jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
hostap/tests/hwsim/auth_serv/eap_user.conf

156 lines
5.4 KiB
Text
Raw Normal View History

tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"pwd user" PWD "secret password"
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"pwd user@domain" PWD "secret password"
tests: WPA2-Enterprise connection using EAP-pwd and NTHash Signed-off-by: Jouni Malinen <j@w1.fi>
2015-03-28 08:45:25 +01:00
"pwd-hash" PWD hash:e3718ece8ab74792cbbfffd316d2d19a
tests: EAP-pwd with salted passwords Signed-off-by: Jouni Malinen <j@w1.fi>
2018-05-28 16:14:37 +02:00
"pwd-hash-sha1" PWD ssha1:046239e0660a59015231082a071c803e9f5848ae42eaccb4c08c97ae397bc879c4b071b9088ee715
"pwd-hash-sha256" PWD ssha256:eb0fc747d940308ee5ddcb88d4998a39fa9fcad3044872cf35a1b54b8d351dadc05f525ec27be0d35eca52a328c582ebc7
"pwd-hash-sha512" PWD ssha512:368d96e5acb41b164fe5ce038ab7c3552a82f88fae2e8481da525cc2c68c53b19390a91ccc61a1a04595b620b92e47c39bae353108035c49aaeb23859ad6d22dc08d2057cdd9f0831636a47cbac8d23ed7de8575a197b6320d5627e8f9768bd2109471bc7dff566f7a5e0e9990c285dc1d42e02ed06d6f9490323053ab252d88
tests: Increas EAP-pwd fragmentation coverage Verify fragmentation of additional message types. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-04-05 23:52:13 +02:00
"pwd.user@test123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890.example.com" PWD "secret password"
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"gpsk user" GPSK "abcdefghijklmnop0123456789abcdef"
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"gpsk user@domain" GPSK "abcdefghijklmnop0123456789abcdef"
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"sake user" SAKE 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"sake user@domain" SAKE 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"eke user" EKE "hello"
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"eke user@domain" EKE "hello"
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"ikev2 user" IKEV2 "ike password"
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"ikev2 user@domain" IKEV2 "ike password"
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
"pax.user@example.com" PAX 0123456789abcdef0123456789abcdef
"psk.user@example.com" PSK 0123456789abcdef0123456789abcdef
tests: Verify EAP vendor test Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-05 18:23:29 +01:00
"vendor-test" VENDOR-TEST "foo"
tests: Verify HS 2.0 OSEN connection Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-26 17:10:08 +01:00
"osen@example.com" WFA-UNAUTH-TLS
tests: UNAUTH-TLS Signed-off-by: Jouni Malinen <j@w1.fi>
2014-05-11 19:59:07 +02:00
"unauth-tls" UNAUTH-TLS
tests: Add more EAP test cases This increases EAP method coverage for WPA2-Enterprise to include EAP-pwd, EAP-GPSK, EAP-SAKE, EAP-EKE, EAP-IKEv2, EAP-PAX, and EAP-PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-03 10:58:38 +01:00
tests: WPS and EAP-WSC in network profile This goes through some error paths that do not really show up in real WPS use cases. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 19:52:03 +01:00
"WFA-SimpleConfig-Enrollee-1-0" WSC
"WFA-SimpleConfig-Enrollee-unexpected" WSC
tests: EAP Re-authentication Protocol (ERP) This tests RP EAP-Initiate/Re-auth-Start transmission, ERP key derivation, and EAP-Initiate/Re-auth + EAP-Finish/Re-auth exchange and rMSK derivation. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-29 19:34:43 +01:00
"erp-fast@example.com" FAST
"erp-fast@example.com" GTC "password" [2]
"erp-gpsk@example.com" GPSK "abcdefghijklmnop0123456789abcdef"
"erp-eke@example.com" EKE "hello"
"erp-pax@example.com" PAX 0123456789abcdef0123456789abcdef
"erp-peap@example.com" PEAP
"erp-peap@example.com" MSCHAPV2 "password" [2]
