From 22d83ec560b5b3780159297571cf308ea42adf48 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Fri, 14 Aug 2026 22:42:00 -0700 Subject: [PATCH] Load wolfProvider at process start and run hostap FIPS tests on approved algorithms only --- .../hostap-hostap_2_11-wolfprov-fips.patch | 792 +++++++++++++++++- 1 file changed, 754 insertions(+), 38 deletions(-) diff --git a/wolfProvider/hostap/hostap-hostap_2_11-wolfprov-fips.patch b/wolfProvider/hostap/hostap-hostap_2_11-wolfprov-fips.patch index 64a29828..9f945220 100644 --- a/wolfProvider/hostap/hostap-hostap_2_11-wolfprov-fips.patch +++ b/wolfProvider/hostap/hostap-hostap_2_11-wolfprov-fips.patch @@ -1,8 +1,25 @@ diff --git a/src/crypto/crypto_openssl.c b/src/crypto/crypto_openssl.c -index 2d8ff60..1bb28b6 100644 +index 2d8ff60..5c158d3 100644 --- a/src/crypto/crypto_openssl.c +++ b/src/crypto/crypto_openssl.c -@@ -196,7 +196,7 @@ void openssl_load_legacy_provider(void) +@@ -190,13 +190,24 @@ static int EC_GROUP_get_curve(const EC_GROUP *group, BIGNUM *p, BIGNUM *a, + static OSSL_PROVIDER *openssl_legacy_provider = NULL; + #endif /* OpenSSL version >= 3.0 */ + ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++static void __attribute__((constructor)) openssl_load_wolfprov(void) ++{ ++ /* Route all crypto through wolfProvider from process start; on success ++ * retain_fallbacks=0 keeps the stock default provider inactive, and a ++ * failed load leaves the fallback providers untouched. */ ++ OSSL_PROVIDER_try_load(NULL, "libwolfprov", 0); ++} ++#endif /* OpenSSL version >= 3.0 */ ++ ++ + void openssl_load_legacy_provider(void) + { + #if OPENSSL_VERSION_NUMBER >= 0x30000000L if (openssl_legacy_provider) return; @@ -11,63 +28,709 @@ index 2d8ff60..1bb28b6 100644 #endif /* OpenSSL version >= 3.0 */ } +diff --git a/tests/hwsim/hostapd.py b/tests/hwsim/hostapd.py +index ebb2e32..1726f6e 100644 +--- a/tests/hwsim/hostapd.py ++++ b/tests/hwsim/hostapd.py +@@ -843,7 +843,15 @@ def wpa_eap_params(ssid=None): + return params + + def wpa2_eap_params(ssid=None): +- params = radius_params() ++ params = {"eap_server": "1", ++ "eap_user_file": "auth_serv/eap_user.conf", ++ "ca_cert": "auth_serv/ca.pem", ++ "server_cert": "auth_serv/server.pem", ++ "private_key": "auth_serv/server.key", ++ "pac_opaque_encr_key": "000102030405060708090a0b0c0d0e0f", ++ "eap_fast_a_id": "101112131415161718191a1b1c1d1e1f", ++ "eap_fast_a_id_info": "test server", ++ "eap_fast_prov": "2"} + params["wpa"] = "2" + params["wpa_key_mgmt"] = "WPA-EAP" + params["rsn_pairwise"] = "CCMP" +diff --git a/tests/hwsim/test_ap_ciphers.py b/tests/hwsim/test_ap_ciphers.py +index 5ad3e02..ce45fe9 100644 +--- a/tests/hwsim/test_ap_ciphers.py ++++ b/tests/hwsim/test_ap_ciphers.py +@@ -76,13 +76,6 @@ def check_group_mgmt_cipher(dev, ap, cipher, sta_req_cipher=None): + if res != group_mgmt: + raise Exception("Unexpected group mgmt cipher: " + res) + +-@remote_compatible +-def test_ap_cipher_tkip(dev, apdev): +- """WPA2-PSK/TKIP connection""" +- skip_with_fips(dev[0]) +- skip_without_tkip(dev[0]) +- check_cipher(dev[0], apdev[0], "TKIP") +- + @remote_compatible + def test_ap_cipher_tkip_countermeasures_ap(dev, apdev): + """WPA-PSK/TKIP countermeasures (detected by AP)""" diff --git a/tests/hwsim/test_ap_eap.py b/tests/hwsim/test_ap_eap.py -index f8e75b5..3820ae0 100644 +index f8e75b5..cceb247 100644 --- a/tests/hwsim/test_ap_eap.py +++ b/tests/hwsim/test_ap_eap.py -@@ -2000,16 +2000,6 @@ def test_ap_wpa2_eap_ttls_mschapv2_utf8(dev, apdev): - dev[2].request("REMOVE_NETWORK all") - dev[2].wait_disconnected() +@@ -1882,36 +1882,6 @@ def test_ap_wpa2_eap_ttls_mschap_incorrect_password(dev, apdev): + ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAP", + expect_failure=True) --def test_ap_wpa2_eap_ttls_eap_gtc(dev, apdev): -- """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC""" +-def test_ap_wpa2_eap_ttls_mschapv2(dev, apdev): +- """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2""" +- check_domain_suffix_match(dev[0]) +- check_eap_capa(dev[0], "MSCHAPV2") - params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") - hapd = hostapd.add_ap(apdev[0], params) -- eap_connect(dev[0], hapd, "TTLS", "user", +- eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user", - anonymous_identity="ttls", password="password", -- ca_cert="auth_serv/ca.pem", phase2="autheap=GTC") +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- domain_suffix_match="server.w1.fi") - hwsim_utils.test_connectivity(dev[0], hapd) +- sta1 = hapd.get_sta(dev[0].p2p_interface_addr()) +- eapol1 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol") - eap_reauth(dev[0], "TTLS") +- sta2 = hapd.get_sta(dev[0].p2p_interface_addr()) +- eapol2 = hapd.get_sta(dev[0].p2p_interface_addr(), info="eapol") +- if int(sta2['dot1xAuthEapolFramesRx']) <= int(sta1['dot1xAuthEapolFramesRx']): +- raise Exception("dot1xAuthEapolFramesRx did not increase") +- if int(eapol2['authAuthEapStartsWhileAuthenticated']) < 1: +- raise Exception("authAuthEapStartsWhileAuthenticated did not increase") +- if int(eapol2['backendAuthSuccesses']) <= int(eapol1['backendAuthSuccesses']): +- raise Exception("backendAuthSuccesses did not increase") - - def test_ap_wpa2_eap_ttls_eap_gtc_incorrect_password(dev, apdev): - """WPA2-Enterprise connection using EAP-TTLS/EAP-GTC - incorrect password""" +- logger.info("Password as hash value") +- dev[0].request("REMOVE_NETWORK all") +- eap_connect(dev[0], hapd, "TTLS", "DOMAIN\mschapv2 user", +- anonymous_identity="ttls", +- password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") +- + def test_ap_wpa2_eap_ttls_invalid_phase2(dev, apdev): + """EAP-TTLS with invalid phase2 parameter values""" params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") -@@ -2548,17 +2538,6 @@ def test_ap_wpa2_eap_peap_eap_gtc(dev, apdev, params): - anonymous_identity="peap", password="password", - ca_cert="auth_serv/ca.pem", phase2="auth=GTC") +@@ -2071,17 +2041,6 @@ def test_ap_wpa2_eap_ttls_eap_gtc_oom(dev, apdev): + dev[0].request("REMOVE_NETWORK all") + dev[0].wait_disconnected() --def test_ap_wpa2_eap_peap_eap_tls(dev, apdev): -- """WPA2-Enterprise connection using EAP-PEAP/EAP-TLS""" +-def test_ap_wpa2_eap_ttls_eap_md5(dev, apdev): +- """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5""" +- check_eap_capa(dev[0], "MD5") - params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") - hapd = hostapd.add_ap(apdev[0], params) -- eap_connect(dev[0], hapd, "PEAP", "cert user", -- ca_cert="auth_serv/ca.pem", phase2="auth=TLS", -- ca_cert2="auth_serv/ca.pem", -- client_cert2="auth_serv/user.pem", -- private_key2="auth_serv/user.key") +- eap_connect(dev[0], hapd, "TTLS", "user", +- anonymous_identity="ttls", password="password", +- ca_cert="auth_serv/ca.pem", phase2="autheap=MD5") +- hwsim_utils.test_connectivity(dev[0], hapd) +- eap_reauth(dev[0], "TTLS") +- + def test_ap_wpa2_eap_ttls_eap_md5_incorrect_password(dev, apdev): + """WPA2-Enterprise connection using EAP-TTLS/EAP-MD5 - incorrect password""" + check_eap_capa(dev[0], "MD5") +@@ -2377,36 +2336,6 @@ def test_ap_wpa2_eap_fast_eap_aka(dev, apdev): + ca_cert="auth_serv/ca.pem", phase2="auth=AKA") + eap_reauth(dev[0], "FAST") + +-def test_ap_wpa2_eap_peap_eap_mschapv2(dev, apdev): +- """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2""" +- check_eap_capa(dev[0], "MSCHAPV2") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hapd = hostapd.add_ap(apdev[0], params) +- eap_connect(dev[0], hapd, "PEAP", "user", +- anonymous_identity="peap", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") +- hwsim_utils.test_connectivity(dev[0], hapd) - eap_reauth(dev[0], "PEAP") +- dev[0].request("REMOVE_NETWORK all") +- eap_connect(dev[0], hapd, "PEAP", "user", +- anonymous_identity="peap", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- fragment_size="200") - - def test_ap_wpa2_eap_peap_eap_vendor(dev, apdev): - """WPA2-Enterprise connection using EAP-PEAP/EAP-vendor""" - params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") -@@ -2566,15 +2545,6 @@ def test_ap_wpa2_eap_peap_eap_vendor(dev, apdev): - eap_connect(dev[0], hapd, "PEAP", "vendor-test-2", - ca_cert="auth_serv/ca.pem", phase2="auth=VENDOR-TEST") +- logger.info("Password as hash value") +- dev[0].request("REMOVE_NETWORK all") +- eap_connect(dev[0], hapd, "PEAP", "user", +- anonymous_identity="peap", +- password_hex="hash:8846f7eaee8fb117ad06bdd830b7586c", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2") +- +- logger.info("Negative test with incorrect password") +- dev[0].request("REMOVE_NETWORK all") +- eap_connect(dev[0], hapd, "PEAP", "user", +- anonymous_identity="peap", password="password1", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- expect_failure=True) +- + def test_ap_wpa2_eap_peap_eap_mschapv2_domain(dev, apdev): + """WPA2-Enterprise connection using EAP-PEAP/EAP-MSCHAPv2 with domain""" + check_eap_capa(dev[0], "MSCHAPV2") +@@ -3816,400 +3745,6 @@ def test_ap_wpa2_eap_vendor_test_oom(dev, apdev): + dev[0].request("REMOVE_NETWORK all") + dev[0].wait_disconnected() --def test_ap_wpa2_eap_tls(dev, apdev): -- """WPA2-Enterprise connection using EAP-TLS""" +-def test_ap_wpa2_eap_fast_mschapv2_unauth_prov(dev, apdev): +- """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and unauthenticated provisioning""" +- check_eap_capa(dev[0], "FAST") - params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") - hapd = hostapd.add_ap(apdev[0], params) -- eap_connect(dev[0], hapd, "TLS", "tls user", ca_cert="auth_serv/ca.pem", -- client_cert="auth_serv/user.pem", -- private_key="auth_serv/user.key") -- eap_reauth(dev[0], "TLS") +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", pac_file="blob://fast_pac") +- hwsim_utils.test_connectivity(dev[0], hapd) +- res = eap_reauth(dev[0], "FAST") +- if res['tls_session_reused'] != '1': +- raise Exception("EAP-FAST could not use PAC session ticket") - - def test_eap_tls_pkcs8_pkcs5_v2_des3(dev, apdev): - """WPA2-Enterprise connection using EAP-TLS and PKCS #8, PKCS #5 v2 DES3 key""" - params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +-def test_ap_wpa2_eap_fast_pac_file(dev, apdev, params): +- """WPA2-Enterprise connection using EAP-FAST/MSCHAPv2 and PAC file""" +- check_eap_capa(dev[0], "FAST") +- pac_file = os.path.join(params['logdir'], "fast.pac") +- pac_file2 = os.path.join(params['logdir'], "fast-bin.pac") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hapd = hostapd.add_ap(apdev[0], params) +- +- try: +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", pac_file=pac_file) +- with open(pac_file, "r") as f: +- data = f.read() +- if "wpa_supplicant EAP-FAST PAC file - version 1" not in data: +- raise Exception("PAC file header missing") +- if "PAC-Key=" not in data: +- raise Exception("PAC-Key missing from PAC file") +- dev[0].request("REMOVE_NETWORK all") +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- pac_file=pac_file) +- +- eap_connect(dev[1], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file=pac_file2) +- dev[1].request("REMOVE_NETWORK all") +- eap_connect(dev[1], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_pac_format=binary", +- pac_file=pac_file2) +- finally: +- try: +- os.remove(pac_file) +- except: +- pass +- try: +- os.remove(pac_file2) +- except: +- pass +- +-def test_ap_wpa2_eap_fast_binary_pac(dev, apdev): +- """WPA2-Enterprise connection using EAP-FAST and binary PAC format""" +- check_eap_capa(dev[0], "FAST") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hapd = hostapd.add_ap(apdev[0], params) +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_max_pac_list_len=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin") +- res = eap_reauth(dev[0], "FAST") +- if res['tls_session_reused'] != '1': +- raise Exception("EAP-FAST could not use PAC session ticket") +- +- # Verify fast_max_pac_list_len=0 special case +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_max_pac_list_len=0 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin") +- +-def