blob: f659f0f57d5fbabcc873294a108f4f6b5574fcca [file] [log] [blame]
ChetanGaonkerd43b7d42016-06-08 11:07:34 -07001#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07002# Copyright 2016-present Ciena Corporation
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
ChetanGaonkerd43b7d42016-06-08 11:07:34 -07007#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07008# http://www.apache.org/licenses/LICENSE-2.0
ChetanGaonkerd43b7d42016-06-08 11:07:34 -07009#
Chetan Gaonkercfcce782016-05-10 10:10:42 -070010# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15#
A R Karthicka2e53d62016-02-19 17:38:30 -080016import unittest
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080017import time
18import os
19from nose.tools import *
A R Karthick22aa0c62016-05-31 11:17:12 -070020from nose.twistedtools import reactor, deferred
21from twisted.internet import defer
A R Karthicka2e53d62016-02-19 17:38:30 -080022from EapTLS import TLSAuthTest
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080023from OnosCtrl import OnosCtrl
A R Karthick9313b762016-11-07 13:14:35 -080024from CordLogger import CordLogger
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070025from scapy.all import *
ChetanGaonker6138fcd2016-08-18 17:56:39 -070026from scapy_ssl_tls.ssl_tls import *
27from scapy_ssl_tls.ssl_tls_crypto import *
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070028log.setLevel('INFO')
A R Karthicka2e53d62016-02-19 17:38:30 -080029
A R Karthick9313b762016-11-07 13:14:35 -080030class eap_auth_exchange(CordLogger):
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080031
A.R Karthick95d044e2016-06-10 18:44:36 -070032 app = 'org.opencord.aaa'
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070033 TLS_TIMEOUT = 20
ChetanGaonker6138fcd2016-08-18 17:56:39 -070034 TEST_TIMEOUT = 3600
A R Karthickeeac7e12017-03-10 17:35:39 -080035 #this is from ca.pem file
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070036 CLIENT_CERT_INVALID = '''-----BEGIN CERTIFICATE-----
A R Karthickeeac7e12017-03-10 17:35:39 -080037MIIEyTCCA7GgAwIBAgIJAN3OagiHm6AXMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
38VQQGEwJVUzELMAkGA1UECAwCQ0ExEjAQBgNVBAcMCVNvbWV3aGVyZTETMBEGA1UE
39CgwKQ2llbmEgSW5jLjEeMBwGCSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYw
40JAYDVQQDDB1FeGFtcGxlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNzAzMTEw
41MDQ3NDNaFw0yMjEwMzEwMDQ3NDNaMIGLMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
42Q0ExEjAQBgNVBAcMCVNvbWV3aGVyZTETMBEGA1UECgwKQ2llbmEgSW5jLjEeMBwG
43CSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYwJAYDVQQDDB1FeGFtcGxlIENl
A R Karthickaa10a202016-08-15 15:06:21 -070044cnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
A R Karthickeeac7e12017-03-10 17:35:39 -080045ggEBALYkVvncfeRel/apXy5iODla5H7sUpU7a+pwT7nephmjKDh0GPX/t5GUwgkB
461zQAEj0IPoxZIfSAGSFP/mqTUK2sm7qerArih0E3kBRpnBKJZB/4r1OTZ04CsuRQ
47QJOqcI0mZJWUKEcahN4yZvRyxeiCeFFoc0Nw787MQHhD9lZTqJUoAvautUe1GCjG
4846DS4MzpWNGkqn5/ZC8lQ198AceMwf2pJRuOQg5cPwp65+dKNLUMLiSUV7JpvmAo
49of4MHtGaBxKHESZ2jPiNTT2uKI/7KxH3Pr/ctft3bcSX2d4q49B2tdEIRzC0ankm
50CrxFcq9Cb3MGaNuwWAtk3fOGKusCAwEAAaOCASwwggEoMB0GA1UdDgQWBBRtf8rH
51zJW7rliW1eZnbVbSb3obfDCBwAYDVR0jBIG4MIG1gBRtf8rHzJW7rliW1eZnbVbS
52b3obfKGBkaSBjjCBizELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRIwEAYDVQQH
53DAlTb21ld2hlcmUxEzARBgNVBAoMCkNpZW5hIEluYy4xHjAcBgkqhkiG9w0BCQEW
54D2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAwwdRXhhbXBsZSBDZXJ0aWZpY2F0ZSBB
55dXRob3JpdHmCCQDdzmoIh5ugFzAMBgNVHRMEBTADAQH/MDYGA1UdHwQvMC0wK6Ap
A R Karthickaa10a202016-08-15 15:06:21 -070056oCeGJWh0dHA6Ly93d3cuZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZI
