Commit graph

14320 commits

Author SHA1 Message Date
Jouni Malinen ecacd9ccd4 DPP2: Extend wpa_pmk_to_ptk() to support extra Z.x component in context
DPP allows Diffie-Hellman exchange to be used for PFS in PTK derivation.
This requires an additional Z.x (x coordinate of the DH shared secret)
to be passed to wpa_pmk_to_ptk(). This commit adds that to the function
and updates all the callers to pass NULL,0 for that part in preparation
of the DPP specific changes to start using this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-18 01:31:31 +02:00
Jouni Malinen 16a4e931f0 OWE: Allow Diffie-Hellman Parameter element to be included with DPP
The previous OWE implementation on the AP side rejected any
(Re)Association Request frame with the Diffie-Hellman Parameter element
if AKM was not OWE. This breaks compatibility with DPP PFS, so relax
that rule to allow DPP AKM to be used as well. While this commit alone
does not add support for PFS, this allows interoperability between
non-PFS implementation on the AP and a newer PFS implementation on the
STA.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-18 00:27:11 +02:00
Jouni Malinen e71a90711d tests: Fix mesh_sae_groups_invalid to reset sae_groups setting
This test case did not clear a possibly modified sae_groups value from a
prior test case for adev[2] and could fail if the previously set group
was not supported by the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-18 00:02:16 +02:00
Jouni Malinen 96ad141e6c tests: Fix WPS with SAE test cases to reset sae_groups setting
These test cases did not clear a possibly modified sae_groups value from
a prior test case and could fail if the previously set group was not
supported by the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-18 00:02:11 +02:00
Jouni Malinen 95ace8670b tests: Fix ap_mixed_security to reset sae_groups setting
This test case did not clear a possibly modified sae_groups value from a
prior test case and could fail if the previously set group was not
supported by the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-18 00:02:08 +02:00
Jouni Malinen 296670aa94 tests: ap_mixed_security to use SAE capability from the correct station
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 21:38:34 +02:00
Jouni Malinen 203878d797 tests: Helper function for checking DPP-FAIL reporting
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 20:58:44 +02:00
Jouni Malinen 6d196e5928 tests: Helper functions for DPP PKEX initiator and responder
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 20:57:58 +02:00
Jouni Malinen 517f76b158 tests: DPP use the wait_auth_success() helper function
Use the already existing helper function and extend it to cover the most
common test sequences.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 19:17:31 +02:00
Jouni Malinen 7e0091007c tests: Use helper function for DPP_LISTEN commands
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 18:19:58 +02:00
Jouni Malinen e01a492caa tests: Helper function for DISCONNECT + ABORT_SCAN + wait
Use a helper function to perform this common sequence to disconnect and
stop any possibly started reconnection attempt.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 17:58:33 +02:00
Jouni Malinen 2b4263d06f tests: Handle scan result clearing more carefully in ap_country
If the ABORT_SCAN command succeeds, CTRL-EVENT-SCAN-RESULTS event is
delivered for the aborted scan. Following this with an immediate
flush_scan_cache() call can result in the first scan interpreting that
pending event as the completion and that results in trying to start
another scan while the first scan is still in progress.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 17:40:39 +02:00
Jouni Malinen 09bdbc6ed9 tests: Remove group at the end of p2p_ext_vendor_elem_invitation
This is needed to avoid leaving behind a ROC operation at the end of the
test case. This was found with the following test sequence:
p2p_ext_vendor_elem_invitation wifi_display_r2

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 17:06:04 +02:00
Jouni Malinen 421d658a67 tests: Fix ECDSA signature generation
Parsing of the DER encoded signature was unable to handle results that
were shorter than the prime. These need to be zero padded from left to
generate the correct value.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 16:53:05 +02:00
Jouni Malinen 3a88b7e6e9 tests: Split event wait in grpform_cred_ready_timeout
The long wait for the monitor socket events resulted in another socket
running out of TX buffer space. Split the wait into smaller segments and
clear the other socket in each iteration.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 16:08:53 +02:00
Jouni Malinen e4b4e1748a tests: Clear monitor socket queue in ap_hs20_interworking_oom
Do not leave all the event messages pending in the socket queue for the
full duration of the test case to avoid hitting the TX socket queue
limit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 16:08:31 +02:00
Jouni Malinen b21540e682 tests: Close wpa_supplicant control interface more robustly
Some of the test cases left behind attached control interface monitor
sockets that could result in hitting the wpa_supplicant socket TX queue
limit. Try to be a bit more careful about detaching and closing the
sockets to avoid this.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 16:08:30 +02:00
Jouni Malinen 4d916a7f3e tests: Fix dump_monitor() without monitor attached
Do not try to dump pending event messages if the monitor socket has not
been attached.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-17 12:22:23 +02:00
Jouni Malinen 808bdb308f Add TEST_FAIL() to aes_encrypt_init() with internal crypto
This is needed for the hwsim test cases ap_wpa2_eap_psk_oom and
ap_wpa2_eap_sim_oom.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-16 18:52:09 +02:00
Jouni Malinen 32f4760664 TLS: Add support for RFC 5705 TLS exporter context with internal TLS
Use the provided context, if any, to generate the seed for TLS PRF.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-16 18:52:09 +02:00
Ervin Oro a916ff5cd8 Add support for an optional context parameter to TLS exporter
Allow an additional context value to be passed to TLS exporter as
specified in RFC 5705 section 4.