test_ap_wpa2_eap_fast_missing_pac_config(dev, apdev): +- """WPA2-Enterprise connection using EAP-FAST and missing PAC config""" +- check_eap_capa(dev[0], "FAST") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- pac_file="blob://fast_pac_not_in_use", +- wait_connect=False, scan_freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) +- if ev is None: +- raise Exception("Timeout on EAP failure report") +- dev[0].request("REMOVE_NETWORK all") +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- wait_connect=False, scan_freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) +- if ev is None: +- raise Exception("Timeout on EAP failure report") +- +-def test_ap_wpa2_eap_fast_binary_pac_errors(dev, apdev): +- """EAP-FAST and binary PAC errors""" +- check_eap_capa(dev[0], "FAST") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hapd = hostapd.add_ap(apdev[0], params) +- +- tests = [(1, "=eap_fast_save_pac_bin"), +- (1, "eap_fast_write_pac"), +- (2, "eap_fast_write_pac"),] +- for count, func in tests: +- if "OK" not in dev[0].request("SET blob fast_pac_bin_errors "): +- raise Exception("Could not set blob") +- +- with alloc_fail(dev[0], count, func): +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin_errors") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- tests = ["00", "000000000000", "6ae4920c0001", +- "6ae4920c000000", +- "6ae4920c0000" + "0000" + 32*"00" + "ffff" + "0000", +- "6ae4920c0000" + "0000" + 32*"00" + "0001" + "0000", +- "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0001", +- "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0008" + "00040000" + "0007000100"] +- for t in tests: +- if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + t): +- raise Exception("Could not set blob") +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin_errors", +- scan_freq="2412", wait_connect=False) +- ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], +- timeout=5) +- if ev is None: +- raise Exception("Failure not reported") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0000" +- tests = [(1, "eap_fast_load_pac_bin"), +- (2, "eap_fast_load_pac_bin"), +- (3, "eap_fast_load_pac_bin")] +- for count, func in tests: +- if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac): +- raise Exception("Could not set blob") +- +- with alloc_fail(dev[0], count, func): +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin_errors", +- scan_freq="2412", wait_connect=False) +- ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], +- timeout=5) +- if ev is None: +- raise Exception("Failure not reported") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0005" + "0011223344" +- if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac): +- raise Exception("Could not set blob") +- +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin_errors") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- pac = "6ae4920c0000" + "0000" + 32*"00" + "0000" + "0009" + "00040000" + "0007000100" +- tests = [(1, "eap_fast_pac_get_a_id"), +- (2, "eap_fast_pac_get_a_id")] +- for count, func in tests: +- if "OK" not in dev[0].request("SET blob fast_pac_bin_errors " + pac): +- raise Exception("Could not set blob") +- with alloc_fail(dev[0], count, func): +- eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_pac_format=binary", +- pac_file="blob://fast_pac_bin_errors") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +-def test_ap_wpa2_eap_fast_text_pac_errors(dev, apdev): +- """EAP-FAST and text PAC errors""" +- check_eap_capa(dev[0], "FAST") +- params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") +- hostapd.add_ap(apdev[0], params) +- +- tests = [(1, "eap_fast_parse_hex;eap_fast_parse_pac_key"), +- (1, "eap_fast_parse_hex;eap_fast_parse_pac_opaque"), +- (1, "eap_fast_parse_hex;eap_fast_parse_a_id"), +- (1, "eap_fast_parse_start"), +- (1, "eap_fast_save_pac")] +- for count, func in tests: +- dev[0].request("FLUSH") +- if "OK" not in dev[0].request("SET blob fast_pac_text_errors "): +- raise Exception("Could