blob: b2877af0501ff345025d84aec274d5f991b78b36 [file] [log] [blame]
A R Karthick05d9b5f2016-06-08 11:53:54 -07001#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07002# Copyright 2016-present Ciena Corporation
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
A R Karthick05d9b5f2016-06-08 11:53:54 -07007#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07008# http://www.apache.org/licenses/LICENSE-2.0
A R Karthick05d9b5f2016-06-08 11:53:54 -07009#
Chetan Gaonkercfcce782016-05-10 10:10:42 -070010# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15#
A R Karthicka2e53d62016-02-19 17:38:30 -080016#### Authentication parameters
Chetan Gaonker35cb16f2016-03-02 03:05:28 -080017from scapy.all import *
A R Karthickaa10a202016-08-15 15:06:21 -070018from scapy_ssl_tls.ssl_tls import *
A R Karthicka2e53d62016-02-19 17:38:30 -080019from socket import *
20from struct import *
A R Karthicka2e53d62016-02-19 17:38:30 -080021import sys
22from nose.tools import assert_equal, assert_not_equal, assert_raises, assert_true
A R Karthick76a497a2017-04-12 10:59:39 -070023from CordTestUtils import log_test
A R Karthicka2e53d62016-02-19 17:38:30 -080024
25USER = "raduser"
26PASS = "radpass"
27WRONG_USER = "XXXX"
28WRONG_PASS = "XXXX"
29NO_USER = ""
30NO_PASS = ""
31DEV = "tap0"
32ETHERTYPE_PAE = 0x888e
33PAE_GROUP_ADDR = "\xff\xff\xff\xff\xff\xff"
34EAPOL_VERSION = 1
35EAPOL_EAPPACKET = 0
36EAPOL_START = 1
37EAPOL_LOGOFF = 2
38EAPOL_KEY = 3
39EAPOL_ASF = 4
40EAP_REQUEST = 1
41EAP_RESPONSE = 2
42EAP_SUCCESS = 3
43EAP_FAILURE = 4
44EAP_TYPE_ID = 1
45EAP_TYPE_MD5 = 4
46EAP_TYPE_MSCHAP = 26
47EAP_TYPE_TLS = 13
48cCertMsg = '\x0b\x00\x00\x03\x00\x00\x00'
49TLS_LENGTH_INCLUDED = 0x80
A R Karthickaa10a202016-08-15 15:06:21 -070050TLS_MORE_FRAGMENTS = 0x40
A R Karthicka2e53d62016-02-19 17:38:30 -080051
A R Karthicka2e53d62016-02-19 17:38:30 -080052class EapolPacket(object):
A R Karthick05d9b5f2016-06-08 11:53:54 -070053
ChetanGaonker6138fcd2016-08-18 17:56:39 -070054 src_mac_map = { 'bcast': 'ff:ff:ff:ff:ff:ff',
55 'mcast': '01:80:C2:00:00:03',
56 'zeros': '00:00:00:00:00:00',
57 'default': None
58 }
59
A R Karthicka2e53d62016-02-19 17:38:30 -080060 def __init__(self, intf = 'veth0'):
61 self.intf = intf
62 self.s = None
A R Karthickaa10a202016-08-15 15:06:21 -070063 self.max_recv_size = 1600
A R Karthicka2e53d62016-02-19 17:38:30 -080064
ChetanGaonker6138fcd2016-08-18 17:56:39 -070065 def setup(self, src_mac = 'default'):
A R Karthicka2e53d62016-02-19 17:38:30 -080066 self.s = socket(AF_PACKET, SOCK_RAW, htons(ETHERTYPE_PAE))
67 self.s.bind((self.intf, ETHERTYPE_PAE))
68 self.mymac = self.s.getsockname()[4]
ChetanGaonker6138fcd2016-08-18 17:56:39 -070069 mac = None
70 if self.src_mac_map.has_key(src_mac):
71 mac = self.src_mac_map[src_mac]
72 if mac is None:
73 mac = self.mymac
74 self.llheader = Ether(dst = PAE_GROUP_ADDR, src = mac, type = ETHERTYPE_PAE)
A R Karthick76a497a2017-04-12 10:59:39 -070075 log_test.info('llheader packet is %s'%self.llheader.show())
76 log_test.info('source mac of packet is %s'%mac)
Chetan Gaonker5b366302016-03-21 16:18:21 -070077 self.recv_sock = L2Socket(iface = self.intf, type = ETHERTYPE_PAE)
A R Karthicka2e53d62016-02-19 17:38:30 -080078