A R Karthickeeac7e12017-03-10 17:35:39 -080057hvcNAQELBQADggEBAKWjORcBc1WK3r8mq88ipUC2UR1qvxdON4K/hd+rdAj0E/xA
58QCJDORKno8f2MktqLfhU0amCVBvwdfmVFmVDtl38b1pu+mNFO+FDp04039Fd5ThM
59iYmiQjnJ2IcAi/CILtrjURvJUPSOX9lviOtcla0HW94dgA9IDRs5frrWO9jkcxXR
60+oz3LNMfVnXqhoHHQ1RtvqOozhEsUZZWY5MuUxRY25peeZ7m1vz+zDa/DbrV1wsP
61dxOocmYdGFIAT9AiRnR4Jc/hqabBVNMZlGAA+2dELajpaHqb4yx5gBLVkT7VgHjI
627cp7jLRL7T+i4orZiAXpeEpAeOrP8r0DYTJi/8A=
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070063-----END CERTIFICATE-----'''
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080064
ChetanGaonker6138fcd2016-08-18 17:56:39 -070065 invalid_cipher_suites = ['TLS_RSA_WITH_NULL_SHA256',
66 'TLS_RSA_WITH_AES_128_CBC_SHA',
67 'TLS_RSA_WITH_AES_128_CBC_SHA256',
68 'TLS_RSA_WITH_AES_256_CBC_SHA256',
69 'TLS_DHE_DSS_WITH_AES_128_CBC_SHA256',
70 'TLS_DHE_RSA_WITH_AES_128_CBC_SHA256',
71 'TLS_DH_anon_WITH_AES_128_CBC_SHA256',
72 'TLS_DHE_DSS_WITH_AES_256_CBC_SHA256',
73 'TLS_DHE_RSA_WITH_AES_256_CBC_SHA256',
74 'TLS_DH_anon_WITH_AES_256_CBC_SHA256']
75
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070076 def setUp(self):
A R Karthick9313b762016-11-07 13:14:35 -080077 super(eap_auth_exchange, self).setUp()
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070078 self.onos_ctrl = OnosCtrl(self.app)
79 self.onos_aaa_config()
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080080
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070081 def onos_aaa_config(self):
A R Karthicka652c4a2017-03-10 17:47:08 -080082 aaa_dict = {'apps' : { self.app : { 'AAA' : { 'radiusSecret': 'radius_password',
83 'radiusIp': '172.17.0.2' } } } }
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070084 radius_ip = os.getenv('ONOS_AAA_IP') or '172.17.0.2'
A R Karthicka652c4a2017-03-10 17:47:08 -080085 aaa_dict['apps'][self.app]['AAA']['radiusIp'] = radius_ip
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070086 self.onos_ctrl.activate()
87 time.sleep(2)
88 self.onos_load_config(aaa_dict)
Chetan Gaonker1f7c3f82016-03-08 12:17:37 -080089
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070090 def onos_load_config(self, config):
91 status, code = OnosCtrl.config(config)
92 if status is False:
93 log.info('Configure request for AAA returned status %d' %code)
94 assert_equal(status, True)
Chetan Gaonker41d2e072016-03-15 16:41:31 -070095 time.sleep(3)
A R Karthick22aa0c62016-05-31 11:17:12 -070096
ChetanGaonkerd43b7d42016-06-08 11:07:34 -070097 @deferred(TLS_TIMEOUT)
98 def test_eap_tls(self):
99 df = defer.Deferred()
100 def eap_tls_verify(df):
101 tls = TLSAuthTest()
102 tls.runTest()
103 df.callback(0)
104 reactor.callLater(0, eap_tls_verify, df)
105 return df
106
107 @deferred(TLS_TIMEOUT)
108 def test_eap_tls_with_no_cert(self):
109 df = defer.Deferred()
110 def eap_tls_no_cert(df):
111 def tls_no_cert_cb():
112 log.info('TLS authentication failed with no certificate')
ChetanGaonkerd43b7d42016-06-08 11:07:34 -0700113 tls = TLSAuthTest(fail_cb = tls_no_cert_cb, client_cert = '')
114 tls.runTest()
115 assert_equal(tls.failTest, True)
116 df.callback(0)
117 reactor.callLater(0, eap_tls_no_cert, df)
118 return df
119
120 @deferred(TLS_TIMEOUT)
121 def test_eap_tls_with_invalid_cert(self):
122 df = defer.Deferred()
123 def eap_tls_invalid_cert(df):
124 def tls_invalid_cert_cb():
125 log.info('TLS authentication failed with invalid certificate')
126
127 tls = TLSAuthTest(fail_cb = tls_invalid_cert_cb,
128 client_cert = self.CLIENT_CERT_INVALID)
129 tls.runTest()
130 assert_equal(tls.failTest, True)
131 df.callback(0)
132 reactor.callLater(0, eap_tls_invalid_cert, df)
133 return df
134
135 @deferred(TLS_TIMEOUT)
136 def test_eap_tls_Nusers_with_same_valid_cert(self):
137 df = defer.Deferred()
