A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 1 | # |
Chetan Gaonker | cfcce78 | 2016-05-10 10:10:42 -0700 | [diff] [blame] | 2 | # Copyright 2016-present Ciena Corporation |
| 3 | # |
| 4 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | # you may not use this file except in compliance with the License. |
| 6 | # You may obtain a copy of the License at |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 7 | # |
Chetan Gaonker | cfcce78 | 2016-05-10 10:10:42 -0700 | [diff] [blame] | 8 | # http://www.apache.org/licenses/LICENSE-2.0 |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 9 | # |
Chetan Gaonker | cfcce78 | 2016-05-10 10:10:42 -0700 | [diff] [blame] | 10 | # Unless required by applicable law or agreed to in writing, software |
| 11 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | # See the License for the specific language governing permissions and |
| 14 | # limitations under the License. |
| 15 | # |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 16 | import sys, os |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 17 | from EapolAAA import * |
| 18 | from enum import * |
| 19 | import noseTlsAuthHolder as tlsAuthHolder |
| 20 | from scapy_ssl_tls.ssl_tls import * |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 21 | from scapy_ssl_tls.ssl_tls_crypto import * |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 22 | from tls_cert import Key |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 23 | from socket import * |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 24 | import struct |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 25 | import scapy |
| 26 | from nose.tools import * |
| 27 | from CordTestBase import CordTester |
Chetan Gaonker | 4a25e2b | 2016-03-04 14:45:15 -0800 | [diff] [blame] | 28 | import re |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 29 | |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 30 | log.setLevel('INFO') |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 31 | |
| 32 | def bytes_to_num(data): |
| 33 | return int(data.encode('hex'), 16) |
| 34 | |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 35 | class TLSAuthTest(EapolPacket, CordTester): |
| 36 | |
| 37 | tlsStateTable = Enumeration("TLSStateTable", ("ST_EAP_SETUP", |
| 38 | "ST_EAP_START", |
| 39 | "ST_EAP_ID_REQ", |
| 40 | "ST_EAP_TLS_HELLO_REQ", |
| 41 | "ST_EAP_TLS_CERT_REQ", |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 42 | "ST_EAP_TLS_CHANGE_CIPHER_SPEC", |
| 43 | "ST_EAP_TLS_FINISHED", |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 44 | "ST_EAP_TLS_DONE" |
| 45 | ) |
| 46 | ) |
| 47 | tlsEventTable = Enumeration("TLSEventTable", ("EVT_EAP_SETUP", |
| 48 | "EVT_EAP_START", |
| 49 | "EVT_EAP_ID_REQ", |
| 50 | "EVT_EAP_TLS_HELLO_REQ", |
| 51 | "EVT_EAP_TLS_CERT_REQ", |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 52 | "EVT_EAP_TLS_CHANGE_CIPHER_SPEC", |
| 53 | "EVT_EAP_TLS_FINISHED", |
A R Karthick | a2e53d6 | 2016-02-19 17:38:30 -0800 | [diff] [blame] | 54 | "EVT_EAP_TLS_DONE" |
| 55 | ) |
| 56 | ) |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 57 | server_hello_done_signature = '\x0e\x00\x00\x00' |
| 58 | SERVER_HELLO = '\x02' |
| 59 | SERVER_CERTIFICATE = '\x0b' |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 60 | CERTIFICATE_REQUEST = '\x0d' |
| 61 | SERVER_HELLO_DONE = '\x0e' |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 62 | SERVER_UNKNOWN = '\xff' |
| 63 | HANDSHAKE = '\x16' |
| 64 | CHANGE_CIPHER = '\x14' |
