From 061cbb258fced68b127f66bdd35c55f77928b720 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Wed, 14 Jan 2015 15:30:47 +0200 Subject: [PATCH] tests: domain_match checking against server certificate Signed-off-by: Jouni Malinen --- tests/hwsim/test_ap_eap.py | 105 +++++++++++++++++++++++++++++++++++ tests/hwsim/wpasupplicant.py | 3 +- 2 files changed, 107 insertions(+), 1 deletion(-) diff --git a/tests/hwsim/test_ap_eap.py b/tests/hwsim/test_ap_eap.py index 1bcb0dcb6..311c1c9b3 100644 --- a/tests/hwsim/test_ap_eap.py +++ b/tests/hwsim/test_ap_eap.py @@ -927,6 +927,18 @@ def test_ap_wpa2_eap_ttls_mschapv2_suffix_match(dev, apdev): hwsim_utils.test_connectivity(dev[0], hapd) eap_reauth(dev[0], "TTLS") +def test_ap_wpa2_eap_ttls_mschapv2_domain_match(dev, apdev): + """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 (domain_match)""" + params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") + hostapd.add_ap(apdev[0]['ifname'], params) + hapd = hostapd.Hostapd(apdev[0]['ifname']) + eap_connect(dev[0], apdev[0], "TTLS", "DOMAIN\mschapv2 user", + anonymous_identity="ttls", password="password", + ca_cert="auth_serv/ca.pem", phase2="auth=MSCHAPV2", + domain_match="Server.w1.fi") + hwsim_utils.test_connectivity(dev[0], hapd) + eap_reauth(dev[0], "TTLS") + def test_ap_wpa2_eap_ttls_mschapv2_incorrect_password(dev, apdev): """WPA2-Enterprise connection using EAP-TTLS/MSCHAPv2 - incorrect password""" params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") @@ -1358,6 +1370,59 @@ def test_ap_wpa2_eap_tls_neg_suffix_match(dev, apdev): if ev is None: raise Exception("Network block disabling not reported") +def test_ap_wpa2_eap_tls_neg_domain_match(dev, apdev): + """WPA2-Enterprise negative test - domain mismatch""" + params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TTLS", + identity="DOMAIN\mschapv2 user", anonymous_identity="ttls", + password="password", phase2="auth=MSCHAPV2", + ca_cert="auth_serv/ca.pem", + domain_match="w1.fi", + wait_connect=False, scan_freq="2412") + + ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=10) + if ev is None: + raise Exception("Association and EAP start timed out") + + ev = dev[0].wait_event(["CTRL-EVENT-EAP-METHOD"], timeout=10) + if ev is None: + raise Exception("EAP method selection timed out") + if "TTLS" not in ev: + raise Exception("Unexpected EAP method") + + ev = dev[0].wait_event(["CTRL-EVENT-EAP-TLS-CERT-ERROR", + "CTRL-EVENT-EAP-SUCCESS", + "CTRL-EVENT-EAP-FAILURE", + "CTRL-EVENT-CONNECTED", + "CTRL-EVENT-DISCONNECTED"], timeout=10) + if ev is None: + raise Exception("EAP result timed out") + if "CTRL-EVENT-EAP-TLS-CERT-ERROR" not in ev: + raise Exception("TLS certificate error not reported") + if "Domain mismatch" not in ev: + raise Exception("Domain mismatch not reported") + + ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS", + "CTRL-EVENT-EAP-FAILURE", + "CTRL-EVENT-CONNECTED", + "CTRL-EVENT-DISCONNECTED"], timeout=10) + if ev is None: + raise Exception("EAP result(2) timed out") + if "CTRL-EVENT-EAP-FAILURE" not in ev: + raise Exception("EAP failure not reported") + + ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED", + "CTRL-EVENT-DISCONNECTED"], timeout=10) + if ev is None: + raise Exception("EAP result(3) timed out") + if "CTRL-EVENT-DISCONNECTED" not in ev: + raise Exception("Disconnection not reported") + + ev = dev[0].wait_event(["CTRL-EVENT-SSID-TEMP-DISABLED"], timeout=10) + if ev is None: + raise Exception("Network block disabling not reported") + def test_ap_wpa2_eap_tls_neg_subject_match(dev, apdev): """WPA2-Enterprise negative test - subject mismatch""" params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") @@ -2064,6 +2129,19 @@ def test_ap_wpa2_eap_tls_domain_suffix_match_cn_full(dev, apdev): domain_suffix_match="server3.w1.fi", scan_freq="2412") +def test_ap_wpa2_eap_tls_domain_match_cn(dev, apdev): + """WPA2-Enterprise using EAP-TLS and domainmatch (CN)""" + params = int_eap_server_params() + params["server_cert"] = "auth_serv/server-no-dnsname.pem" + params["private_key"] = "auth_serv/server-no-dnsname.key" + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", + identity="tls user", ca_cert="auth_serv/ca.pem", + private_key="auth_serv/user.pkcs12", + private_key_passwd="whatever", + domain_match="server3.w1.fi", + scan_freq="2412") + def test_ap_wpa2_eap_tls_domain_suffix_match_cn(dev, apdev): """WPA2-Enterprise using EAP-TLS and domain suffix match (CN)""" check_domain_match_full(dev[0]) @@ -2105,6 +2183,33 @@ def test_ap_wpa2_eap_tls_domain_suffix_mismatch_cn(dev, apdev): if ev is None: raise Exception("Timeout on EAP failure report (2)") +def test_ap_wpa2_eap_tls_domain_mismatch_cn(dev, apdev): + """WPA2-Enterprise using EAP-TLS and domain mismatch (CN)""" + params = int_eap_server_params() + params["server_cert"] = "auth_serv/server-no-dnsname.pem" + params["private_key"] = "auth_serv/server-no-dnsname.key" + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", + identity="tls user", ca_cert="auth_serv/ca.pem", + private_key="auth_serv/user.pkcs12", + private_key_passwd="whatever", + domain_match="example.com", + wait_connect=False, + scan_freq="2412") + dev[1].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", + identity="tls user", ca_cert="auth_serv/ca.pem", + private_key="auth_serv/user.pkcs12", + private_key_passwd="whatever", + domain_match="w1.fi", + wait_connect=False, + scan_freq="2412") + ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"]) + if ev is None: + raise Exception("Timeout on EAP failure report") + ev = dev[1].wait_event(["CTRL-EVENT-EAP-FAILURE"]) + if ev is None: + raise Exception("Timeout on EAP failure report (2)") + def test_ap_wpa2_eap_ttls_expired_cert(dev, apdev): """WPA2-Enterprise using EAP-TTLS and expired certificate""" params = int_eap_server_params() diff --git a/tests/hwsim/wpasupplicant.py b/tests/hwsim/wpasupplicant.py index 5bf794cfc..15a86aeb5 100644 --- a/tests/hwsim/wpasupplicant.py +++ b/tests/hwsim/wpasupplicant.py @@ -793,7 +793,8 @@ class WpaSupplicant: "private_key_passwd", "ca_cert2", "client_cert2", "private_key2", "phase1", "phase2", "domain_suffix_match", "altsubject_match", "subject_match", "pac_file", "dh_file", - "bgscan", "ht_mcs", "id_str", "openssl_ciphers" ] + "bgscan", "ht_mcs", "id_str", "openssl_ciphers", + "domain_match" ] for field in quoted: if field in kwargs and kwargs[field]: self.set_network_quoted(id, field, kwargs[field])