138 def eap_tls_Nusers_with_same_valid_cert(df):
139 num_users = 3
140 for i in xrange(num_users):
141 tls = TLSAuthTest(intf = 'veth{}'.format(i*2))
142 tls.runTest()
143 df.callback(0)
144 reactor.callLater(0, eap_tls_Nusers_with_same_valid_cert, df)
145 return df
A R Karthicka2e53d62016-02-19 17:38:30 -0800146
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700147 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800148 def test_eap_tls_with_invalid_session_id(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700149 df = defer.Deferred()
150 def eap_tls_invalid_session_id(df):
151 def tls_invalid_session_id_cb():
152 log.info('TLS authentication failed with invalid session id')
153 tls = TLSAuthTest(fail_cb = tls_invalid_session_id_cb,session_id = 12345, session_id_length = 1)
154 tls.runTest()
155 assert_equal(tls.failTest, True)
156 df.callback(0)
157 reactor.callLater(0, eap_tls_invalid_session_id, df)
158 return df
159
160 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800161 def test_eap_tls_with_random_gmt_unix_time(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700162 df = defer.Deferred()
163 def eap_tls_invalid_gmt_unix_time(df):
164 def eap_tls_invalid_gmt_unix_time_cb():
165 log.info('TLS authentication failed with invalid gmt_unix_time in Client Hello Packet')
166 for i in [0,7265,98758,23627238]:
167 log.info("\nExecuting test case with gmt_unix_time value is set to %d"%i)
168 tls = TLSAuthTest(fail_cb = eap_tls_invalid_gmt_unix_time_cb, gmt_unix_time = i)
169 tls.runTest()
170 assert_equal(tls.failTest, True)
171 df.callback(0)
172 reactor.callLater(0, eap_tls_invalid_gmt_unix_time, df)
173 return df
174
175 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800176 def test_eap_tls_with_invalid_content_type(self,Positive_Test=True):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700177 df = defer.Deferred()
178 def eap_tls_invalid_content_type(df):
179 def tls_invalid_content_type_cb():
180 log.info('TLS authentication failed with invalid content type in TLSContentType packet')
181 tls = TLSAuthTest(fail_cb = tls_invalid_content_type_cb, invalid_content_type = 24)
182 tls.runTest()
183 assert_equal(tls.failTest, True)
184 df.callback(0)
185 reactor.callLater(0, eap_tls_invalid_content_type, df)
186 return df
187
188 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800189 def test_eap_tls_with_invalid_record_fragment_length(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700190 df = defer.Deferred()
191 def eap_tls_invalid_record_fragment_length(df):
192 def eap_tls_invalid_record_fragment_length_cb():
193 log.info('TLS authentication failed with invalid fragment length field in TLSRecord packet')
194 tls = TLSAuthTest(fail_cb = eap_tls_invalid_record_fragment_length_cb, record_fragment_length = 17384)
195 tls.runTest()
196 assert_equal(tls.failTest, True)
197 df.callback(0)
198 reactor.callLater(0, eap_tls_invalid_record_fragment_length, df)
199 return df
200
201 #invalid id field in identifier response packet
202 @deferred(TLS_TIMEOUT)
203 def test_eap_tls_with_invalid_id_in_identifier_response_packet(self):
204 df = defer.Deferred()
205 def eap_tls_with_invalid_id_in_identifier_response_packet(df):
206 def tls_with_invalid_id_in_identifier_response_packet_cb():
207 log.info('TLS authentication failed with invalid id in identifier packet')
208 tls = TLSAuthTest(fail_cb = tls_with_invalid_id_in_identifier_response_packet_cb,
209 id_mismatch_in_identifier_response_packet = True)
210 tls.runTest()
211 assert_equal(tls.failTest, True)
212 df.callback(0)
213 reactor.callLater(0, eap_tls_with_invalid_id_in_identifier_response_packet, df)
214 return df
215
216 #invalid id field in client hello packet
