blob: cf8c673cadab0e6530573b0ace877f89c6d65d22 [file] [log] [blame]
A R Karthick05d9b5f2016-06-08 11:53:54 -07001#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07002# Copyright 2016-present Ciena Corporation
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
A R Karthick05d9b5f2016-06-08 11:53:54 -07007#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07008# http://www.apache.org/licenses/LICENSE-2.0
A R Karthick05d9b5f2016-06-08 11:53:54 -07009#
Chetan Gaonkercfcce782016-05-10 10:10:42 -070010# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15#
A R Karthicka2e53d62016-02-19 17:38:30 -080016import sys, os
A R Karthicka2e53d62016-02-19 17:38:30 -080017from EapolAAA import *
18from enum import *
19import noseTlsAuthHolder as tlsAuthHolder
20from scapy_ssl_tls.ssl_tls import *
A R Karthick22aa0c62016-05-31 11:17:12 -070021from scapy_ssl_tls.ssl_tls_crypto import *
A R Karthick307483c2016-06-06 17:05:19 -070022from tls_cert import Key
A R Karthicka2e53d62016-02-19 17:38:30 -080023from socket import *
A R Karthick307483c2016-06-06 17:05:19 -070024import struct
A R Karthicka2e53d62016-02-19 17:38:30 -080025import scapy
26from nose.tools import *
27from CordTestBase import CordTester
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -080028import re
A R Karthick22aa0c62016-05-31 11:17:12 -070029
Chetan Gaonker5b366302016-03-21 16:18:21 -070030log.setLevel('INFO')
A R Karthick22aa0c62016-05-31 11:17:12 -070031
32def bytes_to_num(data):
33 return int(data.encode('hex'), 16)
34
A R Karthicka2e53d62016-02-19 17:38:30 -080035class TLSAuthTest(EapolPacket, CordTester):
36
37 tlsStateTable = Enumeration("TLSStateTable", ("ST_EAP_SETUP",
38 "ST_EAP_START",
39 "ST_EAP_ID_REQ",
40 "ST_EAP_TLS_HELLO_REQ",
41 "ST_EAP_TLS_CERT_REQ",
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080042 "ST_EAP_TLS_CHANGE_CIPHER_SPEC",
43 "ST_EAP_TLS_FINISHED",
A R Karthicka2e53d62016-02-19 17:38:30 -080044 "ST_EAP_TLS_DONE"
45 )
46 )
47 tlsEventTable = Enumeration("TLSEventTable", ("EVT_EAP_SETUP",
48 "EVT_EAP_START",
49 "EVT_EAP_ID_REQ",
50 "EVT_EAP_TLS_HELLO_REQ",
51 "EVT_EAP_TLS_CERT_REQ",
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080052 "EVT_EAP_TLS_CHANGE_CIPHER_SPEC",
53 "EVT_EAP_TLS_FINISHED",
A R Karthicka2e53d62016-02-19 17:38:30 -080054 "EVT_EAP_TLS_DONE"
55 )
56 )
A R Karthick22aa0c62016-05-31 11:17:12 -070057 server_hello_done_signature = '\x0e\x00\x00\x00'
58 SERVER_HELLO = '\x02'
59 SERVER_CERTIFICATE = '\x0b'
A R Karthick307483c2016-06-06 17:05:19 -070060 CERTIFICATE_REQUEST = '\x0d'
61 SERVER_HELLO_DONE = '\x0e'
A R Karthick22aa0c62016-05-31 11:17:12 -070062 SERVER_UNKNOWN = '\xff'
63 HANDSHAKE = '\x16'
64 CHANGE_CIPHER = '\x14'
65 TLS_OFFSET = 28
66 HDR_IDX = 0
67 DATA_IDX = 1
68 CB_IDX = 2
A R Karthick307483c2016-06-06 17:05:19 -070069
A R Karthick22aa0c62016-05-31 11:17:12 -070070 CLIENT_CERT = """-----BEGIN CERTIFICATE-----
A R Karthick307483c2016-06-06 17:05:19 -070071MIICuDCCAiGgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080072CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
73IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
A R Karthick307483c2016-06-06 17:05:19 -070074RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwNjA2MjExMjI3WhcN
75MTcwNjAxMjExMjI3WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080076BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
