blob: c9cf599ea30f726e6ef405b5e6319a8d8863b35f [file] [log] [blame]
A R Karthick05d9b5f2016-06-08 11:53:54 -07001#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07002# Copyright 2016-present Ciena Corporation
3#
4# Licensed under the Apache License, Version 2.0 (the "License");
5# you may not use this file except in compliance with the License.
6# You may obtain a copy of the License at
A R Karthick05d9b5f2016-06-08 11:53:54 -07007#
Chetan Gaonkercfcce782016-05-10 10:10:42 -07008# http://www.apache.org/licenses/LICENSE-2.0
A R Karthick05d9b5f2016-06-08 11:53:54 -07009#
Chetan Gaonkercfcce782016-05-10 10:10:42 -070010# Unless required by applicable law or agreed to in writing, software
11# distributed under the License is distributed on an "AS IS" BASIS,
12# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13# See the License for the specific language governing permissions and
14# limitations under the License.
15#
A R Karthicka2e53d62016-02-19 17:38:30 -080016import sys, os
A R Karthicka2e53d62016-02-19 17:38:30 -080017from EapolAAA import *
18from enum import *
19import noseTlsAuthHolder as tlsAuthHolder
20from scapy_ssl_tls.ssl_tls import *
A R Karthick22aa0c62016-05-31 11:17:12 -070021from scapy_ssl_tls.ssl_tls_crypto import *
A R Karthick307483c2016-06-06 17:05:19 -070022from tls_cert import Key
A R Karthicka2e53d62016-02-19 17:38:30 -080023from socket import *
ChetanGaonker6138fcd2016-08-18 17:56:39 -070024from CordTestServer import cord_test_radius_restart
A R Karthick307483c2016-06-06 17:05:19 -070025import struct
A R Karthicka2e53d62016-02-19 17:38:30 -080026import scapy
27from nose.tools import *
28from CordTestBase import CordTester
ChetanGaonker6138fcd2016-08-18 17:56:39 -070029from CordContainer import *
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -080030import re
ChetanGaonker6138fcd2016-08-18 17:56:39 -070031import time
A R Karthick22aa0c62016-05-31 11:17:12 -070032
Chetan Gaonker5b366302016-03-21 16:18:21 -070033log.setLevel('INFO')
A R Karthick22aa0c62016-05-31 11:17:12 -070034
35def bytes_to_num(data):
A R Karthick2b93d6a2016-09-06 15:19:09 -070036 try:
37 return int(data.encode('hex'), 16)
38 except:
39 print('Exception')
40 return -1
A R Karthick22aa0c62016-05-31 11:17:12 -070041
A R Karthicka2e53d62016-02-19 17:38:30 -080042class TLSAuthTest(EapolPacket, CordTester):
43
44 tlsStateTable = Enumeration("TLSStateTable", ("ST_EAP_SETUP",
45 "ST_EAP_START",
46 "ST_EAP_ID_REQ",
47 "ST_EAP_TLS_HELLO_REQ",
48 "ST_EAP_TLS_CERT_REQ",
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080049 "ST_EAP_TLS_CHANGE_CIPHER_SPEC",
50 "ST_EAP_TLS_FINISHED",
A R Karthicka2e53d62016-02-19 17:38:30 -080051 "ST_EAP_TLS_DONE"
52 )
53 )
54 tlsEventTable = Enumeration("TLSEventTable", ("EVT_EAP_SETUP",
55 "EVT_EAP_START",
56 "EVT_EAP_ID_REQ",
57 "EVT_EAP_TLS_HELLO_REQ",
58 "EVT_EAP_TLS_CERT_REQ",
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080059 "EVT_EAP_TLS_CHANGE_CIPHER_SPEC",
60 "EVT_EAP_TLS_FINISHED",
A R Karthicka2e53d62016-02-19 17:38:30 -080061 "EVT_EAP_TLS_DONE"
62 )
63 )
A R Karthick22aa0c62016-05-31 11:17:12 -070064 server_hello_done_signature = '\x0e\x00\x00\x00'
65 SERVER_HELLO = '\x02'
66 SERVER_CERTIFICATE = '\x0b'
A R Karthick307483c2016-06-06 17:05:19 -070067 CERTIFICATE_REQUEST = '\x0d'
68 SERVER_HELLO_DONE = '\x0e'
A R Karthick22aa0c62016-05-31 11:17:12 -070069 SERVER_UNKNOWN = '\xff'
70 HANDSHAKE = '\x16'
71 CHANGE_CIPHER = '\x14'
72 TLS_OFFSET = 28
73 HDR_IDX = 0
74 DATA_IDX = 1
75 CB_IDX = 2
A R Karthick307483c2016-06-06 17:05:19 -070076
A R Karthick22aa0c62016-05-31 11:17:12 -070077 CLIENT_CERT = """-----BEGIN CERTIFICATE-----
A R Karthickaa10a202016-08-15 15:06:21 -070078MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080079CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
80IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