| 65 | TLS_OFFSET = 28 |
| 66 | HDR_IDX = 0 |
| 67 | DATA_IDX = 1 |
| 68 | CB_IDX = 2 |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 69 | |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 70 | CLIENT_CERT = """-----BEGIN CERTIFICATE----- |
A R Karthick | aa10a20 | 2016-08-15 15:06:21 -0700 | [diff] [blame] | 71 | MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 72 | CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h |
| 73 | IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd |
A R Karthick | aa10a20 | 2016-08-15 15:06:21 -0700 | [diff] [blame] | 74 | RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN |
| 75 | MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 76 | BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI |
A R Karthick | aa10a20 | 2016-08-15 15:06:21 -0700 | [diff] [blame] | 77 | hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC |
| 78 | AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ |
| 79 | 5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK |
| 80 | tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR |
| 81 | OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21 |
| 82 | qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39 |
| 83 | 2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB |
| 84 | BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l |
| 85 | eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV |
| 86 | MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn |
| 87 | VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP |
| 88 | RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ |
| 89 | dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3 |
| 90 | T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt |
| 91 | yg== |
Chetan Gaonker | 4a25e2b | 2016-03-04 14:45:15 -0800 | [diff] [blame] | 92 | -----END CERTIFICATE-----""" |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 93 | |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 94 | CLIENT_PRIV_KEY = """-----BEGIN RSA PRIVATE KEY----- |
A R Karthick | aa10a20 | 2016-08-15 15:06:21 -0700 | [diff] [blame] | 95 | MIIEpAIBAAKCAQEA7F6ZwGw+f21mwJrmjYkDqxAMLsDomAI1deXZUXMos028H09L |
| 96 | oPtkGxDkCfTMQMw3OLnWruWetiDVfKIThLwXMwYAWv3hGUYxAlRtEP1X+iqzMxfi |
| 97 | T76IA4q0gDWCvfHtmL7S2SNVJXNdOaA2eEKEBqZ0yyNhQbn4Jj1YCJxfLL5URXfN |
| 98 | OmFlkNE6NyMSnib9NJdU9g+BgNcjjRhkpfkF2+rKRa1P+0iBlvjxFLU0/I39eQJj |
| 99 | OXdu/bWrHsxzR9wRuwkEghFhNSR/GeyKVyeYvFJg76n4Nn24EsHNxC37hF3mktJ+ |
| 100 | LbVYzf3Znag6Le+z85gA8CqCaLYlY6/eZ49r/wIDAQABAoIBAQC9Oha4l2+JMBoc |
| 101 | g2WjVVcccWJvY3xRhSMrWXEa5ahlswuxvRd8rwS7LlCBL/r8vQBQZ2ZY6fafM7X1 |
| 102 | awNZNgMUk+9g6PJ1+11s0g3mlgsCeYCwnKRO1ueofjh2k2AxlCZ0LAA8WS7nJm4x |
| 103 | nfM9X3K2qDfEEHTh23Gvm1iIvDbtZ3+kXnjsdAuYduiaDDPNSyNOSCe2eCt2d9vt |
| 104 | twV5pEf0PXcuLJ29i2LkRKdPwz/1J/AAE0dTJS9lrlLKE9qWXO2my4eUQI2FXVzW |
| 105 | RpxhjGoFNXa59okobZ555rRrp4LHe8HPx5aowLSS5HGGrXHpiyYpFR9uciQxMD6q |
| 106 | BQgmim5RAoGBAP09mWJS2gyiB9xqNY8MYyTrldXUIfujJ5OZch088rmbdS2p3TvG |
| 107 | Oy6K0rOufBMCl95Ncv6YQ7cjQKpq8Q7fTfPkRI3/994DZu5D+vwyqIZpBnHDAnTi |
| 108 | R9kf1Ep1QHmJPPE1GcijTnksaXP5g9+me2fTi4cCcl+An8GPv06z/KKjAoGBAO7x |
| 109 | 8MH1Dy2zAJhvlPbXdQLa/6b5aQeEVqObnJUvEaEy4M3c0QakULTDVQjsu/+ONNNV |
| 110 | 0Z5ZsBIWe/LaXxenub9lRJpD4KZOdz5bYIIq+Oa8L4bqTvyB/pVcZOE5a4ANvGiC |
| 111 | 4rVdAenPu734skgDFQPNZWKi/T6OZyJYgNzHG4L1AoGAEugvdHzVFM5gId+4Ifb9 |
| 112 | y/re0/kjlGMJCGcTcwVi5eKqa/9bqiPRtVbeBlZHoy+1YP6NUF7T5291W4PifYbE |
| 113 | jioDyEpNGkFMxQtESOILXQWoWoQBwfJHBPnwYqLAbpKFf0jEpQs0R62+Lc96Pg9y |