A R Karthick307483c2016-06-06 17:05:19 -070077hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkC
78gYEAwvXiSzb9LZ6c7uNziUfKvoHO7wu/uiFC5YUpXbmVGuGZizbVrny0xnR85Dfe
79+9R4diansfDhIhzOUl1XjN3YDeSS9OeF5YWNNE8XDhlz2d3rVzaN6hIhdotBkUjg
80rUewjTg5OFR31QEyG3v8xR3CLgiE9xQELjZbSA07pD79zuUCAwEAAaNPME0wEwYD
81VR0lBAwwCgYIKwYBBQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5l
82eGFtcGxlLmNvbS9leGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOBgQDAjkrY
836tDChmKbvr8w6Du/t8vHjTCoCIocHTN0qzWOeb1YsAGX89+TrWIuO1dFyYd+Z0KC
84PDKB5j/ygml9Na+AklSYAVJIjvlzXKZrOaPmhZqDufi+rXWti/utVqY4VMW2+HKC
85nXp37qWeuFLGyR1519Y1d6F/5XzqmvbwURuEug==
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -080086-----END CERTIFICATE-----"""
A R Karthick22aa0c62016-05-31 11:17:12 -070087
A R Karthick307483c2016-06-06 17:05:19 -070088 CLIENT_PRIV_KEY = """-----BEGIN RSA PRIVATE KEY-----
89MIICXAIBAAKBgQDC9eJLNv0tnpzu43OJR8q+gc7vC7+6IULlhSlduZUa4ZmLNtWu
90fLTGdHzkN9771Hh2Jqex8OEiHM5SXVeM3dgN5JL054XlhY00TxcOGXPZ3etXNo3q
91EiF2i0GRSOCtR7CNODk4VHfVATIbe/zFHcIuCIT3FAQuNltIDTukPv3O5QIDAQAB
92AoGBAJha7NgYhevzqvIov25Fs1QDP0Kh7Ne5DH0u/e+nirUyHfqkBILSI7d+6uay
93Hsiv9t9mP+CXvGgbGMVW+oc0CpUbZw4Y64jZhg/vakMuHVhpgUCyPyzjk+7Z7STg
942B1DEAxILApU8azjrDBIRHM8q0CH6NFwJPpFjg2oi7li6hPhAkEA56e/UT7Mh+57
95qWb2q9CuI+unQcav1tqxRxUtrGHl0YSO5YTWCnaT7vVFUSbemwUhEHJs8h+Qw41L
96g4eBu/qXLQJBANdy7puiDBBvV8XxQms14VRAEUUpCwqmzieG3RNmgr7wYRKyXzws
97hbgp5HIkGFIM4FOIrFj5jUP6CuF2BfoYaZkCQGRIny75w6s413nfY/u/TBOqyW5V
98J/wYElSWW35bpxTLkNzVY5+F88ankUlvTUDIuKaZEobCmXW+bilTeRs6gUUCQGeo
992Lzw3rUZnTWTus0yg1Ox751C/hkF4LKL5NpsvAN6THpecAvXsA7HuS5hx4HSyCvo
1002mOEzj8ikxGfY4jNLiECQE09wQ39Gw3oGKCzdsTcWy8PXIWjOS44+7N/GjUB52+o
101CK7BGBOdZGZUSFc1rVA7eWKzxFDZ+EK264z6DL95mRw=
102-----END RSA PRIVATE KEY-----"""
103
A R Karthick22aa0c62016-05-31 11:17:12 -0700104 def handle_server_hello_done(self, server_hello_done):
105 if server_hello_done[-4:] == self.server_hello_done_signature:
106 self.server_hello_done_received = True
107
A R Karthick05d9b5f2016-06-08 11:53:54 -0700108 def __init__(self, intf = 'veth0', client_cert = None, client_priv_key = None, fail_cb = None):
A R Karthick22aa0c62016-05-31 11:17:12 -0700109 self.fsmTable = tlsAuthHolder.initTlsAuthHolderFsmTable(self, self.tlsStateTable, self.tlsEventTable)
110 EapolPacket.__init__(self, intf)
111 CordTester.__init__(self, self.fsmTable, self.tlsStateTable.ST_EAP_TLS_DONE)
112 #self.tlsStateTable, self.tlsEventTable)
113 self.currentState = self.tlsStateTable.ST_EAP_SETUP
114 self.currentEvent = self.tlsEventTable.EVT_EAP_SETUP
115 self.nextState = None
116 self.nextEvent = None
117 self.pending_bytes = 0 #for TLS fragment reassembly
118 self.server_hello_done_received = False
119 self.send_tls_response = True
120 self.server_certs = []
121 self.pkt_last = ''
122 self.pkt_history = []
123 self.pkt_map = { self.SERVER_HELLO: ['', '', lambda pkt: pkt ],
124 self.SERVER_CERTIFICATE: ['', '', lambda pkt: pkt ],
A R Karthick307483c2016-06-06 17:05:19 -0700125 self.CERTIFICATE_REQUEST: ['', '', lambda pkt: pkt ],
A R Karthick22aa0c62016-05-31 11:17:12 -0700126 self.SERVER_HELLO_DONE: ['', '', self.handle_server_hello_done ],
127 self.SERVER_UNKNOWN: ['', '', lambda pkt: pkt ]
128 }
129 self.tls_ctx = TLSSessionCtx(client = True)