A R Karthickaa10a202016-08-15 15:06:21 -070081RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
82MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
Chetan Gaonkerf8f77182016-03-11 15:34:57 -080083BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
A R Karthickaa10a202016-08-15 15:06:21 -070084hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
85AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
865An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
87tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
88OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
89qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
902Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
91BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
92eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
93MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
94VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
95RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
96dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
97T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
98yg==
Chetan Gaonker4a25e2b2016-03-04 14:45:15 -080099-----END CERTIFICATE-----"""
A R Karthick22aa0c62016-05-31 11:17:12 -0700100
A R Karthick307483c2016-06-06 17:05:19 -0700101 CLIENT_PRIV_KEY = """-----BEGIN RSA PRIVATE KEY-----
A R Karthickaa10a202016-08-15 15:06:21 -0700102MIIEpAIBAAKCAQEA7F6ZwGw+f21mwJrmjYkDqxAMLsDomAI1deXZUXMos028H09L
103oPtkGxDkCfTMQMw3OLnWruWetiDVfKIThLwXMwYAWv3hGUYxAlRtEP1X+iqzMxfi
104T76IA4q0gDWCvfHtmL7S2SNVJXNdOaA2eEKEBqZ0yyNhQbn4Jj1YCJxfLL5URXfN
105OmFlkNE6NyMSnib9NJdU9g+BgNcjjRhkpfkF2+rKRa1P+0iBlvjxFLU0/I39eQJj
106OXdu/bWrHsxzR9wRuwkEghFhNSR/GeyKVyeYvFJg76n4Nn24EsHNxC37hF3mktJ+
107LbVYzf3Znag6Le+z85gA8CqCaLYlY6/eZ49r/wIDAQABAoIBAQC9Oha4l2+JMBoc
108g2WjVVcccWJvY3xRhSMrWXEa5ahlswuxvRd8rwS7LlCBL/r8vQBQZ2ZY6fafM7X1
109awNZNgMUk+9g6PJ1+11s0g3mlgsCeYCwnKRO1ueofjh2k2AxlCZ0LAA8WS7nJm4x
110nfM9X3K2qDfEEHTh23Gvm1iIvDbtZ3+kXnjsdAuYduiaDDPNSyNOSCe2eCt2d9vt
111twV5pEf0PXcuLJ29i2LkRKdPwz/1J/AAE0dTJS9lrlLKE9qWXO2my4eUQI2FXVzW
112RpxhjGoFNXa59okobZ555rRrp4LHe8HPx5aowLSS5HGGrXHpiyYpFR9uciQxMD6q
113BQgmim5RAoGBAP09mWJS2gyiB9xqNY8MYyTrldXUIfujJ5OZch088rmbdS2p3TvG
114Oy6K0rOufBMCl95Ncv6YQ7cjQKpq8Q7fTfPkRI3/994DZu5D+vwyqIZpBnHDAnTi
115R9kf1Ep1QHmJPPE1GcijTnksaXP5g9+me2fTi4cCcl+An8GPv06z/KKjAoGBAO7x
1168MH1Dy2zAJhvlPbXdQLa/6b5aQeEVqObnJUvEaEy4M3c0QakULTDVQjsu/+ONNNV
1170Z5ZsBIWe/LaXxenub9lRJpD4KZOdz5bYIIq+Oa8L4bqTvyB/pVcZOE5a4ANvGiC
1184rVdAenPu734skgDFQPNZWKi/T6OZyJYgNzHG4L1AoGAEugvdHzVFM5gId+4Ifb9
119y/re0/kjlGMJCGcTcwVi5eKqa/9bqiPRtVbeBlZHoy+1YP6NUF7T5291W4PifYbE
120jioDyEpNGkFMxQtESOILXQWoWoQBwfJHBPnwYqLAbpKFf0jEpQs0R62+Lc96Pg9y
1219TyBFVJkcabrxorR8LFVclsCgYB8+eJ5MBneRy/aixIZAZxb//uTdAQxQFCohi2i
122Adpwu9HFGufhV3Q296u0XU3/XnvWxZ47+qES9Nujq//suXd32hnFrhcEJSpNXTHf
123I2bIGEmrgUYK4Fst+ANzobrOYWDYMQ0u2xSzHEoQFNH6xFHriTSsIJ/gZk8fMbdE
124wodrOQKBgQCOsFLo97vhlv6abA4v0T6bXuq4pzedIEh3bkqC/8rpLxqG98VoymHM
125bZIYf0U0KK3aNVfyXkIjGBaqA9/A0ttx/guOacf8M3yXbl3uEqlKevJTjhWlbUjp
126fM2med+fZ0+bh4DZ3O8BUJ1+6dxHngF/86GlwxTK4iSRkLIv6n3YSA==
A R Karthick307483c2016-06-06 17:05:19 -0700127-----END RSA PRIVATE KEY-----"""
128
A R Karthick22aa0c62016-05-31 11:17:12 -0700129 def handle_server_hello_done(self, server_hello_done):
130 if server_hello_done[-4:] == self.server_hello_done_signature:
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700131 log.info('server hello received')
A R Karthick22aa0c62016-05-31 11:17:12 -0700132 self.server_hello_done_received = True
133
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700134 def __init__(self, intf = 'veth0', client_cert = None, client_priv_key = None,
135 fail_cb = None, src_mac='default', version = "TLS_1_0", session_id = '',
136 session_id_length = None, gmt_unix_time=1234, invalid_content_type = 22,
137 record_fragment_length = None, cipher_suites_length = None,