79 def cleanup(self):
80 if self.s is not None:
81 self.s.close()
82 self.s = None
A R Karthick05d9b5f2016-06-08 11:53:54 -070083
A R Karthicka2e53d62016-02-19 17:38:30 -080084 def eapol(self, req_type, payload=""):
Chetan Gaonker35cb16f2016-03-02 03:05:28 -080085 return EAPOL(version = EAPOL_VERSION, type = req_type)/payload
A R Karthicka2e53d62016-02-19 17:38:30 -080086
87 def eap(self, code, pkt_id, req_type=0, data=""):
Chetan Gaonker35cb16f2016-03-02 03:05:28 -080088 return EAP(code = code, id = pkt_id, type = req_type)/data
A R Karthicka2e53d62016-02-19 17:38:30 -080089
A R Karthickaa10a202016-08-15 15:06:21 -070090 def eapFragmentSend(self, code, pkt_id, flags = TLS_LENGTH_INCLUDED, payload = "", fragsize = 1024):
91 req_type = EAP_TYPE_TLS
92 if code in [ EAP_SUCCESS, EAP_FAILURE ]:
93 data = pack("!BBH", code, pkt_id, 4)
94 self.eapol_send(EAPOL_EAPPACKET, data)
95 return True
96
97 if len(payload) <= fragsize:
98 if flags & TLS_LENGTH_INCLUDED:
99 flags_dlen = pack("!BL", flags, len(payload))
100 data = pack("!BBHB", code, pkt_id, 5 + len(flags_dlen) + len(payload), req_type) \
101 + flags_dlen + payload
102 self.eapol_send(EAPOL_EAPPACKET, data)
103 return True
104 flags_str = pack("!B", flags)
105 data = pack("!BBHB", code, pkt_id, 5+len(flags_str)+len(payload), req_type) + flags_str + payload
106 self.eapol_send(EAPOL_EAPPACKET, data)
107 return True
108
109 fragments = []
110 data = payload[:]
111 frag = 0
112 def eapol_frag_cb(pkt):
113 r = str(pkt)
114 tls_data = r[self.TLS_OFFSET:]
115 frag_data = fragments[frag]
116 ##change packet id in response to match request
117 eap_payload = frag_data[:1] + pack("!B", pkt[EAP].id) + frag_data[2:]
118 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
119
120 while len(data) > 0:
121 data_frag = data[:fragsize]
122 data = data[fragsize:]
123 if frag == 0:
124 ##first frag, include the total length
125 flags_dlen = pack("!BL", TLS_LENGTH_INCLUDED | TLS_MORE_FRAGMENTS, len(payload))
126 fragments.append(pack("!BBHB", code, pkt_id, 5 + len(flags_dlen) + len(data_frag), req_type) \
127 + flags_dlen + data_frag)
128 else:
129 if len(data) > 0:
130 flags = TLS_MORE_FRAGMENTS
131 else:
132 flags = 0
133 flags_str = pack("!B", flags)
134 fragments.append(pack("!BBHB", code, pkt_id, 5+len(flags_str)+len(data_frag), req_type) + \
135 flags_str + data_frag)
136 frag += 1
137
138 frag = 0
139 self.eapol_send(EAPOL_EAPPACKET, fragments[frag])
140 for frag in range(len(fragments)-1):
141 frag += 1
142 r = self.eapol_scapy_recv(cb = eapol_frag_cb,
143 lfilter = lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and \
144 pkt[EAP].code == EAP.REQUEST)
145
146 return True
147
A R Karthicka2e53d62016-02-19 17:38:30 -0800148 def eapTLS(self, code, pkt_id, flags = TLS_LENGTH_INCLUDED, data=""):
149 req_type = EAP_TYPE_TLS
150 if code in [EAP_SUCCESS, EAP_FAILURE]:
151 return pack("!BBH", code, pkt_id, 4)
152 else:
153 if flags & TLS_LENGTH_INCLUDED:
154 flags_dlen = pack("!BL", flags, len(data))
155 return pack("!BBHB", code, pkt_id, 5+len(flags_dlen)+len(data), req_type) + flags_dlen + data
156 flags_str = pack("!B", flags)
157 return pack("!BBHB", code, pkt_id, 5+len(flags_str)+len(data), req_type) + flags_str + data