This does not yet implement it for the internal TLS implementation.
However, as currently nothing uses context yet, this will not break
anything right now. WolfSSL maintainers also stated that they are not
going to add context support yet, but would look into it if/when this is
required by a published draft or a standard.

Signed-off-by: Ervin Oro <ervin.oro@aalto.fi>
2019-03-16 18:52:09 +02:00
Jouni Malinen fab49f6145 tests: Python coding style cleanup (pylint3 bad-whitespace)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 18:52:09 +02:00
Jouni Malinen 009b54bedd tests: DPP and provisoning DPP and legacy AKMs
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 18:52:09 +02:00
Jouni Malinen 18015fc8a4 DPP2: Support new legacy+DPP config object credentials
This allows devices supporting DPP protocol version 2 or newer to
provision networks that enable both the legacy (PSK/SAE) and DPP
credentials.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 18:52:06 +02:00
Jouni Malinen dd6c598007 DPP: Support DPP and SAE in the same network profile
Make both DPP and SAE code aware of the cases where the same network
profile is configured to enable both DPP and SAE. Prefer DPP over SAE in
such cases and start DPP/SAE exchanges based on what both the station
and the AP support.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 17:29:59 +02:00
Jouni Malinen 9305c2332b DPP: Clean up configuration parsing
Share a single parsing implementation for both hostapd and
wpa_supplicant to avoid code duplication. In addition, clean up the
implementation to be more easily extensible.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 17:29:59 +02:00
Jouni Malinen 3e1cfead0b tests: Use matching prefix for the ProxyARP IPv6 log files
The "_ipv6" part of the file name was missing and this resulted in file
names that conflicted with the IPv4 test cases and could overwrite logs
for those.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 23:57:44 +02:00
Jouni Malinen 39139d7ead tests: Decode brctl showmacs output for the debug log
This is needed with python3 to make the debug log more readable.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 23:57:44 +02:00
Jouni Malinen 649038e117 tests: Remove unnecessary second wait from connect_cmd_reject_assoc
It does not look like there would be two CTRL-EVENT-ASSOC-REJECT events
here, so only check the first one instead of requiring both to be
received with status_code=27. This test case could fail based on the
second connection attempt (due to that extra event wait) timing out.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 23:57:44 +02:00
Jouni Malinen a2d300765b tests: Make parallel-vm.py log easier to use for debugging failures
Print a list of full paths to log files from failed test cases both the
parallel.log and stdout so that they can be easily opened for analysis.
In addition, renumber the VM lines in the <timestamp>-parallel.log to
match the i+1 numbering used in the log directories and UI that is
tracking test execution.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 21:10:00 +02:00
Jouni Malinen 8cfc758827 tests: Make ap_wpa2_eap_peap_params more robust
One of the steps that expected failure due to PMKID mismatch did not
stop connection attempts. This could result in the following test step
failing due to the previous profile with peaplabel=1 getting used to
derive the MSK incorrectly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 13:51:55 +02:00
Jouni Malinen 043a29ecc4 tests: Clear pending monitor events before starting scan
The wait_event() call for scan completion could have processed a
previously received event from a prior scan instead of the newly started
one. This could result in flush_scan_cache() assuming there are still
results in the cache even though the scan request to clear the cache had
not even be started yet.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 13:51:55 +02:00
Jouni Malinen 4131ba5c55 tests: External radio work and DISCONNECT clearing connection attempt
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 13:03:31 +02:00
Jouni Malinen f5db775049 Remove pending connect and sme-connect radio works on disconnect
There was a race condition in a case where a new connection attempt was
scheduled as a pending radio work and that was followed by a DISCONNECT
command before the pending radio work is started. The pending radio work
would not have been deleted in that sequence and instead, it was
executed when the radio became available next. This could result in an
unexpected connection after an explicit request to disconnect.

Fix this by removing pending connect and sme-connect radio works on
disconnection request.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 13:03:31 +02:00
Jouni Malinen a8b8da1132 tests: Python coding style cleanup (pylint3 unneeded-not)
Use more readable "foo not in bar" construction for the couple of places
that did "not foo in bar".

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 11:34:32 +02:00
Jouni Malinen 2f22ed4fab tests: Fix run-tests.py module file (-l) handling
Prior cleanup broke the indentation here and made the addition of test
cases unreachable.