138 compression_methods_length = None, compression_methods = TLSCompressionMethod.NULL,
139 CipherSuite = True, cipher_suite = 'RSA_WITH_AES_256_CBC_SHA', id_mismatch_in_identifier_response_packet = False,
140 id_mismatch_in_client_hello_packet = False , dont_send_client_certificate = False,
141 dont_send_client_hello = False, restart_radius = False, invalid_client_hello_handshake_type = False,
142 invalid_cert_req_handshake = False, incorrect_tlsrecord_type_cert_req = False,
143 invalid_client_hello_handshake_length = False, clientkeyex_replace_with_serverkeyex = False):
144
A R Karthick22aa0c62016-05-31 11:17:12 -0700145 self.fsmTable = tlsAuthHolder.initTlsAuthHolderFsmTable(self, self.tlsStateTable, self.tlsEventTable)
146 EapolPacket.__init__(self, intf)
147 CordTester.__init__(self, self.fsmTable, self.tlsStateTable.ST_EAP_TLS_DONE)
148 #self.tlsStateTable, self.tlsEventTable)
149 self.currentState = self.tlsStateTable.ST_EAP_SETUP
150 self.currentEvent = self.tlsEventTable.EVT_EAP_SETUP
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700151 self.src_mac = src_mac
152 self.version = version
153 self.session_id_length = session_id_length
154 self.session_id = session_id
155 self.gmt_unix_time = gmt_unix_time
156 self.invalid_content_type = invalid_content_type
157 self.CipherSuite = CipherSuite
158 self.cipher_suites_length = cipher_suites_length
159 self.compression_methods_length = compression_methods_length
160 self.cipher_suite = cipher_suite
161 self.compression_methods_length = compression_methods_length
162 self.compression_methods = compression_methods
163 self.record_fragment_length = record_fragment_length
164 self.invalid_client_hello_handshake_type = invalid_client_hello_handshake_type
165 self.invalid_client_hello_handshake_length = invalid_client_hello_handshake_length
166 self.invalid_cert_req_handshake = invalid_cert_req_handshake
167 self.id_mismatch_in_identifier_response_packet = id_mismatch_in_identifier_response_packet
168 self.id_mismatch_in_client_hello_packet = id_mismatch_in_client_hello_packet
169 self.dont_send_client_certificate = dont_send_client_certificate
170 self.dont_send_client_hello = dont_send_client_hello
171 self.incorrect_tlsrecord_type_cert_req = incorrect_tlsrecord_type_cert_req
172 self.restart_radius = restart_radius
173 self.clientkeyex_replace_with_serverkeyex = clientkeyex_replace_with_serverkeyex
A R Karthick22aa0c62016-05-31 11:17:12 -0700174 self.nextState = None
175 self.nextEvent = None
176 self.pending_bytes = 0 #for TLS fragment reassembly
177 self.server_hello_done_received = False
A R Karthickf028ec92016-08-15 16:58:11 -0700178 self.server_hello_done_eap_id = 0
A R Karthick22aa0c62016-05-31 11:17:12 -0700179 self.send_tls_response = True
180 self.server_certs = []
181 self.pkt_last = ''
182 self.pkt_history = []
183 self.pkt_map = { self.SERVER_HELLO: ['', '', lambda pkt: pkt ],
184 self.SERVER_CERTIFICATE: ['', '', lambda pkt: pkt ],
A R Karthick307483c2016-06-06 17:05:19 -0700185 self.CERTIFICATE_REQUEST: ['', '', lambda pkt: pkt ],
A R Karthick22aa0c62016-05-31 11:17:12 -0700186 self.SERVER_HELLO_DONE: ['', '', self.handle_server_hello_done ],
187 self.SERVER_UNKNOWN: ['', '', lambda pkt: pkt ]
188 }
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700189 if self.clientkeyex_replace_with_serverkeyex:
190 self.tls_ctx = TLSSessionCtx(client = False)
191 else:
192 self.tls_ctx = TLSSessionCtx(client = True)
A R Karthick05d9b5f2016-06-08 11:53:54 -0700193 self.client_cert = self.CLIENT_CERT if client_cert is None else client_cert
194 self.client_priv_key = self.CLIENT_PRIV_KEY if client_priv_key is None else client_priv_key
195 self.failTest = False
196 self.fail_cb = fail_cb
A R Karthick22aa0c62016-05-31 11:17:12 -0700197
198 def load_tls_record(self, data, pkt_type = ''):
A R Karthick307483c2016-06-06 17:05:19 -0700199 #if pkt_type not in [ self.SERVER_HELLO_DONE, self.SERVER_UNKNOWN ]:
200 if pkt_type == self.SERVER_HELLO_DONE:
201 data = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/data)
202 elif pkt_type == self.CERTIFICATE_REQUEST:
203 data = str(TLSRecord()/TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/data[9:])
204 data = None #For now ignore this record
205 if data:
A R Karthick22aa0c62016-05-31 11:17:12 -0700206 TLS(data, ctx = self.tls_ctx)
207
208 def pkt_update(self, pkt_type, data, hdr=None, reassembled = False):
209 if not self.pkt_map.has_key(pkt_type):
210 return
211 if hdr is not None:
212 self.pkt_map[pkt_type][self.HDR_IDX] += hdr
213 self.pkt_map[pkt_type][self.DATA_IDX] += data
214 if reassembled is True:
215 self.pkt_map[pkt_type][self.CB_IDX](self.pkt_map[pkt_type][self.DATA_IDX])
216 log.info('Appending packet type %02x to packet history of len %d'
217 %(ord(pkt_type), len(self.pkt_map[pkt_type][self.DATA_IDX])))
218 self.pkt_history.append(self.pkt_map[pkt_type][self.DATA_IDX])
219 data = ''.join(self.pkt_map[pkt_type][:self.DATA_IDX+1])
220 self.load_tls_record(data, pkt_type = pkt_type)
221 self.pkt_map[pkt_type][self.HDR_IDX] = ''
222 self.pkt_map[pkt_type][self.DATA_IDX] = ''
223
A R Karthick05d9b5f2016-06-08 11:53:54 -0700224 def tlsFail(self):
225 ##Force a failure
ChetanGaonker3441faf2016-10-27 12:15:21 -0700226 log.info('entering into testFail function')
A R Karthick05d9b5f2016-06-08 11:53:54 -0700227 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED
A.R Karthick7eb2ce02016-06-10 19:00:50 -0700228 self.nextState = self.tlsStateTable.ST_EAP_TLS_FINISHED
A R Karthick05d9b5f2016-06-08 11:53:54 -0700229 self.failTest = True
230
A R Karthick22aa0c62016-05-31 11:17:12 -0700231 def eapol_server_hello_cb(self, pkt):
232 '''Reassemble and send response for server hello/certificate fragments'''
233 r = str(pkt)
234 offset = self.TLS_OFFSET
235 tls_data = r[offset:]
A R Karthick307483c2016-06-06 17:05:19 -0700236 type_hdrlen = 0
A R Karthick22aa0c62016-05-31 11:17:12 -0700237 if self.pending_bytes > 0:
238 if len(tls_data) >= self.pending_bytes:
239 self.pkt_update(self.pkt_last, tls_data[:self.pending_bytes], reassembled = True)
240 offset += self.pending_bytes
241 self.pkt_last = ''
242 self.pending_bytes = 0
243 else:
244 self.pkt_update(self.pkt_last, tls_data)
245 self.pending_bytes -= len(tls_data)
A R Karthick2b93d6a2016-09-06 15:19:09 -0700246 print('Offset: %d, pkt : %d, pending %d\n' %(offset, len(pkt), self.pending_bytes))
A R Karthick22aa0c62016-05-31 11:17:12 -0700247 while self.pending_bytes == 0 and offset < len(pkt):
248 tls_data = r[offset:]
A R Karthick2b93d6a2016-09-06 15:19:09 -0700249 hexdump(tls_data)
A R Karthick22aa0c62016-05-31 11:17:12 -0700250 self.pending_bytes = bytes_to_num(tls_data[3:5])
A R Karthick2b93d6a2016-09-06 15:19:09 -0700251 if self.pending_bytes < 0:
252 self.pending_bytes = 0
253 return
A R Karthick22aa0c62016-05-31 11:17:12 -0700254 if tls_data[0] == self.HANDSHAKE:
255 pkt_type = tls_data[5]
A R Karthick307483c2016-06-06 17:05:19 -0700256 if pkt_type in [ self.CERTIFICATE_REQUEST ]:
257 self.pending_bytes = bytes_to_num(tls_data[6:9])
258 type_hdrlen = 4
259 if len(tls_data) - 5 - type_hdrlen >= self.pending_bytes:
260 data_received = tls_data[5: 5 + type_hdrlen + self.pending_bytes ]
261 offset += 5 + type_hdrlen + self.pending_bytes
262 type_hdrlen = 0
A R Karthick22aa0c62016-05-31 11:17:12 -0700263 self.pending_bytes = 0
264 self.pkt_update(pkt_type, data_received,
265 hdr = tls_data[:5],
266 reassembled = True)
267 else:
268 self.pkt_update(pkt_type, tls_data[5:],
269 hdr = tls_data[:5],
270 reassembled = False)
A R Karthick307483c2016-06-06 17:05:19 -0700271 self.pending_bytes -= len(tls_data) - 5 - type_hdrlen
A R Karthick22aa0c62016-05-31 11:17:12 -0700272 self.pkt_last = pkt_type
273 log.info('Pending bytes left %d' %(self.pending_bytes))