not set blob") +- +- with alloc_fail(dev[0], count, func): +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac_text_errors", +- scan_freq="2412", wait_connect=False) +- wait_fail_trigger(dev[0], "GET_ALLOC_FAIL") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- pac = "wpa_supplicant EAP-FAST PAC file - version 1\n" +- pac += "START\n" +- pac += "PAC-Type\n" +- pac += "END\n" +- if "OK" not in dev[0].request("SET blob fast_pac_text_errors " + binascii.hexlify(pac.encode()).decode()): +- raise Exception("Could not set blob") +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac_text_errors", +- scan_freq="2412", wait_connect=False) +- ev = dev[0].wait_event(["EAP: Failed to initialize EAP method"], timeout=5) +- if ev is None: +- raise Exception("Failure not reported") +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- dev[0].request("FLUSH") +- if "OK" not in dev[0].request("SET blob fast_pac_text_errors "): +- raise Exception("Could not set blob") +- +- with alloc_fail(dev[0], 1, "eap_fast_add_pac_data"): +- for i in range(3): +- params = int_eap_server_params() +- params['ssid'] = "test-wpa2-eap-2" +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- +- hapd2 = hostapd.add_ap(apdev[1], params) +- +- dev[0].connect("test-wpa2-eap-2", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac_text_errors", +- scan_freq="2412", wait_connect=False) +- dev[0].wait_connected() +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- hapd2.disable() +- +-def test_ap_wpa2_eap_fast_pac_truncate(dev, apdev): +- """EAP-FAST and PAC list truncation""" +- check_eap_capa(dev[0], "FAST") +- if "OK" not in dev[0].request("SET blob fast_pac_truncate "): +- raise Exception("Could not set blob") +- for i in range(5): +- params = int_eap_server_params() +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1 fast_max_pac_list_len=2", +- pac_file="blob://fast_pac_truncate", +- scan_freq="2412", wait_connect=False) +- dev[0].wait_connected() +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- hapd.disable() +- +-def test_ap_wpa2_eap_fast_pac_refresh(dev, apdev): +- """EAP-FAST and PAC refresh""" +- check_eap_capa(dev[0], "FAST") +- if "OK" not in dev[0].request("SET blob fast_pac_refresh "): +- raise Exception("Could not set blob") +- for i in range(2): +- params = int_eap_server_params() +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- params['pac_key_refresh_time'] = "1" +- params['pac_key_lifetime'] = "10" +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac_refresh", +- scan_freq="2412", wait_connect=False) +- dev[0].wait_connected() +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- hapd.disable() +- +- for i in range(2): +- params = int_eap_server_params() +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- params['pac_key_refresh_time'] = "10" +- params['pac_key_lifetime'] = "10" +- hapd = hostapd.add_ap(apdev[0], params) +- +- dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac_refresh", +- scan_freq="2412", wait_connect=False) +- dev[0].wait_connected() +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- +- hapd.disable() +- +-def test_ap_wpa2_eap_fast_pac_lifetime(dev, apdev): +- """EAP-FAST and PAC lifetime""" +- check_eap_capa(dev[0], "FAST") +- if "OK" not in dev[0].request("SET blob fast_pac_refresh "): +- raise Exception("Could not set blob") +- +- i = 0 +- params = int_eap_server_params() +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- params['pac_key_refresh_time'] = "0" +- params['pac_key_lifetime'] = "2" +- hapd = hostapd.add_ap(apdev[0], params) +- +- id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=2", +- pac_file="blob://fast_pac_refresh", +- scan_freq="2412", wait_connect=False) +- dev[0].wait_connected() +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- +- time.sleep(3) +- dev[0].request("PMKSA_FLUSH") +- dev[0].request("RECONNECT") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10) +- if ev is None: +- raise Exception("No EAP-Failure seen after expired