217 @deferred(TLS_TIMEOUT)
218 def test_eap_tls_with_invalid_id_in_client_hello_packet(self):
219 df = defer.Deferred()
220 def eap_tls_with_invalid_id_in_client_hello_packet(df):
221 def tls_with_invalid_id_in_client_hello_packet_cb():
222 log.info('TLS authentication failed with invalid id in client hello packet')
223 tls = TLSAuthTest(fail_cb = tls_with_invalid_id_in_client_hello_packet_cb,
224 id_mismatch_in_client_hello_packet = True)
225 tls.runTest()
226 assert_equal(tls.failTest, True)
227 df.callback(0)
228 reactor.callLater(0, eap_tls_with_invalid_id_in_client_hello_packet, df)
229 return df
230
231 @deferred(TLS_TIMEOUT)
232 def test_eap_tls_without_sending_client_hello(self):
233 df = defer.Deferred()
234 def eap_tls_without_sending_client_hello(df):
235 def tls_without_sending_client_hello_cb():
236 log.info('TLS authentication failed with not sending client hello')
237 tls = TLSAuthTest(fail_cb = tls_without_sending_client_hello_cb,
238 dont_send_client_hello = True)
239 tls.runTest()
240 assert_equal(tls.failTest, True)
241 df.callback(0)
242 reactor.callLater(0, eap_tls_without_sending_client_hello, df)
243 return df
244
245 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800246 def test_eap_tls_with_aaa_app_deactivation(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700247 df = defer.Deferred()
248 def eap_tls_aaa_app_deactivate(df):
249 def tls_aaa_app_deactivate_cb():
250 log.info('TLS authentication failed with aaa app deactivated in ONOS')
251 tls = TLSAuthTest(fail_cb = tls_aaa_app_deactivate_cb)
252 self.onos_ctrl.deactivate()
253 tls.runTest()
254 assert_equal(tls.failTest, True)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800255 self.onos_ctrl.activate()
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700256 df.callback(0)
257 reactor.callLater(0, eap_tls_aaa_app_deactivate, df)
258 return df
259
260 #keeping cipher suite length as zero but including cipher suite key which is more than zero length in client hello packet
261 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800262 def test_eap_tls_with_incorrect_cipher_suite_length_field(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700263 df = defer.Deferred()
264 def eap_tls_incorrect_cipher_suite_length_field(df):
265 def tls_incorrect_cipher_suite_length_field_cb():
266 log.info('TLS authentication failed with incorrect cipher suite length field in client hello packet')
267 tls = TLSAuthTest(fail_cb = tls_incorrect_cipher_suite_length_field_cb, cipher_suites_length = 0)
268 tls.runTest()
269 assert_equal(tls.failTest, True)
270 df.callback(0)
271 reactor.callLater(0, eap_tls_incorrect_cipher_suite_length_field, df)
272 return df
273
274 #keeping compression methods length to zero but sending compression method of more than 0 zero length in client hello packet
275 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800276 def test_eap_tls_with_incorrect_compression_methods_length_field(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700277 df = defer.Deferred()
278 def eap_tls_incorrect_compression_methods_length_field(df):
279 def tls_incorrect_compression_methods_length_field_cb():
280 log.info('TLS authentication failed with incorrect compression methods length field in client hello packet')
281 tls = TLSAuthTest(fail_cb = tls_incorrect_compression_methods_length_field_cb, compression_methods_length=1,compression_methods=TLSCompressionMethod.LZS)
282 tls.runTest()
283 assert_equal(tls.failTest, True)
284 df.callback(0)
285 reactor.callLater(0, eap_tls_incorrect_compression_methods_length_field, df)
286 return df
287
288 #checking with broadcast source mac of EAPOL packet
