Commit graph

60 commits

Author SHA1 Message Date
Jouni Malinen
e43352ff41 tests: SAE anti clogging during an attack
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 13:07:25 +02:00
Jouni Malinen
a053ab9590 tests: More complete group list for sae_groups
Add group 1 for completeness sake and also and Brainpool groups with
OpenSSL 1.1.*.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 13:05:23 +02:00
Jouni Malinen
c097f12c8f tests: Enable needed SAE groups explicitly in sae_oom_wpas
Configure the sae_groups parameter for hostapd explicitly in preparation
for the default value change in the implementation.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 17:14:05 +02:00
Jouni Malinen
b3361e5dc9 tests: Explicit str/bytes conversion for key_lifetime_in_memory
This is needed for python3.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-02-04 12:26:34 +02:00
Masashi Honma
54c58f29c0 tests: Replace str.encode('hex') with binascii.hexlify() for python3
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-02-04 12:26:34 +02:00
Jouni Malinen
6de2a80940 tests: SAE and password identifier (exclusively)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-01-24 00:20:49 +02:00
Jouni Malinen
be5e7a0771 tests: SAE and password identifier with FFC
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-02 11:56:04 +02:00
Jouni Malinen
c481e1cbb7 tests: SAE and MFP enabled without sae_require_mfp
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-14 20:14:30 +03:00
Jouni Malinen
e96fa19753 tests: Add more details on sae_bignum_failure logs
It is easier to understand the hostapd debug log here if each step is
noted there before starting the wpa_supplicant operation. In addition,
it looks safer to process all pending event messages between each step
to avoid running out of any buffer limits.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-20 13:07:38 +03:00
Jouni Malinen
fe102801f6 tests: SAE reauthentication
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-06-06 23:59:46 +03:00
Jouni Malinen
9a0ae89d62 tests: SAE with Password Identifier
This verifies SAE Password Identifier functionality in both the
infrastructure and mesh BSS cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 17:30:29 +03:00
Jouni Malinen
fa617ee6a0 tests: SAE and PSK enabled in wpa_supplicant network profile
Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-09 19:34:44 +03:00
Jouni Malinen
3382224082 tests: SAE with connect command
This does not really work with mac80211_hwsim due to missing offload
support, but at least some minimal extra code coverage can be achieved.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-02 20:21:46 +02:00
Jouni Malinen
5c8df74f18 tests: Mixed SAE and non-SAE network and MFP required with SAE
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 18:28:07 +02:00
Jouni Malinen
2d0a04a86c tests: SAE protocol testing - Confirm replay
Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 12:19:08 +02:00
Jouni Malinen
77f52098a5 tests: Make sae_invalid_anti_clogging_token_req more robust
Beacon more frequently since Probe Request frames are practically ignored
in this test setup (ext_mgmt_frame_handled=1 on hostapd side) and
wpa_supplicant scans may end up getting ignored if no new results are
available due to the missing Probe Response frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-10-22 17:21:57 +03:00
Jouni Malinen
b74f82a4f8 tests: Comment out during-association TK-in-memory checks
TK needs to be maintained in memory for additional testing
functionality, so for now, comment out these checks.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-10-16 17:43:10 +03:00
Jouni Malinen
6db556b21d tests: Allow wpa_supplicant to maintain GTK in memory during association
This is needed to allow GTK configuration triggers to verify whether the
key has changed.

Signed-off-by: Jouni Malinen <j@w1.fi>
2017-10-16 02:03:47 +03:00
Jouni Malinen
606ef7d328 tests: SAE with sae_password
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 23:24:19 +03:00
Jouni Malinen
eea62048d8 tests: SAE commit message override on wpa_supplicant
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-04 13:32:04 +03:00
Jouni Malinen
cd06e2663b tests: SAE commit message override on hostapd
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-04 13:32:03 +03:00
Jouni Malinen
1342c47a33 tests: SAE reflection attack using internal hostapd mechanism
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-04 13:32:03 +03:00
Jouni Malinen
7b28c40892 tests: sae_group in hostapd STA ctrl_iface command
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-12-28 14:31:43 +02:00
Jouni Malinen
7a92dbd792 tests: SAE protocol testing with hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-12-26 14:30:50 +02:00
Jouni Malinen
28be769bc3 tests: SAE and invalid anti-clogging token request
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 17:53:25 +03:00
Jouni Malinen
2fd44db70e tests: More SAE OOM coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 17:34:16 +03:00
Jonathan Afek
9fd6804d61 tests: Mark 525 tests as remote compatible
After successfully passing the 525 tests on a remote setup mark the
tests as remote compatible.

Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
2016-06-27 21:47:37 +03:00
Jonathan Afek
fb120f1652 tests: Remove unused import subprocess
Number of files imported subprocess without using anything from subprocess.

Signed-off-by: Jonathan Afek <jonathanx.afek@intel.com>
2016-06-27 21:10:35 +03:00
Janusz Dziedzic
afc26df29c tests: Pass full apdev to add_ap() function (4)
Pass the full apdev to the add_ap() function instead of just ifname.
This allows us to handle also remote hosts while we can check
apdev['hostname'], apdev['port'].

This step (4) converts the cases that call hostapd.add_ap() from a
helper function that got apdev[i] as an argument.

