP':
 199         raise Exception("Incorrect group_cipher reported")
 200     hwsim_utils.test_connectivity(dev[1], hapd)
 201     hwsim_utils.test_connectivity(dev[0], dev[1])
 202
 203 @remote_compatible
 204 def test_ap_cipher_bip(dev, apdev):
 205     """WPA2-PSK with BIP"""
 206     check_group_mgmt_cipher(dev[0], apdev[0], "AES-128-CMAC")
 207
 208 def test_ap_cipher_bip_gmac_128(dev, apdev):
 209     """WPA2-PSK with BIP-GMAC-128"""
 210     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-GMAC-128")
 211
 212 def test_ap_cipher_bip_gmac_256(dev, apdev):
 213     """WPA2-PSK with BIP-GMAC-256"""
 214     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-GMAC-256")
 215
 216 def test_ap_cipher_bip_cmac_256(dev, apdev):
 217     """WPA2-PSK with BIP-CMAC-256"""
 218     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-CMAC-256")