274 assert self.pending_bytes > 0
A R Karthick307483c2016-06-06 17:05:19 -0700275 elif tls_data[0] == self.SERVER_HELLO_DONE:
A R Karthickf028ec92016-08-15 16:58:11 -0700276 self.server_hello_done_eap_id = pkt[EAP].id
A R Karthick307483c2016-06-06 17:05:19 -0700277 self.pkt_update(tls_data[0], tls_data, reassembled = True)
278 break
A R Karthick22aa0c62016-05-31 11:17:12 -0700279 else:
280 self.pkt_last = self.SERVER_UNKNOWN
281 if len(tls_data) - 5 >= self.pending_bytes:
282 offset += 5 + self.pending_bytes
283 self.pending_bytes = 0
284 self.pkt_last = ''
285
A R Karthickf028ec92016-08-15 16:58:11 -0700286 #send TLS response ack till we receive server hello done
287 if self.server_hello_done_received == False:
A R Karthick22aa0c62016-05-31 11:17:12 -0700288 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, '')
289 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
290
291 def _eapSetup(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700292 #if self.src_mac == 'bcast':self.setup(src_mac='bcast')
293 #if self.src_mac == 'mcast': self.setup(src_mac='mcast')
294 #if self.src_mac == 'zeros': self.setup(src_mac='zeros')
295 #if self.src_mac == 'default': self.setup(src_mac='default')
296 self.setup(src_mac=self.src_mac)
A R Karthick22aa0c62016-05-31 11:17:12 -0700297 self.nextEvent = self.tlsEventTable.EVT_EAP_START
A R Karthick05d9b5f2016-06-08 11:53:54 -0700298
A R Karthick22aa0c62016-05-31 11:17:12 -0700299 def _eapStart(self):
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700300 log.info('_eapStart method started')
A R Karthick22aa0c62016-05-31 11:17:12 -0700301 self.eapol_start()
302 self.nextEvent = self.tlsEventTable.EVT_EAP_ID_REQ
303
304 def _eapIdReq(self):
305 log.info( 'Inside EAP ID Req' )
306 def eapol_cb(pkt):
307 log.info('Got EAPOL packet with type id and code request')
308 log.info('Packet code: %d, type: %d, id: %d', pkt[EAP].code, pkt[EAP].type, pkt[EAP].id)
309 log.info("<====== Send EAP Response with identity = %s ================>" % USER)
310 self.eapol_id_req(pkt[EAP].id, USER)
311
A R Karthick05d9b5f2016-06-08 11:53:54 -0700312 r = self.eapol_scapy_recv(cb = eapol_cb,
313 lfilter =
314 lambda pkt: EAP in pkt and pkt[EAP].type == EAP.TYPE_ID and pkt[EAP].code == EAP.REQUEST)
315 if len(r) > 0:
316 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_HELLO_REQ
317 else:
318 self.tlsFail()
319 return r
A R Karthick22aa0c62016-05-31 11:17:12 -0700320
321 def _eapTlsHelloReq(self):
322
323 def eapol_cb(pkt):
324 log.info('Got hello request for id %d', pkt[EAP].id)
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700325 self.client_hello = TLSClientHello(version= self.version,
326 gmt_unix_time=self.gmt_unix_time,
A R Karthick22aa0c62016-05-31 11:17:12 -0700327 random_bytes= '\xAB' * 28,
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700328 session_id_length = self.session_id_length,
329 session_id= self.session_id,
330 compression_methods_length = self.compression_methods_length,
331 compression_methods= self.compression_methods,
332 cipher_suites_length = self.cipher_suites_length,
333 cipher_suites=[self.cipher_suite]
A R Karthick22aa0c62016-05-31 11:17:12 -0700334 )
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700335 if self.invalid_client_hello_handshake_type:
336 log.info('sending server_hello instead of client_hello handshape type in client hello packet')
337 client_hello_data = TLSHandshake(type='server_hello')/self.client_hello
338 elif self.invalid_client_hello_handshake_length:
339 log.info('sending TLS Handshake message with zero length field in client hello packet')
340 client_hello_data = TLSHandshake(length=0)/self.client_hello
341 else:
342 client_hello_data = TLSHandshake()/self.client_hello
343 #client_hello_data = TLSHandshake()/self.client_hello
A R Karthick307483c2016-06-06 17:05:19 -0700344 self.pkt_history.append( str(client_hello_data) )