289 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800290 def test_eap_tls_with_invalid_source_mac_broadcast(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700291 df = defer.Deferred()
292 def eap_tls_invalid_source_mac_broadcast(df):
293 def tls_invalid_source_mac_broadcast_cb():
294 log.info('TLS authentication failed with invalid source mac as broadcast in EAPOL packet')
295 tls = TLSAuthTest(fail_cb = tls_invalid_source_mac_broadcast_cb, src_mac='bcast')
296 tls.runTest()
297 assert_equal(tls.failTest, True)
298 df.callback(0)
299 reactor.callLater(0, eap_tls_invalid_source_mac_broadcast, df)
300 return df
301
302 #checking with multicast source mac of EAPOL packet
303 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800304 def test_eap_tls_with_invalid_source_mac_multicast(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700305 df = defer.Deferred()
306 def eap_tls_invalid_source_mac_multicast(df):
307 def tls_invalid_source_mac_multicast_cb():
308 log.info('TLS authentication failed with invalid source mac as multicast in EAPOL packet')
309 tls = TLSAuthTest(fail_cb = tls_invalid_source_mac_multicast_cb, src_mac='mcast')
310 tls.runTest()
311 assert_equal(tls.failTest, True)
312 df.callback(0)
313 reactor.callLater(0, eap_tls_invalid_source_mac_multicast, df)
314 return df
315
316 #checking with zero source mac of EAPOL packet
317 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800318 def test_eap_tls_with_invalid_source_mac_zero(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700319 df = defer.Deferred()
320 def eap_tls_invalid_source_mac_zero(df):
321 def tls_invalid_source_mac_zero_cb():
322 log.info('TLS authentication failed with invalid source mac as zero in EAPOL packet')
323 tls = TLSAuthTest(fail_cb = tls_invalid_source_mac_zero_cb, src_mac='zeros')
324 tls.runTest()
325 assert_equal(tls.failTest, True)
326 df.callback(0)
327 reactor.callLater(0, eap_tls_invalid_source_mac_zero, df)
328 return df
329
330 #Restarting Radius server after sending client hello
331 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800332 def test_eap_tls_with_restart_of_radius_server(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700333 df = defer.Deferred()
334 def eap_tls_restart_radius_server(df):
335 def tls_restart_radius_server_cb():
336 log.info('TLS authentication failed with radius server down in middle of authentication process')
337 tls = TLSAuthTest(fail_cb = tls_restart_radius_server_cb, restart_radius=True)
338 tls.runTest()
339 assert_equal(tls.failTest, True)
340 df.callback(0)
341 reactor.callLater(0, eap_tls_restart_radius_server, df)
342 return df
343
344 @deferred(TLS_TIMEOUT)
345 def test_eap_tls_with_incorrect_handshake_type_client_hello(self):
346 df = defer.Deferred()
347 def eap_tls_incorrect_handshake_type_client_hello(df):
348 def tls_incorrect_handshake_type_client_hello_cb():
349 log.info('TLS authentication failed with incorrect handshake type in client hello packet')
350 tls = TLSAuthTest(fail_cb = tls_incorrect_handshake_type_client_hello_cb, invalid_client_hello_handshake_type=True)
351 tls.runTest()
352 assert_equal(tls.failTest, True)
353 df.callback(0)
354 reactor.callLater(0, eap_tls_incorrect_handshake_type_client_hello, df)
355 return df
356
357 #Sending certificate request type of handhsake instead of certificate verify in client certificate request message
358 @deferred(TLS_TIMEOUT)
359 def test_eap_tls_with_incorrect_handshake_type_certificate_request(self):
360 df = defer.Deferred()
361 def eap_tls_incorrect_handshake_type_certificate_request(df):
362 def tls_incorrect_handshake_type_certificate_request_cb():
363 log.info('TLS authentication failed with incorrect handshake type in client certificate request packet')
