| # Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| # Try 802.1x authentication. |
| |
| { "name":"Check1x_TTLS", |
| "steps":[ # Channel [any] |
| [ "create", { "type": "hostap" } ], |
| [ "install_files", { "system": "router", |
| "files": |
| { "/tmp/hostapd_ca_cert" : |
| site_eap_certs.ca_cert_1, |
| "/tmp/hostapd_server_cert": |
| site_eap_certs.server_cert_1, |
| "/tmp/hostapd_private_key": |
| site_eap_certs.server_private_key_1, |
| "/tmp/hostapd_expired_server_cert": |
| site_eap_certs.server_expired_cert, |
| "/tmp/hostapd_expired_private_key": |
| site_eap_certs.server_expired_key, |
| "/tmp/hostapd_eap_user_file": |
| """* TTLS |
| "testuser-chapv2" MSCHAPV2 "password" [2] |
| "testuser-md5" MD5 "password" [2] |
| "testuser-tchapv2" TTLS-MSCHAPV2 "password" [2] |
| "testuser-tchap" TTLS-MSCHAP "password" [2] |
| "testuser-tpap" TTLS-PAP "password" [2]""" } } ], |
| [ "config", { "channel": "2412", |
| "mode": "11g", |
| "wpa": "1", |
| "wpa_key_mgmt": "WPA-EAP", |
| "eap_server": "1", |
| "wpa_pairwise":"CCMP", |
| "ieee8021x": "1", |
| "ca_cert": "/tmp/hostapd_ca_cert", |
| "server_cert": "/tmp/hostapd_server_cert", |
| "private_key": "/tmp/hostapd_private_key", |
| "eap_user_file": "/tmp/hostapd_eap_user_file"} ], |
| [ "install_files", { "system": "client", |
| "files": |
| { "/tmp/ca-cert.pem" : |
| site_eap_certs.ca_cert_1, |
| "/tmp/ca-cert-other.pem" : |
| site_eap_certs.ca_cert_2} } ], |
| [ "connect", { "security": "802_1x", |
| "psk": "EAP.Identity:testuser-chapv2" |
| ":EAP.Password:password" |
| ":EAP.CACert:/tmp/ca-cert.pem"} ], |
| [ "client_ping", { "count":"10" } ], |
| |
| [ "disconnect" ], |
| |
| # Try MD5 inner auth |
| [ "config", { "ssid_suffix": "t1" } ], |
| [ "connect", { "security": "802_1x", |
| "psk": "EAP.Identity:testuser-md5" |
| ":EAP.Password:password" |
| ":EAP.CACert:/tmp/ca-cert.pem"} ], |
| [ "client_ping", { "count": "10" } ], |
| |
| [ "disconnect" ], |
| |
| # |
| # Try authenticating using the wrong client password |
| [ "config", { "ssid_suffix": "t2" } ], |
| [ "!connect", { "security": "802_1x", |
| "psk": "EAP.Identity:testuser-chapv2" |
| ":EAP.Password:wrongpassword"} ], |
| |
| # Try authenticating to an AP with an expired server cert. |
| [ "config", { "ssid_suffix": "t3", |
| "ca_cert": "/tmp/hostapd_ca_cert", |
| "server_cert": "/tmp/hostapd_expired_server_cert", |
| "private_key": "/tmp/hostapd_expired_private_key"} ], |
| [ "!connect", { "security":"802_1x", |
| "psk": "EAP.Identity:testuser-chapv2" |
| ":EAP.Password:password" |
| ":EAP.CACert:/tmp/ca-cert.pem"}, |
| "TLS: Certificate verification failed, error 10 " |
| "\(certificate has expired\)" ], |
| # |
| # Try authenticating with the right client password but wrong CA |
| [ "config", { "ssid_suffix": "t4", |
| "server_cert": "/tmp/hostapd_server_cert", |
| "private_key": "/tmp/hostapd_private_key"} ], |
| [ "!connect", { "security": "802_1x", |
| "psk": "EAP.Identity:testuser-chapv2" |
| ":EAP.Password:password" |
| ":EAP.CACert:/tmp/ca-cert-other.pem"} ], |
| ] |
| |
| # Create a template for the rest of our attempts at EAP-TTLS types |
| + reduce(lambda x,y: x+y, map(list, zip( |
| list([ "config", { "ssid_suffix": "t" + suffix } ] |
| for suffix in map(str, range(4,7))), |
| list([ "connect", { "security":"802_1x", |
| "psk" : "EAP.Identity:" + user + |
| ":EAP.Password:" + password + |
| ":EAP.CACert:/tmp/ca-cert.pem" + |
| ":EAP.InnerEAP:" + auth } ] |
| for user, password, auth in [ |
| # This is the list of authentication attempts to perform |
| ("testuser-tchapv2", "password", "auth=MSCHAPV2" ), |
| ("testuser-tchap", "password", "auth=MSCHAP"), |
| ("testuser-tpap", "password", "auth=PAP") |
| ]), |
| [ [ "client_ping", { "count":"10" } ] ] * 3, |
| [ [ "disconnect" ] ] * 3 |
| ))) + |
| |
| [ [ "destroy" ] ], |
| } |