| 114 | 9TyBFVJkcabrxorR8LFVclsCgYB8+eJ5MBneRy/aixIZAZxb//uTdAQxQFCohi2i |
| 115 | Adpwu9HFGufhV3Q296u0XU3/XnvWxZ47+qES9Nujq//suXd32hnFrhcEJSpNXTHf |
| 116 | I2bIGEmrgUYK4Fst+ANzobrOYWDYMQ0u2xSzHEoQFNH6xFHriTSsIJ/gZk8fMbdE |
| 117 | wodrOQKBgQCOsFLo97vhlv6abA4v0T6bXuq4pzedIEh3bkqC/8rpLxqG98VoymHM |
| 118 | bZIYf0U0KK3aNVfyXkIjGBaqA9/A0ttx/guOacf8M3yXbl3uEqlKevJTjhWlbUjp |
| 119 | fM2med+fZ0+bh4DZ3O8BUJ1+6dxHngF/86GlwxTK4iSRkLIv6n3YSA== |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 120 | -----END RSA PRIVATE KEY-----""" |
| 121 | |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 122 | def handle_server_hello_done(self, server_hello_done): |
| 123 | if server_hello_done[-4:] == self.server_hello_done_signature: |
| 124 | self.server_hello_done_received = True |
| 125 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 126 | def __init__(self, intf = 'veth0', client_cert = None, client_priv_key = None, fail_cb = None): |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 127 | self.fsmTable = tlsAuthHolder.initTlsAuthHolderFsmTable(self, self.tlsStateTable, self.tlsEventTable) |
| 128 | EapolPacket.__init__(self, intf) |
| 129 | CordTester.__init__(self, self.fsmTable, self.tlsStateTable.ST_EAP_TLS_DONE) |
| 130 | #self.tlsStateTable, self.tlsEventTable) |
| 131 | self.currentState = self.tlsStateTable.ST_EAP_SETUP |
| 132 | self.currentEvent = self.tlsEventTable.EVT_EAP_SETUP |
| 133 | self.nextState = None |
| 134 | self.nextEvent = None |
| 135 | self.pending_bytes = 0 #for TLS fragment reassembly |
| 136 | self.server_hello_done_received = False |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 137 | self.server_hello_done_eap_id = 0 |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 138 | self.send_tls_response = True |
| 139 | self.server_certs = [] |
| 140 | self.pkt_last = '' |
| 141 | self.pkt_history = [] |
| 142 | self.pkt_map = { self.SERVER_HELLO: ['', '', lambda pkt: pkt ], |
| 143 | self.SERVER_CERTIFICATE: ['', '', lambda pkt: pkt ], |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 144 | self.CERTIFICATE_REQUEST: ['', '', lambda pkt: pkt ], |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 145 | self.SERVER_HELLO_DONE: ['', '', self.handle_server_hello_done ], |
| 146 | self.SERVER_UNKNOWN: ['', '', lambda pkt: pkt ] |
| 147 | } |
| 148 | self.tls_ctx = TLSSessionCtx(client = True) |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 149 | self.client_cert = self.CLIENT_CERT if client_cert is None else client_cert |
| 150 | self.client_priv_key = self.CLIENT_PRIV_KEY if client_priv_key is None else client_priv_key |
| 151 | self.failTest = False |
| 152 | self.fail_cb = fail_cb |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 153 | |
| 154 | def load_tls_record(self, data, pkt_type = ''): |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 155 | #if pkt_type not in [ self.SERVER_HELLO_DONE, self.SERVER_UNKNOWN ]: |
| 156 | if pkt_type == self.SERVER_HELLO_DONE: |
| 157 | data = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/data) |
| 158 | elif pkt_type == self.CERTIFICATE_REQUEST: |
| 159 | data = str(TLSRecord()/TLSHandshake(type=TLSHandshakeType.CERTIFICATE_REQUEST)/data[9:]) |
| 160 | data = None #For now ignore this record |
| 161 | if data: |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 162 | TLS(data, ctx = self.tls_ctx) |
| 163 | |
| 164 | def pkt_update(self, pkt_type, data, hdr=None, reassembled = False): |
| 165 | if not self.pkt_map.has_key(pkt_type): |