A R Karthick05d9b5f2016-06-08 11:53:54 -0700130 self.client_cert = self.CLIENT_CERT if client_cert is None else client_cert
131 self.client_priv_key = self.CLIENT_PRIV_KEY if client_priv_key is None else client_priv_key
132 self.failTest = False
133 self.fail_cb = fail_cb
A R Karthick22aa0c62016-05-31 11:17:12 -0700134
135 def load_tls_record(self, data, pkt_type = ''):
A R Karthick307483c2016-06-06 17:05:19 -0700136 #if pkt_type not in [ self.SERVER_HELLO_DONE, self.SERVER_UNKNOWN ]:
137 if pkt_type == self.SERVER_HELLO_DONE:
138 data = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/data)
139 elif pkt_type == self.CERTIFICATE_REQUEST:
140 data = str(TLSRecord()/TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/data[9:])
141 data = None #For now ignore this record
142 if data:
A R Karthick22aa0c62016-05-31 11:17:12 -0700143 TLS(data, ctx = self.tls_ctx)
144
145 def pkt_update(self, pkt_type, data, hdr=None, reassembled = False):
146 if not self.pkt_map.has_key(pkt_type):
147 return
148 if hdr is not None:
149 self.pkt_map[pkt_type][self.HDR_IDX] += hdr
150 self.pkt_map[pkt_type][self.DATA_IDX] += data
151 if reassembled is True:
152 self.pkt_map[pkt_type][self.CB_IDX](self.pkt_map[pkt_type][self.DATA_IDX])
153 log.info('Appending packet type %02x to packet history of len %d'
154 %(ord(pkt_type), len(self.pkt_map[pkt_type][self.DATA_IDX])))
155 self.pkt_history.append(self.pkt_map[pkt_type][self.DATA_IDX])
156 data = ''.join(self.pkt_map[pkt_type][:self.DATA_IDX+1])
157 self.load_tls_record(data, pkt_type = pkt_type)
158 self.pkt_map[pkt_type][self.HDR_IDX] = ''
159 self.pkt_map[pkt_type][self.DATA_IDX] = ''
160
A R Karthick05d9b5f2016-06-08 11:53:54 -0700161 def tlsFail(self):
162 ##Force a failure
163 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED
A.R Karthick7eb2ce02016-06-10 19:00:50 -0700164 self.nextState = self.tlsStateTable.ST_EAP_TLS_FINISHED
A R Karthick05d9b5f2016-06-08 11:53:54 -0700165 self.failTest = True
166
A R Karthick22aa0c62016-05-31 11:17:12 -0700167 def eapol_server_hello_cb(self, pkt):
168 '''Reassemble and send response for server hello/certificate fragments'''
169 r = str(pkt)
170 offset = self.TLS_OFFSET
171 tls_data = r[offset:]
A R Karthick307483c2016-06-06 17:05:19 -0700172 type_hdrlen = 0
A R Karthick22aa0c62016-05-31 11:17:12 -0700173 if self.pending_bytes > 0:
174 if len(tls_data) >= self.pending_bytes:
175 self.pkt_update(self.pkt_last, tls_data[:self.pending_bytes], reassembled = True)
176 offset += self.pending_bytes
177 self.pkt_last = ''
178 self.pending_bytes = 0
179 else:
180 self.pkt_update(self.pkt_last, tls_data)
181 self.pending_bytes -= len(tls_data)
182
183 while self.pending_bytes == 0 and offset < len(pkt):
184 tls_data = r[offset:]
185 self.pending_bytes = bytes_to_num(tls_data[3:5])
186 if tls_data[0] == self.HANDSHAKE:
187 pkt_type = tls_data[5]
A R Karthick307483c2016-06-06 17:05:19 -0700188 if pkt_type in [ self.CERTIFICATE_REQUEST ]:
189 self.pending_bytes = bytes_to_num(tls_data[6:9])
190 type_hdrlen = 4
191 if len(tls_data) - 5 - type_hdrlen >= self.pending_bytes:
192 data_received = tls_data[5: 5 + type_hdrlen + self.pending_bytes ]
193 offset += 5 + type_hdrlen + self.pending_bytes
194 type_hdrlen = 0
A R Karthick22aa0c62016-05-31 11:17:12 -0700195 self.pending_bytes = 0
196 self.pkt_update(pkt_type, data_received,