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700345 if self.record_fragment_length:
346 reqdata = TLSRecord(length=self.record_fragment_length)/client_hello_data
347 else:
348 reqdata = TLSRecord()/client_hello_data
A R Karthick22aa0c62016-05-31 11:17:12 -0700349 self.load_tls_record(str(reqdata))
350 log.info("Sending Client Hello TLS payload of len %d, id %d" %(len(reqdata),pkt[EAP].id))
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700351 if self.id_mismatch_in_client_hello_packet:
352 log.info('\nsending invalid id field in client hello packet')
353 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id+10, TLS_LENGTH_INCLUDED, str(reqdata))
354 else:
355 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, str(reqdata))
356 if self.dont_send_client_hello:
357 log.info('\nskipping client hello packet sending part')
358 pass
359 else:
360 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
361 if self.restart_radius:
362 cord_test_radius_restart()
A R Karthick22aa0c62016-05-31 11:17:12 -0700363
A R Karthick05d9b5f2016-06-08 11:53:54 -0700364 r = self.eapol_scapy_recv(cb = eapol_cb,
A R Karthick22aa0c62016-05-31 11:17:12 -0700365 lfilter =
366 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
A R Karthick05d9b5f2016-06-08 11:53:54 -0700367
368 if len(r) == 0:
369 self.tlsFail()
370 return r
371
A R Karthickf028ec92016-08-15 16:58:11 -0700372 #move to client/server certificate request
A R Karthick22aa0c62016-05-31 11:17:12 -0700373 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CERT_REQ
374
A R Karthick307483c2016-06-06 17:05:19 -0700375 def get_verify_data(self):
A R Karthick22aa0c62016-05-31 11:17:12 -0700376 all_handshake_pkts = ''.join(self.pkt_history)
A R Karthick307483c2016-06-06 17:05:19 -0700377 return self.tls_ctx.get_verify_data(data = all_handshake_pkts)
378
379 def get_verify_signature(self, pem_data):
380 all_handshake_pkts = ''.join(self.pkt_history)
381 k = Key(pem_data)
382 signature = k.sign(all_handshake_pkts, t = 'pkcs', h = 'tls')
383 signature_data = '{}{}'.format(struct.pack('!H', len(signature)), signature)
384 return signature_data
385
386 def get_encrypted_handshake_msg(self, finish_val=''):
A R Karthick22aa0c62016-05-31 11:17:12 -0700387 if not finish_val:
A R Karthick307483c2016-06-06 17:05:19 -0700388 finish_val = self.get_verify_data()
A R Karthick22aa0c62016-05-31 11:17:12 -0700389 msg = str(TLSHandshake(type=TLSHandshakeType.FINISHED)/finish_val)
390 crypto_container = CryptoContainer(self.tls_ctx, data = msg,
391 content_type = TLSContentType.HANDSHAKE)
392 return crypto_container.encrypt()
393
A R Karthick307483c2016-06-06 17:05:19 -0700394 def get_encrypted_application_msg(self, msg = ''):
395 '''Needed with tunneled TLS'''
396 if not msg:
397 msg = 'test data'
398 return to_raw(TLSPlaintext(data = 'GET / HTTP/1.1\r\nHOST: localhost\r\n\r\n'), self.tls_ctx)
399
A R Karthick22aa0c62016-05-31 11:17:12 -0700400 def _eapTlsCertReq(self):
A R Karthickf028ec92016-08-15 16:58:11 -0700401 log.info('Receiving server certificates')
402 while self.server_hello_done_received == False:
403 r = self.eapol_scapy_recv(cb = self.eapol_server_hello_cb,
404 lfilter =
405 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and \
406 pkt[EAP].code == EAP.REQUEST)
407 if len(r) == 0:
408 self.tlsFail()
409 return r
A R Karthickf028ec92016-08-15 16:58:11 -0700410 log.info('Sending client certificate request')
411 rex_pem = re.compile(r'\-+BEGIN[^\-]+\-+(.*?)\-+END[^\-]+\-+', re.DOTALL)
412 if self.client_cert:
413 der_cert = rex_pem.findall(self.client_cert)[0].decode("base64")
414 client_certificate_list = TLSHandshake()/TLSCertificateList(
415 certificates=[TLSCertificate(data=x509.X509Cert(der_cert))])
A R Karthick05d9b5f2016-06-08 11:53:54 -0700416 else:
A R Karthickf028ec92016-08-15 16:58:11 -0700417 client_certificate_list = TLSHandshake()/TLSCertificateList(certificates=[])
