The test cases fst_ap_start_session_oom and fst_setup_mbie_diff did not
clean up FST sessions properly in case alloc_fail failed due to missing
support for it in the build. This could result in abandoning attached
hostapd global control interface monitors and test case failures due to
the global control interface socket running out of output buffer.
Fix this by going through the cleanup steps even if alloc_fail raises
HwsimSkip exception.
Signed-off-by: Jouni Malinen <j@w1.fi>
For now, this is not enforcing cfg80211 reassociation since the needed
changes do not yet exist in the upstream kernel. Once those changes are
accepted, the TODO note in the test case can be addressed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This needs to be allowed with OpenSSL 1.1.0 since the RC4-based cipher
has been disabled by default.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This class allows execution of commands on a remote hosts/machine. This
is based on ssh with authorized keys, so you should be able to execute
such commands without any password:
ssh <user>@<hostname> id
By default user is root.
Support for sync and async calls is included.
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
This is needed for ap_vlan_tagged_wpa2_radius_id_change to pass. The
ioctl-based vlan_add() function does not use the vlan_if_name parameter
at all.
Signed-off-by: Jouni Malinen <j@w1.fi>
The no self.global_iface case was not returning the result from the
self.request() case. While this is not really a path that is supposed to
be used, make it return the response since it is at least theoretically
possible to get here.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is needed to allow updated Interworking behavior that adds the
realm to the EAP-Response/Identity value.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Incorrect path and file name was used in the openssl command to generate
one of the OCSP responses. Also fix
ap_wpa2_eap_tls_intermediate_ca_ocsp_multi to expect success rather than
failure due to OCSP response. Based on the test description, this was
supposed to succeed, but apparently that root_ocsp() bug prevented this
from happening.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Test different delay intervals between the INTERFACE_DISABLED event
and the INTERFACE_ENABLED event for discovery_and_interface_disabled.
Previously, only a delay of 1 second was used, in which case the
scan results for the P2P_FIND operation were received after the
interface was enabled again, and the case the scan results were
received while the interface was disabled was not covered.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
A malicious station could try to do FT-over-DS with a non WPA-enabled
BSS. When this BSS is located in the same hostapd instance, internal RRB
delivery will be used and thus the FT Action Frame will be processed by
a non-WPA enabled BSS. This processing used to crash hostapd as
hapd->wpa_auth is NULL.
This test implements such a malicious request for regression testing.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
This adds new tests to verify pmksa_cache_preauth when
used with per_sta_vif and possibly vlans.
While at it it refactors the code such that the tests
pmksa_cache_preauth
pmksa_cache_preauth_vlan_enabled
pmksa_cache_preauth_vlan_used
pmksa_cache_preauth_per_sta_vif
pmksa_cache_preauth_vlan_enabled_per_sta_vif
pmksa_cache_preauth_vlan_used_per_sta_vif
share code where possible.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
This adds a test case ap_vlan_reconnect. It connects, disconnects, and
reconnects a station in a VLAN. This tests for a regression with
wpa_group entering the FATAL_FAILURE state as the AP_VLAN interface is
removed before the group was stopped.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
This extends the P2P Device testing coverage to include the newly
enabled option of using the primary interface (e.g., wlan0) for P2P
group operation instead of always forcing a separate group interface to
be created dynamically.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This tests BSS Transition Management Query frame generation with
candidate list and transmission of the following request and response
frames.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Add a test that verifies that no Association Request frame is sent to
APs that include the MBO IE with association disallowed attribute in
Beacon and Probe Response frames.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Add tests to verify that MBO IE in BSS Transition Management Request
frame is parsed correctly:
1. The MBO transition reason code is received by the MBO station.
2. The MBO cellular data connection preference is received by the
MBO station.
3. The MBO station does not try to connect to the AP until the retry
delay is over.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
This is needed to avoid reporting failures after a change to remove the
fallback path in PIN generation.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This enhances the test pmksa_cache_preauth_vlan_used to check
connectivity in the correct VLAN bridge.