364 tls = TLSAuthTest(fail_cb = tls_incorrect_handshake_type_certificate_request_cb, invalid_cert_req_handshake=True)
365 tls.runTest()
366 assert_equal(tls.failTest, True)
367 df.callback(0)
368 reactor.callLater(0, eap_tls_incorrect_handshake_type_certificate_request, df)
369 return df
370
371 #Sending tls record content type as 'ALERT' instead of 'HANDSHAKE' in certificate request packet
372 @deferred(TLS_TIMEOUT)
373 def test_eap_tls_with_incorrect_tlsrecord_certificate_request(self):
374 df = defer.Deferred()
375 def eap_tls_incorrect_tlsrecord_certificate_request(df):
376 def tls_incorrect_tlsrecord_certificate_request_cb():
377 log.info('TLS authentication failed with incorrect tlsrecord type in certificate request packet')
378 tls = TLSAuthTest(fail_cb = tls_incorrect_tlsrecord_certificate_request_cb, incorrect_tlsrecord_type_cert_req=True)
379 tls.runTest()
380 assert_equal(tls.failTest, True)
381 df.callback(0)
382 reactor.callLater(0, eap_tls_incorrect_tlsrecord_certificate_request, df)
383 return df
384
385 #Sending client hello with zero lenght field in Handshake protocol
386 @deferred(TLS_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800387 def test_eap_tls_with_invalid_handshake_length_client_hello(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700388 df = defer.Deferred()
389 def eap_tls_invalid_handshake_length_client_hello(df):
390 def tls_invalid_handshake_length_client_hello_cb():
391 log.info('TLS authentication failed with invalid handshake length in client hello packet')
392 tls = TLSAuthTest(fail_cb = tls_invalid_handshake_length_client_hello_cb, invalid_client_hello_handshake_length=True)
393 tls.runTest()
394 assert_equal(tls.failTest, True)
395 df.callback(0)
396 reactor.callLater(0, eap_tls_invalid_handshake_length_client_hello, df)
397 return df
398
399 @deferred(TLS_TIMEOUT)
400 def test_eap_tls_clientkeyex_replace_with_serverkeyex(self):
401 df = defer.Deferred()
402 def eap_tls_clientkeyex_replace_with_serverkeyex(df):
403 def tls_clientkeyex_replace_with_serverkeyex_cb():
404 log.info('TLS authentication failed with client key exchange replaced with server key exchange')
405 tls = TLSAuthTest(fail_cb = tls_clientkeyex_replace_with_serverkeyex_cb,clientkeyex_replace_with_serverkeyex=True)
406 tls.runTest()
407 assert_equal(tls.failTest, True)
408 df.callback(0)
409 reactor.callLater(0, eap_tls_clientkeyex_replace_with_serverkeyex, df)
410 return df
411
412 #simulating authentication for multiple users, 1K in this test case
413 @deferred(TEST_TIMEOUT)
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800414 def test_eap_tls_1k_sessions_with_diff_mac(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700415 df = defer.Deferred()
416 def eap_tls_1k_with_diff_mac(df):
417 for i in xrange(1000):
418 tls = TLSAuthTest(src_mac = 'random')
419 tls.runTest()
420 log.info('Authentication successfull for user %d'%i)
421 df.callback(0)
422 reactor.callLater(0, eap_tls_1k_with_diff_mac, df)
423 return df
424
425 #simulating authentication for multiple users, 5K in this test case
ChetanGaonkere2b665b2016-12-07 00:50:56 -0800426 @deferred(TEST_TIMEOUT+1800)
427 def test_eap_tls_5k_sessions_with_diff_mac(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700428 df = defer.Deferred()
429 def eap_tls_5k_with_diff_mac(df):
430 for i in xrange(5000):
431 tls = TLSAuthTest(src_mac = 'random')
432 tls.runTest()
433 log.info('Authentication successfull for user %d'%i)
434 df.callback(0)
435 reactor.callLater(0, eap_tls_5k_with_diff_mac, df)
436 return df
437
A R Karthicka2e53d62016-02-19 17:38:30 -0800438if __name__ == '__main__':
439 t = TLSAuthTest()
440 t.runTest()