418 client_certificate = TLSRecord(version="TLS_1_0")/client_certificate_list
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700419 kex_data = self.tls_ctx.get_client_kex_data()
A R Karthickf028ec92016-08-15 16:58:11 -0700420 client_key_ex_data = TLSHandshake()/kex_data
421 client_key_ex = TLSRecord()/client_key_ex_data
422 if self.client_cert:
423 self.load_tls_record(str(client_certificate))
424 self.pkt_history.append(str(client_certificate_list))
425 self.load_tls_record(str(client_key_ex))
426 self.pkt_history.append(str(client_key_ex_data))
427 verify_signature = self.get_verify_signature(self.client_priv_key)
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700428 if self.invalid_cert_req_handshake:
429 log.info("sending 'certificate-request' type of handshake message instead of 'certificate-verify' type")
430 client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/verify_signature
431 else:
432 client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_VERIFY)/verify_signature
433 if self.incorrect_tlsrecord_type_cert_req:
434 log.info("sending TLS Record type as ALERT instead of HANDSHAKE in certificate request packet")
435 client_cert_record = TLSRecord(content_type=TLSContentType.ALERT)/client_cert_verify
436 else:
437 client_cert_record = TLSRecord(content_type=TLSContentType.HANDSHAKE)/client_cert_verify
A R Karthickf028ec92016-08-15 16:58:11 -0700438 self.pkt_history.append(str(client_cert_verify))
439 #log.info('TLS ctxt: %s' %self.tls_ctx)
440 client_ccs = TLSRecord(version="TLS_1_0")/TLSChangeCipherSpec()
441 enc_handshake_msg = self.get_encrypted_handshake_msg()
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700442 if self.invalid_content_type:
443 handshake_msg = str(TLSRecord(content_type=self.invalid_content_type)/enc_handshake_msg)
444 else:
445 handshake_msg = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/enc_handshake_msg)
A R Karthickf028ec92016-08-15 16:58:11 -0700446 reqdata = str(TLS.from_records([client_certificate, client_key_ex, client_cert_record, client_ccs]))
447 reqdata += handshake_msg
448 log.info("------> Sending Client Hello TLS Certificate payload of len %d ----------->" %len(reqdata))
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700449 if self.dont_send_client_certificate:
450 log.info('\nskipping sending client certificate part')
451 pass
452 else:
453 status = self.eapFragmentSend(EAP_RESPONSE, self.server_hello_done_eap_id, TLS_LENGTH_INCLUDED,
A R Karthickf028ec92016-08-15 16:58:11 -0700454 payload = reqdata, fragsize = 1024)
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700455 assert_equal(status, True)
456 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CHANGE_CIPHER_SPEC
Chetan Gaonkerf8f77182016-03-11 15:34:57 -0800457
ChetanGaonker3441faf2016-10-27 12:15:21 -0700458 def _eapTlsCertReq_delay(self):
459 self.server_hello_done_received = True
460 log.info('Sending client certificate request')
461 rex_pem = re.compile(r'\-+BEGIN[^\-]+\-+(.*?)\-+END[^\-]+\-+', re.DOTALL)
462
463 if self.client_cert:
464 der_cert = rex_pem.findall(self.client_cert)[0].decode("base64")
465 client_certificate_list = TLSHandshake()/TLSCertificateList(
466 certificates=[TLSCertificate(data=x509.X509Cert(der_cert))])
467 else:
468 client_certificate_list = TLSHandshake()/TLSCertificateList(certificates=[])
469
470 client_certificate = TLSRecord(version="TLS_1_0")/client_certificate_list
471 kex_data = self.tls_ctx.get_client_kex_data()
472 client_key_ex_data = TLSHandshake()/kex_data
473 client_key_ex = TLSRecord()/client_key_ex_data
474
475 if self.client_cert:
476 self.load_tls_record(str(client_certificate))
477 self.pkt_history.append(str(client_certificate_list))
478
479 self.load_tls_record(str(client_key_ex))
480 self.pkt_history.append(str(client_key_ex_data))