197 hdr = tls_data[:5],
198 reassembled = True)
199 else:
200 self.pkt_update(pkt_type, tls_data[5:],
201 hdr = tls_data[:5],
202 reassembled = False)
A R Karthick307483c2016-06-06 17:05:19 -0700203 self.pending_bytes -= len(tls_data) - 5 - type_hdrlen
A R Karthick22aa0c62016-05-31 11:17:12 -0700204 self.pkt_last = pkt_type
205 log.info('Pending bytes left %d' %(self.pending_bytes))
206 assert self.pending_bytes > 0
A R Karthick307483c2016-06-06 17:05:19 -0700207 elif tls_data[0] == self.SERVER_HELLO_DONE:
208 self.pkt_update(tls_data[0], tls_data, reassembled = True)
209 break
A R Karthick22aa0c62016-05-31 11:17:12 -0700210 else:
211 self.pkt_last = self.SERVER_UNKNOWN
212 if len(tls_data) - 5 >= self.pending_bytes:
213 offset += 5 + self.pending_bytes
214 self.pending_bytes = 0
215 self.pkt_last = ''
216
217 #send TLS response
218 if self.send_tls_response:
219 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, '')
220 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
221
222 def _eapSetup(self):
223 self.setup()
224 self.nextEvent = self.tlsEventTable.EVT_EAP_START
A R Karthick05d9b5f2016-06-08 11:53:54 -0700225
A R Karthick22aa0c62016-05-31 11:17:12 -0700226 def _eapStart(self):
227 self.eapol_start()
228 self.nextEvent = self.tlsEventTable.EVT_EAP_ID_REQ
229
230 def _eapIdReq(self):
231 log.info( 'Inside EAP ID Req' )
232 def eapol_cb(pkt):
233 log.info('Got EAPOL packet with type id and code request')
234 log.info('Packet code: %d, type: %d, id: %d', pkt[EAP].code, pkt[EAP].type, pkt[EAP].id)
235 log.info("<====== Send EAP Response with identity = %s ================>" % USER)
236 self.eapol_id_req(pkt[EAP].id, USER)
237
A R Karthick05d9b5f2016-06-08 11:53:54 -0700238 r = self.eapol_scapy_recv(cb = eapol_cb,
239 lfilter =
240 lambda pkt: EAP in pkt and pkt[EAP].type == EAP.TYPE_ID and pkt[EAP].code == EAP.REQUEST)
241 if len(r) > 0:
242 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_HELLO_REQ
243 else:
244 self.tlsFail()
245 return r
A R Karthick22aa0c62016-05-31 11:17:12 -0700246
247 def _eapTlsHelloReq(self):
248
249 def eapol_cb(pkt):
250 log.info('Got hello request for id %d', pkt[EAP].id)
251 self.client_hello = TLSClientHello(version="TLS_1_0",
252 gmt_unix_time=1234,
253 random_bytes= '\xAB' * 28,
254 session_id='',
A R Karthick307483c2016-06-06 17:05:19 -0700255 compression_methods=[TLSCompressionMethod.NULL],
A R Karthick22aa0c62016-05-31 11:17:12 -0700256 cipher_suites=[TLSCipherSuite.RSA_WITH_AES_256_CBC_SHA]
257 )
A R Karthick307483c2016-06-06 17:05:19 -0700258 client_hello_data = TLSHandshake()/self.client_hello
259 self.pkt_history.append( str(client_hello_data) )
260 reqdata = TLSRecord()/client_hello_data
A R Karthick22aa0c62016-05-31 11:17:12 -0700261 self.load_tls_record(str(reqdata))
262 log.info("Sending Client Hello TLS payload of len %d, id %d" %(len(reqdata),pkt[EAP].id))
263 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, str(reqdata))
264 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
265
A R Karthick05d9b5f2016-06-08 11:53:54 -0700266 r = self.eapol_scapy_recv(cb = eapol_cb,
A R Karthick22aa0c62016-05-31 11:17:12 -0700267 lfilter =
268 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
A R Karthick05d9b5f2016-06-08 11:53:54 -0700269
270 if len(r) == 0:
271 self.tlsFail()
272 return r
273
274 for i in range(2):