PAC") +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- +- dev[0].select_network(id) +- dev[0].wait_connected() +- dev[0].request("REMOVE_NETWORK all") +- dev[0].wait_disconnected() +- + def test_ap_wpa2_eap_fast_gtc_auth_prov(dev, apdev): + """WPA2-Enterprise connection using EAP-FAST/GTC and authenticated provisioning""" + check_eap_capa(dev[0], "FAST") +@@ -4271,32 +3806,6 @@ def test_ap_wpa2_eap_fast_prf_oom(dev, apdev): + raise Exception("EAP failure not reported") + dev[0].request("DISCONNECT") + +-def test_ap_wpa2_eap_fast_server_oom(dev, apdev): +- """EAP-FAST/MSCHAPv2 and server OOM""" +- check_eap_capa(dev[0], "FAST") +- +- params = int_eap_server_params() +- params['dh_file'] = 'auth_serv/dh.conf' +- params['pac_opaque_encr_key'] = '000102030405060708090a0b0c0d0e0f' +- params['eap_fast_a_id'] = '1011' +- params['eap_fast_a_id_info'] = 'another test server' +- hapd = hostapd.add_ap(apdev[0], params) +- +- with alloc_fail(hapd, 1, "tls_session_ticket_ext_cb"): +- id = eap_connect(dev[0], hapd, "FAST", "user", +- anonymous_identity="FAST", password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=1", +- pac_file="blob://fast_pac", +- expect_failure=True) +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=10) +- if ev is None: +- raise Exception("No EAP failure reported") +- dev[0].wait_disconnected() +- dev[0].request("DISCONNECT") +- +- dev[0].select_network(id, freq="2412") +- + def test_ap_wpa2_eap_fast_cipher_suites(dev, apdev): + """EAP-FAST and different TLS cipher suites""" + check_eap_capa(dev[0], "FAST") +@@ -4350,131 +3859,6 @@ def test_ap_wpa2_eap_fast_cipher_suites(dev, apdev): + if res != cipher: + raise Exception("Unexpected TLS cipher info (configured %s): %s" % (cipher, res)) + +-def test_ap_wpa2_eap_fast_prov(dev, apdev): +- """EAP-FAST and provisioning options""" +- check_eap_capa(dev[0], "FAST") +- if "OK" not in dev[0].request("SET blob fast_pac_prov "): +- raise Exception("Could not set blob") +- +- i = 100 +- params = int_eap_server_params() +- params['disable_pmksa_caching'] = '1' +- params['pac_opaque_encr_key'] = "000102030405060708090a0b0c0dff%02x" % i +- params['eap_fast_a_id'] = "101112131415161718191a1b1c1dff%02x" % i +- params['eap_fast_a_id_info'] = "test server %d" % i +- params['eap_fast_prov'] = "0" +- hapd = hostapd.add_ap(apdev[0], params) +- +- logger.info("Provisioning attempt while server has provisioning disabled") +- id = dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="FAST", +- identity="user", anonymous_identity="FAST", +- password="password", +- ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", +- phase1="fast_provisioning=2", +- pac_file="blob://fast_pac_prov", +- scan_freq="2412", wait_connect=False) +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='failure'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_disconnected() +- dev[0].request("DISCONNECT") +- dev[0].dump_monitor() +- +- hapd.disable() +- logger.info("Authenticated provisioning") +- hapd.set("eap_fast_prov", "2") +- hapd.enable() +- +- dev[0].select_network(id, freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='success'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_connected() +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- dev[0].dump_monitor() +- +- hapd.disable() +- logger.info("Provisioning disabled - using previously provisioned PAC") +- hapd.set("eap_fast_prov", "0") +- hapd.enable() +- +- dev[0].select_network(id, freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='success'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_connected() +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- dev[0].dump_monitor() +- +- logger.info("Drop PAC and verify connection failure") +- if "OK" not in dev[0].request("SET blob fast_pac_prov "): +- raise Exception("Could not set blob") +- +- dev[0].select_network(id, freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='failure'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_disconnected() +- dev[0].request("DISCONNECT") +- dev[0].dump_monitor() +- +- hapd.disable() +- logger.info("Anonymous