158
A R Karthickaa10a202016-08-15 15:06:21 -0700159 def eapTLSFragment(self, code, pkt_id, frag, data="", data_len = 0):
160 req_type = EAP_TYPE_TLS
161 if frag == 0:
162 flags = TLS_LENGTH_INCLUDED | TLS_MORE_FRAGMENTS
163 elif frag > 0:
164 flags = TLS_MORE_FRAGMENTS
165 else:
166 #last fragment
167 flags = 0
168 if data_len == 0:
169 data_len = len(data)
170 if flags & TLS_LENGTH_INCLUDED:
171 flags_dlen = pack("!BL", flags, data_len)
172 return pack("!BBHB", code, pkt_id, 5+len(flags_dlen)+len(data), req_type) + flags_dlen + data
173 flags_str = pack("!B", flags)
174 return pack("!BBHB", code, pkt_id, 5+len(flags_str)+len(data), req_type) + flags_str + data
175
A R Karthicka2e53d62016-02-19 17:38:30 -0800176 def eapol_send(self, eapol_type, eap_payload):
Chetan Gaonker35cb16f2016-03-02 03:05:28 -0800177 return sendp(self.llheader/self.eapol(eapol_type, eap_payload), iface=self.intf)
A R Karthicka2e53d62016-02-19 17:38:30 -0800178
179 def eapol_recv(self):
A R Karthickaa10a202016-08-15 15:06:21 -0700180 p = self.s.recv(self.max_recv_size)[14:]
A R Karthicka2e53d62016-02-19 17:38:30 -0800181 vers,pkt_type,eapollen = unpack("!BBH",p[:4])
182 print "Version %d, type %d, len %d" %(vers, pkt_type, eapollen)
183 assert_equal(pkt_type, EAPOL_EAPPACKET)
184 return p[4:]
185
A.R Karthickaa859b22017-06-12 14:50:35 -0700186 def eapol_scapy_recv(self, cb = None, lfilter = None, count = 1, timeout = 10):
Chetan Gaonker5b366302016-03-21 16:18:21 -0700187 def eapol_default_cb(pkt): pass
188 if cb is None:
189 cb = eapol_default_cb
A R Karthick05d9b5f2016-06-08 11:53:54 -0700190 return sniff(prn = cb, lfilter = lfilter, count = count, timeout = timeout, opened_socket = self.recv_sock)
Chetan Gaonker5b366302016-03-21 16:18:21 -0700191
A R Karthicka2e53d62016-02-19 17:38:30 -0800192 def eapol_start(self):
193 eap_payload = self.eap(EAPOL_START, 2)
194 return self.eapol_send(EAPOL_START, eap_payload)
195
A R Karthick307483c2016-06-06 17:05:19 -0700196 def eapol_logoff(self):
197 eap_payload = self.eap(EAPOL_LOGOFF, 2)
198 return self.eapol_send(EAPOL_LOGOFF, eap_payload)
199
A R Karthicka2e53d62016-02-19 17:38:30 -0800200 def eapol_id_req(self, pkt_id = 0, user = USER):
201 eap_payload = self.eap(EAP_RESPONSE, pkt_id, EAP_TYPE_ID, user)
202 return self.eapol_send(EAPOL_EAPPACKET, eap_payload)
203
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -0800204 def eap_md5_challenge_recv(self,rad_pwd):
205 PASS = rad_pwd
206 print 'Inside EAP MD5 Challenge Exchange'
A R Karthickaa10a202016-08-15 15:06:21 -0700207 p = self.s.recv(self.max_recv_size)[14:]
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -0800208 vers,pkt_type,eapollen = unpack("!BBH",p[:4])
209 print "EAPOL Version %d, type %d, len %d" %(vers, pkt_type, eapollen)
210 code, pkt_id, eaplen = unpack("!BBH", p[4:8])
211 print "EAP Code %d, id %d, len %d" %(code, pkt_id, eaplen)
212 assert_equal(code, EAP_REQUEST)
213 reqtype = unpack("!B", p[8:9])[0]
214 reqdata = p[9:4+eaplen]
215 print 'Request type is %d' %(reqtype)
216 assert_equal(reqtype, EAP_TYPE_MD5)
217 challenge=pack("!B",pkt_id)+PASS+reqdata[1:]
218 print "Generating md5 challenge for %s" % challenge