| 166 | return |
| 167 | if hdr is not None: |
| 168 | self.pkt_map[pkt_type][self.HDR_IDX] += hdr |
| 169 | self.pkt_map[pkt_type][self.DATA_IDX] += data |
| 170 | if reassembled is True: |
| 171 | self.pkt_map[pkt_type][self.CB_IDX](self.pkt_map[pkt_type][self.DATA_IDX]) |
| 172 | log.info('Appending packet type %02x to packet history of len %d' |
| 173 | %(ord(pkt_type), len(self.pkt_map[pkt_type][self.DATA_IDX]))) |
| 174 | self.pkt_history.append(self.pkt_map[pkt_type][self.DATA_IDX]) |
| 175 | data = ''.join(self.pkt_map[pkt_type][:self.DATA_IDX+1]) |
| 176 | self.load_tls_record(data, pkt_type = pkt_type) |
| 177 | self.pkt_map[pkt_type][self.HDR_IDX] = '' |
| 178 | self.pkt_map[pkt_type][self.DATA_IDX] = '' |
| 179 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 180 | def tlsFail(self): |
| 181 | ##Force a failure |
| 182 | self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED |
A.R Karthick | 7eb2ce0 | 2016-06-10 19:00:50 -0700 | [diff] [blame] | 183 | self.nextState = self.tlsStateTable.ST_EAP_TLS_FINISHED |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 184 | self.failTest = True |
| 185 | |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 186 | def eapol_server_hello_cb(self, pkt): |
| 187 | '''Reassemble and send response for server hello/certificate fragments''' |
| 188 | r = str(pkt) |
| 189 | offset = self.TLS_OFFSET |
| 190 | tls_data = r[offset:] |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 191 | type_hdrlen = 0 |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 192 | if self.pending_bytes > 0: |
| 193 | if len(tls_data) >= self.pending_bytes: |
| 194 | self.pkt_update(self.pkt_last, tls_data[:self.pending_bytes], reassembled = True) |
| 195 | offset += self.pending_bytes |
| 196 | self.pkt_last = '' |
| 197 | self.pending_bytes = 0 |
| 198 | else: |
| 199 | self.pkt_update(self.pkt_last, tls_data) |
| 200 | self.pending_bytes -= len(tls_data) |
| 201 | |
| 202 | while self.pending_bytes == 0 and offset < len(pkt): |
| 203 | tls_data = r[offset:] |
| 204 | self.pending_bytes = bytes_to_num(tls_data[3:5]) |
| 205 | if tls_data[0] == self.HANDSHAKE: |
| 206 | pkt_type = tls_data[5] |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 207 | if pkt_type in [ self.CERTIFICATE_REQUEST ]: |
| 208 | self.pending_bytes = bytes_to_num(tls_data[6:9]) |
| 209 | type_hdrlen = 4 |
| 210 | if len(tls_data) - 5 - type_hdrlen >= self.pending_bytes: |
| 211 | data_received = tls_data[5: 5 + type_hdrlen + self.pending_bytes ] |
| 212 | offset += 5 + type_hdrlen + self.pending_bytes |
| 213 | type_hdrlen = 0 |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 214 | self.pending_bytes = 0 |
| 215 | self.pkt_update(pkt_type, data_received, |
| 216 | hdr = tls_data[:5], |
| 217 | reassembled = True) |
| 218 | else: |
| 219 | self.pkt_update(pkt_type, tls_data[5:], |
| 220 | hdr = tls_data[:5], |
| 221 | reassembled = False) |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 222 | self.pending_bytes -= len(tls_data) - 5 - type_hdrlen |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 223 | self.pkt_last = pkt_type |
| 224 | log.info('Pending bytes left %d' %(self.pending_bytes)) |
| 225 | assert self.pending_bytes > 0 |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 226 | elif tls_data[0] == self.SERVER_HELLO_DONE: |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 227 | self.server_hello_done_eap_id = pkt[EAP].id |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 228 | self.pkt_update(tls_data[0], tls_data, reassembled = True) |