"erp-psk@example.com" PSK 0123456789abcdef0123456789abcdef
"erp-pwd@example.com" PWD "secret password"
"erp-sake@example.com" SAKE 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
"erp-tls@example.com" TLS
"erp-ttls@example.com" TTLS
"erp-ttls@example.com" TTLS-PAP "password" [2]
tests: Fix ERP anonymous_identity test cases These need to be run without realm in the identity value to allow the realm from the anonymous_identity to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-01-13 20:36:00 +01:00
"erp-ttls" TTLS
"erp-ttls" TTLS-PAP "password" [2]
tests: ERP with EAP-IKEv2 Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-20 22:48:53 +01:00
"erp-ikev2@example.com" IKEV2 "password"
tests: EAP Re-authentication Protocol (ERP) This tests RP EAP-Initiate/Re-auth-Start transmission, ERP key derivation, and EAP-Initiate/Re-auth + EAP-Finish/Re-auth exchange and rMSK derivation. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-29 19:34:43 +01:00
tests: VLAN tests using RADIUS tunnel attributes Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-08 10:29:35 +01:00
"vlan1" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=64:d:13
radius_accept_attr=65:d:6
radius_accept_attr=81:s:1
"vlan2" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=64:d:13
radius_accept_attr=65:d:6
radius_accept_attr=81:s:2
tests: Untagged VLAN ID with EGRESS_VLANID RADIUS attribute Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:52:05 +01:00
"vlan1b" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=56:x:32000001
tests: Verify tagged-only connectivity Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:52:02 +01:00
"vlan1tagged" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=56:x:31000001
tests: Verify connectivity with untagged/tagged VLAN mixed configuration Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2016-01-21 14:52:06 +01:00
"vlan12mixed" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=56:x:31000001
radius_accept_attr=64:d:13
radius_accept_attr=65:d:6
radius_accept_attr=81:s:2
tests: RADIUS Class attribute Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:16:29 +01:00
"test-class" PAX 0123456789abcdef0123456789abcdef
radius_accept_attr=25:x:00112233445566778899
tests: PMKSA cache and Chargeable-User-Identity Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 23:51:14 +01:00
"gpsk-cui" GPSK "abcdefghijklmnop0123456789abcdef"
radius_accept_attr=89:s:gpsk-chargeable-user-identity
tests: RADIUS Class attribute Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:16:29 +01:00
radius_accept_attr=25:x:00112233445566778899aa
tests: PMKSA cache and Chargeable-User-Identity Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-09 23:51:14 +01:00
tests: FT-EAP with VLAN Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2017-05-18 15:21:52 +02:00
"gpsk-vlan1" GPSK "abcdefghijklmnop0123456789abcdef"
radius_accept_attr=64:d:13
radius_accept_attr=65:d:6
radius_accept_attr=81:s:1
tests: PMKSA cache entry timeout based on Session-Timeout This verifies that hostapd uses Session-Timeout value from Access-Accept as the lifetime for the PMKSA cache entries and expires entries both while the station is disconnected and during an association. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-04 18:38:55 +02:00
"gpsk-user-session-timeout" GPSK "abcdefghijklmnop0123456789abcdef"
radius_accept_attr=27:d:3
tests: EAP-MSCHAPv2 error cases Signed-off-by: Jouni Malinen <j@w1.fi>
2015-10-12 00:05:37 +02:00
"phase1-user" MSCHAPV2,MD5,GTC "password"
tests: RADIUS MAC ACL Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-29 18:32:45 +01:00
"020000000000" MACACL "020000000000"