Fixes: 0663ae22ff ("tests: Do not use tabs for indentation")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 11:18:20 +02:00
Jouni Malinen c675397cc3 OpenSSL: Fix build with OpenSSL 1.0.2
X509_get_subject_name() in OpenSSL 1.0.2 does not mark its argument as a
const pointer, so need to type cast this to avoid a build warning.

Fixes: 841205a1ce ("OpenSSL: Add 'check_cert_subject' support for TLS server")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:33:33 +02:00
Jouni Malinen 3507968fd2 tests: SAE anti-clogging request with mesh BSS
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen ff5f54e159 SAE: Reduce queue wait time for pending Authentication frames
The queue_len * 50 ms wait time was too large with the retransmission
timeouts used in the mesh case for SAE. The maximum wait of 750 ms was
enough to prevent successful completion of authentication after having
hit the maximum queue length. While the previous commit is enough to
allow this to complete successfully in couple of retries, it looks like
a smaller wait time should be used here even if it means potentially
using more CPU.

Drop the processing wait time to queue_len * 10 ms so that the maximum
wait time is 150 ms if the queue is full.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen 5e3a759cd4 SAE: Improved queuing policy for pending authentication frames
The previous design of simply queuing all SAE commit messages was not
exactly good at allowing recovery from a flooding state if the valid
peer used frequent retransmissions of the SAE message. This could
happen, e.g., with mesh BSSs using SAE. The frequent retransmissions and
restarts of SAE authentication combined with SAE confirm messages
bypassing the queue ended up in not being able to finish SAE exchange
successfully.

Fix this by modifying the queuing policy to queue SAE confirm messages
if there is a queued SAE commit message from the same peer so that the
messages within the same exchange do not get reordered. In addition,
replace queued SAE commit/confirm message if a new matching message is
received from the same peer STA. This is useful for the case where the
peer restarts SAE more quickly than the local end has time to process
the queued messages.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen 8ad1009e50 tests: DPP and Enrollee rejecting Config Object
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen 67b3bcc954 DPP2: Testing option for Config Object rejction
Add a new testing option to force Enrollee to reject the receive Config
Object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen 22f90b32f1 DPP2: Configuration Result message generation and processing
Use this new message from Enrollee to Configurator to indicate result of
the config object provisioning if both devices support protocol version
2 or newer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen 8b6c834ff9 tests: DPP test cases to handle new behavior due to config result
The new DPP Configuration Result message can result in a bit different
behavior at the end of the configuration exchange and some of the test
cases need more flexibility to work with that DPP2 behavior.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen c98617b48d DPP2: Make DPP version number support available over control interface
"GET_CAPABILITY dpp" can now be used to determine which version number
of DPP is supported in the build.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-15 00:31:09 +02:00
Jouni Malinen f77d106294 tests: Fix dpp_qr_code_auth_initiator_enrollee to clear gas_address3
gas_address3 was set to 1 in this test case, but it was never cleared.
That can result in unexpected behavior in other test cases that dpeends
on gas_address3 being in its default value 0. Clear the parameter
explicitly to avoid this.

This resulted in an error in the following test sequence:
dpp_qr_code_auth_initiator_enrollee gas_anqp_address3_ap_forced

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-14 00:13:35 +02:00
Jouni Malinen 86db4e63d3 tests: Make WNM test case scan clearing more robust
There was a race condition on starting the flush_scan_cache() operations
if a scan happened to be in progress when the test case ended since the
ABORT_SCAN success case did not wait for the pending scan operation to
be completed. Wait for the scan completion event in addition to the
disconnection event if the ABORT_SCAN command is accepted.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 23:33:41 +02:00
Jouni Malinen 673631b8a3 More robust timer_tick_enabled tracking
Do not set sm->timer_tick_enabled if the eloop_register_timeout() call
fails so that the next attempt to enable the timer in
eapol_enable_timer_tick() can try to recover from unexpected eloop
failures. This should not really be needed in practical use cases, but
certain out-of-memory test cases can trigger allocation failure in
eloop_register_timeout() and if that happens, the previous EAPOL
supplicant state machine implementation got pretty much completely stuck
for any operation needing the timer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 23:33:41 +02:00
Jouni Malinen 64766a7783 tests: Make TDLS test case scan clearing more robust
There was a race condition on starting the flush_scan_cache() operations
if a scan happened to be in progress when the test case ended since the
ABORT_SCAN success case did not wait for the pending scan operation to
be completed. Wait for the scan completion event in addition to the
disconnection event if the ABORT_SCAN command is accepted.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 23:33:21 +02:00
Jouni Malinen 32e4ad4433 tests: Decode station dump output to restore pre-python3 behavior
These TDLS test cases missed Popen() result decode() calls in the
earlier python3 compatibility changes. Add those to make debug log more
readable.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 20:40:31 +02:00