| 229 | break |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 230 | else: |
| 231 | self.pkt_last = self.SERVER_UNKNOWN |
| 232 | if len(tls_data) - 5 >= self.pending_bytes: |
| 233 | offset += 5 + self.pending_bytes |
| 234 | self.pending_bytes = 0 |
| 235 | self.pkt_last = '' |
| 236 | |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 237 | #send TLS response ack till we receive server hello done |
| 238 | if self.server_hello_done_received == False: |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 239 | eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, '') |
| 240 | self.eapol_send(EAPOL_EAPPACKET, eap_payload) |
| 241 | |
| 242 | def _eapSetup(self): |
| 243 | self.setup() |
| 244 | self.nextEvent = self.tlsEventTable.EVT_EAP_START |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 245 | |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 246 | def _eapStart(self): |
| 247 | self.eapol_start() |
| 248 | self.nextEvent = self.tlsEventTable.EVT_EAP_ID_REQ |
| 249 | |
| 250 | def _eapIdReq(self): |
| 251 | log.info( 'Inside EAP ID Req' ) |
| 252 | def eapol_cb(pkt): |
| 253 | log.info('Got EAPOL packet with type id and code request') |
| 254 | log.info('Packet code: %d, type: %d, id: %d', pkt[EAP].code, pkt[EAP].type, pkt[EAP].id) |
| 255 | log.info("<====== Send EAP Response with identity = %s ================>" % USER) |
| 256 | self.eapol_id_req(pkt[EAP].id, USER) |
| 257 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 258 | r = self.eapol_scapy_recv(cb = eapol_cb, |
| 259 | lfilter = |
| 260 | lambda pkt: EAP in pkt and pkt[EAP].type == EAP.TYPE_ID and pkt[EAP].code == EAP.REQUEST) |
| 261 | if len(r) > 0: |
| 262 | self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_HELLO_REQ |
| 263 | else: |
| 264 | self.tlsFail() |
| 265 | return r |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 266 | |
| 267 | def _eapTlsHelloReq(self): |
| 268 | |
| 269 | def eapol_cb(pkt): |
| 270 | log.info('Got hello request for id %d', pkt[EAP].id) |
| 271 | self.client_hello = TLSClientHello(version="TLS_1_0", |
| 272 | gmt_unix_time=1234, |
| 273 | random_bytes= '\xAB' * 28, |
| 274 | session_id='', |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 275 | compression_methods=[TLSCompressionMethod.NULL], |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 276 | cipher_suites=[TLSCipherSuite.RSA_WITH_AES_256_CBC_SHA] |
| 277 | ) |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 278 | client_hello_data = TLSHandshake()/self.client_hello |
| 279 | self.pkt_history.append( str(client_hello_data) ) |
| 280 | reqdata = TLSRecord()/client_hello_data |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 281 | self.load_tls_record(str(reqdata)) |
| 282 | log.info("Sending Client Hello TLS payload of len %d, id %d" %(len(reqdata),pkt[EAP].id)) |
| 283 | eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, TLS_LENGTH_INCLUDED, str(reqdata)) |
| 284 | self.eapol_send(EAPOL_EAPPACKET, eap_payload) |
| 285 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 286 | r = self.eapol_scapy_recv(cb = eapol_cb, |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 287 | lfilter = |
| 288 | lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST) |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 289 | |
| 290 | if len(r) == 0: |
| 291 | self.tlsFail() |
| 292 | return r |