provisioning") +- hapd.set("eap_fast_prov", "1") +- hapd.enable() +- dev[0].set_network_quoted(id, "phase1", "fast_provisioning=1") +- dev[0].select_network(id, freq="2412") +- # Anonymous provisioning results in EAP-Failure first +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='failure'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_disconnected() +- # And then the actual data connection +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='success'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_connected() +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- dev[0].dump_monitor() +- +- hapd.disable() +- logger.info("Provisioning disabled - using previously provisioned PAC") +- hapd.set("eap_fast_prov", "0") +- hapd.enable() +- +- dev[0].select_network(id, freq="2412") +- ev = dev[0].wait_event(["CTRL-EVENT-EAP-STATUS status='completion'"], +- timeout=15) +- if ev is None: +- raise Exception("EAP result not reported") +- if "parameter='success'" not in ev: +- raise Exception("Unexpected EAP result: " + ev) +- dev[0].wait_connected() +- dev[0].request("DISCONNECT") +- dev[0].wait_disconnected() +- dev[0].dump_monitor() +- + def test_ap_wpa2_eap_fast_eap_vendor(dev, apdev): + """WPA2-Enterprise connection using EAP-FAST/EAP-vendor""" + check_eap_capa(dev[0], "FAST") diff --git a/tests/hwsim/test_ap_psk.py b/tests/hwsim/test_ap_psk.py -index 9655093..82e5d5c 100644 +index 9655093..b452abe 100644 --- a/tests/hwsim/test_ap_psk.py +++ b/tests/hwsim/test_ap_psk.py @@ -35,27 +35,6 @@ def check_mib(dev, vals): @@ -98,6 +761,59 @@ index 9655093..82e5d5c 100644 def test_ap_wpa2_psk_file(dev, apdev): """WPA2-PSK AP with PSK from a file""" ssid = "test-wpa2-psk" +@@ -211,28 +190,6 @@ def _test_ap_wpa2_psk_mem(dev, apdev): + dev[1].request("CTRL-RSP-PSK_PASSPHRASE-" + id + ':' + psk) + dev[1].wait_connected(timeout=10) + +-@remote_compatible +-def test_ap_wpa2_ptk_rekey(dev, apdev): +- """WPA2-PSK AP and PTK rekey enforced by station""" +- ssid = "test-wpa2-psk" +- passphrase = 'qwertyuiop' +- params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase) +- hapd = hostapd.add_ap(apdev[0], params) +- +- Wlantest.setup(hapd) +- wt = Wlantest() +- wt.flush() +- wt.add_passphrase(passphrase) +- +- dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412") +- ev = dev[0].wait_event(["WPA: Key negotiation completed", +- "CTRL-EVENT-DISCONNECTED"]) +- if ev is None: +- raise Exception("PTK rekey timed out") +- if "CTRL-EVENT-DISCONNECTED" in ev: +- raise Exception("Disconnect instead of rekey") +- hwsim_utils.test_connectivity(dev[0], hapd) +- + def test_ap_wpa2_ptk_rekey_blocked_ap(dev, apdev): + """WPA2-PSK AP and PTK rekey enforced by station and AP blocking it""" + ssid = "test-wpa2-psk" +@@ -340,23 +297,6 @@ def test_ap_wpa2_sha256_ptk_rekey_ap(dev, apdev): + check_mib(dev[0], [("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-6"), + ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-6")]) + +-@remote_compatible +-def test_ap_wpa_ptk_rekey(dev, apdev): +- """WPA-PSK/TKIP AP and PTK rekey enforced by station""" +- skip_with_fips(dev[0]) +- skip_without_tkip(dev[0]) +- ssid = "test-wpa-psk" +- passphrase = 'qwertyuiop' +- params = hostapd.wpa_params(ssid=ssid, passphrase=passphrase) +- hapd = hostapd.add_ap(apdev[0], params) +- dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412") +- if "[WPA-PSK-TKIP]" not in dev[0].request("SCAN_RESULTS"): +- raise Exception("Scan results missing WPA element info") +- ev = dev[0].wait_event(["WPA: Key negotiation completed"]) +- if ev is None: +- raise Exception("PTK rekey timed out") +- hwsim_utils.test_connectivity(dev[0], hapd) +- + @remote_compatible + def test_ap_wpa_ptk_rekey_ap(dev, apdev): + """WPA-PSK/TKIP AP and PTK rekey enforced by AP""" diff --git a/tests/hwsim/vm/inside.sh b/tests/hwsim/vm/inside.sh index 31dfb9d..424b48b 100755 --- a/tests/hwsim/vm/inside.sh