tests: RADIUS MAC ACL and accounting enabled This ends up using the special User-Name = STA MAC address case for Accounting-Request. In addition, add Chargeable-User-Identity for one of the STAs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 14:48:23 +01:00
"020000000100" MACACL "020000000100"
tests: WPA2-Enterprise connection using MAC ACL Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-30 23:34:27 +02:00
radius_accept_attr=1:s:test-user
tests: RADIUS MAC ACL and accounting enabled This ends up using the special User-Name = STA MAC address case for Accounting-Request. In addition, add Chargeable-User-Identity for one of the STAs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-29 14:48:23 +01:00
radius_accept_attr=89:s:macacl-cui-test
tests: Invalid VLAN ID from RADIUS server for ACL Signed-off-by: Jouni Malinen <j@w1.fi>
2016-12-26 17:39:49 +01:00
"020000000200" MACACL "020000000200"
radius_accept_attr=56:x:32000011
tests: EAP-TTLS/EAP-AKA, EAP-PEAP/EAP-AKA, EAP-FAST/EAP-AKA These add some more EAP-TTLS/PEAP/FAST coverage to test pending Phase 2 response re-processing. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-05-17 22:39:16 +02:00
"0232010000000000@ttls" TTLS,AKA
"0232010000000000@peap" PEAP,AKA
"0232010000000000@fast" FAST,AKA
tests: EAP-SIM tunneled within EAP-TTLS/PEAP/FAST This verifies both the internal and external GSM authentication operation when EAP-SIM is tunneled within EAP-TTLS/PEAP/FAST. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-10 15:05:33 +01:00
"1232010000000000@ttls" TTLS,SIM
"1232010000000000@peap" PEAP,SIM
"1232010000000000@fast" FAST,SIM
tests: EAP-AKA' and EAP-AKA both enabled (bidding mechanism) Signed-off-by: Jouni Malinen <j@w1.fi>
2014-05-17 23:04:18 +02:00
"6555444333222111@both" AKA',AKA
tests: EAP-PEAP version forcing Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-19 19:59:14 +01:00
"peap-ver0" PEAP [ver=0]
"peap-ver1" PEAP [ver=1]
tests: EAP-TTLS/EAP-AKA, EAP-PEAP/EAP-AKA, EAP-FAST/EAP-AKA These add some more EAP-TTLS/PEAP/FAST coverage to test pending Phase 2 response re-processing. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-05-17 22:39:16 +02:00
tests: Start RADIUS authentication server This can be used to run WPA2-Enterprise test cases. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-29 18:14:16 +02:00
"0"* AKA
"1"* SIM
"2"* AKA
"3"* SIM
"4"* AKA
"5"* SIM
"6"* AKA'
"7"* AKA'
"8"* AKA'
* TTLS,TLS,PEAP,FAST,SIM,AKA',AKA
"0"* AKA [2]
"1"* SIM [2]
"2"* AKA [2]
"3"* SIM [2]
"4"* AKA [2]
"5"* SIM [2]
"6"* AKA' [2]
"7"* AKA' [2]
"8"* AKA' [2]
"pap user" TTLS-PAP "password" [2]
tests: Verify that wpa_supplicant clears keys from memory Check that PMK and PTK and not left in memory (heap or stack) unnecessarily after they are not needed anymore. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 12:13:25 +01:00
"pap-secret" TTLS-PAP "63d2d21ac3c09ed567ee004a34490f1d16e7fa5835edf17ddba70a63f1a90a25" [2]
"pap-secret@example.com" TTLS-PAP "63d2d21ac3c09ed567ee004a34490f1d16e7fa5835edf17ddba70a63f1a90a25" [2]
tests: Start RADIUS authentication server This can be used to run WPA2-Enterprise test cases. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-29 18:14:16 +02:00
"chap user" TTLS-CHAP "password" [2]
"mschap user" TTLS-MSCHAP "password" [2]
"DOMAIN\mschapv2 user" TTLS-MSCHAPV2 hash:8846f7eaee8fb117ad06bdd830b7586c [2]
tests: Use a domain name in the identity for get_emsk OOM tests These test cases depend on ERP processing to reach the get_emsk handler function. Since ERP really needs the realm to derive a proper keyName-NAI, modify these test cases to pass the realm part in the identity to allow error checking to be introduced for rejecting ERP cases where the realm is not available. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-05-22 12:47:37 +02:00
"mschapv2 user@domain" TTLS-MSCHAPV2 hash:8846f7eaee8fb117ad06bdd830b7586c [2]