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-04-03 22:46:12 +03:00
Janusz Dziedzic
8b8a1864ff tests: Pass full apdev to add_ap() function (1)
Pass the full apdev to the add_ap() function instead of just ifname.
This allows us to handle also remote hosts while we can check
apdev['hostname'], apdev['port'].

This step (1) converts the cases where apdev[#]['ifname'] was used as
the argument to hostapd.add_ap().

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2016-04-03 22:45:57 +03:00
Jouni Malinen
51761ba297 tests: SAE and bignum failures
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-28 01:59:23 +03:00
Jouni Malinen
4f6985de09 tests: SAE and pwe failure
Signed-off-by: Jouni Malinen <j@w1.fi>
2016-03-27 21:45:11 +03:00
Jouni Malinen
8e416cecdb tests: Make key-lifetime-in-memory more robust for GTK check
The decrypted copy of a GTK from EAPOL-Key is cleared from memory only
after having sent out CTRL-EVENT-CONNECTED. As such, there was a race
condition on the test case reading the wpa_supplicant process memory
after the connection. This was unlikely to occur due to the one second
sleep, but even with that, it would be at least theorically possible to
hit this race under heavy load (e.g., when using large number of VMs to
run parallel testing). Avoid this by running a PING command to make sure
wpa_supplicant has returned to eloop before reading the process memory.
This should make it less likely to report false positives on GTK being
found in memory.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-12-14 17:23:47 +02:00
Jouni Malinen
8eb45bde38 tests: Write GTK locations into debug log in key_lifetime_in_memory
It looks like it is possible for the GTK to be found from memory every
now and then. This makes these test cases fail. Write the memory
addresses in which the GTK was found to the log to make it somewhat
easier to try to figure out where the key can be left in memory.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-12-06 17:48:43 +02:00
Jouni Malinen
db036ed53d tests: Use group 26 instead of 25 in sae_oom_wpas with BoringSSL
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-18 19:46:56 +03:00
Jouni Malinen
a68d17929b tests: Allow group 25 to fail in sae_groups if running with BoringSSL
It looks like NID_X9_62_prime192v1 is not available, so allow that group
to fail without failing the full sae_groups test case.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-18 19:43:23 +03:00
Jouni Malinen
10ba4ae4d3 tests: SAE and no random numbers available
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-29 23:23:56 +03:00
Jouni Malinen
17ce7bb9db tests: SAE and invalid commit-scalar value 1
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-27 12:51:15 +03:00
Jouni Malinen
9e286d5ea2 tests: sae_groups to include Brainpool EC groups
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-26 22:41:51 +03:00
Jouni Malinen
b1f487cb74 tests: Try heavier SAE groups in sae_groups
This changes the sae_groups test case design to try with every group and
skip triggering test failure for the heavier ones that are likely to
fail in some VM setups under load. This provides more testing coverage
by not limiting the test based on lowest common setup.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-25 20:53:07 +03:00
Jouni Malinen
33dcced589 tests: SAE with number of different passwords
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-24 21:07:18 +03:00
Jouni Malinen
1965e1965e tests: SAE anti clogging protocol testing
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 23:10:36 +03:00
Jouni Malinen
939527b59d tests: SAE reflection attack
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 23:10:36 +03:00
Jouni Malinen
5527a3911a tests: SAE protocol tests
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-22 00:04:09 +03:00
Jouni Malinen
eb6d353270 tests: SAE and OOM in wpa_supplicant
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 23:31:12 +03:00
Jouni Malinen
54f2cae2e6 tests: Make *_key_lifetime_in_memory more robust
It was possible for the GTK-found-in-memory case to be triggered due to
a retransmission of EAPOL-Key msg 3/4 especially when running test cases
under heavy load (i.e., timeout on hostapd due to not receiving the 4/4
response quickly enough). Make this false failure report less likely by
waiting a bit longer after the connection has been completed before
fetching the process memory.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-31 18:06:06 +02:00
Jouni Malinen
7cc9a81f1e tests: Make PMKSA caching tests more robust
When the STA is forced to disconnect immediately after completion of
4-way handshake, there is a race condition on the AP side between the
reception of EAPOL-Key msg 4/4 and the following Deauthentication frame.
It is possible for the deauthentication notification to be processed
first since that message uses different path from kernel to user space.

If hostapd does not receive EAPOL-Key msg 4/4 prior to deauthentication,
no PMKSA cache entry is added. This race condition was making the test
cases expecting PMKSA caching to work to fail every now and then. Avoid
this issue by waiting for AP-STA-CONNECTED event from hostapd. This
makes sure the PMKSA cache entry gets added on the AP side.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-18 15:47:56 +02:00
Jouni Malinen
b9749b6aaa tests: Verify that SAE is supported for test cases requiring it
This makes it more convenient to run tests with wpa_supplicant builds
that do not support SAE (e.g., due to crypto library not providing
sufficient functionality for this).

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-12 00:19:21 +02:00
Jouni Malinen
81e787b750 tests: Convert test skipping to use exception
Instead of returning "skip" from the test function, raise the new
HwsimSkip exception to indicate a test case was skipped.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-08 22:43:47 +02:00
Jouni Malinen
5b3c40a65b tests: Verify that wpa_supplicant clears keys from memory
Check that PMK and PTK and not left in memory (heap or stack)
unnecessarily after they are not needed anymore.

Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-30 10:37:02 +02:00