275 r = self.eapol_scapy_recv(cb = self.eapol_server_hello_cb,
276 lfilter =
277 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
278 if len(r) == 0:
279 self.tlsFail()
280 return r
281
A R Karthick22aa0c62016-05-31 11:17:12 -0700282 ##send cert request when we receive the last server hello fragment
283 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CERT_REQ
284
A R Karthick307483c2016-06-06 17:05:19 -0700285 def get_verify_data(self):
A R Karthick22aa0c62016-05-31 11:17:12 -0700286 all_handshake_pkts = ''.join(self.pkt_history)
A R Karthick307483c2016-06-06 17:05:19 -0700287 return self.tls_ctx.get_verify_data(data = all_handshake_pkts)
288
289 def get_verify_signature(self, pem_data):
290 all_handshake_pkts = ''.join(self.pkt_history)
291 k = Key(pem_data)
292 signature = k.sign(all_handshake_pkts, t = 'pkcs', h = 'tls')
293 signature_data = '{}{}'.format(struct.pack('!H', len(signature)), signature)
294 return signature_data
295
296 def get_encrypted_handshake_msg(self, finish_val=''):
A R Karthick22aa0c62016-05-31 11:17:12 -0700297 if not finish_val:
A R Karthick307483c2016-06-06 17:05:19 -0700298 finish_val = self.get_verify_data()
A R Karthick22aa0c62016-05-31 11:17:12 -0700299 msg = str(TLSHandshake(type=TLSHandshakeType.FINISHED)/finish_val)
300 crypto_container = CryptoContainer(self.tls_ctx, data = msg,
301 content_type = TLSContentType.HANDSHAKE)
302 return crypto_container.encrypt()
303
A R Karthick307483c2016-06-06 17:05:19 -0700304 def get_encrypted_application_msg(self, msg = ''):
305 '''Needed with tunneled TLS'''
306 if not msg:
307 msg = 'test data'
308 return to_raw(TLSPlaintext(data = 'GET / HTTP/1.1\r\nHOST: localhost\r\n\r\n'), self.tls_ctx)
309
A R Karthick22aa0c62016-05-31 11:17:12 -0700310 def _eapTlsCertReq(self):
311
312 def eapol_cb(pkt):
313 log.info('Got cert request')
314 self.send_tls_response = False
315 self.eapol_server_hello_cb(pkt)
316 assert self.server_hello_done_received == True
317 rex_pem = re.compile(r'\-+BEGIN[^\-]+\-+(.*?)\-+END[^\-]+\-+', re.DOTALL)
A R Karthick05d9b5f2016-06-08 11:53:54 -0700318 if self.client_cert:
319 der_cert = rex_pem.findall(self.client_cert)[0].decode("base64")
320 client_certificate_list = TLSHandshake()/TLSCertificateList(
321 certificates=[TLSCertificate(data=x509.X509Cert(der_cert))])
322 else:
323 client_certificate_list = TLSHandshake()/TLSCertificateList(certificates=[])
A R Karthick307483c2016-06-06 17:05:19 -0700324 client_certificate = TLSRecord(version="TLS_1_0")/client_certificate_list
A R Karthick22aa0c62016-05-31 11:17:12 -0700325 kex_data = self.tls_ctx.get_client_kex_data()
A R Karthick307483c2016-06-06 17:05:19 -0700326 client_key_ex_data = TLSHandshake()/kex_data
327 client_key_ex = TLSRecord()/client_key_ex_data
A R Karthick05d9b5f2016-06-08 11:53:54 -0700328 if self.client_cert:
329 self.load_tls_record(str(client_certificate))
330 self.pkt_history.append(str(client_certificate_list))
A R Karthick22aa0c62016-05-31 11:17:12 -0700331 self.load_tls_record(str(client_key_ex))
A R Karthick307483c2016-06-06 17:05:19 -0700332 self.pkt_history.append(str(client_key_ex_data))
A R Karthick05d9b5f2016-06-08 11:53:54 -0700333 verify_signature = self.get_verify_signature(self.client_priv_key)
A R Karthick307483c2016-06-06 17:05:19 -0700334 client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_VERIFY)/verify_signature