| 293 | |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 294 | #move to client/server certificate request |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 295 | self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CERT_REQ |
| 296 | |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 297 | def get_verify_data(self): |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 298 | all_handshake_pkts = ''.join(self.pkt_history) |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 299 | return self.tls_ctx.get_verify_data(data = all_handshake_pkts) |
| 300 | |
| 301 | def get_verify_signature(self, pem_data): |
| 302 | all_handshake_pkts = ''.join(self.pkt_history) |
| 303 | k = Key(pem_data) |
| 304 | signature = k.sign(all_handshake_pkts, t = 'pkcs', h = 'tls') |
| 305 | signature_data = '{}{}'.format(struct.pack('!H', len(signature)), signature) |
| 306 | return signature_data |
| 307 | |
| 308 | def get_encrypted_handshake_msg(self, finish_val=''): |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 309 | if not finish_val: |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 310 | finish_val = self.get_verify_data() |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 311 | msg = str(TLSHandshake(type=TLSHandshakeType.FINISHED)/finish_val) |
| 312 | crypto_container = CryptoContainer(self.tls_ctx, data = msg, |
| 313 | content_type = TLSContentType.HANDSHAKE) |
| 314 | return crypto_container.encrypt() |
| 315 | |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 316 | def get_encrypted_application_msg(self, msg = ''): |
| 317 | '''Needed with tunneled TLS''' |
| 318 | if not msg: |
| 319 | msg = 'test data' |
| 320 | return to_raw(TLSPlaintext(data = 'GET / HTTP/1.1\r\nHOST: localhost\r\n\r\n'), self.tls_ctx) |
| 321 | |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 322 | def _eapTlsCertReq(self): |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 323 | log.info('Receiving server certificates') |
| 324 | while self.server_hello_done_received == False: |
| 325 | r = self.eapol_scapy_recv(cb = self.eapol_server_hello_cb, |
| 326 | lfilter = |
| 327 | lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and \ |
| 328 | pkt[EAP].code == EAP.REQUEST) |
| 329 | if len(r) == 0: |
| 330 | self.tlsFail() |
| 331 | return r |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 332 | |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 333 | log.info('Sending client certificate request') |
| 334 | rex_pem = re.compile(r'\-+BEGIN[^\-]+\-+(.*?)\-+END[^\-]+\-+', re.DOTALL) |
| 335 | if self.client_cert: |
| 336 | der_cert = rex_pem.findall(self.client_cert)[0].decode("base64") |
| 337 | client_certificate_list = TLSHandshake()/TLSCertificateList( |
| 338 | certificates=[TLSCertificate(data=x509.X509Cert(der_cert))]) |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 339 | else: |
A R Karthick | f028ec9 | 2016-08-15 16:58:11 -0700 | [diff] [blame^] | 340 | client_certificate_list = TLSHandshake()/TLSCertificateList(certificates=[]) |
| 341 | client_certificate = TLSRecord(version="TLS_1_0")/client_certificate_list |
| 342 | kex_data = self.tls_ctx.get_client_kex_data() |
| 343 | client_key_ex_data = TLSHandshake()/kex_data |
| 344 | client_key_ex = TLSRecord()/client_key_ex_data |
| 345 | if self.client_cert: |
| 346 | self.load_tls_record(str(client_certificate)) |
| 347 | self.pkt_history.append(str(client_certificate_list)) |
| 348 | self.load_tls_record(str(client_key_ex)) |
| 349 | self.pkt_history.append(str(client_key_ex_data)) |
| 350 | verify_signature = self.get_verify_signature(self.client_priv_key) |