219 return (challenge,pkt_id)
220
221 def eap_Status(self):
222 print 'Inside EAP Status'
A R Karthickaa10a202016-08-15 15:06:21 -0700223 p = self.s.recv(self.max_recv_size)[14:]
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -0800224 code, id, eaplen = unpack("!BBH", p[4:8])
225 return code
226
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000227 @classmethod
228 def eap_invalid_tls_packets_info(self, invalid_field_name = None, invalid_field_value = None):
A R Karthick76a497a2017-04-12 10:59:39 -0700229 log_test.info( 'Changing invalid field values in tls auth packets' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000230 if invalid_field_name == 'eapolTlsVersion':
231 global EAPOL_VERSION
A R Karthick76a497a2017-04-12 10:59:39 -0700232 log_test.info( 'Changing invalid field values in tls auth packets====== version changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000233 EAPOL_VERSION = invalid_field_value
234 if invalid_field_name == 'eapolTlsType':
235 global EAP_TYPE_TLS
A R Karthick76a497a2017-04-12 10:59:39 -0700236 log_test.info( 'Changing invalid field values in tls auth packets====== EAP TYPE TLS changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000237 EAP_TYPE_TLS = invalid_field_value
238 if invalid_field_name == 'eapolTypeID':
239 global EAP_TYPE_ID
A R Karthick76a497a2017-04-12 10:59:39 -0700240 log_test.info( 'Changing invalid field values in tls auth packets====== EAP TYPE TLS changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000241 EAP_TYPE_ID = invalid_field_value
242 if invalid_field_name == 'eapolResponse':
243 global EAP_RESPONSE
A R Karthick76a497a2017-04-12 10:59:39 -0700244 log_test.info( 'Changing invalid field values in tls auth packets====== EAP TYPE TLS changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000245 EAP_RESPONSE = invalid_field_value
246
247
248 @classmethod
249 def eap_tls_packets_field_value_replace(self, invalid_field_name = None):
A R Karthick76a497a2017-04-12 10:59:39 -0700250 log_test.info( 'Changing invalid field values in tls auth packets' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000251 if invalid_field_name == 'eapolTlsVersion':
252 global EAPOL_VERSION
253 EAPOL_VERSION = 1
A R Karthick76a497a2017-04-12 10:59:39 -0700254 log_test.info( 'Changing invalid field values in tls auth packets====== version changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000255 if invalid_field_name == 'eapolTlsType':
256 global EAP_TYPE_TLS
257 EAP_TYPE_TLS = 13
A R Karthick76a497a2017-04-12 10:59:39 -0700258 log_test.info( 'Changing invalid field values in tls auth packets====== version changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000259 if invalid_field_name == 'eapolTypeID':
260 global EAP_TYPE_ID
261 EAP_TYPE_ID = 1
A R Karthick76a497a2017-04-12 10:59:39 -0700262 log_test.info( 'Changing invalid field values in tls auth packets====== version changing' )
Thangavelu K Sef6f0a52016-12-14 19:57:05 +0000263 if invalid_field_name == 'eapolResponse':
264 global EAP_RESPONSE
265 EAP_RESPONSE = 2
A R Karthick76a497a2017-04-12 10:59:39 -0700266 log_test.info( 'Changing invalid field values in tls auth packets====== version changing' )