tests: Add Hotspot 2.0 test cases for connecting with username The test_ap_hs20_username* test cases verify that a username/password credential can be used for Hotspot 2.0 connection and that the network type is reported correctly. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-10-29 13:38:31 +01:00
"hs20-test" TTLS-MSCHAPV2 "password" [2]
tests: Hotspot 2.0 and failures during profile configuration Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-04 11:15:15 +02:00
"hs20-test-with-domain@example.com" TTLS-MSCHAPV2 "password" [2]
tests: Verify NtPasswordHash with different UTF-8 cases This adds a password that uses one, two, and three octet encoding for UTF-8 characters. The value is tested against a pre-configured hash to verify that utf8_to_ucs2() function works correctly. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-02-15 11:08:50 +01:00
"utf8-user" TTLS-MSCHAPV2 "secret-åäö-€-password" [2]
"utf8-user-hash" TTLS-MSCHAPV2 hash:bd5844fad2489992da7fe8c5a01559cf [2]
tests: Start RADIUS authentication server This can be used to run WPA2-Enterprise test cases. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-09-29 18:14:16 +02:00
"user" MSCHAPV2,MD5,GTC "password" [2]
tests: Accept "user@example.com" as user identity similarly to "user" This is needed to allow updated Interworking behavior that adds the realm to the EAP-Response/Identity value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-03-11 20:05:25 +01:00
"user@example.com" MSCHAPV2,MD5,GTC "password" [2]
tests: EAP-GTC server error cases In addition, no-password-configured coverage extended to EAP-MD5 and EAP-MSCHAPv2 as well. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 14:59:02 +01:00
"user2" MSCHAPV2,MD5,GTC "password" [2]
tests: EAP-PEAP/MSCHAPv2 with domain name Signed-off-by: Jouni Malinen <j@w1.fi>
2015-03-29 21:06:06 +02:00
"DOMAIN\user3" MSCHAPV2 "password" [2]
tests: EAP-GTC server error cases In addition, no-password-configured coverage extended to EAP-MD5 and EAP-MSCHAPv2 as well. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-28 14:59:02 +01:00
"user-no-passwd" MSCHAPV2,MD5,GTC [2]
tests: Verify EAP-PEAP/EAP-TLS Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-05 18:20:00 +01:00
"cert user" TLS [2]
tests: Verify HS 2.0 deauth request from RADIUS Access-Accept Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-07 22:21:17 +01:00
"hs20-deauth-test" TTLS-MSCHAPV2 "password" [2]
radius_accept_attr=26:x:00009f680405016400
tests: HS 2.0 subscription remediation notification Signed-off-by: Jouni Malinen <j@w1.fi>
2014-03-08 10:49:23 +01:00
"hs20-subrem-test" TTLS-MSCHAPV2 "password" [2]
radius_accept_attr=26:x:00009f6801170168747470733a2f2f6578616d706c652e636f6d2f
tests: HS 2.0 session information URL Verify that session information is stored from Access-Accept and sent to the station at the requested timeout. Verify that station processes this notification. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-10 10:34:31 +01:00
"hs20-session-info-test" TTLS-MSCHAPV2 "password" [2]
radius_accept_attr=27:d:63
radius_accept_attr=26:x:00009f6805170168747470733a2f2f6578616d706c652e636f6d2f
tests: Hotspot 2.0 Terms and Conditions signaling Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-23 20:10:30 +02:00
"hs20-t-c-test" TTLS-MSCHAPV2 "password" [2]
radius_accept_attr=26:x:00009f68090601000000
tests: Hotspot 2.0 Terms and Conditions signaling - CoA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-25 00:23:01 +02:00
radius_accept_attr=89:s:hs20-cui
tests: dot1xAuthSessionUserName Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-01 20:29:25 +01:00
"test-user" TTLS-PAP "password" [2]
radius_accept_attr=1:s:real-user
Reference in a new issue Copy permalink