From 40c654cc1d426e99877e44cdf9c32b8cd169ed07 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Thu, 7 Jan 2016 21:44:49 +0200 Subject: [PATCH] tests: EAP-SIM with external GSM auth and replacing SIM These test cases verify that EAP-SIM with external GSM auth supports the use case of replacing the SIM. The first test case does this incorrectly by not clearing the pseudonym identity (anonymous_identity in the network profile) while the second one clears that and shows successful connection. Signed-off-by: Jouni Malinen --- tests/hwsim/auth_serv/hlr_auc_gw.milenage_db | 3 + tests/hwsim/test_ap_eap.py | 207 +++++++++++++++++++ 2 files changed, 210 insertions(+) diff --git a/tests/hwsim/auth_serv/hlr_auc_gw.milenage_db b/tests/hwsim/auth_serv/hlr_auc_gw.milenage_db index ecd06d720..1c494f773 100644 --- a/tests/hwsim/auth_serv/hlr_auc_gw.milenage_db +++ b/tests/hwsim/auth_serv/hlr_auc_gw.milenage_db @@ -8,6 +8,9 @@ # IMSI Ki OPc AMF SQN 232010000000000 90dca4eda45b53cf0f12d7c9c3bc6a89 cb9cccc4b9258e6dca4760379fb82581 61df 000000000000 +# Modified version of the previous to allow testing with replaced SIM. +232010000000009 a0dca4eda45b53cf0f12d7c9c3bc6a89 cb9cccc4b9258e6dca4760379fb82581 61df 000000000000 + # These values are from Test Set 19 which has the AMF separation bit set to 1 # and as such, is suitable for EAP-AKA' test. 555444333222111 5122250214c33e723a5dd523fc145fc0 981d464c7c52eb6e5036234984ad0bcf c3ab 16f3b3f70fc1 diff --git a/tests/hwsim/test_ap_eap.py b/tests/hwsim/test_ap_eap.py index 6a4eec66a..e1af53639 100644 --- a/tests/hwsim/test_ap_eap.py +++ b/tests/hwsim/test_ap_eap.py @@ -479,6 +479,213 @@ def _test_ap_wpa2_eap_sim_ext(dev, apdev): if ev is None: raise Exception("EAP failure not reported") +def test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev): + """EAP-SIM with external GSM auth and replacing SIM without clearing pseudonym id""" + try: + _test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev) + finally: + dev[0].request("SET external_sim 0") + +def _test_ap_wpa2_eap_sim_ext_replace_sim(dev, apdev): + check_hlr_auc_gw_support() + params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].request("SET external_sim 1") + id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP", + identity="1232010000000000", + wait_connect=False, scan_freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000000 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + dev[0].wait_connected(timeout=15) + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + + # Replace SIM, but forget to drop the previous pseudonym identity + dev[0].set_network_quoted(id, "identity", "1232010000000009") + dev[0].select_network(id, freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000009 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + ev = dev[0].wait_event(["CTRL-EVENT-EAP-FAILURE"], timeout=15) + if ev is None: + raise Exception("EAP-Failure not reported") + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + +def test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev): + """EAP-SIM with external GSM auth and replacing SIM and clearing pseudonym identity""" + try: + _test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev) + finally: + dev[0].request("SET external_sim 0") + +def _test_ap_wpa2_eap_sim_ext_replace_sim2(dev, apdev): + check_hlr_auc_gw_support() + params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].request("SET external_sim 1") + id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP", + identity="1232010000000000", + wait_connect=False, scan_freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000000 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + dev[0].wait_connected(timeout=15) + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + + # Replace SIM and drop the previous pseudonym identity + dev[0].set_network_quoted(id, "identity", "1232010000000009") + dev[0].set_network(id, "anonymous_identity", "NULL") + dev[0].select_network(id, freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000009 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + dev[0].wait_connected() + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + +def test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev): + """EAP-SIM with external GSM auth, replacing SIM, and no identity in config""" + try: + _test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev) + finally: + dev[0].request("SET external_sim 0") + +def _test_ap_wpa2_eap_sim_ext_replace_sim3(dev, apdev): + check_hlr_auc_gw_support() + params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap") + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].request("SET external_sim 1") + id = dev[0].connect("test-wpa2-eap", eap="SIM", key_mgmt="WPA-EAP", + wait_connect=False, scan_freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"]) + if ev is None: + raise Exception("Request for identity timed out") + rid = ev.split(':')[0].split('-')[-1] + dev[0].request("CTRL-RSP-IDENTITY-" + rid + ":1232010000000000") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000000 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + dev[0].wait_connected(timeout=15) + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + + # Replace SIM and drop the previous permanent and pseudonym identities + dev[0].set_network(id, "identity", "NULL") + dev[0].set_network(id, "anonymous_identity", "NULL") + dev[0].select_network(id, freq="2412") + + ev = dev[0].wait_event(["CTRL-REQ-IDENTITY"]) + if ev is None: + raise Exception("Request for identity timed out") + rid = ev.split(':')[0].split('-')[-1] + dev[0].request("CTRL-RSP-IDENTITY-" + rid + ":1232010000000009") + + ev = dev[0].wait_event(["CTRL-REQ-SIM"], timeout=15) + if ev is None: + raise Exception("Wait for external SIM processing request timed out") + p = ev.split(':', 2) + if p[1] != "GSM-AUTH": + raise Exception("Unexpected CTRL-REQ-SIM type") + rid = p[0].split('-')[3] + rand = p[2].split(' ')[0] + + res = subprocess.check_output(["../../hostapd/hlr_auc_gw", + "-m", + "auth_serv/hlr_auc_gw.milenage_db", + "GSM-AUTH-REQ 232010000000009 " + rand]) + if "GSM-AUTH-RESP" not in res: + raise Exception("Unexpected hlr_auc_gw response") + resp = res.split(' ')[2].rstrip() + + dev[0].request("CTRL-RSP-SIM-" + rid + ":GSM-AUTH:" + resp) + dev[0].wait_connected() + dev[0].request("DISCONNECT") + dev[0].wait_disconnected() + def test_ap_wpa2_eap_sim_oom(dev, apdev): """EAP-SIM and OOM""" params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")