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
The use of the newer OpenSSL API in openssl_hmac_vector() removes one of
the memory allocations, so the TEST_ALLOC_FAIL here could not trigger.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This verifies that num_plinks is decremented properly if a peer mesh STA
reconnects without closing the link explicitly.
Signed-off-by: Jouni Malinen <j@w1.fi>
This test case for enforcing that AP setup fails in case there is need
to fall back to 20 MHz channel due to invalid 40 MHz configuration.
Modify this to allow successful AP startup as long as 40 MHz channel
does not get enabled.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This verifies that the persistent group information gets dropped based
on peer response (unknown group) and that a new group formation can be
completed after such invitation failure.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The previous version expired in January. The new ones are from running
ec-generate.sh and ec2-generate.sh again.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This is a regression test case for hostapd bug where the
disconnection/deauthentication TX status callback timeout could be
forgotten after new association if no ACK frame was received and the STA
managed to reconnect within two seconds.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The OpenSSL memory allocation changes broke this test case. Fix this by
removing the cases that do not get triggered anymore and add a separate
wpas_ctrl_error test case to cover the fail_test() versions of errors.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Use helper variable to indicate end of the test case instead of having
to use a fixed length of the loop.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This is needed to fix ap_wpa2_eap_psk_oom, ap_wpa2_eap_sim_oom,
eap_proto_psk_errors, and ap_ft_oom with the new OpenSSL dynamic memory
allocation design.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These need to be run without realm in the identity value to allow the
realm from the anonymous_identity to be used.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These test cases verify that EAP-SIM with external GSM auth supports the
use case of replacing the SIM. The first test case does this incorrectly
by not clearing the pseudonym identity (anonymous_identity in the
network profile) while the second one clears that and shows successful
connection.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
It was possible to hit an error case in ap_wpa2_eap_in_bridge where the
selectedMethod STATUS field was not available. This resulted in not very
helpful "'selectedMethod'" message in the test log file. Make this
clearer by dumping all received STATUS fields and a clearer exception
message indicating that selectedMethod was missing.
Signed-off-by: Jouni Malinen <j@w1.fi>
The test cases discovery_ctrl_char_in_devname and discovery_group_client
tried to allow three P2P_FIND instances to be used before reporting an
error. However, this did not really work properly since the second and
third attempts would likely fail to start the initial special P2P_FIND
scan due to an already ongoing p2p_scan operation. Fix this by stopping
the previous P2P_FIND and waiting for the scan to complete if a retry is
needed.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This verifies that there is no NULL pointer dereference when the AP code
processes Probe Request and (Re)Association Request frames with a P2P IE
in case P2P support is explicitly disabled on the AP mode interface.
This is a regression test case for the fixes in the previous commit.
Signed-off-by: Jouni Malinen <j@w1.fi>
Couple of waits for this event used the "GO-NEG-FAILURE" string instead
of the full event prefix. While this worked in the tests due to a
substring matching, it is better to use the full event prefix here.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
It was possible for the dump_monitor() call to drop a P2P-GO-NEG-FAILURE
event that was indicated quickly after the P2P_CONNECT command was
issued. This could result in grpform_reject test case failing to see the
expected event and fail the test due to "Rejection not reported".
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
rsn_ie_proto_eap_sta followed by eap_ttls_mschapv2_session_resumption
showed a failure case where the special RSNE from rsn_ie_proto_eap_sta
ended up remaining in a wpa_supplicant BSS entry and the SELECT_NETWORK
command used the previous scan results without checking for changed AP
configuration. This resulted in test failure due to RSN IE being claimed
to be different in EAPOL-Key msg 3/4. This is not really a real world
issue, but try to avoid false failure reports by explicitly clearing the
BSS table at the end of rsn_ie_proto_eap_sta.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This verifies that the previous commit works correctly by forcing a
P2P_LISTEN command execution to be interupted by a P2P_FIND command
timed in a manner that forces it to show up before the kernel ROC has
started for the Listen.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This verifies that P2P_STOP_FIND stops a pending offchannel TX wait in
the kernel by checking that a listen operation can be started in less
than a second after stopping a pending Action frame TX. This verifies
that the optimization introduced in the previous commit works properly.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This reverts commit be9fe3d8af. While I
did manage to complete multiple test runs without failures, it looks
like this change increases full test run duration by about 30 seconds
when using seven VMs. The most visible reason for that seems to be in
"breaking" active scanning quite frequently with the Probe Response
frame coming out about 40 ms (or more) after the Probe Request frame
which is long enough for the station to already have left the channel.
