libeap/tests/hwsim/test_ap_ciphers.py

   1 # Cipher suite tests
   2 # Copyright (c) 2013-2015, Jouni Malinen <j@w1.fi>
   3 #
   4 # This software may be distributed under the terms of the BSD license.
   5 # See README for more details.
   6
   7 import time
   8 import logging
   9 logger = logging.getLogger()
  10 import os.path
  11
  12 import hwsim_utils
  13 import hostapd
  14 from utils import HwsimSkip, skip_with_fips
  15 from wlantest import Wlantest
  16
  17 def check_cipher(dev, ap, cipher):
  18     if cipher not in dev.get_capability("pairwise"):
  19         raise HwsimSkip("Cipher %s not supported" % cipher)
  20     params = { "ssid": "test-wpa2-psk",
  21                "wpa_passphrase": "12345678",
  22                "wpa": "2",
  23                "wpa_key_mgmt": "WPA-PSK",
  24                "rsn_pairwise": cipher }
  25     hapd = hostapd.add_ap(ap['ifname'], params)
  26     dev.connect("test-wpa2-psk", psk="12345678",
  27                 pairwise=cipher, group=cipher, scan_freq="2412")
  28     hwsim_utils.test_connectivity(dev, hapd)
  29
  30 def check_group_mgmt_cipher(dev, ap, cipher):
  31     wt = Wlantest()
  32     wt.flush()
  33     wt.add_passphrase("12345678")
  34
  35     if cipher not in dev.get_capability("group_mgmt"):
  36         raise HwsimSkip("Cipher %s not supported" % cipher)
  37     params = { "ssid": "test-wpa2-psk-pmf",
  38                "wpa_passphrase": "12345678",
  39                "wpa": "2",
  40                "ieee80211w": "2",
  41                "wpa_key_mgmt": "WPA-PSK-SHA256",
  42                "rsn_pairwise": "CCMP",
  43                "group_mgmt_cipher": cipher }
  44     hapd = hostapd.add_ap(ap['ifname'], params)
  45     dev.connect("test-wpa2-psk-pmf", psk="12345678", ieee80211w="2",
  46                 key_mgmt="WPA-PSK-SHA256",
  47                 pairwise="CCMP", group="CCMP", scan_freq="2412")
  48     hwsim_utils.test_connectivity(dev, hapd)
  49     hapd.request("DEAUTHENTICATE ff:ff:ff:ff:ff:ff")
  50     dev.wait_disconnected()
  51     if wt.get_bss_counter('valid_bip_mmie', ap['bssid']) < 1:
  52         raise Exception("No valid BIP MMIE seen")
  53     if wt.get_bss_counter('bip_deauth', ap['bssid']) < 1:
  54         raise Exception("No valid BIP deauth seen")
  55
  56     if cipher == "AES-128-CMAC":
  57         group_mgmt = "BIP"
  58     else:
  59         group_mgmt = cipher
  60     res =  wt.info_bss('group_mgmt', ap['bssid']).strip()
  61     if res != group_mgmt:
  62         raise Exception("Unexpected group mgmt cipher: " + res)
  63
  64 def test_ap_cipher_tkip(dev, apdev):
  65     """WPA2-PSK/TKIP connection"""
  66     skip_with_fips(dev[0])
  67     check_cipher(dev[0], apdev[0], "TKIP")
  68
  69 def test_ap_cipher_tkip_countermeasures_ap(dev, apdev):
  70     """WPA-PSK/TKIP countermeasures (detected by AP)"""
  71     skip_with_fips(dev[0])
  72     testfile = "/sys/kernel/debug/ieee80211/%s/netdev:%s/tkip_mic_test" % (dev[0].get_driver_status_field("phyname"), dev[0].ifname)
  73     if not os.path.exists(testfile):
  74         raise HwsimSkip("tkip_mic_test not supported in mac80211")
  75
  76     params = { "ssid": "tkip-countermeasures",
  77                "wpa_passphrase": "12345678",
  78                "wpa": "1",
  79                "wpa_key_mgmt": "WPA-PSK",
  80                "wpa_pairwise": "TKIP" }
  81     hapd = hostapd.add_ap(apdev[0]['ifname'], params)
  82
  83     dev[0].connect("tkip-countermeasures", psk="12345678",
  84                    pairwise="TKIP", group="TKIP", scan_freq="2412")
  85
  86     dev[0].dump_monitor()
  87     with open(testfile, "w") as f:
  88         f.write(apdev[0]['bssid'])
  89     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
  90     if ev is not None:
  91         raise Exception("Unexpected disconnection on first Michael MIC failure")
  92
  93     with open(testfile, "w") as f:
  94         f.write("ff:ff:ff:ff:ff:ff")
  95     ev = dev[0].wait_disconnected(timeout=10,
  96                                   error="No disconnection after two Michael MIC failures")
  97     if "reason=14" not in ev:
  98         raise Exception("Unexpected disconnection reason: " + ev)
  99     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
 100     if ev is not None:
 101         raise Exception("Unexpected connection during TKIP countermeasures")
 102
 103 def test_ap_cipher_tkip_countermeasures_sta(dev, apdev):
 104     """WPA-PSK/TKIP countermeasures (detected by STA)"""
 105     skip_with_fips(dev[0])
 106     params = { "ssid": "tkip-countermeasures",
 107                "wpa_passphrase": "12345678",
 108                "wpa": "1",