| 351 | client_cert_verify = TLSHandshake(type=TLSHandshakeType.CERTIFICATE_VERIFY)/verify_signature |
| 352 | client_cert_record = TLSRecord(content_type=TLSContentType.HANDSHAKE)/client_cert_verify |
| 353 | self.pkt_history.append(str(client_cert_verify)) |
| 354 | #log.info('TLS ctxt: %s' %self.tls_ctx) |
| 355 | client_ccs = TLSRecord(version="TLS_1_0")/TLSChangeCipherSpec() |
| 356 | enc_handshake_msg = self.get_encrypted_handshake_msg() |
| 357 | handshake_msg = str(TLSRecord(content_type=TLSContentType.HANDSHAKE)/enc_handshake_msg) |
| 358 | reqdata = str(TLS.from_records([client_certificate, client_key_ex, client_cert_record, client_ccs])) |
| 359 | reqdata += handshake_msg |
| 360 | log.info("------> Sending Client Hello TLS Certificate payload of len %d ----------->" %len(reqdata)) |
| 361 | status = self.eapFragmentSend(EAP_RESPONSE, self.server_hello_done_eap_id, TLS_LENGTH_INCLUDED, |
| 362 | payload = reqdata, fragsize = 1024) |
| 363 | assert_equal(status, True) |
| 364 | self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_CHANGE_CIPHER_SPEC |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 365 | |
| 366 | def _eapTlsChangeCipherSpec(self): |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 367 | def eapol_cb(pkt): |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 368 | r = str(pkt) |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 369 | tls_data = r[self.TLS_OFFSET:] |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 370 | log.info('Verifying TLS Change Cipher spec record type %x' %ord(tls_data[0])) |
| 371 | assert tls_data[0] == self.CHANGE_CIPHER |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 372 | log.info('Handshake finished. Sending empty data') |
| 373 | eap_payload = self.eapTLS(EAP_RESPONSE, pkt[EAP].id, 0, '') |
| 374 | self.eapol_send(EAPOL_EAPPACKET, eap_payload) |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 375 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 376 | r = self.eapol_scapy_recv(cb = eapol_cb, |
| 377 | lfilter = |
| 378 | lambda pkt: EAP in pkt and pkt[EAP].type == EAP_TYPE_TLS and pkt[EAP].code == EAP.REQUEST) |
| 379 | if len(r) > 0: |
| 380 | self.nextEvent = self.tlsEventTable.EVT_EAP_TLS_FINISHED |
| 381 | else: |
| 382 | self.tlsFail() |
| 383 | return r |
Chetan Gaonker | f8f7718 | 2016-03-11 15:34:57 -0800 | [diff] [blame] | 384 | |
| 385 | def _eapTlsFinished(self): |
A.R Karthick | 7eb2ce0 | 2016-06-10 19:00:50 -0700 | [diff] [blame] | 386 | self.nextEvent = None |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 387 | def eapol_cb(pkt): |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 388 | log.info('Server authentication successfull') |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 389 | |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 390 | timeout = 5 |
| 391 | if self.failTest is True: |
| 392 | if self.fail_cb is not None: |
| 393 | self.fail_cb() |
| 394 | return |
| 395 | timeout = None ##Wait forever on failure and force testcase timeouts |
| 396 | |
Chetan Gaonker | 5b36630 | 2016-03-21 16:18:21 -0700 | [diff] [blame] | 397 | self.eapol_scapy_recv(cb = eapol_cb, |
A R Karthick | 22aa0c6 | 2016-05-31 11:17:12 -0700 | [diff] [blame] | 398 | lfilter = |
A R Karthick | 05d9b5f | 2016-06-08 11:53:54 -0700 | [diff] [blame] | 399 | lambda pkt: EAP in pkt and pkt[EAP].code == EAP.SUCCESS, |
| 400 | timeout = timeout) |
A R Karthick | 307483c | 2016-06-06 17:05:19 -0700 | [diff] [blame] | 401 | self.eapol_logoff() |