481 verify_signature = self.get_verify_signature(self.client_priv_key)
482
483 if self.invalid_cert_req_handshake:
484 log.info("Sending 'certificate-request' type of handshake message instead of 'certificate-verify' type")
485 client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/verify_signature
486 else:
487 client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_VERIFY)/verify_signature
488
489 if self.incorrect_tlsrecord_type_cert_req:
490 log.info("Sending TLS Record type as ALERT instead of HANDSHAKE in certificate request packet")
491 client_cert_record = TLSRecord(content_type=TLSContentType.ALERT)/client_cert_verify
492 else:
493 client_cert_record = TLSRecord(content_type=TLSContentType.HANDSHAKE)/client_cert_verify
494
495 self.pkt_history.append(str(client_cert_verify))
496 #log.info('TLS ctxt: %s' %self.tls_ctx)
497 client_ccs = TLSRecord(version="TLS_1_0")/TLSChangeCipherSpec()
498 enc_handshake_msg = self.get_encrypted_handshake_msg()
499
500 if self.invalid_content_type:
501 handshake_msg = str(TLSRecord(content_type=self.invalid_content_type)/enc_handshake_msg)
502 else:
503 handshake_msg = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/enc_handshake_msg)
504 reqdata = str(TLS.from_records([client_certificate, client_key_ex, client_cert_record, client_ccs]))
505 reqdata += handshake_msg
506 log.info("------> Sending Client Hello TLS Certificate payload of len %d ----------->" %len(reqdata))
507
508 if self.dont_send_client_certificate:
509 log.info('\nSkipping sending client certificate part')
510 pass
511 else:
512 status = self.eapFragmentSend(EAP_RESPONSE, self.server_hello_done_eap_id, TLS_LENGTH_INCLUDED,
513 payload = reqdata, fragsize = 1024)
514 assert_equal(status, True)
515 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CHANGE_CIPHER_SPEC
516
Chetan Gaonkerf8f77182016-03-11 15:34:57 -0800517 def _eapTlsChangeCipherSpec(self):
Chetan Gaonker5b366302016-03-21 16:18:21 -0700518 def eapol_cb(pkt):
A R Karthick22aa0c62016-05-31 11:17:12 -0700519 r = str(pkt)
ChetanGaonker6138fcd2016-08-18 17:56:39 -0700520 log.info('data received in change cipher spec function is %s'%pkt.show())
A R Karthick307483c2016-06-06 17:05:19 -0700521 tls_data = r[self.TLS_OFFSET:]
A R Karthick22aa0c62016-05-31 11:17:12 -0700522 log.info('Verifying TLS Change Cipher spec record type %x' %ord(tls_data[0]))
523 assert tls_data[0] == self.CHANGE_CIPHER
A R Karthick307483c2016-06-06 17:05:19 -0700524 log.info('Handshake finished. Sending empty data')
525 eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, 0, '')
526 self.eapol_send(EAPOL_EAPPACKET, eap_payload)
Chetan Gaonker5b366302016-03-21 16:18:21 -0700527
A R Karthick05d9b5f2016-06-08 11:53:54 -0700528 r = self.eapol_scapy_recv(cb = eapol_cb,
529 lfilter =
530 lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST)
531 if len(r) > 0:
532 self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED
533 else:
534 self.tlsFail()
535 return r
Chetan Gaonkerf8f77182016-03-11 15:34:57 -0800536
537 def _eapTlsFinished(self):
A.R Karthick7eb2ce02016-06-10 19:00:50 -0700538 self.nextEvent = None
Chetan Gaonker5b366302016-03-21 16:18:21 -0700539 def eapol_cb(pkt):
A R Karthick307483c2016-06-06 17:05:19 -0700540 log.info('Server authentication successfull')
Chetan Gaonker5b366302016-03-21 16:18:21 -0700541
A R Karthick05d9b5f2016-06-08 11:53:54 -0700542 timeout = 5
543 if self.failTest is True:
544 if self.fail_cb is not None:
545 self.fail_cb()
546 return
547 timeout = None ##Wait forever on failure and force testcase timeouts
548
Chetan Gaonker5b366302016-03-21 16:18:21 -0700549 self.eapol_scapy_recv(cb = eapol_cb,
A R Karthick22aa0c62016-05-31 11:17:12 -0700550 lfilter =
A R Karthick05d9b5f2016-06-08 11:53:54 -0700551 lambda pkt: EAP in pkt and pkt[EAP].code == EAP.SUCCESS,
552 timeout = timeout)
A R Karthick307483c2016-06-06 17:05:19 -0700553 self.eapol_logoff()