 109                "wpa_key_mgmt": "WPA-PSK",
 110                "wpa_pairwise": "TKIP" }
 111     hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 112
 113     testfile = "/sys/kernel/debug/ieee80211/%s/netdev:%s/tkip_mic_test" % (hapd.get_driver_status_field("phyname"), apdev[0]['ifname'])
 114     if not os.path.exists(testfile):
 115         raise HwsimSkip("tkip_mic_test not supported in mac80211")
 116
 117     dev[0].connect("tkip-countermeasures", psk="12345678",
 118                    pairwise="TKIP", group="TKIP", scan_freq="2412")
 119
 120     dev[0].dump_monitor()
 121     with open(testfile, "w") as f:
 122         f.write(dev[0].p2p_dev_addr())
 123     ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED"], timeout=1)
 124     if ev is not None:
 125         raise Exception("Unexpected disconnection on first Michael MIC failure")
 126
 127     with open(testfile, "w") as f:
 128         f.write("ff:ff:ff:ff:ff:ff")
 129     ev = dev[0].wait_disconnected(timeout=10,
 130                                   error="No disconnection after two Michael MIC failures")
 131     if "reason=14 locally_generated=1" not in ev:
 132         raise Exception("Unexpected disconnection reason: " + ev)
 133     ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
 134     if ev is not None:
 135         raise Exception("Unexpected connection during TKIP countermeasures")
 136
 137 def test_ap_cipher_ccmp(dev, apdev):
 138     """WPA2-PSK/CCMP connection"""
 139     check_cipher(dev[0], apdev[0], "CCMP")
 140
 141 def test_ap_cipher_gcmp(dev, apdev):
 142     """WPA2-PSK/GCMP connection"""
 143     check_cipher(dev[0], apdev[0], "GCMP")
 144
 145 def test_ap_cipher_ccmp_256(dev, apdev):
 146     """WPA2-PSK/CCMP-256 connection"""
 147     check_cipher(dev[0], apdev[0], "CCMP-256")
 148
 149 def test_ap_cipher_gcmp_256(dev, apdev):
 150     """WPA2-PSK/GCMP-256 connection"""
 151     check_cipher(dev[0], apdev[0], "GCMP-256")
 152
 153 def test_ap_cipher_mixed_wpa_wpa2(dev, apdev):
 154     """WPA2-PSK/CCMP/ and WPA-PSK/TKIP mixed configuration"""
 155     skip_with_fips(dev[0])
 156     ssid = "test-wpa-wpa2-psk"
 157     passphrase = "12345678"
 158     params = { "ssid": ssid,
 159                "wpa_passphrase": passphrase,
 160                "wpa": "3",
 161                "wpa_key_mgmt": "WPA-PSK",
 162                "rsn_pairwise": "CCMP",
 163                "wpa_pairwise": "TKIP" }
 164     hapd = hostapd.add_ap(apdev[0]['ifname'], params)
 165     dev[0].connect(ssid, psk=passphrase, proto="WPA2",
 166                    pairwise="CCMP", group="TKIP", scan_freq="2412")
 167     status = dev[0].get_status()
 168     if status['key_mgmt'] != 'WPA2-PSK':
 169         raise Exception("Incorrect key_mgmt reported")
 170     if status['pairwise_cipher'] != 'CCMP':
 171         raise Exception("Incorrect pairwise_cipher reported")
 172     if status['group_cipher'] != 'TKIP':
 173         raise Exception("Incorrect group_cipher reported")
 174     bss = dev[0].get_bss(apdev[0]['bssid'])
 175     if bss['ssid'] != ssid:
 176         raise Exception("Unexpected SSID in the BSS entry")
 177     if "[WPA-PSK-TKIP]" not in bss['flags']:
 178         raise Exception("Missing BSS flag WPA-PSK-TKIP")
 179     if "[WPA2-PSK-CCMP]" not in bss['flags']:
 180         raise Exception("Missing BSS flag WPA2-PSK-CCMP")
 181     hwsim_utils.test_connectivity(dev[0], hapd)
 182
 183     dev[1].connect(ssid, psk=passphrase, proto="WPA",
 184                    pairwise="TKIP", group="TKIP", scan_freq="2412")
 185     status = dev[1].get_status()
 186     if status['key_mgmt'] != 'WPA-PSK':
 187         raise Exception("Incorrect key_mgmt reported")
 188     if status['pairwise_cipher'] != 'TKIP':
 189         raise Exception("Incorrect pairwise_cipher reported")
 190     if status['group_cipher'] != 'TKIP':
 191         raise Exception("Incorrect group_cipher reported")
 192     hwsim_utils.test_connectivity(dev[1], hapd)
 193     hwsim_utils.test_connectivity(dev[0], dev[1])
 194
 195 def test_ap_cipher_bip(dev, apdev):
 196     """WPA2-PSK with BIP"""
 197     check_group_mgmt_cipher(dev[0], apdev[0], "AES-128-CMAC")
 198
 199 def test_ap_cipher_bip_gmac_128(dev, apdev):
 200     """WPA2-PSK with BIP-GMAC-128"""
 201     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-GMAC-128")
 202
 203 def test_ap_cipher_bip_gmac_256(dev, apdev):
 204     """WPA2-PSK with BIP-GMAC-256"""
 205     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-GMAC-256")
 206
 207 def test_ap_cipher_bip_cmac_256(dev, apdev):
 208     """WPA2-PSK with BIP-CMAC-256"""
 209     check_group_mgmt_cipher(dev[0], apdev[0], "BIP-CMAC-256")