Since this logging change is not critical, it is simplest to revert it
for now rather than make changes to huge number of test cases to allow
more scan attempts to be performed before timing out.
Signed-off-by: Jouni Malinen <j@w1.fi>
The previously used 10 second timeout allowed only two scan attempts
(five seconds between scans) and it was possible to hit a failure every
now and then when running under heavy load and the Probe Response frame
got delayed by 40 ms or so twice in a row. Add more time for one more
scan attempt to reduce the likelihood of this happening.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
These test caases depended on a single active scan round finding the AP.
It is possible for the Probe Response frame to get delayed sufficiently
to miss the response especially when testing under heavy load with
multiple parallel VMs. Allow couple of scan retries to avoid reporting
failures from these test cases.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Use the group SSID (if known) when requesting a join operation. This
makes some of the P2PS test cases more robust in cases where previously
executed tests have added older groups into the cached scan results with
the same MAC addresses and an incorrect BSS could have been picked
previously.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This makes it less likely to hit issues with running out of control
interface TX queue when running multiple FST test in a row. Number of
the FST operation sequences seemed to leave quite a few event messages
pending in one of the attached control interface sockets for wlan5 which
could result in test failure if the buffer space ran out and some of the
wpa_supplicant events were not delivered.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
It is better to get these messages into the actual debug log instead of
hoping they will be noticed from stdout.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This test case used to leave the dynamically added wlan5 interface in a
state where it was still trying to reconnect to a network. This could
result in the following test cases being unable to clear the cfg80211
scan cache. Avoid this type of issues by explicitly stopping the
connection attempt and making sure that there are no scan results in the
cache at the end of connect_cmd_disconnect_event.
The following test case sequence triggered a failure due to the
remaining BSS table entry:
connect_cmd_disconnect_event connect_cmd_wep ap_hs20_random_mac_addr
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This parameter is used only in couple of test cases and there is no need
to maintain the code to reset it in WpaSupplicant::reset().
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
It was possible to hit a race condition between WPS_CANCEL and
immediately following WPS_PIN command. Wait for a disconnection event to
avoid that. This was seen with the following test case sequence:
ap_wpa2_psk_supp_proto_wrong_group_key_len ap_wps_probe_req_ie_oom
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
When running tests, make printk put all messages, including debug
messages, onto the serial console to go into the console file.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Wait for the AP-DISABLED and AP-ENABLED group events before reading the
current group operation frequency after P2P-REMOVE-AND-REFORM-GROUP.
This reduces a possibility of a race condition making a test case fail
with the returned frequency being 0 when reading this before the
reformed group is fully up. This may help avoid false error reports for
the following test cases: p2p_go_move_reg_change p2p_go_move_scm
p2p_go_move_scm_peer_supports p2p_go_move_scm_multi.
Signed-off-by: Jouni Malinen <j@w1.fi>
This is needed for number of EAP test cases at least when using the
internal TLS server implementation.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Since wpa_supplicant is now retrying GAS comeback failures once, the
gas_anqp_oom_hapd test case started failing. Fix this by updating the
test case to expect success (on the retry).
Signed-off-by: Jouni Malinen <j@w1.fi>
This is in preparation of a wpa_supplicant change to allow GAS retries
which can result in the previous test case design showing failures due
to "unexpected" management frames (GAS Initial Request from the retry).
Signed-off-by: Jouni Malinen <j@w1.fi>
This adds some more test coverage for phase1 parameters that had not
previously been included in any of the test cases.
Signed-off-by: Jouni Malinen <j@w1.fi>
These test cases were supposed to clear the cfg80211 and wpa_supplicant
scan caches in the end to avoid causing issues to the following test
cases. This did not work properly after introduction of the support for
aborting a pending scan. Fix this by using the flush_scan_cache()
function and waiting within the test case until the final scan operation
completes.