335 client_cert_record = TLSRecord(content_type=TLSContentType.HANDSHAKE)/client_cert_verify
336 self.pkt_history.append(str(client_cert_verify))
A R Karthick22aa0c62016-05-31 11:17:12 -0700337 #log.info('TLS ctxt: %s' %self.tls_ctx)
338 client_ccs = TLSRecord(version="TLS_1_0")/TLSChangeCipherSpec()
339 enc_handshake_msg = self.get_encrypted_handshake_msg()
340 handshake_msg = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/enc_handshake_msg)
A R Karthick307483c2016-06-06 17:05:19 -0700341 reqdata = str(TLS.from_records([client_certificate, client_key_ex, client_cert_record, client_ccs]))
A R Karthick22aa0c62016-05-31 11:17:12 -0700342 reqdata += handshake_msg
Chetan Gaonker5b366302016-03-21 16:18:21 -0700343 log.info("------> Sending Client Hello TLS Certificate payload of len %d ----------->" %len(reqdata))
A R Karthick307483c2016-06-06 17:05:19 -0700344 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, reqdata)
Chetan Gaonker5b366302016-03-21 16:18:21 -0700345 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
346
A R Karthick05d9b5f2016-06-08 11:53:54 -0700347 r = self.eapol_scapy_recv(cb = eapol_cb,
348 lfilter =
349 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
350 if len(r) > 0:
351 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CHANGE_CIPHER_SPEC
352 else:
353 self.tlsFail()
354 return r
Chetan Gaonkerf8f77182016-03-11 15:34:57 -0800355
356 def _eapTlsChangeCipherSpec(self):
Chetan Gaonker5b366302016-03-21 16:18:21 -0700357 def eapol_cb(pkt):
A R Karthick22aa0c62016-05-31 11:17:12 -0700358 r = str(pkt)
A R Karthick307483c2016-06-06 17:05:19 -0700359 tls_data = r[self.TLS_OFFSET:]
A R Karthick22aa0c62016-05-31 11:17:12 -0700360 log.info('Verifying TLS Change Cipher spec record type %x' %ord(tls_data[0]))
361 assert tls_data[0] == self.CHANGE_CIPHER
A R Karthick307483c2016-06-06 17:05:19 -0700362 log.info('Handshake finished. Sending empty data')
363 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, 0, '')
364 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
Chetan Gaonker5b366302016-03-21 16:18:21 -0700365
A R Karthick05d9b5f2016-06-08 11:53:54 -0700366 r = self.eapol_scapy_recv(cb = eapol_cb,
367 lfilter =
368 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
369 if len(r) > 0:
370 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED
371 else:
372 self.tlsFail()
373 return r
Chetan Gaonkerf8f77182016-03-11 15:34:57 -0800374
375 def _eapTlsFinished(self):
A.R Karthick7eb2ce02016-06-10 19:00:50 -0700376 self.nextEvent = None
Chetan Gaonker5b366302016-03-21 16:18:21 -0700377 def eapol_cb(pkt):
A R Karthick307483c2016-06-06 17:05:19 -0700378 log.info('Server authentication successfull')
Chetan Gaonker5b366302016-03-21 16:18:21 -0700379
A R Karthick05d9b5f2016-06-08 11:53:54 -0700380 timeout = 5
381 if self.failTest is True:
382 if self.fail_cb is not None:
383 self.fail_cb()
384 return
385 timeout = None ##Wait forever on failure and force testcase timeouts
386
Chetan Gaonker5b366302016-03-21 16:18:21 -0700387 self.eapol_scapy_recv(cb = eapol_cb,
A R Karthick22aa0c62016-05-31 11:17:12 -0700388 lfilter =
A R Karthick05d9b5f2016-06-08 11:53:54 -0700389 lambda pkt: EAP in pkt and pkt[EAP].code == EAP.SUCCESS,
390 timeout = timeout)
A R Karthick307483c2016-06-06 17:05:19 -0700391 self.eapol_logoff()