This issue was triggered by ssid_hidden/ssid_hidden2 followed by
ext_password_interworking (though, not every time).
Signed-off-by: Jouni Malinen <j@w1.fi>
The rfkill initialization will be moved out from
wpa_driver_nl80211_drv_init() which would break one step in this OOM
test case due to the memory allocation not existing anymore. Fix this by
skipping that OOM step to avoid causing false failures with the
following commits.
Signed-off-by: Jouni Malinen <j@w1.fi>
This speeds up and clarifies error reporting for cases where the GO
fails to start in invitation.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This is useful for testing CRDA since it means you can use EPATH to
redirect the test scripts to a different crda binary.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This adds more coverage for TDLS testing for a case where the direct
link should use various VHT channel bandwidths.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
The decrypted copy of a GTK from EAPOL-Key is cleared from memory only
after having sent out CTRL-EVENT-CONNECTED. As such, there was a race
condition on the test case reading the wpa_supplicant process memory
after the connection. This was unlikely to occur due to the one second
sleep, but even with that, it would be at least theorically possible to
hit this race under heavy load (e.g., when using large number of VMs to
run parallel testing). Avoid this by running a PING command to make sure
wpa_supplicant has returned to eloop before reading the process memory.
This should make it less likely to report false positives on GTK being
found in memory.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This makes it easier to see where in memory the key was found and what
there is in memory around that location.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
init=CORE was previously used due to invalid db.txt data for 00. For
now, allow both it and the new init=USER after fixed db.txt.
Signed-off-by: Jouni Malinen <j@w1.fi>
This test case could fail if the cfg80211 scan cache brought in a BSS
entry from an earlier test case and a new scan did not get executed
prior to the ROAM command. Fix this by forcing the scan to go through
prior to roaming to AP2
This issue showed up with the following test case sequence:
connect_cmd_roam pmksa_cache_opportunistic_connect
Signed-off-by: Jouni Malinen <j@w1.fi>
It looks like it is possible for the GTK to be found from memory every
now and then. This makes these test cases fail. Write the memory
addresses in which the GTK was found to the log to make it somewhat
easier to try to figure out where the key can be left in memory.
Signed-off-by: Jouni Malinen <j@w1.fi>
It was possible for the BSSs object property change signal to be
generated during the OOM test case for Get(). If that happened, the
signal was not sent out, but the following Get(BSSs) operation succeeded
unexpectedly which resulted in a test failure. Make this less likely to
happen by waiting 50 ms between the scan and Get(BSSs) operation. This
should be sufficient to cover most cases since wpa_supplicant uses 5 ms
timeout for D-Bus property changed updates.
Signed-off-by: Jouni Malinen <j@w1.fi>
It was possible for the AP's Beacon frame to be seen by dev[0] when
running a scan. This is not an error case. Make this test case more
robust by verifying with a sniffer whether a Probe Response frame was
sent to unexpected STA.
Signed-off-by: Jouni Malinen <j@w1.fi>
This verifies client private key use in encrypted PKCS #8 format with
PKCS #5 v1.5 format using pbeWithMD5AndDES-CBC and PKCS #5 v2.0 format
using PBES2 with des-ede3-cbc.
Signed-off-by: Jouni Malinen <j@w1.fi>
Verify that P2P_CANCEL gets rejected on fully re-invoked persistent
group. This did not work properly before the last couple of commits and
before this week, the P2P_CANCEL on a separate group interface in P2p
Client role could result in use of freed memory and process termination.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
It was possible for a cached scan entry in cfg80211 from an earlier test
case to show up while verifying that the disabled AP does not show up in
scan results. This could result in invalid test failures, e.g., when
running test cases "ap_require_ht ap_multi_bss_config" multiple times
(depends a bit on timing). Make this less likely to occur by explicitly
clearing the scan cache and by stopping wlan1 from trying to associate
before stopping ap_required_ht* test cases.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Only one of the ERs was stopped at the end of the test case and this
could result in the following test case failing, e.g., when executing
this test case sequence: ap_wps_er_multi_add_enrollee ap_wps_upnp.
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
